PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

prosim o kontrolu logu

https://pc-help.cnews.cz/viewtopic.php?f=70&t=17446

Stránka 1 z 1

prosim o kontrolu logu

Napsal: 20 srp 2007 21:48
od bordino
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:31:15, on 20.8.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\713xRMT.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\TVtuner\honestech TVR\scheduleTV.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\WinCmd\Wincmd32.exe
C:\Documents and Settings\Administrator\Plocha\Antivir\antivir\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cache.jcu.cz:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5FA6752A-C4A0-4222-88C2-928AE5AB4966} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Curl - {A78CC2FF-6E4E-4556-B27C-D7C3A70D7A50} - (no file)
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PCI TV Card Remote Control Applet] C:\WINDOWS\713xRMT.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ScheduleTV.lnk = C:\Program Files\TVtuner\honestech TVR\scheduleTV.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm480YYCZ
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://www.mapy.cz a http
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... 0.15-3.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O17 - HKLM\Software\..\Telephony: DomainName = k2.jcu.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O20 - Winlogon Notify: wintxs32 - wintxs32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

--
End of file - 6713 bytes

Díky moc za pomoc

Napsal: 20 srp 2007 21:57
od Damned
Odinstaluj nejdříve ten MyWeb Search,pak sem dej znovu log

novy log a neco o mywebsearch

Napsal: 21 srp 2007 21:02
od bordino
Diky za odpoved,
jediny misto kde jsem nasel neco o "mywebsearch" bylo

C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy\Recovery

posilam znovu muj log a predem dekuji za rady:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:52:34, on 21.8.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\713xRMT.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\TVtuner\honestech TVR\scheduleTV.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinCmd\Wincmd32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinCmd\Wincmd32.exe
C:\Documents and Settings\Administrator\Plocha\Antivir\antivir\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cache.jcu.cz:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PCI TV Card Remote Control Applet] C:\WINDOWS\713xRMT.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3135] command /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4928] cmd /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7177] command /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2488] cmd /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3328] command /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6394] cmd /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7183] command /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3461] cmd /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3087] command /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2810] cmd /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7076] command /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5082] cmd /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1264] command /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5720] cmd /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4793] command /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6672] cmd /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [SpybotDeletingB1675] command /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1653] cmd /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4081] command /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9865] cmd /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6687] command /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9254] cmd /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8831] command /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3872] cmd /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8143] command /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3774] cmd /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7282] command /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD987] cmd /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6265] command /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD378] cmd /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9192] command /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6283] cmd /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ScheduleTV.lnk = C:\Program Files\TVtuner\honestech TVR\scheduleTV.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - ?p=ZRxdm480YYCZ
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://www.mapy.cz a http
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O17 - HKLM\Software\..\Telephony: DomainName = k2.jcu.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O20 - Winlogon Notify: wintxs32 - wintxs32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

--
End of file - 8511 bytes

Napsal: 22 srp 2007 09:37
od bellatrix
spybot to akosi nezvlada odstranit... :smile:

fixni v hijackthis:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\RunOnce: [SpybotDeletingA3135] command /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4928] cmd /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7177] command /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2488] cmd /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3328] command /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6394] cmd /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7183] command /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3461] cmd /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3087] command /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2810] cmd /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7076] command /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5082] cmd /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1264] command /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5720] cmd /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4793] command /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6672] cmd /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1675] command /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1653] cmd /c del "C:\WINDOWS\Temp\win318B.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4081] command /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9865] cmd /c del "C:\WINDOWS\Temp\win3130.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6687] command /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9254] cmd /c del "C:\WINDOWS\Temp\win3128.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8831] command /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3872] cmd /c del "C:\WINDOWS\Temp\win3121.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8143] command /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3774] cmd /c del "C:\WINDOWS\Temp\win3119.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7282] command /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD987] cmd /c del "C:\WINDOWS\Temp\win3112.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6265] command /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD378] cmd /c del "C:\WINDOWS\Temp\win3108.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9192] command /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6283] cmd /c del "C:\WINDOWS\Temp\win30C3.tmp_tobedeleted"
O8 - Extra context menu item: &Search - ?p=ZRxdm480YYCZ
O20 - Winlogon Notify: wintxs32 - wintxs32.dll (file missing)
+ odporucam doinstalovat firewall

po restarte hod novy log z hjt

novy log a firewall

Napsal: 22 srp 2007 22:13
od bordino
Prosim jeste o radu. Jaky firewall by jsi mi doporucil?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:05:23, on 22.8.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\713xRMT.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\TVtuner\honestech TVR\scheduleTV.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinCmd\Wincmd32.exe
C:\Documents and Settings\Administrator\Plocha\Antivir\antivir\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cache.jcu.cz:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PCI TV Card Remote Control Applet] C:\WINDOWS\713xRMT.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ScheduleTV.lnk = C:\Program Files\TVtuner\honestech TVR\scheduleTV.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://www.mapy.cz a http
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O17 - HKLM\Software\..\Telephony: DomainName = k2.jcu.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = k2.jcu.cz
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

--
End of file - 5133 bytes

Napsal: 23 srp 2007 09:15
od bellatrix
log je ok, firewall by som Ti doporucila Comodo alebo Zone Alarm + doinstaluj SP2
Časové pásmo: UTC+02:00
Stránka 1 z 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/