PC-HELP.CZ

Brekeke nějak se mi to kouše tak by to chtělo trochu popostrčit. :)

Nějakou dobu sem to tady nedával ke kontrole, pořád mi nejede net (jenom prohlížeče), tak se tu moc nedostanu a asi toho bude k bloknutí víc.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25:08, on 31.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Maxthon2\Maxthon.exe
D:\ICQLite\ICQLite.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle\RAM_XP.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\spyemergencycnt.dll
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://test.catalog.update.microsoft.co ... 5861570609
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5831178687
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 5831683703
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Spy Emergency Shield Service (SpyEmrgSrv) - Unknown owner - C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergencySrv.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)

--
End of file - 7822 bytes

...A HJT asi nebude nejnovější.

v první řadě se zbav Spy Emergency. je to na nic soft. udělá víš škody jak užitku.běží ti rezidentně dva antiviry. jeden odinstaluj.nemáš firewall.vidím jen nějaké náznaky Outpost Firewall Pro.

No tak Spy Amergency se nemůžu zbavit, né že bych bych se nějak extra snažil,ale přes CCleanra to nejde a vymazat kořenovou složku nejde uplně.
Outpost sem taky smazal ale taky tam něco zbylo (zařídím).

A o těch dvou Anti. vím, ale NOD mám už po zkušební verzi a používám ho jen na kontrolu, jinak jed AVG.
Vlastně ten NOD jede ale jako "skrytý".

s tím spy emergency bývají problémy. stáhni si killbox a natvrdo ho odstřel. pročisti pořádně registry (např.registry mechanic-trial). doinstaluj firewall (Zone Alarm, Comodo, Kerio) a nechej jeden antivir. to může být příčina toho pomalého PC. po zkušební době stejně nejde u NODA aktualizace, tak na co ho nechávat na sken?

nod odinstaluj,stále běží!

podívej se do START>Programy jestli tam ve složce spyemergrncy nenajdeš uninstal.
kdyžtak ho smažeš na tvrdo

to Baron Prášil:mám odzkoušeno, že ten uninstal tam fakt není.jsou s tím problémy a jiné řešení, než smazat natvrdo není.bohužel.

to ReCall:jinak se řiď tím, co říká Baron Prášil. to je tady místní profík přes havěť

Tak sem hledal složku S.E. a nic sem nenašel a přes Hledání sem našel jen "SpyEmergencyCnt.dll" a to ani killbox to nechce odstranit.

Baron Prášil: Tak toho NODa sem odinstaloval.

je to složka C:\Program Files\NETGATE

zkus avenger a skript



potvrď to a uvidíme po restartu

Po složce NETGATE není ani stopy. Není ani skrytá.
Takže, jedině kde je vidět Spy Emergency je HJT log.

pošli log z combofixu,domažeme ho tím

Trochu pozdě, ale přece...

ComboFix 08-02.01.6 - WarezBos 2008-02-01 14:25:35.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.139 [GMT 1:00]
Running from: C:\Documents and Settings\WarezBos\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\nm


((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))
.

2008-02-01 13:21 . 2008-02-01 13:21 <DIR> d-------- C:\Program Files\Kerio
2008-02-01 12:55 . 2008-02-01 13:04 <DIR> dr------- C:\My Software
2008-01-27 19:36 . 2008-01-27 19:36 <DIR> d-------- C:\Program Files\Common Files\Everstrike Software
2008-01-27 18:24 . 2007-07-30 11:12 <DIR> d--h----- C:\Documents and Settings\Tiger\ćablony
2008-01-27 18:24 . 2007-07-30 19:07 <DIR> d-------- C:\Documents and Settings\Tiger\Plocha
2008-01-27 18:24 . 2007-07-30 13:04 <DIR> d--h----- C:\Documents and Settings\Tiger\Okolnˇ tisk rny
2008-01-27 18:24 . 2007-07-30 13:04 <DIR> d--h----- C:\Documents and Settings\Tiger\Okolnˇ sˇś
2008-01-27 18:24 . 2007-07-30 13:04 <DIR> d-------- C:\Documents and Settings\Tiger\Oblˇben‚ polo§ky
2008-01-27 18:24 . 2007-07-30 13:04 <DIR> dr------- C:\Documents and Settings\Tiger\Nabˇdka Start
2008-01-27 18:24 . 2007-07-30 13:04 <DIR> d-------- C:\Documents and Settings\Tiger\Dokumenty
2008-01-27 18:24 . 2007-07-30 11:17 <DIR> dr-h----- C:\Documents and Settings\Tiger\Data aplikacˇ
2008-01-24 17:54 . 2008-02-01 12:57 <DIR> d-------- C:\Program Files\URUSoft
2008-01-15 20:12 . 2008-01-15 20:12 2,745 --a------ C:\WINDOWS\wtran32.INI
2008-01-15 20:12 . 2008-01-20 16:37 1,154 --a------ C:\WINDOWS\wdict32.INI
2008-01-10 18:15 . 2008-01-10 18:15 <DIR> d-------- C:\Program Files\Webteh
2008-01-05 21:58 . 2008-02-01 13:09 <DIR> d-------- C:\Incomplete

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-31 21:36 --------- d-----w C:\Program Files\DOSBox-0.65
2008-01-26 13:01 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-01-02 21:40 --------- d-----w C:\Program Files\styler
2008-01-02 15:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-29 20:54 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-12-29 20:54 249,856 ------w C:\WINDOWS\Setup1.exe
2007-12-29 11:55 47,360 ----a-w C:\WINDOWS\system32\drivers\Pcouffin.sys
2007-12-29 11:55 --------- d-----w C:\Program Files\vso
2007-12-28 21:06 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2007-12-26 17:23 --------- d-----w C:\Program Files\GDS
2007-12-26 12:38 --------- d-----w C:\Program Files\Polda 5
2007-12-25 18:11 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-25 18:08 --------- d-----w C:\Program Files\Nero
2007-11-23 09:01 65,536 ----a-w C:\WINDOWS\IFinst27.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-18 23:05 630784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 16:49 25088]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RAM Idle Professional"="C:\Program Files\RAM Idle\RAM_XP.exe" [2004-06-11 15:28 133632]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-09-09 10:16 196608]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-28 18:21 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 16:49 25088]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-28 18:21 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys [2005-04-26 10:22]
R1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys [2007-05-20 14:06]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-08-29 12:07]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-04 00:04]
S2 LF30FS;LF30FS;C:\Porgramy\LockFolder\LF30XP.sys []
S3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;C:\WINDOWS\system32\Drivers\spyemrg_guard.sys [2007-05-20 14:06]

.
Contents of the 'Scheduled Tasks' folder
"2007-09-23 17:40:56 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-17 10:09:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 14:29:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\Program Files\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
.
**************************************************************************
.
Completion time: 2008-02-01 14:31:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-01 13:31:30

...a co mám vlastně v HJT logu fixnout.