prosim kontrola logu

[sas]

prave ze to z cerna kliknu pravym tlacitkem a nic se nezobrazi zadny kopirovat a pod . , pres tu klavesnici to taky nereaguje, zkusim prehodit mu moji klavesnici,ale nevim

[Reklama]

[fredik]

Pravé tlačítko myši tam nefunguje. Když to maš označené je to zčernalé tak zmačkneš klavesu Ctrl držíš ji zmáčklou a zmáčkneš ještě klávesu C pak obě pustíš, vložíš to sem tak že zmáčkneš klávesu Ctlr držíš ji zmáčkou a zmačkneš ještě klávesu V a pak pustíš obě a tím to vložíš.

[sas]

tak ani na klavesnici nereaguje,jediny co to reaguje tak na levy tlaci. mysi to z cerna kopirovat, presovat nejde

[fredik]

To je divné že to nejde. Tak jinak vlož sem ještě jednou nový log z HJT.

Stáhni si 30-ti dení verzi Kaspersky Antivirus (je to sice v angličtině) nainstaluj ho proveď update a pak spusť scan a co najde za potvory tak nech odstranit.

[sas]

Logfile of HijackThis v1.99.1
Scan saved at 19:23:47, on 9.10.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ondřej Bunčo\Dokumenty\Nová složka\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

ktomu kasperskymu , toho nenainstaluji mam na tom pc slabou ramku, tak jsem to nechal projet spyware terminatorem,ted zkusim zkopirovat to logo z virama,jestli to pomohlo

[sas]

spywareterminator odstranil 24 kri. objektu ,tady je ta tabulka , ale logo tech viru nejde tu tabulku jsem vytahl z toho loga scan kde to slo oznacit modre, ale ten log viru jde jen cerne nejde otevrit v poznamkovem okne.

[mijaja]

V tomto posledním logu není nic špatného. Rozhodně ale chybí SP2!!

Ty řádky vyber z logu MWAVu - vyjede ti v poznámkovém bloku- a ne z toho okénka programu.

[sas]

i kdyz v programu mwa otevru log a vnem dam vyhledat ware tak to vyhleda,zatrhnu cely radek chci to prekopirovat a prekopiruji celej log mwa. co s tim .dik

[sas]

nebylo by jednodussi rein. windows

[mijaja]

Tady je výběr ze sasova logu mwav:

Sun Oct 08 17:57:10 2006 => Scanning File C:\WINDOWS\System32\bre.dll
Sun Oct 08 17:57:10 2006 => File C:\WINDOWS\System32\bre.dll infected by "Trojan-Downloader.Win32.Small.ajp" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:57:37 2006 => System found infected with spyware Spyware/Adware ({78364d99-a640-4ddf-b91a-67eff8373045})! Action taken: No Action Taken.

Sun Oct 08 17:57:42 2006 => System found infected with spyware Spyware/Adware ({78364d99-a640-4ddf-b91a-67eff8373045})! Action taken: No Action Taken.

Sun Oct 08 17:57:43 2006 => Offending Key found: HKLM\Software\windows adstatus !!!
Sun Oct 08 17:57:43 2006 => Object "windows adstatus Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Oct 08 17:57:43 2006 => Offending Key found: HKLM\Software\microsoft\downloadmanager !!!
Sun Oct 08 17:57:43 2006 => Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Oct 08 17:57:47 2006 => Offending file found: C:\winstall.exe
Sun Oct 08 17:57:47 2006 => System found infected with spywareno!/spysheriff Commercial KeyLogger (winstall.exe)! Action taken: No Action Taken.

Sun Oct 08 17:57:47 2006 => Offending file found: C:\WINDOWS\gpinstall.exe
Sun Oct 08 17:57:47 2006 => System found infected with conducent flexpak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken.

Sun Oct 08 17:57:47 2006 => Offending file found: C:\WINDOWS\system32win32.exe
Sun Oct 08 17:57:47 2006 => System found infected with windows adstatus Spyware/Adware (system32win32.exe)! Action taken: No Action Taken.

Sun Oct 08 17:57:49 2006 => Offending file found: C:\WINDOWS\System32\comdlg64.dll
Sun Oct 08 17:57:49 2006 => System found infected with bravesentry Spyware/Adware (comdlg64.dll)! Action taken: No Action Taken.

Sun Oct 08 17:57:49 2006 => Offending file found: C:\WINDOWS\System32\ide21201.vxd
Sun Oct 08 17:57:49 2006 => System found infected with windupdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken.

Sun Oct 08 17:57:49 2006 => Offending file found: C:\WINDOWS\System32\kernels8.exe
Sun Oct 08 17:57:49 2006 => System found infected with bravesentry Spyware/Adware (kernels8.exe)! Action taken: No Action Taken.

Sun Oct 08 17:57:49 2006 => Offending file found: C:\WINDOWS\System32\maxd64.exe
Sun Oct 08 17:57:49 2006 => System found infected with bravesentry Spyware/Adware (maxd64.exe)! Action taken: No Action Taken.

Sun Oct 08 17:57:49 2006 => Offending file found: C:\WINDOWS\System32\spoolsvv.exe
Sun Oct 08 17:57:49 2006 => System found infected with spoolsvv Spyware/Adware (spoolsvv.exe)! Action taken: No Action Taken.

Sun Oct 08 17:57:50 2006 => Offending Folder found: C:\Program Files\istbar
Sun Oct 08 17:57:50 2006 => Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Oct 08 17:57:50 2006 => Offending Folder found: C:\Program Files\sidefind
Sun Oct 08 17:57:50 2006 => Object "sidefind Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Oct 08 17:57:50 2006 => Offending Folder found: C:\Program Files\web_rebates
Sun Oct 08 17:57:50 2006 => Object "toprebates Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sun Oct 08 17:57:50 2006 => Offending file found: C:\Documents and Settings\Ondřej Bunčo\Data aplikací\install.dat
Sun Oct 08 17:57:50 2006 => System found infected with zlob Trojan-Downloader (install.dat)! Action taken: No Action Taken.

Sun Oct 08 17:57:53 2006 => Offending file found: C:\WINDOWS\vb.ini
Sun Oct 08 17:57:53 2006 => System found infected with virusburst Trojan (C:\WINDOWS\vb.ini)! Action taken: No Action Taken.

Sun Oct 08 17:58:06 2006 => Scanning File C:\WINDOWS\sysldr32.exe
Sun Oct 08 17:58:07 2006 => File C:\WINDOWS\sysldr32.exe infected by "Trojan-Downloader.Win32.Small.ckh" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:58:07 2006 => Scanning File C:\WINDOWS\System32win.exe
Sun Oct 08 17:58:07 2006 => File C:\WINDOWS\System32win.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:58:07 2006 => Scanning File C:\WINDOWS\System32win32.exe
Sun Oct 08 17:58:08 2006 => File C:\WINDOWS\System32win32.exe infected by "Trojan-Dropper.Win32.WinAD.c" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:58:08 2006 => Scanning File C:\WINDOWS\sysvx_.exe
Sun Oct 08 17:58:08 2006 => File C:\WINDOWS\sysvx_.exe infected by "Email-Worm.Win32.Locksky.aj" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:58:17 2006 => Scanning File C:\WINDOWS\System32\bre.dll
Sun Oct 08 17:58:18 2006 => File C:\WINDOWS\System32\bre.dll infected by "Trojan-Downloader.Win32.Small.ajp" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:58:26 2006 => Scanning File C:\WINDOWS\System32\comdlg64.dll
Sun Oct 08 17:58:26 2006 => File C:\WINDOWS\System32\comdlg64.dll infected by "Rootkit.Win32.Agent.bk" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:58:59 2006 => Scanning File C:\WINDOWS\System32\IeHelperEx.dll
Sun Oct 08 17:58:59 2006 => File C:\WINDOWS\System32\IeHelperEx.dll infected by "Trojan.Win32.BHO.b" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:59:12 2006 => Scanning File C:\WINDOWS\System32\kernels8.exe
Sun Oct 08 17:59:12 2006 => File C:\WINDOWS\System32\kernels8.exe infected by "Trojan-Downloader.Win32.Tibs.cv" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:59:17 2006 => Scanning File C:\WINDOWS\System32\maxd64.exe
Sun Oct 08 17:59:17 2006 => File C:\WINDOWS\System32\maxd64.exe infected by "Trojan.Win32.Dialer.ay" Virus! Action Taken: No Action Taken.

Sun Oct 08 17:59:33 2006 => Scanning File C:\WINDOWS\System32\mspostsp.exe
Sun Oct 08 17:59:33 2006 => File C:\WINDOWS\System32\mspostsp.exe infected by "Trojan.Win32.Inject.i" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:02 2006 => Scanning File C:\WINDOWS\System32\qvxgamet2.exe
Sun Oct 08 18:00:02 2006 => File C:\WINDOWS\System32\qvxgamet2.exe infected by "Trojan-PSW.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:02 2006 => Scanning File C:\WINDOWS\System32\qvxgamet4.exe
Sun Oct 08 18:00:02 2006 => File C:\WINDOWS\System32\qvxgamet4.exe infected by "Trojan-Downloader.Win32.Small.cxx" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:17 2006 => Scanning File C:\WINDOWS\System32\slx.exe[
Sun Oct 08 18:00:17 2006 => File C:\WINDOWS\System32\slx.exe[ infected by "Trojan-Downloader.Win32.Tibs.cv" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:19 2006 => Scanning File C:\WINDOWS\System32\spoolsvv.exe
Sun Oct 08 18:00:20 2006 => File C:\WINDOWS\System32\spoolsvv.exe infected by "Trojan.Win32.Spabot.u" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:28 2006 => Scanning File C:\WINDOWS\System32\sysvx.exe
Sun Oct 08 18:00:28 2006 => File C:\WINDOWS\System32\sysvx.exe infected by "Email-Worm.Win32.Locksky.m" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:40 2006 => Scanning File C:\WINDOWS\System32\vxgame2.exe
Sun Oct 08 18:00:41 2006 => File C:\WINDOWS\System32\vxgame2.exe infected by "Trojan-Clicker.Win32.Agent.dw" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:41 2006 => Scanning File C:\WINDOWS\System32\vxgame3.exe
Sun Oct 08 18:00:41 2006 => File C:\WINDOWS\System32\vxgame3.exe infected by "Trojan-Downloader.Win32.Small.cgy" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:41 2006 => Scanning File C:\WINDOWS\System32\vxgame4.exe
Sun Oct 08 18:00:42 2006 => File C:\WINDOWS\System32\vxgame4.exe infected by "Trojan.Win32.Spabot.u" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:42 2006 => Scanning File C:\WINDOWS\System32\vxgame6.exe
Sun Oct 08 18:00:42 2006 => File C:\WINDOWS\System32\vxgame6.exe infected by "Email-Worm.Win32.Locksky.aj" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:42 2006 => Scanning File C:\WINDOWS\System32\vxgamet1.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxgamet1.exe infected by "Trojan-Downloader.Win32.Small.ckn" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxgamet2.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxgamet2.exe infected by "Trojan-Downloader.Win32.Small.bwk" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxgamet3.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxgamet3.exe infected by "Trojan-Dropper.Win32.Delf.th" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxgamet4.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxgamet4.exe infected by "Trojan-Downloader.Win32.Tiny.ba" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxh8jkdq1.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxh8jkdq1.exe infected by "Trojan-Dropper.Win32.Small.wp" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxh8jkdq2.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxh8jkdq2.exe infected by "not-virus:Hoax.Win32.Renos.bp" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxh8jkdq5.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxh8jkdq5.exe infected by "Trojan-Downloader.Win32.Small.awa" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxh8jkdq6.exe
Sun Oct 08 18:00:43 2006 => File C:\WINDOWS\System32\vxh8jkdq6.exe infected by "Trojan-Downloader.Win32.Small.atl" Virus! Action Taken: No Action Taken.

Sun Oct 08 18:00:43 2006 => Scanning File C:\WINDOWS\System32\vxh8jkdq7.exe
Sun Oct 08 18:00:44 2006 => File C:\WINDOWS\System32\vxh8jkdq7.exe infected by "Trojan-Downloader.Win32.Tibs.cn" Virus! Action Taken: No Action Taken.

Mon Oct 09 20:12:03 2006 => ***** Scanning complete. *****

Mon Oct 09 20:12:03 2006 => Total Objects Scanned: 17912
Mon Oct 09 20:12:03 2006 => Total Critical Objects: 26
Mon Oct 09 20:12:03 2006 => Total Disinfected Objects: 0
Mon Oct 09 20:12:03 2006 => Total Objects Renamed: 0
Mon Oct 09 20:12:03 2006 => Total Deleted Objects: 0
Mon Oct 09 20:12:03 2006 => Total Errors: 8
Mon Oct 09 20:12:03 2006 => Time Elapsed: 00:05:35
Mon Oct 09 20:12:03 2006 => Virus Database Date: 10/6/2006
Mon Oct 09 20:12:03 2006 => Virus Database Count: 229312

Mon Oct 09 20:12:03 2006 => Scan Completed.

[mijaja]

Najdi na disku ty červeně označené soubory a vymaž je. Nastav si v Možnostech složky zobrazování skrytých a systémových souborů, abys je lépe nalezl:

C:\winstall.exe
C:\WINDOWS\System32\bre.dll
C:\WINDOWS\System32\comdlg64.dll - tohle je rootkit
C:\WINDOWS\System32\IeHelperEx.dll
C:\WINDOWS\System32\ide21201.vxd
C:\WINDOWS\System32\kernels8.exe - pozor, abys nevymazal soubor kernel32.dll - ten patří systému
C:\WINDOWS\System32\maxd64.exe
C:\WINDOWS\System32\spoolsvv.exe - opět pozor! soubor spoolsv.exe (s jedním V ) je systémový
C:\WINDOWS\System32\mspostsp.exe
C:\WINDOWS\System32\slx.exe - to je dost záhadné jméno šmejda
C:\WINDOWS\System32\sysvx.exe
C:\WINDOWS\System32\qvxgamet2.exe
C:\WINDOWS\System32\qvxgamet4.exe
C:\WINDOWS\System32\vxgame2.exe
C:\WINDOWS\System32\vxgame3.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgamet1.exe
C:\WINDOWS\System32\vxgamet2.exe
C:\WINDOWS\System32\vxgamet3.exe
C:\WINDOWS\System32\vxgamet4.exe
C:\WINDOWS\System32\vxh8jkdq5.exe
C:\WINDOWS\System32\vxh8jkdq6.exe
C:\WINDOWS\System32\vxh8jkdq7.exe


C:\WINDOWS\gpinstall.exe
C:\WINDOWS\vb.ini
C:\WINDOWS\System32win.exe
C:\WINDOWS\system32win32.exe
C:\WINDOWS\sysldr32.exe

C:\WINDOWS\sysvx_.exe

C:\Program Files\istbar
C:\Program Files\sidefind
C:\Program Files\web_rebates

C:\Documents and Settings\Ondřej Bunčo\Data aplikací\install.dat

Podívej se na disku i po souboru ipsec6mon.dll. a jak jej najdeš, okamžitě maž! Měl by být ve složce C:\WINDOWS\System32\ipsec6mon.dll


Potom dej: Nabídka Start>>Spustit- do okénka napiš regedit a zmáčkni Entern nebo OK. V editoru registrů vyhledej tyto klíče:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{78364D99-A640-4ddf-B91A-67EFF8373045}

HKEY_CLASSES_ROOT\CLSID\{78364D99-A640-4ddf-B91A-67EFF8373045}

HKEY_LOCAL_MACHINE\SOFTWARE\windows adstatus
HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\downloadmanager

a všechny je smaž (ale jen ty klíče, ne celé registry!)

Pokud najdeš všechno a zlikviduješ to, máš vyhráno. Pokud něco z toho nenajdeš, napiš sem které soubory to byly a budeme pokračovat.

[sas]

jo dik , zkusim to.