ของผมเจอเต็มๆครับ พอเปิดหน้าเวป มันก็เข้าเวปจีนเลยครับ
ลองสแกนหาไวรัสก็ไม่เจอครับ แต่ลองเอาอีกตัวสแกนดูมีเยอะครับ ไม่รู้ตัวไรมั่ง
Malwarebytes' Anti-Malware 1.36
Database version: 2029
Windows 5.1.2600 Service Pack 2
24/4/2552 8:48:25
mbam-log-2009-04-24 (08-48-25).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 204904
Time elapsed: 13 minute(s), 48 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\erdznUfbK0ZF.dll (Spyware.Onlinegames) -> Delete on reboot.
Registry Keys Infected:
HKEY_CL._ROOT\CLSID\{669029ee-81fb-496f-9ac4-fe838b16f231} (Spyware.Onlinegames) -> Quarantined and deleted successfully.
HKEY_CL._ROOT\CLSID\{f9ba1aa9-cad4-4c14-bde6-922dff5f6f38} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{669029ee-81fb-496f-9ac4-fe838b16f231} (Spyware.Onlinegames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rstray (Backdoor.IRCBot) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\erdznUfbK0ZF.dll (Spyware.Onlinegames) -> Delete on reboot.
C:\Documents and Settings\Administrator\Local Settings\temp\DNFupdate.exe (Spyware.Onlinegames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\UC28109Q\S10[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Favorites\าปฦ๐ภดา๔ภึษ็ว๘.url (Trojan.Agent) -> Quarantined and deleted successfully.
