PC-HELP.CZ

Ahoj Nějak mi zlobí vypínání a i při startu nenaběhne vše. MS antispy mi
při každém startu něco najde, odstranim to a při příštím je to tam zase.
Posilam log, tak mě ho prosím prohlídni.

Logfile of HijackThis v1.99.1
Scan saved at 11:22:07, on 30.3.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.asus.com.tw/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.0.4:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Probe V2.24.02.lnk = ?
O4 - Global Startup: Rychlé spuštění aplikace HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {275E2FE0-7486-11D0-89D6-00A0C90C9B67} (MCSiMenuCtl Class) - https://setbox.contactel.cz/_woi/mcsimenu.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/Shared ... vSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 4391980812
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Doktore, víš, že mnoho přášků může pacientovi uškodit? Máš v kompu Spyware Doctora, Spy Sweepera, Microsoft AntiSpyware a Spybot SD a všechno ti jede rezidentně. Buď vypni rezidenty u SpyDoctora a SpySweepera a nechej MSAnti + Spybot, nebo nechej jen jeden z těch prvních dvou a MSAnti a Spybot vypni (ale mám dojem, že u MSAnti nejde rezident vypnout - to bys asi musel odinstalovat, u Spybotu jde vypnout - SD Helper).
Boj o přístupová práva mezi rezidenty ti může zpomalovat reakce kompu a samozřejmě prodloužená kontrola souborů potom neúměrně protahuje nabíhání i vypínání systému.

Jinak v logu fixni tento řádek:
O4 - Global Startup: Probe V2.24.02.lnk = ?

žádný šmejd tam není - spíše jen ta rivalita zmíněných programů.

No nechápu to, uSpySweepra jsem neměl zatrhlé spouštění při startu a
tak by štíty neměly fachat, ale nezabyval jsem se stím, stejne mi končí tak jsem ho nechával dožít. U Doctora mám štíty vypnuté, kromě Keylogger Guard, co snad nevadí ne ?

Keylogger Guard ti hlídá vstupy do kompu přes klávesnici - takže také nějaká forma rezidence. Ale to může být i tím, že těch funkcí jak u Doctora, tak u Sweeperu je více a anglicky nepříliš znalý člověk(jako já ) může mít s laděním programů problémy. Nemám ani jeden z nich, takže nevím, jestli třeba funkce štítu nelze vůbec vypnout a vypneš jen některé doplňkové služby, asi to je na vyzkoušení....

Tak Sweepra jsem vyhodil ai jiné nepotřebné,ale je to stejné a MS Anti. mi pokaždé najde
Spyware Scan Details
Start Date: 30.3.2006 15:40:31
End Date: 30.3.2006 15:42:22
Total Time: 1 mins 51 secs

Detected Threats

Rivarts.A Backdoor more information...
Status: Removed
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv\Enum 0 Root\LEGACY_MCHINJDRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv\Enum Count 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv\Enum NextInstance 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv Type 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv ErrorControl 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv Start 4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv ImagePath \??\C:\WINDOWS\TEMP\mc2216.tmp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv DeleteFlag 1


Detected Spyware Cookies
No spyware cookies were found during this scan.

Zjistí to při každém startu. Navíc jede všechno fakt hrozně pomalu a to vypínání- dohromady asi 5 minut

Takže půjdeme k jádru pudla. Stáhni siMWAV a udělej sken. Potom z logu mwavu vyber jen řádky, kde se píše o virech, spyware, adware, malware a riskware a dej je sem. Tohle ti nemusí dělat aktivní vir - může se spouštět se startem apod.

S toho dloouhého logu ?

Dej si funkci hledat (v notepadu = CTRL+F a potom F3 ) a dej sem jen ty výše jmenované řádky.

Tady to je
Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus.avi
Thu Mar 30 17:00:23 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus.avi
Thu Mar 30 17:00:23 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus002.avc
Thu Mar 30 17:00:23 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus003.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus004.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus005.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus006.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus007.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus008.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus009.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus010.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus011.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus012.avc
Thu Mar 30 17:00:24 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus013.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus014.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus015.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus016.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus017.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus018.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus019.avc
Thu Mar 30 17:00:25 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\virus020.avc

Thu Mar 30 17:05:21 2006 => ***** Checking for specific ITW Viruses *****
Thu Mar 30 17:05:21 2006 => Checking for Welchia Virus...
Thu Mar 30 17:05:21 2006 => Checking for LovGate Virus...
Thu Mar 30 17:05:21 2006 => Checking for CodeRed Virus...
Thu Mar 30 17:05:21 2006 => Checking for OpaServ Virus...
Thu Mar 30 17:05:21 2006 => Checking for Sobig.e Virus...
Thu Mar 30 17:05:21 2006 => Checking for Winupie Virus...
Thu Mar 30 17:05:22 2006 => Checking for Swen Virus...
Thu Mar 30 17:05:22 2006 => Checking for JS.Fortnight Virus...
Thu Mar 30 17:05:22 2006 => Checking for Novarg Virus...
Thu Mar 30 17:05:22 2006 => Checking for Pagabot Virus...
Thu Mar 30 17:05:22 2006 => Checking for Parite.b Virus...
Thu Mar 30 17:05:22 2006 => Checking for Parite.a Virus...
Thu Mar 30 17:05:22 2006 => Checking for Adware.SeekSeek Virus...

Thu Mar 30 17:05:22 2006 => ***** Scanning complete. *****

Thu Mar 30 17:05:22 2006 => Total Objects Scanned: 20948
Thu Mar 30 17:05:22 2006 => Total Critical Objects: 2
Thu Mar 30 17:05:23 2006 => Total Disinfected Objects: 0
Thu Mar 30 17:05:23 2006 => Total Objects Renamed: 0
Thu Mar 30 17:05:23 2006 => Total Deleted Objects: 0
Thu Mar 30 17:05:23 2006 => Total Errors: 4
Thu Mar 30 17:05:23 2006 => Time Elapsed: 00:16:58
Thu Mar 30 17:05:23 2006 => Virus Database Date: 3/28/2006
Thu Mar 30 17:05:23 2006 => Virus Database Count: 184466

Možná ještě toto
Thu Mar 30 16:51:03 2006 => System found infected with clientman Spyware/Adware (firstrun.log)! Action taken: No Action Taken.
Thu Mar 30 16:51:09 2006 => System found infected with hotbar Spyware/Adware (wbemess.lo_)! Action taken: No Action Taken.
Thu Mar 30 16:59:22 2006 => Scanning File C:\DOCUME~1\MIREKM~1\LOCALS~1\Temp\Spyware.sdb

Tak tyhle viry v Tempu můžeš smáznout CCleanerem.

Ale tento řádek označuje ještě něco, co by v tom logu mělo být:


Thu Mar 30 17:05:22 2006 => Total Critical Objects: 2
Tyto řádky by měly vypadat nějak takhle - příklad:
File D:\Instal - PROGRAMY\GoldWave\GoldWave 5.12\Crack\keygen.Vexe infected by "Trojan-Clicker.Win32.Small.is" Virus! Action Taken: No Action Taken.