prosím o kontrolu (vyřešeno)

[falko]

už jsem ty potvory zlikvidoval.mwav ale hlasí pořád jeden spící,
Mon May 15 21:32:54 2006 => System found infected with cws.loadadv.400 Browser Hijacker ({5e2121ee-0300-11d4-8d3b-444553540000})! Action taken: No Action Taken.
Mon May 15 21:32:56 2006 => Offending Folder found: G:\WINDOWS\system32\1024
Mon May 15 21:32:56 2006 => Object "smitfraud Browser Hijacker" found in File System! Action Taken: No Action Taken.
který patří podle klíčů v registrech ovladačům grafiky.....mám ATI 9600pro od gigabytu a desku taky.V keriu jsem programu VGA utility manager zakázal komunikace s internetem a sítí.
Poprosil bych ještě jestli můžu o kontrolu logu z HijackThis jestli tam ještě není náhodou nějaka bestie.


Logfile of HijackThis v1.99.1
Scan saved at 18:06:27, on 16.5.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Ahead\InCD\InCDsrv.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
G:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\WINDOWS\System32\cisvc.exe
G:\WINDOWS\System32\CTsvcCDA.exe
G:\WINDOWS\System32\inetsrv\inetinfo.exe
G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
G:\WINDOWS\System32\tcpsvcs.exe
G:\WINDOWS\System32\snmp.exe
G:\WINDOWS\System32\MsPMSPSv.exe
G:\WINDOWS\System32\mqsvc.exe
G:\WINDOWS\System32\mqtgsvc.exe
G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
G:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
G:\Program Files\SWT2000\HCM.exe
G:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
G:\Program Files\ATI Technologies\ATI HydraVision\HydraMD.exe
G:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
G:\Program Files\Microsoft AntiSpyware\gcasServ.exe
G:\Program Files\Gigabyte\ET5\GUI.exe
G:\Program Files\D-Tools\daemon.exe
G:\WINDOWS\system32\CTHELPER.EXE
G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
G:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\iolo\System Mechanic 4\PopupStopper.exe
G:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\YzShadow\YzShadow.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
G:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
G:\Documents and Settings\falko\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9999
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [WinPatrol] G:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [VGAUtil] G:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [SDM4500P] G:\Program Files\SWT2000\HCM.exe
O4 - HKLM\..\Run: [mouseElf] G:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
O4 - HKLM\..\Run: [Jet Detection] "G:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [HydraVisionViewPort] G:\Program Files\ATI Technologies\ATI HydraVision\HydraMD.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] G:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [gcasServ] "G:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EasyTuneV] G:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "G:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [avast!] G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AudioHQU] G:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [ATIPTA] G:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "G:\Program Files\iolo\System Mechanic 4\PopupStopper.exe"
O4 - Startup: Stardock ObjectDock.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: UberIcon.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\YzShadow\YzShadow.exe
O4 - Startup: Y'z ToolBar.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: Hlavní panel ATI CATALYST.lnk = G:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://G:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://G:\Utility\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://G:\Utility\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://G:\Utility\Free Download Manager\dlall.htm
O8 - Extra context menu item: Stáhnout webovou stránku Free Download Managerem - file://G:\Utility\Free Download Manager\dlpage.htm
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Program Files\ICQLite\ICQLite.exe
O12 - Plugin for .spop: G:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - G:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - G:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - G:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - G:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe



Mockrát DĚKUJI!!!

[Reklama]

[mijaja]

Pro klid duše, zkontroluj na Jottiscanu tyhle soubory:

G:\Program Files\SWT2000\HCM.exe - to by mělo být od klávesnice?

Fixni tohle:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [Jet Detection] "G:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe - tohle nemusí jet na pozadí


Tuhle službu zastav ve Službách systému Windows - nejsou potřebné:

nabídka Start>>Spustit- do okénka napiš services.msc a zmáčkni Enter.

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - G:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - G:\Program Files\Ahead\InCD\InCDsrv.exe

označíš příslušný řádek a pravým myšítkem přepni na ručně nebo zakázáno.

Nejsou to šmejdi, ale jen kosmetické úpravy, takže je to v pohodě. Ten adresář G:\WINDOWS\system32\1024 můžeš celý smazat - patří šmejdům a nepatří do woken.

[falko]

HCM.exe patří klávesnici-SAMSUNG
Mnohokrát děkuji za rady a čas strávený aby jsi mi pomohl!Strašně si vážím lidí jako jsi TY!V dnešní době nikomu moc lidí neporadí ani nepomůže pokud s toho něco nemají.
Ještě jedna posledni otázka(doufám): Nevíš prosím tě jak nastavit kerio aby mi neblokovalo centrum.cz?Mám tam email. adresu a nemůžu číst maily :( Chce to odblokovat JavaScript.Když ho ale odblokuju tak to nejde pořád.
Nemáš s tím skušenost?Děkuji

[mijaja]

No jsem rád, že ti to jede. U toho Keria - dej záložku WWW > potom Výjimky a vlož tam tu adresu a dej povolit.



Já jsem tak musel povolit Tipcars kvůli ActiveX a funguje to. Tak to takhle zkus. No a dej sem nový log, jestli je to už v pořádku.

[falko]

Díky,vyskouším.

tady je ten log.......dřív jsem nemohl.....byl jsem fuč

Logfile of HijackThis v1.99.1
Scan saved at 20:59:40, on 17.5.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
G:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\WINDOWS\System32\cisvc.exe
G:\WINDOWS\System32\CTsvcCDA.exe
G:\WINDOWS\System32\inetsrv\inetinfo.exe
G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
G:\WINDOWS\System32\tcpsvcs.exe
G:\WINDOWS\System32\snmp.exe
G:\WINDOWS\System32\MsPMSPSv.exe
G:\WINDOWS\System32\mqsvc.exe
G:\WINDOWS\System32\mqtgsvc.exe
G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
G:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
G:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
G:\Program Files\SWT2000\HCM.exe
G:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
G:\Program Files\ATI Technologies\ATI HydraVision\HydraMD.exe
G:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
G:\Program Files\Microsoft AntiSpyware\gcasServ.exe
G:\Program Files\Gigabyte\ET5\GUI.exe
G:\Program Files\D-Tools\daemon.exe
G:\WINDOWS\system32\CTHELPER.EXE
G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
G:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
G:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\iolo\System Mechanic 4\PopupStopper.exe
G:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\YzShadow\YzShadow.exe
G:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
G:\Program Files\Skype\Phone\Skype.exe
G:\Program Files\mozilla.org\Mozilla\mozilla.exe
G:\WINDOWS\system32\cidaemon.exe
G:\WINDOWS\system32\cidaemon.exe
G:\Documents and Settings\falko\Plocha\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9999
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [WinPatrol] G:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [VGAUtil] G:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [SDM4500P] G:\Program Files\SWT2000\HCM.exe
O4 - HKLM\..\Run: [mouseElf] G:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
O4 - HKLM\..\Run: [HydraVisionViewPort] G:\Program Files\ATI Technologies\ATI HydraVision\HydraMD.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] G:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [gcasServ] "G:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EasyTuneV] G:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "G:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [avast!] G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AudioHQU] G:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [ATIPTA] G:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "G:\Program Files\iolo\System Mechanic 4\PopupStopper.exe"
O4 - Startup: Stardock ObjectDock.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: UberIcon.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\YzShadow\YzShadow.exe
O4 - Startup: Y'z ToolBar.lnk = G:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: Hlavní panel ATI CATALYST.lnk = G:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://G:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://G:\Utility\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://G:\Utility\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://G:\Utility\Free Download Manager\dlall.htm
O8 - Extra context menu item: Stáhnout webovou stránku Free Download Managerem - file://G:\Utility\Free Download Manager\dlpage.htm
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Program Files\ICQLite\ICQLite.exe
O12 - Plugin for .spop: G:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - G:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - G:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - G:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - G:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - G:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

[mijaja]

Takže jo, je to v pohodě. Komp je v pořádku. Jen bych se zeptal, ty soubory od Visty jsou docela početné - nezpomalují ti komp?

[falko]

Ani moc ne.....sice klasické okna sou o malinko rychlejší,ale prostředí visty se mi líbí víc a nějaké to desetinkové spomalení akceptuju.Při hrách atd....to nic nedělá.....(aspoň doufám :) )

[mijaja]

Takže tohle uzavřeme.

[falko]

OK.....a ještě jednou Díky!!!