{"id":412794,"date":"2007-09-23T16:25:12","date_gmt":"2007-09-23T13:25:12","guid":{"rendered":"http:\/\/localhost\/wordpress\/?p=412794"},"modified":"2007-09-23T16:25:12","modified_gmt":"2007-09-23T13:25:12","slug":"%d9%85%d8%b4%d9%83%d9%84%d8%a9-%d8%b8%d9%87%d9%88%d8%b1-%d8%b1%d8%b3%d8%a7%d9%84%d8%a9-cwindowssystem32rundll32-exe","status":"publish","type":"post","link":"https:\/\/www.satfrequencies.com\/girls\/%d9%85%d8%b4%d9%83%d9%84%d8%a9-%d8%b8%d9%87%d9%88%d8%b1-%d8%b1%d8%b3%d8%a7%d9%84%d8%a9-cwindowssystem32rundll32-exe\/","title":{"rendered":"\u0645\u0634\u0643\u0644\u0629 \u0638\u0647\u0648\u0631 \u0631\u0633\u0627\u0644\u0629 C:WINDOWSsystem32rundll32.exe"},"content":{"rendered":"
\n


\n\u0628\u0633\u0645 \u0627\u0644\u0644\u0647 \u0627\u0644\u0631\u062d\u0645\u0646 \u0627\u0644\u0631\u062d\u064a\u0645
\n \u0627\u0644\u0633\u0644\u0627\u0645 \u0639\u0644\u064a\u0643\u0645 \u0648\u0631\u062d\u0645\u0629 \u0627\u0644\u0644\u0647 \u0648\u0628\u0631\u0643\u0627\u062a\u0647
\n\u0627\u0627\u0627\u0631\u062c\u0648 \u0645\u0633\u0627\u0639\u062f\u062a\u064a \u0644\u062f\u064a \u0645\u0634\u0643\u0644\u0647 \u0641\u064a \u062c\u0647\u0627\u0632\u064a \u0639\u0646\u062f \u0641\u062a\u062d \u0627\u064a \u0627\u064a\u0642\u0648\u0646\u0647 \u0639\u0644\u0649 \u0633\u0637\u062d \u0627\u0644\u0645\u0643\u062a\u0628 \u0644\u0627 \u062a\u0641\u062a\u062d
\n\u0648\u0627\u0646\u0645\u0627 \u064a\u0637\u0644\u0628 \u0645\u0646\u064a \u0641\u062a\u062d \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 ……………………..\u0643\u0644 \u0627\u0644\u0628\u0631\u0627\u0645\u062c \u0641\u064a \u0627\u0644\u062c\u0647\u0627\u0632 \u0644\u0627\u0627\u0627\u0627\u0627\u0627\u0627 \u062a\u0641\u062a\u062d \u0648\u0627\u0646\u0645\u0627 \u064a\u0637\u0644\u0628 \u0645\u0646\u064a \u0641\u062a\u062d \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645
\n\u0648\u0648\u0639\u0646\u062f\u0645\u0627 \u0627\u0630\u0647\u0628 \u0627\u0644\u0649 \u0644\u0648\u062d\u0629 \u0627\u0644\u062a\u062d\u0643\u0645 \u0644\u0641\u062a\u062d\u0647\u0627 \u062a\u0638\u0647\u0631 \u0644\u064a \u0647\u0630\u0647 \u0627\u0644\u0631\u0633\u0627\u0644\u0647 C:WINDOWSsystem32rundll32.exe \u0644\u0645 \u064a\u062a\u0645 \u0627\u0644\u0639\u062b\u0648\u0631 \u0639\u0644\u0649 \u0627\u0644\u062a\u0637\u0628\u064a\u0642<\/p>\n

\u0627\u0627\u0627\u0631\u062c\u0648 \u0645\u0633\u0627\u0639\u062f\u062a\u064a
\n\u0648\u0627\u0646\u0646\u064a \u062d\u0645\u0644\u062a \u0628\u0631\u0646\u0627\u0645\u062c HijackThis_by Batoola
\n\u0648\u0648\u0633\u0648\u0641 \u0627\u0642\u0648\u0645 \u0628\u0644\u0635\u0642 \u0645\u0627\u062c\u0627\u0626\u0646\u064a \u0641\u064a \u0627\u0644\u0645\u0641\u0643\u0631\u0647 \u0647\u0646\u0627 \u0648\u0627\u062a\u0645\u0646\u0649 \u0645\u0633\u0627\u0627\u0627\u0627\u0627\u0627\u0627\u0639\u062f\u062a\u064a
\n\u0648\u0648\u0634\u0643\u0631\u0627 <\/p>\n

\nLogfile of Trend Micro HijackThis v2.0.2
\nScan saved at 04 \ud83d\ude06 50 \u0645, on 28\/08\/2009
\nPlatform: Windows XP SP2 (WinNT 5.01.2600)
\nMSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
\nBoot mode: Normal<\/p>\n

Running processes:
\nC:WINDOWSSystem32smss.exe
\nC:WINDOWSsystem32winlogon.exe
\nC:WINDOWSsystem32services.exe
\nC:WINDOWSsystem32lsass.exe
\nC:WINDOWSsystem32svchost.exe
\nC:WINDOWSSystem32svchost.exe
\nC:WINDOWSsystem32spoolsv.exe
\nC:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
\nC:Program FilesBonjourmDNSResponder.exe
\nC:Program FilesESETESET Smart Securityekrn.exe
\nC:WINDOWSsystem32svchost.exe
\nC:Program FilesCommon FilesMotiveMcciCMService.exe
\nC:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
\nC:Program FilesMicrosoftSearch Enhancement PackSeaPortSeaPort.exe
\nC:WINDOWSExplorer.EXE
\nC:WINDOWSsystem32svchost.exe
\nC:Program FilesWindows LiveMessengermsnmsgr.exe
\nC:WINDOWSsystem32ctfmon.exe
\nC:Program FilesWindows LiveContactswlcomm.exe
\nC:Program FilesFlashGetFlashGet.exe
\nC:Program FilesCommon FilesRealUpdate_OBrealsched.exe
\nC:Program FilesCommon FilesAheadlibNMBgMonitor.exe
\nC:Program FilesInternet Exploreriexplore.exe
\nC:Program FilesWindows LiveToolbarwltuser.exe
\nC:DOCUME~1cscLOCALS~1Tempb.exe
\nC:Documents and Settingscsc\u0633\u0637\u062d \u0627\u0644\u0645\u0643\u062a\u0628HijackThis_by Batoola.exe<\/p>\n

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = Google<\/a>
\nR1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http:\/\/toolbar.ask.com\/toolbarv\/askR…5&gct=&gc=1&q=<\/a>
\nR1 – HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http:\/\/toolbar.ask.com\/toolbarv\/askR…5&gct=&gc=1&q=<\/a>
\nR1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http:\/\/toolbar.ask.com\/toolbarv\/askR…gct=&gc=1&q=%s<\/a>
\nR1 – HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = Google<\/a>
\nR1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInt ernet Settings,ProxyServer = 127.0.0.1:9666
\nR1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInt ernet Settings,ProxyOverride = local
\nR3 – URLSearchHook: (no name) – {00A6FAF6-072E-44cf-8957-5838F569A31D} – (no file)
\nR3 – URLSearchHook: samira6 Toolbar – {4bc3dfe3-9ad0-43ba-80b4-58fecdb21c9d} – C:Program Filessamira6tbsami.dll (file missing)
\nR3 – URLSearchHook: DefaultSearchHook Class – {C94E154B-1459-4A47-966B-4B843BEFC7DB} – C:Program FilesAskSearchbinDefaultSearch.dll
\nF3 – REG:win.ini: load=C:WINDOWSsystem32mscjj.exe
\nF3 – REG:win.ini: run=C:WINDOWSsystem32msrlczfh.exe
\nO3 – Toolbar: &Windows Live Toolbar – {21FA44EF-376D-4D53-9B0F-8A89D3229068} – C:Program FilesWindows LiveToolbarwltcore.dll
\nO3 – Toolbar: Google Toolbar – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
\nO3 – Toolbar: samira6 Toolbar – {4bc3dfe3-9ad0-43ba-80b4-58fecdb21c9d} – C:Program Filessamira6tbsami.dll (file missing)
\nO3 – Toolbar: Ask Toolbar – {3041d03e-fd4b-44e0-b742-2d9b88305f98} – C:Program FilesAskBarDisbarbinaskBar.dll
\nO4 – HKLM..Run: “C:Program FilesESETESET Smart Securityegui.exe” \/hide \/waitservice
\nO4 – HKLM..Run: “C:Program FilesAdobeReader 9.0ReaderReader_sl.exe”
\nO4 – HKLM..Run: C:Program FilesFlashGetFlashGet.exe \/min
\nO4 – HKLM..Run: C:Program FilesJavajre1.5.0_04binjusched.exe
\nO4 – HKLM..Run: C:WINDOWSsystem32NeroCheck.exe
\nO4 – HKLM..Run: C:WINDOWSsystem32igfxtray.exe
\nO4 – HKLM..Run: C:WINDOWSsystem32hkcmd.exe
\nO4 – HKLM..Run: C:WINDOWSsystem32igfxpers.exe
\nO4 – HKLM..Run: C:Program FilesFAHESSMcciTrayApp.exe
\nO4 – HKLM..Run: C:Program FilesHPHP Software UpdateHPWuSchd2.exe
\nO4 – HKLM..Run: rundll32 C:PROGRA~1MYWEBS~1bar2.binM3PLUGIN.DLL,UPF
\nO4 – HKLM..Run: “C:Program FilesSony EricssonMobile2Application LauncherApplication Launcher.exe” \/startoptions
\nO4 – HKLM..Run: “C:Program FilesAdobePhotoshop Album Starter Edition3.0Appsapdproxy.exe”
\nO4 – HKLM..Run: C:Documents and SettingsAll UsersApplication Dataseek film amok webhole slow.exe
\nO4 – HKLM..Run: “C:Program FilesQuickTimeqttask.exe” -atboottime
\nO4 – HKLM..Run: “C:Program FilesiTunesiTunesHelper.exe”
\nO4 – HKLM..Run: RUNDLL32.EXE C:WINDOWSsystem32msxm192z.dll,w
\nO4 – HKLM..Run: C:Documents and SettingsAll UsersApplication Data1899734418997344.exe
\nO4 – HKLM..Run: “C:Program FilesCommon FilesRealUpdate_OBrealsched.exe” -osboot
\nO4 – HKLM..Run: C:WINDOWSser.exe
\nO4 – HKCU..Run: C:WINDOWSsystem32ctfmon.exe
\nO4 – HKCU..Run: “C:Program FilesCommon FilesAheadlibNMBgMonitor.exe”
\nO4 – HKCU..Run: “C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNo tifier.exe”
\nO4 – HKCU..Run: C:DOCUME~1cscAPPLIC~1ANTEST~1BoreGramBold.exe
\nO4 – HKCU..Run: “C:Program FilesMessengermsmsgs.exe” \/background
\nO4 – HKCU..Run: “C:Program FilesuTorrentuTorrent.exe”
\nO4 – HKCU..Run: C:DOCUME~1cscLOCALS~1Tempsvato3ju0.exe
\nO4 – HKCU..Run: C:DOCUME~1cscLOCALS~1Tempb.exe
\nO4 – HKLM..PoliciesExplorerRun: C:WINDOWSsystem32msopzbz.exe
\nO4 – HKUSS-1-5-19..Run: C:WINDOWSsystem32CTFMON.EXE (User ‘LOCAL SERVICE’)
\nO4 – HKUSS-1-5-20..Run: C:WINDOWSsystem32CTFMON.EXE (User ‘NETWORK SERVICE’)
\nO4 – HKUSS-1-5-18..Run: C:WINDOWSsystem32CTFMON.EXE (User ‘SYSTEM’)
\nO4 – HKUS.DEFAULT..Run: C:WINDOWSsystem32CTFMON.EXE (User ‘Default user’)
\nO4 – Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
\nO4 – Global Startup: \u0633\u0631\u0639\u0629 \u062a\u0634\u063a\u064a\u0644 Adobe Reader.lnk = C:Program FilesAdobeReader 8.0Readerreader_sl.exe
\nO4 – Global Startup: Adobe Reader Synchronizer.lnk = C:Program FilesAdobeReader 8.0ReaderAdobeCollabSync.exe
\nO4 – Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
\nO4 – Global Startup: Rundll.exe
\nO8 – Extra context menu item: &Download All with FlashGet – C:Program FilesFlashGetjc_all.htm
\nO8 – Extra context menu item: &Download with FlashGet – C:Program FilesFlashGetjc_link.htm
\nO8 – Extra context menu item: &\u062a\u0635\u062f\u064a\u0631 \u0625\u0644\u0649 Microsoft Excel – res:\/\/C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE\/3000
\nO9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_04binnpjpi150_04.dll
\nO9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_04binnpjpi150_04.dll
\nO9 – Extra button: \u062a\u062f\u0648\u064a\u0646 \u0647\u0630\u0627 \u0641\u064a \u0627\u0644\u0645\u062f\u0648\u0646\u0629 – {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} – C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
\nO9 – Extra ‘Tools’ menuitem: &\u062a\u062f\u0648\u064a\u0646 \u0647\u0630\u0627 \u0641\u064a Windows Live Writer – {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} – C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
\nO9 – Extra button: \u0628\u062d\u062b – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
\nO9 – Extra button: FlashGet – {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} – C:Program FilesFlashGetFlashGet.exe
\nO9 – Extra ‘Tools’ menuitem: FlashGet – {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} – C:Program FilesFlashGetFlashGet.exe
\nO9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
\nO9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
\nO16 – DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} – http:\/\/ak.exe.imgfarm.com\/images\/noc…tup1.0.1.1.cab<\/a>
\nO16 – DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) – http:\/\/zone.msn.com\/bingame\/chnz\/def…jolauncher.cab<\/a>
\nO16 – DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) – http:\/\/zone.msn.com\/bingame\/popcaploader_v10.cab<\/a>
\nO16 – DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) – http:\/\/messenger.zone.msn.com\/binary…r.cab56986.cab<\/a>
\nO22 – SharedTaskScheduler: LKMSFOIVAMFOMSFVIOSVJASIUENFJNDJV – {BD56A320-23F2-42AD-F4E4-00AAC39CAA53} – C:WINDOWSsystem32hs7f3uhduhfukde.dll
\nO23 – Service: Apple Mobile Device – Apple Inc. – C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
\nO23 – Service: ASKUpgrade – Unknown owner – C:Program FilesAskBarDisbarbinASKUpgrade.exe
\nO23 – Service: Bonjour Service – Apple Inc. – C:Program FilesBonjourmDNSResponder.exe
\nO23 – Service: Eset HTTP Server (EhttpSrv) – ESET – C:Program FilesESETESET Smart SecurityEHttpSrv.exe
\nO23 – Service: Eset Service (ekrn) – ESET – C:Program FilesESETESET Smart Securityekrn.exe
\nO23 – Service: Google Software Updater (gusvc) – Google – C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
\nO23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
\nO23 – Service: iPod Service – Apple Inc. – C:Program FilesiPodbiniPodService.exe
\nO23 – Service: McciCMService – Motive Communications, Inc. – C:Program FilesCommon FilesMotiveMcciCMService.exe
\nO24 – Desktop Component 0: (no name) – http:\/\/www.***********\/vb\/clientscrip…lobal.js?v=382<\/a><\/p>\n

—
\nEnd of file – 9858 bytes
\n<\/font><\/b>\n <\/div>\n","protected":false},"excerpt":{"rendered":"

\u0628\u0633\u0645 \u0627\u0644\u0644\u0647 \u0627\u0644\u0631\u062d\u0645\u0646 \u0627\u0644\u0631\u062d\u064a\u0645 \u0627\u0644\u0633\u0644\u0627\u0645 \u0639\u0644\u064a\u0643\u0645 \u0648\u0631\u062d\u0645\u0629 \u0627\u0644\u0644\u0647 \u0648\u0628\u0631\u0643\u0627\u062a\u0647 \u0627\u0627\u0627\u0631\u062c\u0648 \u0645\u0633\u0627\u0639\u062f\u062a\u064a \u0644\u062f\u064a \u0645\u0634\u0643\u0644\u0647 \u0641\u064a \u062c\u0647\u0627\u0632\u064a \u0639\u0646\u062f \u0641\u062a\u062d \u0627\u064a \u0627\u064a\u0642\u0648\u0646\u0647 \u0639\u0644\u0649 \u0633\u0637\u062d \u0627\u0644\u0645\u0643\u062a\u0628 \u0644\u0627 \u062a\u0641\u062a\u062d \u0648\u0627\u0646\u0645\u0627 \u064a\u0637\u0644\u0628 \u0645\u0646\u064a \u0641\u062a\u062d \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 ……………………..\u0643\u0644 \u0627\u0644\u0628\u0631\u0627\u0645\u062c \u0641\u064a \u0627\u0644\u062c\u0647\u0627\u0632 \u0644\u0627\u0627\u0627\u0627\u0627\u0627\u0627 \u062a\u0641\u062a\u062d \u0648\u0627\u0646\u0645\u0627 \u064a\u0637\u0644\u0628 \u0645\u0646\u064a \u0641\u062a\u062d \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0648\u0648\u0639\u0646\u062f\u0645\u0627 \u0627\u0630\u0647\u0628 \u0627\u0644\u0649 \u0644\u0648\u062d\u0629 \u0627\u0644\u062a\u062d\u0643\u0645 \u0644\u0641\u062a\u062d\u0647\u0627 \u062a\u0638\u0647\u0631 \u0644\u064a \u0647\u0630\u0647 \u0627\u0644\u0631\u0633\u0627\u0644\u0647 C:WINDOWSsystem32rundll32.exe \u0644\u0645 \u064a\u062a\u0645 \u0627\u0644\u0639\u062b\u0648\u0631 \u0639\u0644\u0649 …<\/p>\n","protected":false},"author":1629,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-412794","post","type-post","status-publish","format-standard","","category-31"],"_links":{"self":[{"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/posts\/412794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/users\/1629"}],"replies":[{"embeddable":true,"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/comments?post=412794"}],"version-history":[{"count":0,"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/posts\/412794\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/media?parent=412794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/categories?post=412794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.satfrequencies.com\/girls\/wp-json\/wp\/v2\/tags?post=412794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}