แล้วก็ไฟล์ IEEXPLOROR.exe อีก 3 อัน
แล้วไฟล์ explorer.exe มันก็รัน 0 % ขึ้นไป 50% ขึ้นไป 100 % แล้วก็กลับลงมา 0 % เหมือนเดิม
เป็นอย่างนี้ครับ
-------------------------
ไม่แน่ใจ ผมทำตาม ลิงค์นี้
http://www.pantip.co.../SV2269823.html
แล้วมันก็ลบไม่ได้ restart แล้ว
พอเปิด killbox แล้วก็ติดตรงที่พอ right click เลือกไฟล์ 5-6 ตัวนั้น copy มันแล้ว ไปที่ fily >> paste from clibboard มันไม่ paste ให้อ่ะครับ มันไม่มีอะไรขึ้นเลย บางทีก็ขึ้นว่า empty array ผมเลยเลือก delete ทีละไฟล์ พอรีสตารท์ ก็ยังไม่หายครับ
Logfile of HijackThis v1.99.1
Scan saved at 0:15:40, on 27/2/2550
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS3\System32\smss.exe
C:\WINDOWS3\system32\csrss.exe
C:\WINDOWS3\system32\winlogon.exe
C:\WINDOWS3\system32\services.exe
C:\WINDOWS3\system32\lsass.exe
C:\WINDOWS3\system32\svchost.exe
C:\WINDOWS3\system32\svchost.exe
C:\WINDOWS3\System32\svchost.exe
C:\WINDOWS3\system32\svchost.exe
C:\WINDOWS3\Explorer.EXE
C:\WINDOWS3\system32\spoolsv.exe
C:\WINDOWS3\IME\imjp8_1\IMJPMIG.EXE
C:\WINDOWS3\RTHDCPL.EXE
C:\WINDOWS3\system32\VTTimer.exe
C:\WINDOWS3\system32\S3trayp.exe
C:\WINDOWS3\system32\wfxsnt40.exe
C:\Program Files\SSC Service Utility\ssc_serv.exe
C:\WINDOWS3\system32\wscript.exe
C:\WINDOWS3\System32\WScript.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Symantec\WinFax\WFXCTL32.EXE
C:\WINDOWS3\system32\svchost.exe
C:\WINDOWS3\system32\svchost.exe
C:\WINDOWS3\system32\wdfmgr.exe
C:\WINDOWS3\system32\WFXSVC.EXE
C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\WINDOWS3\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\True\hi-Speed Navigator\hi-speed Navigator.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS3\system32\taskmgr.exe
C:\Documents and Settings\Administrator.MICROSOF-4ECF70\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://connect.ais-i...ote/mmsvote.php
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {126DF47E-0564-0AEC-3477-C8672521F150} - C:\DOCUME~1\ADMINI~2.MIC\APPLIC~1\32BIRD~1\global scr.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS3\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS3\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS3\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS3\system32\taskswitch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS3\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [VirtualDrive] "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [EPSON Stylus C58 Series on BLACKSERVER (from BLACKP4XP)] C:\WINDOWS3\System32\spool\DRIVERS\W32X86\3\E_FATIBHS.EXE /FU "C:\WINDOWS3\TEMP\E_SAB.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [EPSON Stylus C58 Series (from DELLXP_LAST)] C:\WINDOWS3\System32\spool\DRIVERS\W32X86\3\E_FATIBHS.EXE /FU "C:\WINDOWS3\TEMP\E_S9C.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [RavAV] C:\WINDOWS3\AdobeR.exe
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS3\Twain_32\5600&5650\HotKey.exe
O4 - HKLM\..\Run: [EPSON Stylus C58 Series on DELLXP_LAST (from BLACKP4XP)] C:\WINDOWS3\System32\spool\DRIVERS\W32X86\3\E_FATIBHS.EXE /FU "C:\WINDOWS3\TEMP\E_SA3.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS3\system32\lsasss.exe
O4 - HKLM\..\Run: [SSC Service Utility] C:\Program Files\SSC Service Utility\ssc_serv.exe /s
O4 - HKLM\..\Run: [EPSON Stylus C58 Series on Blackserver (from NOTEBOOK2)] C:\WINDOWS3\System32\spool\DRIVERS\W32X86\3\E_FATIBHS.EXE /FU "C:\WINDOWS3\TEMP\E_S3CC.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [winboot] wscript.exe /E:vbs C:\WINDOWS3\boot.ini
O4 - HKLM\..\Run: [MS32DLL] C:\WINDOWS3\.MS32DLL.dll.vbs
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [DALEPHONESOFTWARELINK] C:\Documents and Settings\All Users.WINDOWS3\Application Data\spam part dale phone\ONLINEPILE.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS3\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [else open] C:\DOCUME~1\ADMINI~2.MIC\APPLIC~1\PARTSU~1\Debug Noun Grey.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Controller.LNK = C:\Program Files\Symantec\WinFax\WFXCTL32.EXE
O8 - Extra context menu item: ส่&งออกไปยัง Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O16 - DPF: {23D236EA-B936-4B2B-900C-D0E8DBBF9570} (BugsGameStarts Class) - http://audition.play...aiGameStart.cab
O16 - DPF: {B7F710EF-CDA4-496A-B430-D7F24B74C53E} (TCGLoaderX Object) - http://www.thaicyber...ion_iv/TCGX.OCX
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by136fd.bay13...ex/HMAtchmt.ocx
O16 - DPF: {F965D65B-7C09-4EDD-82BE-6E6A6ADE181E} (VRPlayerCtrl Class) - http://www.chosen3d....er/VRPlayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{79E09159-AF9D-4759-87C6-2D5244E3CA39}: NameServer = 203.144.207.29,203.144.207.49
O17 - HKLM\System\CCS\Services\Tcpip\..\{99623E34-EDA7-46ED-9821-D3C3FB0C2579}: NameServer = 203.144.207.49 203.144.207.29
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SVCHOST.EXE - Unknown owner - C:\WINDOWS3\system32\vercl.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS3\system32\WFXSVC.EXE
Attached Files
-
ff.JPG 61.49K
0 downloads
