Trojsky kon C:\WINDOWS\System32\diagisr.dll (Vyreseno)

[realko]

diky uz som to spravil tak ze som si to dal cez vyhladavanie a naslo to tak teraz to uz testujem a poslem vyledok toho REGISTRYFIX.EXE

[Reklama]

[fredik]

DOESIT~1 =>Does Itch Logo

[realko]

STATUS: FINISHEDComplete scanning result of "REGISTRYFIX.EXE", received in VirusTotal at 04.10.2007, 21:35:26 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.4.10.0 04.10.2007 no virus found
AntiVir 7.3.1.50 04.10.2007 TR/Dldr.Agent.avz.2
Authentium 4.93.8 04.09.2007 W32/Downloader.AYCD
Avast 4.7.936.0 04.10.2007 no virus found
AVG 7.5.0.447 04.10.2007 Downloader.Agent.GZI
BitDefender 7.2 04.10.2007 Trojan.Downloader.Agent.AVZ
CAT-QuickHeal 9.00 04.10.2007 no virus found
ClamAV devel-20070312 04.10.2007 no virus found
DrWeb 4.33 04.10.2007 Trojan.DownLoader.17533
eSafe 7.0.15.0 04.10.2007 Win32.Agent.avz
eTrust-Vet 30.7.3557 04.10.2007 no virus found
Ewido 4.0 04.10.2007 Downloader.Agent.avz
FileAdvisor 1 04.10.2007 no virus found
Fortinet 2.85.0.0 04.10.2007 W32/Agent.AVZ!tr.dldr
F-Prot 4.3.1.45 04.08.2007 W32/Downloader.AYCD
F-Secure 6.70.13030.0 04.10.2007 Trojan-Downloader.Win32.Agent.avz
Ikarus T3.1.1.5 04.10.2007 Trojan-Downloader.Win32.Agent.avz
Kaspersky 4.0.2.24 04.10.2007 Trojan-Downloader.Win32.Agent.avz
McAfee 5005 04.10.2007 Puper
Microsoft 1.2405 04.10.2007 TrojanDownloader:Win32/Zlob!4805 (threat-c)
NOD32v2 2176 04.10.2007 Win32/Downloader.RPC
Norman 5.80.02 04.10.2007 W32/Agent.ATCP
Panda 9.0.0.4 04.09.2007 Adware/PowerClean
Prevx1 V2 04.10.2007 no virus found
Sophos 4.16.0 04.06.2007 no virus found
Sunbelt 2.2.907.0 04.07.2007 Trojan-Downloader.Win32.Agent.avz
Symantec 10 04.10.2007 Trojan Horse
TheHacker 6.1.6.088 04.09.2007 Trojan/Downloader.Agent.avz
VBA32 3.11.3 04.09.2007 Trojan-Downloader.Win32.Agent.avz
VirusBuster 4.3.7:9 04.10.2007 no virus found
Webwasher-Gateway 6.0.1 04.10.2007 Trojan.Dldr.Agent.avz.2


Aditional Information
File size: 45056 bytes
MD5: 0548adb6403ffe36e7146e0f80afdc36
SHA1: cff10d40bbe594de06a7d3e643529e717fc30093

[fredik]

Ok ještě ty dva a pak to vezmeme všechno jedním tahem.

[realko]

dobre pracuje sa na tom

[realko]

STATUS: FINISHEDComplete scanning result of "DRAW_IDOL.exe", received in VirusTotal at 04.10.2007, 21:55:36 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.4.10.0 04.10.2007 no virus found
AntiVir 7.3.1.50 04.10.2007 TR/Dldr.Swizzor.Gen
Authentium 4.93.8 04.09.2007 no virus found
Avast 4.7.936.0 04.10.2007 no virus found
AVG 7.5.0.447 04.10.2007 Downloader.Obfuskated
BitDefender 7.2 04.10.2007 Trojan.FatObfus.Gen
CAT-QuickHeal 9.00 04.10.2007 (Suspicious) - DNAScan
ClamAV devel-20070312 04.10.2007 no virus found
DrWeb 4.33 04.10.2007 no virus found
eSafe 7.0.15.0 04.10.2007 no virus found
eTrust-Vet 30.7.3557 04.10.2007 no virus found
Ewido 4.0 04.10.2007 no virus found
FileAdvisor 1 04.10.2007 no virus found
Fortinet 2.85.0.0 04.10.2007 suspicious
F-Prot 4.3.1.45 04.08.2007 no virus found
F-Secure 6.70.13030.0 04.10.2007 Trojan.Win32.Obfuscated.en
Ikarus T3.1.1.5 04.10.2007 not-a-virus:AdWare.Win32.Lop.ag
Kaspersky 4.0.2.24 04.10.2007 Trojan.Win32.Obfuscated.en
McAfee 5005 04.10.2007 no virus found
Microsoft 1.2405 04.10.2007 no virus found
NOD32v2 2176 04.10.2007 no virus found
Norman 5.80.02 04.10.2007 no virus found
Panda 9.0.0.4 04.09.2007 Adware/Lop
Prevx1 V2 04.10.2007 no virus found
Sophos 4.16.0 04.06.2007 no virus found
Sunbelt 2.2.907.0 04.07.2007 no virus found
Symantec 10 04.10.2007 no virus found
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.3 04.09.2007 MalwareScope.Trojan-Downloader.Obfuscated.2
VirusBuster 4.3.7:9 04.10.2007 Adware.Lop.Gen
Webwasher-Gateway 6.0.1 04.10.2007 Trojan.Dldr.Swizzor.Gen


Aditional Information
File size: 397824 bytes
MD5: a20abc270484be6182abd669895daa1d
SHA1: 50cbe32f802834a07472db05ecfc22e812ba8122

[realko]

STATUS: FINISHEDComplete scanning result of "Meta_gram.exe", received in VirusTotal at 04.10.2007, 22:17:53 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.4.10.0 04.10.2007 no virus found
AntiVir 7.3.1.50 04.10.2007 TR/Dldr.Swizzor.Gen
Authentium 4.93.8 04.09.2007 no virus found
Avast 4.7.936.0 04.10.2007 no virus found
AVG 7.5.0.447 04.10.2007 Downloader.Obfuskated
BitDefender 7.2 04.10.2007 Trojan.FatObfus.Gen
CAT-QuickHeal 9.00 04.10.2007 no virus found
ClamAV devel-20070312 04.10.2007 no virus found
DrWeb 4.33 04.10.2007 Trojan.Swizzor
eSafe 7.0.15.0 04.10.2007 no virus found
eTrust-Vet 30.7.3557 04.10.2007 no virus found
Ewido 4.0 04.10.2007 Trojan.Obfuscated.en
FileAdvisor 1 04.10.2007 No threat detected
Fortinet 2.85.0.0 04.10.2007 suspicious
F-Prot 4.3.1.45 04.08.2007 no virus found
F-Secure 6.70.13030.0 04.10.2007 Trojan.Win32.Obfuscated.en
Ikarus T3.1.1.5 04.10.2007 not-a-virus:AdWare.Win32.Lop.ag
Kaspersky 4.0.2.24 04.10.2007 Trojan.Win32.Obfuscated.en
McAfee 5005 04.10.2007 no virus found
Microsoft 1.2405 04.10.2007 Spyware:Win32/C2Lop.C (threat-c)
NOD32v2 2178 04.10.2007 no virus found
Norman 5.80.02 04.10.2007 W32/DLoader.CENA
Panda 9.0.0.4 04.09.2007 Adware/Lop
Prevx1 V2 04.10.2007 Adware.Lop
Sophos 4.16.0 04.06.2007 no virus found
Sunbelt 2.2.907.0 04.07.2007 no virus found
Symantec 10 04.10.2007 no virus found
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.3 04.09.2007 MalwareScope.Trojan-Downloader.Obfuscated.2
VirusBuster 4.3.7:9 04.10.2007 Adware.Lop.Gen
Webwasher-Gateway 6.0.1 04.10.2007 Trojan.Dldr.Swizzor.Gen


Aditional Information
File size: 542720 bytes
MD5: 55bd704020a23d2ceaf8d0b1339c3ae8
SHA1: 433c7cbdedf82ea8825869eaeeef4b412f6d803e
Bit9 info: http://fileadvisor.bit9.com/services/ex ... b1339c3ae8
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=edf680385947


tak a uz je to kompletne
teraz prosim nejake riesenie
dakujem

[fredik]

Zatím fixni v HJT toto:
O4 - HKLM\..\RunOnce: [RPCInstall] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\REGISTRYFIX.EXE
a smaž ten soubor: C:\Documents and Settings\Local settings\Temp\REGISTRYFIX.EXE kdyby to nešlo tak dej vědět.

Stáhni si a spusť program OTMoveIT
- Do levého sloupce zkopíruj tyto cesty:
C:\Documents and Settings\Administrator\DATAAP~1\NetPumper
C:\Documents and Settings\Administrator\DATAAP~1\BitGrabber
C:\Documents and Settings\Administrator\DATAAP~1\Does Itch Logo
C:\Documents and Settings\All Users\DATAAP~1\Site For Grim Math

- Po zkopírování klikni na tlačítko MoveIt a zkopíruj následně celý obsah z pravého sloupce, který bude informovat o výsledcích.
Je možné, že pokud nebudou moci být adresáře odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď .

Vlož log z OTMoveIT a nový log z HijackThis.

[realko]

File/Folder C:\Documents and Settings\Administrator\DATAAP~1\NetPumper not found.
File/Folder C:\Documents and Settings\Administrator\DATAAP~1\BitGrabber not found.
File/Folder C:\Documents and Settings\Administrator\DATAAP~1\Does Itch Logo not found.
Folder cleanup failed. C:\Documents and Settings\All Users\DATAAP~1\Site For Grim Math scheduled to be deleted on reboot.

Created on 04.11.2007 00:22:52


toto je to druhe:

Logfile of HijackThis v1.99.1
Scan saved at 0:23:35, on 11. 4. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Plocha\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.sk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb103\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb103\Dealio.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe" "Microcom\ADSL DeskPorte USB"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v3] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKLM\..\Run: [Grim math bone dale] C:\Documents and Settings\All Users\Data aplikací\Site For Grim Math\Meta gram.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [beepheart] C:\DOCUME~1\ADMINI~1\DATAAP~1\DOESIT~1\DRAW IDOL.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb103\res\DealioSearch.html
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb103\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://pokladna.station.zoznam.sk/god/ocx/ExentCtl.ocx
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/061011 ... 101001.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{932E7E91-A64B-4B38-9AC0-1CCEDA0E6D82}: NameServer = 195.146.132.58 195.146.128.60
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe


a ten subor som vymazal ale ked som restartoval pc tak sa zobrazilo ze sa nemoze ten suor najst tak som dal ok a potom sa az zapol pc

[Damned]

Spusť si HJT a zaškrtni čtverečky před hodnotama:

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe&quot
O4 - HKLM\..\Run: [Grim math bone dale] C:\Documents and Settings\All Users\Data aplikací\Site For Grim Math\Meta gram.exe
O4 - HKCU\..\Run: [beepheart] C:\DOCUME~1\ADMINI~1\DATAAP~1\DOESIT~1\DRAW IDOL.exe

Pokud nehraješ nějakou hru, nebo nevíš k čemu máš tento vstup, tak zaškrtni i toto:
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/061011 ... 101001.cab

Poté zmáčkni Fix checked

Poté si stáhni Killbox. Rozbal ho na ploše a do políčka "Full Path of File to Delete" vlož toto: C:\Documents and Settings\All Users\Data aplikací\Site For Grim Math\Meta gram.exe.
Zaškrtni "Delete on Reboot" a zmáčkni červený gombík s bílým křížkem.

Ten samý postu zopakuj i s C:\DOCUME~1\ADMINI~1\DATAAP~1\DOESIT~1\DRAW IDOL.exe (nebo ho normálně tlačítkem souboru nalistuj)

Ještě by mě zajímalo k čemu tam máš to Dealio

Podívej zda nemáš něco s těmito názvy nainstalované (Meta, Grim, Draw a pod).Pokud ano, odinstaluj to v Přidat/Odebrat programy( samozřejmě jen programy o kterých nic nevíš)

[fredik]

Podle všeho tam ty adresáře nejsou ale zkus se po nich podívat a když tam budou tak je smaž ručně:
C:\Documents and Settings\Administrator\DATAAP~1\NetPumper
C:\Documents and Settings\Administrator\DATAAP~1\BitGrabber
C:\Documents and Settings\Administrator\DATAAP~1\Does Itch Logo
C:\Documents and Settings\All Users\DATAAP~1\Site For Grim Math => ten by měl být odstraněn po restartu.

Až všechno provedeš tak sem dej nový log z HJT a pro jistotu i z Lopfind a řekni jestli se všechno povedlo.

[realko]

Logfile of HijackThis v1.99.1
Scan saved at 15:34:42, on 11. 4. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Plocha\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.sk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe" "Microcom\ADSL DeskPorte USB"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v3] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [beepheart] C:\DOCUME~1\ADMINI~1\DATAAP~1\DOESIT~1\DRAW IDOL.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://pokladna.station.zoznam.sk/god/ocx/ExentCtl.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{932E7E91-A64B-4B38-9AC0-1CCEDA0E6D82}: NameServer = 195.146.132.58 195.146.128.60
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe


toto je ten LopFind:

) Výpis obsahů Application Data složek pro zjištění podezřelých adresářů:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\Documents and Settings\Administrator\DATAAP~1

06. 01. 2007 20:41 <DIR> Apple Computer
31. 12. 2006 18:00 <DIR> COWON
27. 12. 2006 18:13 <DIR> Azureus
25. 12. 2006 12:33 <DIR> uTorrent
21. 12. 2006 21:19 <DIR> Samsung
29. 11. 2006 22:12 <DIR> BSplayer
27. 11. 2006 00:00 <DIR> Acclaim Entertainment
18. 11. 2006 21:15 <DIR> Publish Providers
18. 11. 2006 21:12 <DIR> Sony
04. 11. 2006 01:04 <DIR> Talkback
04. 11. 2006 01:03 <DIR> Mozilla
16. 10. 2006 19:04 <DIR> Nokia Multimedia Player
16. 10. 2006 19:02 <DIR> SlySoft
16. 10. 2006 19:01 48 .zreglib
06. 10. 2006 22:59 <DIR> Jomigo
01. 10. 2006 14:03 <DIR> Google
01. 08. 2006 12:05 <DIR> Sun
06. 07. 2006 21:05 <DIR> CyberLink
10. 05. 2006 22:38 <DIR> InterVideo
01. 05. 2006 11:57 <DIR> Skype
25. 04. 2006 14:49 <DIR> Help
29. 01. 2006 01:20 <DIR> LegalSounds
24. 01. 2006 16:07 <DIR> ICQLite
14. 01. 2006 22:59 22096 GDIPFONTCACHEV1.DAT
27. 12. 2005 23:30 <DIR> AdobeUM
27. 12. 2005 23:30 <DIR> Adobe
24. 12. 2005 00:34 <DIR> Macromedia
22. 12. 2005 14:49 <DIR> Lavasoft
19. 12. 2005 15:52 <DIR> Identities
19. 12. 2005 15:52 62 desktop.ini
19. 12. 2005 15:52 <DIR> ..
19. 12. 2005 15:52 <DIR> .
19. 12. 2005 15:52 <DIR> Microsoft
3 soubor…, 22206 bajt…
Adres ý…: 30, Volněch bajt…: 4056653824
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\Documents and Settings\All Users\DATAAP~1

23. 03. 2007 22:51 <DIR> Google
18. 02. 2007 22:30 4083 QTSBandwidthCache
14. 01. 2007 23:36 <DIR> Site For Grim Math
06. 01. 2007 20:40 <DIR> Apple Computer
26. 11. 2006 19:27 <DIR> SecuROM
03. 10. 2006 18:23 <DIR> Sony Ericsson
06. 07. 2006 21:03 <DIR> CyberLink
31. 05. 2006 23:40 <DIR> Spyware Terminator
21. 05. 2006 19:16 <DIR> Yahoo! Companion
01. 05. 2006 11:57 <DIR> Skype
02. 03. 2006 15:16 <DIR> Windows Genuine Advantage
19. 02. 2006 14:12 <DIR> nView_Profiles
28. 01. 2006 11:58 <DIR> OLYMPUS
28. 01. 2006 11:53 <DIR> QuickTime
22. 12. 2005 14:50 <DIR> Adobe
22. 12. 2005 14:49 <DIR> Spybot - Search & Destroy
19. 12. 2005 14:19 62 desktop.ini
19. 12. 2005 14:19 <DIR> Microsoft
19. 12. 2005 14:19 <DIR> .
19. 12. 2005 14:19 <DIR> ..
2 soubor…, 4145 bajt…
Adres ý…: 18, Volněch bajt…: 4056653824
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\Documents and Settings\Default User\DATAAP~1

19. 12. 2005 14:19 62 desktop.ini
19. 12. 2005 14:19 <DIR> ..
19. 12. 2005 14:19 <DIR> Microsoft
19. 12. 2005 14:19 <DIR> .
1 soubor…, 62 bajt…
Adres ý…: 3, Volněch bajt…: 4056653824
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\Documents and Settings\LocalService\DATAAP~1

04. 01. 2006 12:35 <DIR> Help
19. 12. 2005 15:47 <DIR> ..
19. 12. 2005 15:47 <DIR> Microsoft
19. 12. 2005 15:47 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 4, Volněch bajt…: 4056653824
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\Documents and Settings\NetworkService\DATAAP~1

19. 12. 2005 13:58 <DIR> ..
19. 12. 2005 13:58 <DIR> Microsoft
19. 12. 2005 13:58 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 3, Volněch bajt…: 4056649728
Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\Documents and Settings\All Users\Application Data

07. 11. 2006 20:07 <DIR> Move Networks
01. 10. 2006 20:09 <DIR> Exetender
01. 10. 2006 20:09 <DIR> ..
01. 10. 2006 20:09 <DIR> .
0 soubor…, 0 bajt…
Adres ý…: 4, Volněch bajt…: 4056649728

******************************************

2) Vyhledávání a odstranění podezřelých .job souborů:

a) Soubory přítomné v C:\WINDOWS\tasks\ adresáři:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\WINDOWS\Tasks

06. 01. 2007 20:40 284 AppleSoftwareUpdate.job
19. 12. 2005 15:47 6 SA.DAT
19. 12. 2005 13:52 65 desktop.ini
19. 12. 2005 13:52 <DIR> ..
19. 12. 2005 13:52 <DIR> .
3 soubor…, 355 bajt…
Adres ý…: 2, Volněch bajt…: 4˙056˙649˙728

––––––––––––––––––––––––––––––––––––––––––

b) Zjišťování vlastností přítomných .job souborů:

[TRACE] Enumerating jobs and queues
[TRACE] Activating job 'AppleSoftwareUpdate.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\Apple Software Update\SoftwareUpdate.exe'
Parameters: '-Task'
WorkingDirectory: ''
Comment: ''
Creator: 'SYSTEM'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 04/11/2007 14:43:00
NextRun: 04/18/2007 14:43:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 0
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Weekly
WeeksInterval: 1
DaysOfTheWeek: ...W...
StartDate: 01/06/2007
EndDate: 00/00/0000
StartTime: 14:43
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0


––––––––––––––––––––––––––––––––––––––––––

c) Nalezené a odstraněné nežádoucí soubory:


––––––––––––––––––––––––––––––––––––––––––

d) Soubory přítomné v adresáři po vymazání:

Svazek v jednotce C nem  § dnou jmenovku.
S‚riov‚ źˇslo svazku je 84E5-17E1.

Věpis adres ýe C:\WINDOWS\Tasks

06. 01. 2007 20:40 284 AppleSoftwareUpdate.job
19. 12. 2005 15:47 6 SA.DAT
19. 12. 2005 13:52 65 desktop.ini
19. 12. 2005 13:52 <DIR> ..
19. 12. 2005 13:52 <DIR> .
3 soubor…, 355 bajt…
Adres ý…: 2, Volněch bajt…: 4˙056˙629˙248

******************************************

3) Vyhledávání podvodných programů ve složce Program files:


Adresář C:\Program Files\Adv Nepřítomen !

Adresář C:\Program Files\Adverts Nepřítomen !

Adresář C:\Program Files\BitDownload Nepřítomen !

Adresář C:\Program Files\BitGrabber Přítomen !

Adresář C:\Program Files\BitRoll Nepřítomen !

Adresář C:\Program Files\C2Media Nepřítomen !

Adresář C:\Program Files\Download Plugin Nepřítomen !

Adresář C:\Program Files\Messenger Plus! 3 Nepřítomen !

Adresář C:\Program Files\NetPumper Nepřítomen !

Adresář C:\Program Files\Proxy download Nepřítomen !

Adresář C:\Program Files\SuperTorrent Nepřítomen !

Adresář C:\Program Files\Torrent101 Nepřítomen !

Adresář C:\Program Files\TorrentQ Nepřítomen !


tak podarila sa vsetko co si mi poradil som spravil dakujem