Printable View
سلام...
یه ویروسی گرفتم که پس از چند دقیقه روشن بودن کامپیوتر این اتفاقا میفتن :
از اینترنت میپره بیرون ;
هیچ گونه فایل صوتی باز نمیشه ;
دیگه به اینترنت وصل نمیشه ;
کلا هیچ کاری نمیشه کرد و فقط باید خاموش روشن یا ریستارت کنم...
البته گویا این ویروس جهش داره و هی کامل تر میشه...
خوب دوست عزيز با يكي از آنتي ويروس هاي معتبر مثله نود4 يا كسپر يا ... آپديت شده سيستم رو اسكن كن ببين چي پيدا ميكنن . بعد اگر مشكل حل نشد عكسي از نرم افزار زير قرار بده :
کد:http://rapidshare.com/files/237576202/STaskM1.7_www.softarchive.net.rar
اسکن کردم...ولی فایده نداشت...
این فایله هم که خیلی برای ما حجیمه !!
برنامه زيرو دان كن و يكبار Auto Remove & Repair رو بزن و در پايين توش Lisk Task & Prosses رو بزن و در صفحه راست متن رو كلا كپي كن و در اينجا پيست كن .
حجم : 360 KBکد:http://rapidshare.com/files/247104324/JKill.rar.html
این رو باید بذارم ؟؟؟؟
**** Kill LSASS-SMSS1,2-KGH1,2 Ver1.2*********
Step 1 -> Kill Process
VIRUS service Not Found In Memory !!!
VIRUS kazme_gheyz Not Found In Memory !!!
VIRUS lsass Not Found In Memory !!!
VIRUS smss32 Not Found In Memory !!!
VIRUS smss64 Not Found In Memory !!!
;
----- Step 2 -> Delete Files From Windows Folder-----------------------------------
virus.exe Not Found!
Service.exe Not Found!
FSP32.exe Not Found!
kazme__gheyz.exe Not Found!
hideproc.sys Not Found!
LSASS.exe Not Found!
Documents and Settings\Administrator\LSASS.exe Not Found!
Documents and Settings\Win\LSASS.exe Not Found!
Documents and Settings\All Users\LSASS.exe Not Found!
Documents and Settings\Win\smss.exe Not Found!
Documents and Settings\All Users\smss.exe Not Found!
-- Step 3 -> Clean Storage From Virus And Autorun.inf-----
C:\Autorun.inf Not Found!
C:\kazme__gheyz.exe Not Found!
C:\RECYCLER\autoplay.exe Not Found!
D:\Autorun.inf Not Found!
D:\kazme__gheyz.exe Not Found!
D:\RECYCLER\autoplay.exe Not Found!
;
-------- Step 4 -> Remove Virus From Registry---------------
KGH Ver 2 Not Found In Registry ->\SYSTEM\CurrentControlSet\Services\WIN32CM
KGH Ver 1 Not Found In Registry ->\SYSTEM\CurrentControlSet\Services\kazme__gheyz
KGH Ver 1 Not Found In Registry ->\SYSTEM\CurrentControlSet\Services\C:\WINDOWS\sys tem32\kazme__gheyz
KGH Ver 1 Not Found In Registry ->\SYSTEM\ControlSet001\Services\kazme__gheyz
KGH Ver 1 Not Found In Registry ->\SYSTEM\ControlSet001\Services\C:\WINDOWS\system3 2\kazme__gheyz
\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWith Key=SysUtils Not Found!
\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWith Key=SysUtils Not Found!
\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWith Key=smss Not Found!
\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWith Key=smss Not Found!
;
--------Step 5 -> Full Repair Registry--------------------
Additional Key Deleted Success
Key Changed Success
This Segment Extracted From Imen AntiVirus Lab
Safe Mode Repair OK
This Segment Extracted From KasperSky AntiVirus Lab
Please Log Off This User
-- PID ---------- List All task ----Visible---------------------------------
3560 -> Kill LSASS-SMSS-KGH & Any Process Ver1.6 Writed By Mahdi Sharifi
3560 -> Kill LSASS-SMSS-KGH and any process ver 1.6 Create By Mahdi Sharifi
3472 -> knock out ??? ????? ?? ?? ??? ????? - P30World Forums - Windows Internet Explorer
3920 -> New Microsoft Word Document (3) - Microsoft Word
1016 -> Narcis Dictionary 5
360 -> Program Manager
-- PID ---------- List All task ----Hidden-------------------------------------
3560 -> detailes
3472 -> AutoSuggest Drop-Down
3920 -> Text Box
3920 -> Text
3920 -> Text
3920 -> Text
360 -> Start Menu
360 -> CiceroUIWndFrame
3472 -> SysFader
3472 -> SysFader
3472 -> SysFader
2216 -> PCSuite Preferences
2216 -> PCSuite Tray
1656 -> On-Access Scan Messages
2276 -> CiceroUIWndFrame
2276 -> TF_FloatingLangBar_WndTitle
3920 -> DDE Server Window
3472 -> CT83979
3472 -> Acrobat IEHelper
3472 -> C
3472 -> CT83979
3472 -> Acrobat IEHelper
3472 -> C
3472 -> CT83979
3472 -> Acrobat IEHelper
3472 -> C
1016 -> MCI command handling window
420 -> ymsgr-tray-wnd
360 -> MCI command handling window
3472 -> MCI command handling window
3472 -> CT83979
3472 -> DDE Server Window
2216 -> Nokia PC Suite
2876 -> SerLa
1656 -> On-Access Scan Statistics
1656 -> On-Access Scan Statistics - WIN-274E18F7CAC
2316 -> DDE Server Window
2092 -> PersistWndName
2084 -> HkWndName
2052 -> TouchPad object helper window
360 -> Power Meter
360 -> MS_WebcheckMonitor
2052 -> Touchpad driver tray icon window
2160 -> QTPlayer Tray Icon
2052 -> TouchPad object helper window
2052 -> Touchpad driver backward compatibility window
2052 -> Touchpad driver helper window
2064 -> SigmatelSysTray
1928 -> McAfee AutoUpdate
1928 -> ePolicy Orchestrator Agent Monitor
2040 -> Touchpad driver helper window
2024 -> McAfeeFrameworkIcons
2024 -> McTray
360 -> Connections Tray
2876 -> USB Media Module
3472 -> GDI+ Window
360 -> SysFader
3920 -> GDI+ Window
3560 -> M
3560 -> Default IME
3472 -> M
3472 -> Default IME
3472 -> M
3472 -> Default IME
3472 -> M
3472 -> Default IME
3472 -> M
3472 -> Default IME
3920 -> M
3920 -> Default IME
360 -> M
360 -> Default IME
1656 -> M
1016 -> Default IME
420 -> Default IME
360 -> Default IME
3472 -> Default IME
3472 -> Default IME
3472 -> Default IME
3472 -> Default IME
2216 -> Default IME
2216 -> M
2876 -> Default IME
1656 -> M
1656 -> Default IME
2440 -> Default IME
2356 -> Default IME
2316 -> Default IME
2092 -> Default IME
2084 -> Default IME
360 -> Default IME
2160 -> Default IME
2052 -> Default IME
2064 -> Default IME
1928 -> M
1928 -> Default IME
2040 -> Default IME
2024 -> Default IME
1656 -> Default IME
2276 -> Default IME
2876 -> Default IME
1016 -> M
1016 -> Default IME
3920 -> Default IME
360 -> M
360 -> Default IME
-- PID -------------- List All Process ----------------------------
0 -> System Idle Process
4 -> System
600 -> \SystemRoot\System32\smss.exe
648 -> csrss.exe
672 -> \??\C:\WINDOWS\system32\winlogon.exe
716 -> C:\WINDOWS\system32\services.exe
728 -> C:\WINDOWS\system32\lsass.exe
896 -> C:\WINDOWS\system32\svchost.exe
960 -> svchost.exe
1000 -> C:\WINDOWS\System32\svchost.exe
1040 -> C:\WINDOWS\system32\svchost.exe
1100 -> svchost.exe
1208 -> svchost.exe
1504 -> C:\WINDOWS\system32\spoolsv.exe
1684 -> svchost.exe
1716 -> C:\WINDOWS\system32\afisicx.exe
1804 -> C:\WINDOWS\system32\mabidwe.exe
1848 -> C:\Program Files\McAfee\Common Framework\FrameworkService.exe
1868 -> C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
1908 -> C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
1984 -> naPrdMgr.exe
360 -> C:\WINDOWS\Explorer.EXE
556 -> C:\Program Files\CyberLink\Shared files\RichVideo.exe
912 -> C:\WINDOWS\system32\sopidkc.exe
1096 -> C:\WINDOWS\system32\svchost.exe
1656 -> C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
1928 -> C:\Program Files\McAfee\Common Framework\UdaterUI.exe
2024 -> C:\Program Files\McAfee\Common Framework\McTray.exe
2040 -> C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
2052 -> C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2064 -> C:\WINDOWS\stsystra.exe
2084 -> C:\WINDOWS\system32\hkcmd.exe
2092 -> C:\WINDOWS\system32\igfxpers.exe
2148 -> C:\WINDOWS\system32\igfxsrvc.exe
2160 -> C:\Program Files\QuickTime\qttask.exe
2216 -> C:\Program Files\Nokia1\Nokia PC Suite 6\LaunchApplication.exe
2276 -> C:\WINDOWS\system32\ctfmon.exe
2316 -> C:\Program Files\Messenger\msmsgs.exe
2356 -> C:\WINDOWS\system32\rundll32.exe
2400 -> C:\program files\internet explorer\iexplore.exe
2440 -> C:\Program Files\Webshots\webshots.scr
2596 -> C:\Program Files\Canon\CAL\CALMAIN.exe
2876 -> C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
2996 -> alg.exe
3472 -> C:\Program Files\Internet Explorer\iexplore.exe
420 -> C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
432 -> C:\WINDOWS\system32\wuauclt.exe
1016 -> C:\Program Files\Narcis Soft\Dictionary\Narcis.exe
3920 -> C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
3560 -> C:\Documents and Settings\Win\Desktop\JKill.exe
;
--- Startup ->-- HKLM\Software\..\Run --------------------
ShStatEXE="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
McAfeeUpdaterUI="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
Apoint=C:\Program Files\Apoint\Apoint.exe
SynTPLpr=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
SigmatelSysTrayApp=stsystra.exe
igfxtray=C:\WINDOWS\system32\igfxtray.exe
igfxhkcmd=C:\WINDOWS\system32\hkcmd.exe
igfxpers=C:\WINDOWS\system32\igfxpers.exe
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
Explorer=C:\WINDOWS\system32\msrstart.exe
PCSuiteTrayApplication=C:\Program Files\Nokia1\Nokia PC Suite 6\LaunchApplication.exe -startup
;
--- Startup ->--HKCU\Software\..\Run --------------------
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
Yahoo! Pager="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
AdobeManager="C:\Documents and Settings\Win\Application Data\Adobe\rundtl.exe" -sys
mdp=rundll32.exe C:\DOCUME~1\Win\APPLIC~1\Adobe\mdp.dll,InitSys
ModemOnHold=C:\Program Files\NetWaiting\netwaiting.exe
دوست عزيز afisicx.exe , mabidwe.exe هر دو ويروس يا به عبارتي Malware هستن شما ميتوني از برنامه اي كه در پست زير معرفي شده براي پاكسازي استفاده كني :
يا PID اين دو پروسس رو كه به ترتيب 1804 و 1716 هستن رو در همين برنامه كه ليستشو گذاشتي وارد كني و Kill كني بعد بطريقه دستي از System32 پاكشون كني . البته احتمال داره اين PID ها تغيير كرده باشن ، دوباره همون برنامه رو اجرا كن و PID جديد رو وارد كن .کد:http://forum.p30world.com/showpost.php?p=3844835&postcount=1