Tie 4 su hned tie prve:
Object "stylexp Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "stylexp Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Zahltenie RAM-ky pri starte win xp
Problem za začal znovu opakovať
a to ani nie 1 mesiac po formate.
Tu je HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 18:44:17, on 15. 9. 2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\MYPROG~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\My Programs\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\My Programs\Avast4\aswUpdSv.exe
C:\My Programs\Avast4\ashServ.exe
C:\My Programs\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\My Programs\NetLimiter 2 Pro\nlsvc.exe
C:\My Programs\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\My Programs\Alcohol 120\StarWind\StarWindService.exe
C:\My Programs\Kerio\Personal Firewall 4\kpf4gui.exe
C:\My Programs\Avast4\ashMaiSv.exe
C:\My Programs\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\My Programs\Opera\Opera.exe
C:\My Programs\WinRAR\WinRAR.exe
C:\DOCUME~1\Oliver\LOCALS~1\Temp\Rar$EX00.425\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\My Programs\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\MYPROG~1\PCTRAN~1\webie.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\MYPROG~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\My Programs\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\My Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\My Programs\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\My Programs\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\MYPROG~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\My Programs\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\My Programs\ICQLite\ICQLite.exe
O9 - Extra button: WebTran - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\My Programs\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\My Programs\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\My Programs\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\My Programs\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\My Programs\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\My Programs\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\My Programs\Alcohol 120\StarWind\StarWindService.exe
edit:
este pridam nejake info (je to robene neskor):
--------------------------------------
FreeRAM XP Pro Report File
Generated 18:53:23 15. 9. 2006
--------------------------------------
FreeRAM XP Pro Comprehensive Memory Report
Generated on: 18:52:44 15. 9. 2006
Basic Memory Information
Current Amount of RAM Free: 127 MB (49%)
Amount of Installed RAM: 256 MB
Available Virtual Memory: 284 MB (74%)
Total Virtual Memory: 383 MB
Available Total Memory: 413 MB (64%)
Total Memory: 639 MB
Available Virtual Space: 1890 MB
Total Virtual Space: 2047 MB
Advanced Memory Information
Commit Limit, Bytes: 647262208
Current Committed Bytes: 265527296
% Committed Bytes In Use: 41
Cache Bytes: 33423360
Cache Bytes Past Maximum: 71245824
Pool Paged Allocations: 41652
Pool Paged Bytes: 46723072
Free System Page Table Entries: 33609
Pool Nonpaged Allocations: 43376
Pool Nonpaged Bytes: 12115968
Total Working Set: 83808256
Total Working Set Past Maximum: 421130240
Cache Statistics
Copy Read Hits %: 80
Data Map Hits %: 93
MDL Read Hits %: 0
Pin Read Hits %: 68
Paging File and Virtual Memory Details
Paging File Bytes in Use: 169295872
Paging File Bytes Past Maximum: 461701120
Paging File in Use %: 25
Paging File in Use % Past Maximum: 39
Disk Page File Bytes in Use: 103153664
Total Disk Page File Bytes: 401842176
Size of a Single Page: 4096
Total Virtual Space Bytes: 1920630784
Virtual Space Bytes Past Maximum: 2340593664
System
Current Number of Processes Running: 39
Current Number of Threads Running: 497
Current Number of Handles: 9516
a to ani nie 1 mesiac po formate.
Tu je HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 18:44:17, on 15. 9. 2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\MYPROG~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\My Programs\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\My Programs\Avast4\aswUpdSv.exe
C:\My Programs\Avast4\ashServ.exe
C:\My Programs\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\My Programs\NetLimiter 2 Pro\nlsvc.exe
C:\My Programs\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\My Programs\Alcohol 120\StarWind\StarWindService.exe
C:\My Programs\Kerio\Personal Firewall 4\kpf4gui.exe
C:\My Programs\Avast4\ashMaiSv.exe
C:\My Programs\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\My Programs\Opera\Opera.exe
C:\My Programs\WinRAR\WinRAR.exe
C:\DOCUME~1\Oliver\LOCALS~1\Temp\Rar$EX00.425\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\My Programs\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\MYPROG~1\PCTRAN~1\webie.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\MYPROG~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\My Programs\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\My Programs\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\My Programs\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\My Programs\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\MYPROG~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\My Programs\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\My Programs\ICQLite\ICQLite.exe
O9 - Extra button: WebTran - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\MYPROG~1\PCTRAN~1\webie.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\My Programs\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\My Programs\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\My Programs\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\My Programs\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\My Programs\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\My Programs\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\My Programs\Alcohol 120\StarWind\StarWindService.exe
edit:
este pridam nejake info (je to robene neskor):
--------------------------------------
FreeRAM XP Pro Report File
Generated 18:53:23 15. 9. 2006
--------------------------------------
FreeRAM XP Pro Comprehensive Memory Report
Generated on: 18:52:44 15. 9. 2006
Basic Memory Information
Current Amount of RAM Free: 127 MB (49%)
Amount of Installed RAM: 256 MB
Available Virtual Memory: 284 MB (74%)
Total Virtual Memory: 383 MB
Available Total Memory: 413 MB (64%)
Total Memory: 639 MB
Available Virtual Space: 1890 MB
Total Virtual Space: 2047 MB
Advanced Memory Information
Commit Limit, Bytes: 647262208
Current Committed Bytes: 265527296
% Committed Bytes In Use: 41
Cache Bytes: 33423360
Cache Bytes Past Maximum: 71245824
Pool Paged Allocations: 41652
Pool Paged Bytes: 46723072
Free System Page Table Entries: 33609
Pool Nonpaged Allocations: 43376
Pool Nonpaged Bytes: 12115968
Total Working Set: 83808256
Total Working Set Past Maximum: 421130240
Cache Statistics
Copy Read Hits %: 80
Data Map Hits %: 93
MDL Read Hits %: 0
Pin Read Hits %: 68
Paging File and Virtual Memory Details
Paging File Bytes in Use: 169295872
Paging File Bytes Past Maximum: 461701120
Paging File in Use %: 25
Paging File in Use % Past Maximum: 39
Disk Page File Bytes in Use: 103153664
Total Disk Page File Bytes: 401842176
Size of a Single Page: 4096
Total Virtual Space Bytes: 1920630784
Virtual Space Bytes Past Maximum: 2340593664
System
Current Number of Processes Running: 39
Current Number of Threads Running: 497
Current Number of Handles: 9516
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 5 hostů