Prosim, muzete se mi na to podivat ?

[Jamalalicha]

Nejak mi zacalo v posledni dobe padat compo, hlavne pri hrach. Predem moc diky...


Logfile of HijackThis v1.99.1
Scan saved at 4:04:55 PM, on 5/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\SpeedFan\speedfan.exe
D:\instalacky\DAP\DAP.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\rezerva\Torrent\killbox.exe
C:\WINDOWS\system32\taskmgr.exe
D:\rezerva\Torrent\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - Global Startup: VersionTracker Pro.lnk = ?
O8 - Extra context menu item: &Clean Traces - D:\instalacky\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\instalacky\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - D:\instalacky\DAP\dapextie2.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\instalacky\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\instalacky\ICQ\ICQLite\ICQLite.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/ ... 1.2.76.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 6671895140
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://go.radarsync.com/RSActiveX.ocx
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15021/CTPID.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = honus
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = honus
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

[Reklama]

[mijaja]

V logu není žádný aktivní šmejd.

Fixni tyto řádky:

O8 - Extra context menu item: &Clean Traces - D:\instalacky\DAP\Privacy Package\dapcleanerie.htm
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/ ... 1.2.76.cab
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://go.radarsync.com/RSActiveX.ocx
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab

Zaškrtni a dej Fix Checked.
Ale jsou to jen kosmetické úpravy. Bylo by lepší udělat log z MWAVu dle návodu a dát jej sem. Nejdříve ale vyčisti komp Ccleanerem, aby log mwavu nebyl moc dlouhý.

[Jamalalicha]

Moc diky, uz to projizdim, pak Ti to poslu, jsi moc hodny.......

[Jamalalicha]

Mon May 08 16:56:55 2006 => ERROR!!! Invalid Entry {2E9FFF5C-4375-494d-951F-098BAA42239E} = blank (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved). No Action Taken.
Mon May 08 16:56:58 2006 => ERROR!!! Invalid Entry \??\D:\Temp\Rar$EX00.562\RTCore.sys in SYSTEM\CurrentControlSet\Services\RTCore...
Mon May 08 16:56:58 2006 => ERROR!!! Invalid Entry \??\D:\Temp\sony_ssm.sys in SYSTEM\CurrentControlSet\Services\sony_ssm.sys...
Mon May 08 16:56:58 2006 => ERROR!!! Invalid Entry System32\Drivers\spyemrg.sys in SYSTEM\CurrentControlSet\Services\SpyEmrg...

Mon May 08 16:57:10 2006 => System found infected with cws.loadadv.400 Browser Hijacker ({5e2121ee-0300-11d4-8d3b-444553540000})! Action taken: No Action Taken.
Mon May 08 16:57:10 2006 => System found infected with powerstrip Spyware/Adware ({669695bc-a811-4a9d-8cdf-ba8c795f261c})! Action taken: No Action Taken.
Mon May 08 16:57:10 2006 => Offending file found: C:\WINDOWS\gpinstall.exe
Mon May 08 16:57:10 2006 => System found infected with conducent flexpak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken.

Mon May 08 16:56:58 2006 => Scanning File C:\WINDOWS\system32\drivers\WmVirHid.sys
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus.avi
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus004.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus005.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus006.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus007.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus008.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus009.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus010.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus011.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus012.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus013.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus014.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus015.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus016.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus017.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus018.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus019.avc
Mon May 08 16:58:08 2006 => Scanning File D:\Temp\virus020.avc

Mon May 08 17:12:14 2006 => ***** Scanning complete. *****

Mon May 08 17:12:14 2006 => Total Objects Scanned: 14867
Mon May 08 17:12:14 2006 => Total Critical Objects: 3
Mon May 08 17:12:14 2006 => Total Disinfected Objects: 0
Mon May 08 17:12:14 2006 => Total Objects Renamed: 0
Mon May 08 17:12:14 2006 => Total Deleted Objects: 0
Mon May 08 17:12:14 2006 => Total Errors: 4
Mon May 08 17:12:14 2006 => Time Elapsed: 00:00:42
Mon May 08 17:12:14 2006 => Virus Database Date: 5/4/2006
Mon May 08 17:12:14 2006 => Virus Database Count: 191517

Mon May 08 17:12:14 2006 => Scan Completed.

Mon May 08 17:23:45 2006 => Virus Database Date: 5/4/2006
Mon May 08 17:23:45 2006 => Virus Database Count: 191517
Mon May 08 17:26:11 2006 => Generating Virus List... getvlist.exe D:\Temp\vlist.txt

[mijaja]

Máš tam mít jen 3 kritické objekty, a v tom cos napsal jsou, ale nic tak závažného.
Projeď ten soubor C:\WINDOWS\gpinstall.exe na Jottiscanu (mám v podpisu)

Stáhni si soubor SAV32CLI - to je remover od Sophosu a projeď komp. Měl by zlikvidovat to cws.loadadv.400 Browser Hijacker
Podívej se do registů a najdi tento klíč
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\spoolsvr32\csmss.exe a snaž jej.

Ten powerstrip je lištavyskakující v IE a bohižel veze se s Download Accelerátor Plusem - čili ten by musel jít pryč. Ale ta lišta je potenciální nebezpečí, nikoliv akutní. Zkus najít na disku tyto soubory:
%program_files%\powerstrip\pslauncher.exe
%program_files%\powerstrip\pssetup.exe
%program_files%\common files\presentia\pmr.exe
%program_files%\common files\presentia\ltdmgr.exe
%program_files%\common files\presentia\lsvr.exe
%windows%\system\powrstrp.dll
%windows%\omdsn.dll
%system%\powrstrp.dll
%program_files%\powerstrip\powrstrp.dll
psocx.dll
svr.exe
ltdmgr.exe
mwsvm.dat
pmr.bin
pmr.exe
pmr.ocx
powrstrp.dll
psi.ocx
pslauncher.exe
psocx.cab
psocx.dll
pssetup.exe
urls.bin
vs.bin
vurls.bin - může to být kterýkoliv z nich, díky němuž hlásí mwav tento typ nákazy. Jestli najdeš některé z tohoto seznamu, projdi na Jotti a je-li špatný - pryč s ním.

[Jamalalicha]

Toto nemuzu za Boha najit, poradis prosim jak ???


HKLM\Software\Microsoft\Windows\CurrentVersion\Run\spoolsvr32\csmss.exe a smaž jej.

A na tom Jottu je furt plno, zatim diky

[mijaja]

Tak to udělej jednoduše. Otevři regedit, v něm zmáčkni CTRL+F a do okénka zkopíruj tento řádek:

Kód: Vybrat vše

csmss.exe

a dej hledat.
Jestli jsi to už projel tím removerem, tak už taky možná ten klíč neexistuje. Ale pro jistotu jej zkus najít.

Co z těch ostatních souborů - našel jsi něco? Máš v Možnostech složky nastaveno Zobrazování skrytých a systémových souborů? Na disku může být klidně jen jeden, nebo dva soubory. Nemusí tam být všechny.