שלום! לאחרונה נתקלתי בתופעה מוזרה, אחרי שאני גולש באינטרנט ובודק אחרי זמן מה איזה תהליכים רצים במחשב אני מגלה שiexplorer.exe

מופיע בממוצע ב8 פעמים וזה אחרי שהאינטרנט נסגר. ולכן אני צריך לסיים את התהליך באופן ידני. דבר זה מאט את המחשב .

אני משתמש באנטי וירוס של AVG ובתוכונת כמו ad-aware spybot search&destroy Ccleaner...ועדיין תופעה זו חוזרת על עצמה.

אשמח לעזרה...

תבדוק עם hijack this ותעבור לפיירפוקס

הלוג:

Logfile of HijackThis v1.99.1

Scan saved at 07:11:33, on 16/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.17184)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\System32\cisvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\gsicon.exe

C:\WINDOWS\system32\dslagent.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Dahan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.one.co.il/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: e404 helper - {03B902B1-9B25-4173-9468-56775C85A8D4} - C:\Program Files\Helper\1204444924.dll (file missing)

O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~2\toolbaru.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: עוזר הכניסה של Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - (no file)

O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~2\toolbaru.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe

O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\RunOnce: [iCQ] C:\Program Files\ICQ\Icq.exe -trayboot

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)

O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {2B26018A-1D8D-4C19-9A9B-F6C49453A21D} (LauncherV1 Class) - http://irc.msn.co.il/Day/launcher.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200668854623

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200669884951

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {F59AB0C4-3443-4551-A78F-C101F9DE0215} (LauncherV1 Class) - http://irc.nana10.co.il/Cabs/launcher39.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A2EEB94A-1C67-4235-856B-E0FAEE236DF4}: NameServer = 192.115.106.35 62.219.186.7

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

אין צורך לפרסם את זה בפורום (וגם אתה מפרסם תדאג ליישר את הטקסט לשמאל כדי שיהיה יותר ברור לקריאה)

תדביק אותו לפה ותראה מי נגד מי.

התגובה נערכה (הוצמדה לשמאל) בשביל שיהיה אפשרי לקרוא אותה, שים לב להבא.

בכל אופן אני לא ראיתי בה משהו חריג, תנסה באמת להשתמש באתר: http://www.hijackthis.de אולי תמצא משהו.

תודה על העריכה

השתמשתי באתר הסרתי את אלה שנמצאו לא בטוחים...אך הבעיה נותרה.

יכול להיות שיש לו איזה טרוג'ן או משהו שמתחזה ל iexplorer ??

מישו יודע?

תנסה את הCOMBOFIX

מומלץ להפעיל בSAFEMODE

תוריד מפה : http://subs.geekstogo.com/ComboFix.exe

תעלה לנו תמונה מSTARTUP שנמצא ב MSONFIG

התחל , הפעלה , MSCONFIG , סטארטUP

ComboFix 08-06-16.5 - Dahan 06/18/2008 19:10:08.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1255.1.1033.18.1391 [GMT 2:00]

Running from: C:\Documents and Settings\Dahan\Desktop\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Dahan\Favorites\Online Security Test.url

C:\Program Files\Helper

C:\WINDOWS\Downloaded Program Files\launcher.ocx

.

((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 )))))))))))))))))))))))))))))))

.

No new files created in this timespan

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-18 16:18 --------- d-----w C:\Program Files\ICQ

2008-06-17 22:19 --------- d-----w C:\Program Files\eMule

2008-06-15 18:03 --------- d-----w C:\Program Files\mp3split

2008-06-15 17:56 --------- d-----w C:\Program Files\Cool MP3 Splitter

2008-06-07 16:29 --------- d-----w C:\Documents and Settings\Dahan\Application Data\ICQ

2008-06-06 06:39 --------- d-----w C:\Program Files\Java

2008-06-06 06:37 --------- d-----w C:\Program Files\Common Files\Java

2008-06-04 17:26 --------- d-----w C:\Program Files\AvRack

2008-06-01 21:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks

2008-05-30 10:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft

2008-05-30 10:42 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe

2008-05-30 10:42 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys

2008-05-30 10:42 22,328 ----a-w C:\Documents and Settings\Dahan\Application Data\PnkBstrK.sys

2008-05-30 10:42 2,337,865 ----a-w C:\WINDOWS\system32\pbsvc.exe

2008-05-30 10:42 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe

2008-05-30 10:31 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-30 10:31 --------- d-----w C:\Program Files\Ubisoft

2008-05-29 10:29 --------- d-----w C:\Program Files\TmUnitedForever

2008-05-29 10:18 --------- d-----w C:\Program Files\EA Sports

2008-05-29 10:15 --------- d-----w C:\Program Files\Microsoft Games

2008-05-29 10:13 --------- d-----w C:\Program Files\Google

2008-05-29 10:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Codemasters

2008-05-29 10:07 --------- d-----w C:\Program Files\Bus Simulator 2008 Demo

2008-05-18 11:37 --------- d-----w C:\Program Files\Lavalys

2008-05-15 18:21 --------- d-----w C:\Program Files\Sotfone

2008-05-15 18:14 --------- d-----w C:\Documents and Settings\Dahan\Application Data\AVGTOOLBAR

2008-05-15 18:03 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys

2008-05-15 18:03 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll

2008-05-15 18:03 --------- d-----w C:\Program Files\AVG

2008-05-15 18:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8

2008-05-13 11:44 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll

2008-05-13 11:33 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll

2008-05-13 11:33 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll

2008-05-13 11:33 --------- d-----w C:\Program Files\OpenAL

2008-05-12 05:20 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 10:33 --------- d-----w C:\Program Files\MSXML 6.0

2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll

2008-05-02 15:34 --------- d-----w C:\Program Files\ICQ6

2008-05-02 14:01 --------- d-----w C:\Program Files\ICQToolbar2612

2008-05-02 13:26 --------- d-----w C:\Program Files\ICQToolbar

2008-05-01 16:48 --------- d-----w C:\Program Files\Play65

2008-04-28 10:29 805,400 ----a-r C:\WINDOWS\system32\tmp9C.tmp

2008-04-28 10:29 805,400 ----a-r C:\WINDOWS\system32\tmp9B.tmp

2008-04-21 19:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-04-21 19:35 --------- d-----w C:\Program Files\AGEIA Technologies

2008-04-21 18:42 --------- d-----w C:\Program Files\GameShadow

2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll

2008-03-25 19:29 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE

2008-03-25 19:29 299,008 ------w C:\WINDOWS\Setup1.exe

2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

.

------- Sigcheck -------

10/30/2007 06:53 PM 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys

08/23/2001 05:00 PM 327168 e7774698bb0d14b0710a9a31e209f9b6 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys

08/04/2004 08:14 AM 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys

08/04/2004 08:14 AM 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\TCPIP.SYS

02/12/2008 02:39 PM 360064 482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\dllcache\TCPIP.SYS

02/12/2008 02:39 PM 360064 482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\drivers\TCPIP.SYS

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 09:56 AM 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GSICONEXE"="gsicon.exe" [01/08/2003 11:36 AM 90112 C:\WINDOWS\system32\gsicon.exe]

"DSLAGENTEXE"="dslagent.exe" [01/15/2003 10:05 AM 16384 C:\WINDOWS\system32\dslagent.exe]

"RTHDCPL"="RTHDCPL.EXE" [02/19/2008 03:34 PM 16858112 C:\WINDOWS\RTHDCPL.exe]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [05/15/2008 08:03 PM 1177368]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [04/13/2005 03:48 AM 36975]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk

backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]

--a------ 01/19/2008 12:17 PM 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

--a------ 04/04/2007 12:29 AM 165784 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hebrew]

--a------ 05/09/2004 08:59 PM 753664 C:\Program Files\הפוך על הפוך\Hebrew.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]

--a------ 04/01/2008 12:40 PM 172280 C:\Program Files\ICQ6\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]

--a------ 01/13/2003 03:20 PM 49230 C:\Program Files\ICQ\ICQNet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 10/18/2007 11:34 AM 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 07/09/2001 09:50 PM 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

"DSLAGENTEXE"=dslagent.exe USB

"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

"RTHDCPL"=RTHDCPL.EXE

"Alcmtr"=ALCMTR.EXE

"SkyTel"=SkyTel.EXE

"WinampAgent"="C:\Program Files\Winamp\winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"|"= |:Windows Logon Service

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"C:\\Program Files\\Valve\\hl.exe"=

"C:\\Program Files\\ICQ\\Icq.exe"=

"C:\\Program Files\\eMule\\emule.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"F:\\COD4\\iw3mp.exe"=

"C:\\Program Files\\ICQ6\\ICQ.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=

"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [12/06/2005 05:11 PM]

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [05/15/2008 08:03 PM]

R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [05/15/2008 08:03 PM]

R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 09:56 AM]

S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [03/11/2008 07:33 PM]

S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [01/20/2008 02:39 AM]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

*Newly Created Service* - CATCHME

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-18 19:11:39

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 06/18/2008 19:12:29

ComboFix-quarantined-files.txt 2008-06-18 17:12:26

Pre-Run: 28,873,678,848 bytes free

Post-Run: 28,927,905,792 bytes free

189 --- E O F --- 2008-06-11 07:52:36

קובץ מצורף.

[attachment deleted by admin]

הוא מחק לך את אלה

:\Documents and Settings\Dahan\Favorites\Online Security Test.url

C:\Program Files\Helper

C:\WINDOWS\Downloaded Program Files\launcher.ocx

האם הבעיה עדייו קיימת ?

כן הבעיה נפתרה!

תודה לכולכם