Люди добрые, помогите плз. найти того самого червя, который запускает через 5 минут в эксплорере ссылку на порносайты.
Лог выкладываю.


Присоединённый файл ( Кол-во скачиваний: 11 )
 HIJACK_1.LOG 15,06 Kb

Кто такой

Цитата

C:\temp\msbb.exe

Цитата

O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_cracks.cab

Цитата

O9 - Extra 'Tools' menuitem: FUNNY SEXY PICTURES - {FFFFFFFF-ABBB-FFFF-FFFF-FFFFFFFFFFFF} - http://top.holm.ru/cgi-bin/link.cgi?l=book (file missing)

???

Берем AdAware, AVP и т.д. и в путь к светлому и чистому компу....

Это сообщение отредактировал(а) ~FoX~ - 26.9.2005, 16:43

попробуй AVZ c soft.mail.ru находит кучу разных гадостей.

http://soft.mail.ru/program_page.php?grp=13866

м-да, занятный лог, на вскидку - ставь "галку" слева от каждого из пунктов, жми на "Fix checked" и перезагружайся

Цитата

O4 - HKLM\..\Run: [msbb] c:\temp\msbb.exe O4 - HKLM\..\Run: [efmj] C:\WINNT\efmj.exe O16 - DPF: Sametime Meeting Room Client ST31 - http://gbo990n.gillette.com/sametime/stmee...gRoomClient.cab O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exe O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...280e4704df77179 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr...etup1.0.0.8.cab O16 - DPF: {24CEC0BF-C8BC-4BCB-B804-226326B319EF} (JNILoader Control) - O16 - DPF: {3E339D3C-4B12-4E8C-A529-9CC4BEEAFD4F} (VacPro.russia_ver3) - http://www.advnt01.com/dialer/russia.CAB O16 - DPF: {404B3894-5B16-443E-A6CA-3250EE1847F0} (Vacpro.emsat_russia) - http://www.7adpower.com/dialer/emsat_russia.CAB O16 - DPF: {7261EE42-318E-490A-AE8F-77649DBA1ECA} (JNILoader Control) - http://gbo990n.gillette.com/sametime/STMee...STJNILoader.cab O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_cracks.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://cam1.net.kht.ru/activex/AxisCamControl.cab O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O16 - DPF: {A25BE7A9-3102-46B4-BAAE-462471B60ACB} (STConnectivityAgent Control) - O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} (loader Class) - http://dload.ipbill.com/del/loader.cab O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/ve...n6/dlhelper.cab O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl...ArcadeRdxIE.cab O9 - Extra button: (no name) - {FFFFFFFF-ABBB-FFFF-FFFF-FFFFFFFFFFFF} - http://top.holm.ru/cgi-bin/link.cgi?l=book (file missing) O9 - Extra 'Tools' menuitem: FUNNY SEXY PICTURES - {FFFFFFFF-ABBB-FFFF-FFFF-FFFFFFFFFFFF} - http://top.holm.ru/cgi-bin/link.cgi?l=book (file missing)

хотя, возможно, веселье на этом не закончится, так что для более детального анализа можешь воспользоваться ссылкой в привате

Logfile of HijackThis v1.99.1
Scan saved at 9:09:49, on 29.09.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Perl\bin\Perl.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\insight\tools\aiclient.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\PROGRA~1\insight\tools\AICR.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Gillette\adm\bin\GillServ.exe
c:\Program Files\Perl\Bin\perl.exe
c:\Program Files\Gillette\Adm\bin\GillMesg.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Tivoli\lcf\bin\w32-ix86\mrt\LCFD.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\tlntsvr.exe
C:\WINNT\RCSERV.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wm.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\pctspk.exe
C:\Program Files\DELL\AccessDirect\dadapp.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\DELL\AccessDirect\DadTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\System32\dpmw32.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\NWTRAY.EXE
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\PROGRA~1\insight\tools\AISOFTMN.EXE
C:\Program Files\Cerience\RepliGo\RepliGoMon.exe
C:\Program Files\WindUpdates\WinUpdt.exe
C:\Program Files\WindUpdates\WinKA.exe
C:\temp\msbb.exe
C:\Program Files\AdStatus Service\AdStatServ.exe
C:\Program Files\AdStatus Service\AdStatKeep.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Oxjtb\Zvdu.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINNT\unnxwco.exe
C:\WINNT\logon.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\PCSuite_6610i\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\WINNT\system32\internat.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
C:\WINNT\system32\Quickres.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
C:\Program Files\Lotus\Notes\NLNOTES.EXE
C:\Program Files\Lotus\Notes\naldaemn.EXE
C:\Program Files\Lotus\Notes\nwrdaemn.EXE
C:\Program Files\Lotus\Notes\nupdate.EXE
C:\Program Files\Lotus\Notes\nhldaemn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINNT\system32\cmd.exe
C:\Program Files\NavNT\vpdn_lu.exe
C:\WINNT\system32\taskmgr.exe
C:\PROGRA~1\INTERN~1\iexplore.exe
C:\WINNT\System32\winmine.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\ABox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\skripnig\LOCALS~1\Temp\Rar$EX01.820\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fsuweb.gillette.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fsuweb.gillette.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by The Gillette Company
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\ADOBE 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~2\SEARCH~2.DLL
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINNT\wsem303.dll
O2 - BHO: RepliGoIEHelperCtl Class - {91DE4477-9CDC-4806-9BCB-28A963988E94} - C:\Program Files\Cerience\RepliGo\RepliGoIEHelper.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\WINNT\System32\apuc.dll
O3 - Toolbar: PROMT - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - C:\Program Files\PRMT6\PRMTIE\prmtie.dll
O3 - Toolbar: &RepliGo - {81F4066B-F330-4872-8094-3E9FBCCEC8C1} - C:\Program Files\Cerience\RepliGo\RepliGoIEBar.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [UpdHKCU] "C:\Program Files\perl\bin\perl.exe" "C:\Program Files\gillette\adm\bin\UpdHKCU.pl"
O4 - HKLM\..\Run: [DadApp] C:\Program Files\DELL\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Start Telnet Server Service] "net start tlntsvr"
O4 - HKLM\..\Run: [DSLWatch] Perl.exe "C:\Program Files\gillette\adm\bin\DSLWatch.pl"
O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Asset Insight SUM] C:\PROGRA~1\insight\tools\AISOFTMN.EXE -B
O4 - HKLM\..\Run: [DirectCD] C:\Progra~1\Adaptec\DirectCD\Directcd.exe
O4 - HKLM\..\Run: [RepliGo Assistant] "C:\Program Files\Cerience\RepliGo\RepliGoMon.exe"
O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe
O4 - HKLM\..\Run: [msbb] c:\temp\msbb.exe
O4 - HKLM\..\Run: [efmj] C:\WINNT\efmj.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LiveUpdateCheck] C:\Program Files\NavNT\vpdn_lu.exe /fUpdate /s
O4 - HKLM\..\Run: [CfgDownload] C:\Program Files\ixos\bin\CfgDownload.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [XTNDConnect PC - LtNts4] C:\Program Files\Common Files\XCPCSync\Translators\LtNts4\NtsAgnt.exe
O4 - HKLM\..\Run: [XTNDConnect PC] C:\Program Files\Common Files\XCPCMenu.exe
O4 - HKLM\..\Run: [AdStatus Service] C:\Program Files\AdStatus Service\AdStatServ.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize314.exe"
O4 - HKLM\..\Run: [Fnyrp] C:\Program Files\Oxjtb\Zvdu.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [gFxcbD716] C:\WINNT\unnxwco.exe
O4 - HKLM\..\Run: [WinLogon] C:\WINNT\logon.exe
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\PCSuite_6610i\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [Jз?e‡љVnRЦ§\№+ C:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\unnxwco.exe
O4 - HKLM\..\Run: [Jз?e‡љ/‚І95ЯPПvbљ?БC:\Program Files\ISTsvc\istsvc.exe] C:\WINNT\unnxwco.exe
O4 - HKLM\..\Run: [SwdisUsrPCN.lmo03228] "C:\PROGRA~1\Tivoli\lcf\dat\1\cache\lib\w32-ix86\wdusrpcn.exe" "C:\Program Files\Tivoli\swdis\1\wdusrpcn.env"
O4 - HKLM\..\Run: [ABox] C:\WINNT\ABox.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [BrowserFlags] "C:\Program Files\Microsoft Office\User\BrowserFlags.exe" /S /M="C:\Documents and Settings\skripnig\Config\BrowserFlags.cfg"
O4 - HKCU\..\Run: [EDLauncher] C:\Program Files\PRMT6\PRMTED\EDLauncher.exe
O4 - HKCU\..\Run: [AMP Agent] C:\Program Files\Common Files\ARS Company\Agent\Agent.exe
O4 - HKCU\..\Run: [rqiu] C:\PROGRA~1\COMMON~1\rqiu\rqium.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\PCSuite_6610i\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = C:\Program Files\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
O4 - Global Startup: Screen Resolution Changer.lnk = C:\WINNT\system32\Quickres.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra 'Tools' menuitem: Перевести - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra 'Tools' menuitem: Настройка перевода - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://fsuweb.gillette.com
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: JavaConnect -
O16 - DPF: Sametime BroadCast Client ST30SP1 -
O16 - DPF: Sametime Directory Applet ST30SP1 -
O16 - DPF: Sametime Meeting Room Client ST30SP1 -
O16 - DPF: Sametime Meeting Room Client ST31 - http://gbo990n.gillette.com/sametime/stmee...gRoomClient.cab
O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exe
O16 - DPF: {24CEC0BF-C8BC-4BCB-B804-226326B319EF} (JNILoader Control) -
O16 - DPF: {7261EE42-318E-490A-AE8F-77649DBA1ECA} (JNILoader Control) - http://gbo990n.gillette.com/sametime/STMee...STJNILoader.cab
O16 - DPF: {A25BE7A9-3102-46B4-BAAE-462471B60ACB} (STConnectivityAgent Control) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{F37F758B-D59B-4BDC-9B3E-90C69D8817BA}: NameServer = 217.116.128.9 217.116.129.9
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gillette.com,braunag.de
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gillette.com,braunag.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gillette.com,braunag.de
O20 - Winlogon Notify: ckpNotify - C:\WINNT\SYSTEM32\ckpNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: Asset Insight Client (AICLIENT) - Unknown owner - C:\PROGRA~1\insight\tools\aiclient.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: GillServ - Unknown owner - C:\Program Files\Gillette\adm\bin\GillServ.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINNT\System32\angelex.exe (file missing)
O23 - Service: Tivoli Endpoint (lcfd) - Unknown owner - C:\Program Files\Tivoli\lcf\bin\w32-ix86\mrt\LCFD.EXE
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Tivoli Remote Control Service (TME10RC) - IBM Corporation - C:\WINNT\RCSERV.EXE
O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINNT\System32\wm.exe



Всё попробовал по советам, но опять всплыла эта байда.
Название её-
1.Adult Box- на панеле
2.Sfondy Desctop- в окне

Переустанови интернет эксплорер.