Win32:Trojan-gen + Spyware

FABROS · Příspěvekod **FABROS** » 04 srp 2006 21:40

pochopil jsem,že si toto ještě mám poslat
Fri Aug 04 21:34:11 2006 => ***** Checking for specific ITW Viruses *****
Fri Aug 04 21:34:11 2006 => Checking for Welchia Virus...
Fri Aug 04 21:34:11 2006 => Checking for LovGate Virus...
Fri Aug 04 21:34:11 2006 => Checking for CodeRed Virus...
Fri Aug 04 21:34:11 2006 => Checking for OpaServ Virus...
Fri Aug 04 21:34:11 2006 => Checking for Sobig.e Virus...
Fri Aug 04 21:34:11 2006 => Checking for Winupie Virus...
Fri Aug 04 21:34:11 2006 => Checking for Swen Virus...
Fri Aug 04 21:34:11 2006 => Checking for JS.Fortnight Virus...
Fri Aug 04 21:34:11 2006 => Checking for Novarg Virus...
Fri Aug 04 21:34:11 2006 => Checking for Pagabot Virus...
Fri Aug 04 21:34:11 2006 => Checking for Parite.b Virus...
Fri Aug 04 21:34:11 2006 => Checking for Parite.a Virus...
Fri Aug 04 21:34:11 2006 => Checking for Adware.SeekSeek Virus...

Fri Aug 04 21:34:11 2006 => ***** Scanning complete. *****

Fri Aug 04 21:34:11 2006 => Total Objects Scanned: 21086
Fri Aug 04 21:34:11 2006 => Total Critical Objects: 16
Fri Aug 04 21:34:11 2006 => Total Disinfected Objects: 0
Fri Aug 04 21:34:11 2006 => Total Objects Renamed: 0
Fri Aug 04 21:34:11 2006 => Total Deleted Objects: 0
Fri Aug 04 21:34:11 2006 => Total Errors: 7
Fri Aug 04 21:34:11 2006 => Time Elapsed: 00:01:21
Fri Aug 04 21:34:11 2006 => Virus Database Date: 8/4/2006
Fri Aug 04 21:34:11 2006 => Virus Database Count: 212716

Fri Aug 04 21:34:11 2006 => Scan Completed.

Reklama

FABROS · Příspěvekod **FABROS** » 04 srp 2006 21:53

mňo co jsem pochopil a zvládnul to jsem udělal,ale ze vším jsem si rady nevěděl,tak nevím,co dál.Ještě to asi nestačí co,

Příspěvekod **fredik** » 04 srp 2006 22:01

Použij jestli si jestě nepoužil CCleaner použij Čistič a Problémy.
Pak použij SmitFraudFix

Po té vlož znov log z HijackThis dočistíme to.

FABROS · Příspěvekod **FABROS** » 04 srp 2006 22:03

ccleaner už jsem použil,ještě půjdu na ten druhý teda

FABROS · Příspěvekod **FABROS** » 04 srp 2006 22:23

OK ZATÍM HOTOVO A PLOCHA UŽ JE MODRÁ,TO JE DOBŘE NE?

FABROS · Příspěvekod **FABROS** » 04 srp 2006 22:24

JO JJEŠTĚ TI CHCI PODĚKOVAT,ŽE SE MI VĚNUJEŠ.jSI FAK HODNÝ

FABROS · Příspěvekod **FABROS** » 04 srp 2006 22:30

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 22:29:53, on 4.8.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\rpcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hak\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.5:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {F2FEBAD8-4D42-496A-9B5E-33976139D69C} - (no file)
O2 - BHO: (no name) - {F484C398-C71D-4482-8700-A9CCE5D2A0BE} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://host13.nwt.cz/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{19A18288-9FD6-4FD7-B4DF-7165428F1528}: NameServer = 85.255.115.238,85.255.112.216
O17 - HKLM\System\CCS\Services\Tcpip\..\{67172102-A75C-4275-A62E-C7FE13DA02E2}: NameServer = 85.255.115.238,85.255.112.216
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.238 85.255.112.216
O17 - HKLM\System\CS1\Services\Tcpip\..\{19A18288-9FD6-4FD7-B4DF-7165428F1528}: NameServer = 85.255.115.238,85.255.112.216
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.238 85.255.112.216
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

Příspěvekod **fredik** » 04 srp 2006 23:10

Ukonči v Taskmanageru a pak smaž:
C:\WINDOWS\system32\rpcc.exe
Fixni v HJT
O2 - BHO: (no name) - {F2FEBAD8-4D42-496A-9B5E-33976139D69C} - (no file)
O2 - BHO: (no name) - {F484C398-C71D-4482-8700-A9CCE5D2A0BE} - (no file)
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://host13.nwt.cz/activex/AMC.cab

FABROS · Příspěvekod **FABROS** » 04 srp 2006 23:19

PROMIŇ ALE CO TO ZNAMENÁ Ukonči v Taskmanageru a pak smaž: CO TO JE TEN Taskmanager

Příspěvekod **fredik** » 04 srp 2006 23:28

Ve Správci úloh systému Windows

FABROS · Příspěvekod **FABROS** » 04 srp 2006 23:39

Nemůžu to najít nebo spíše to tam není rpcc.exe

FABROS · Příspěvekod **FABROS** » 04 srp 2006 23:43

jinak fixnute mám

Win32:Trojan-gen + Spyware

HijackThis

Kdo je online