Prosím o kontrolu(Vyřešeno)

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: memphisto, Mods_senior, Security team

danmaz
nováček
Příspěvky: 14
Registrován: červenec 06
Pohlaví: Nespecifikováno

Prosím o kontrolu(Vyřešeno)

Příspěvekod danmaz » 26 črc 2006 14:41

Logfile of HijackThis v1.99.1
Scan saved at 14:37:04, on 26.7.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\firebird\bin\ibguard.exe
C:\windows\Explorer.EXE
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\System32\oodag.exe
C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\windows\System32\svchost.exe
C:\Program Files\firebird\bin\ibserver.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\windows\SOUNDMAN.EXE
C:\windows\System32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Domovská stránka\config.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\windows\System32\RUNDLL32.EXE
C:\windows\System32\ctfmon.exe
C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
F:\wall\hotkeyp.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\windows\System32\wuauclt.exe
C:\Program Files\GTRAN\GTDialer X\GTdialer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Vlastník\Plocha\HiJack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\PCTRANSLATOR\WEBIE.DLL
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PCTRANSLATOR\WEBIE.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [domovská stránka] C:\Program Files\Domovská stránka\config.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ShutDown] C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe /Startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\System32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [config.exe] C:\Program Files\Domovská stránka\config.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [HotkeyP] F:\wall\hotkeyp.exe 0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Expekt.com Poker - {3852AC86-965F-4abe-A75F-3DCB7E81A4B2} - C:\Program Files\expektMPP\MPPoker.exe
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PCTRANSLATOR\WEBIE.DLL
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet7_22.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} - http://advnt01.com/dialer/ce_ver32b.CAB
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97B27F1E-EF66-4010-9FB5-360232BE4784}: NameServer = 160.218.10.200 160.218.43.200
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - FirebirdSQL Project - C:\Program Files\firebird\bin\ibserver.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\windows\System32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SDEService - Unknown owner - C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)
Naposledy upravil(a) danmaz dne 01 srp 2006 11:41, celkem upraveno 1 x.

Reklama
Uživatelský avatar
mijaja
Tvůrce článků
Level 6.5
Level 6.5
Příspěvky: 4136
Registrován: září 05
Bydliště: Zlín
Pohlaví: Muž

Příspěvekod mijaja » 26 črc 2006 20:34

V první řadě si nainstaluj SP2 a nějaký firewall - odkazy mám v linku Důležíté..... v podpisu

Potom u jednoho antiviru zastav rezidentní štít - nejlépe u AVG.

Stáhni si LSPFix a spusť jej. V okně zatrhni čtvereček u volby I know what i'm doing a zaktivují se ti šipečky mezi okny. Potom dole v levém okně označ (zamodři ) to, co bude mít název newdotnet7 (a podobné) a šipkama >> jej přesuň do pravého okna. Až to budeš mít, klikni dole na tlačítko Finish. Ale pozor nesmíš přesunout nic jiného, protože by sis mohl zlikvidovat internet.

Zkontroluj na Jottiscanu:

C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe
C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe
F:\wall\hotkeyp.exe

Zastav v Taskmanageru procesy:

C:\Program Files\Domovská stránka\config.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

V Hijackthisu fixni:

O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)
O4 - HKLM\..\Run: [domovská stránka] C:\Program Files\Domovská stránka\config.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ShutDown] C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe /Startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\System32\NeroCheck.exe
O4 - HKLM\..\Run: [config.exe] C:\Program Files\Domovská stránka\config.exe
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} - http://advnt01.com/dialer/ce_ver32b.CAB
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

po zaškrtnutí klikni na FixChecked


Tuhle službu zastav ve Službách systému Windows:

nabídka Start>>Spustit- do okénka napiš services.msc a zmáčkni Enter.

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

označíš příslušný řádek a pravým myšítkem přepni na Vlastnosti a v roletce Typ spouštění dej nejdříve ručně a potom zakázáno.

danmaz
nováček
Příspěvky: 14
Registrován: červenec 06
Pohlaví: Nespecifikováno

Příspěvekod danmaz » 27 črc 2006 19:29

Štít zastaven.
Výsledky Jottiscanu:

SDEServ.exe
Last file scanned at least one scanner reported something
about: MobilaWebCam_Loader_Fixed_By_Mahdi1944.rar, detected by:

AntiVir X
ArcaVir X
Avast Win32:Patcher
AVG Antivirus X
BitDefender MemScan:VirTool.Patcher.B
ClamAV X
Dr.Web Tool.ProcPatch
F-Prot Antivirus X
Fortinet X
Kaspersky Anti-Virus VirTool.Win32.Patcher.a
NOD32 Win32/HackTool.Patcher.B
Norman Virus Control X
UNA X
VirusBuster X
VBA32 X

ShutDown.exe
Kaspersky Anti-Virus not-a-virus:Monitor.Win32.Perflogger.163


Hotkeyp.exe
Scanner Malware name
AntiVir Exploit/HTML.BM.A exploit
ArcaVir Trojan.Exploit.Realpoc.10.E
Avast X
AVG Antivirus X
BitDefender Exploit.HTML.Downloader.BM.C
ClamAV X
Dr.Web Trojan.DownLoader.6164
F-Prot Antivirus X
Fortinet W32/RealPoc_10.E!exploit
Kaspersky Anti-Virus Exploit.Win32.RealPoc.10.e
NOD32 X
Norman Virus Control X
UNA X
VirusBuster X
VBA32 X

V task manageru jsem ty procesy neobjevil.Fixnul jsem.Službu jsem taky zakázal.Člověk který mi tenhle počítač stavěl mi řekl,že nemám instalovat firewall,že radši vždycky přijede a přeinstaluje wokna,tak nevím. :? Ale řeknu mu o ten SP2,ty určitě zvládne :wink:
Ještě nový HiJack log

Logfile of HijackThis v1.99.1
Scan saved at 19:24:10, on 27.7.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\firebird\bin\ibguard.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\windows\Explorer.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\System32\oodag.exe
C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\windows\System32\svchost.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\firebird\bin\ibserver.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\windows\System32\RUNDLL32.EXE
C:\windows\System32\ctfmon.exe
C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
F:\wall\hotkeyp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\windows\System32\wuauclt.exe
C:\Program Files\GTRAN\GTDialer X\GTdialer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PowerArchiver\POWERARC.EXE
C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\_PA431\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\PCTRANSLATOR\WEBIE.DLL
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PCTRANSLATOR\WEBIE.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ShutDown] C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe /Startup
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [HotkeyP] F:\wall\hotkeyp.exe 0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Expekt.com Poker - {3852AC86-965F-4abe-A75F-3DCB7E81A4B2} - C:\Program Files\expektMPP\MPPoker.exe
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PCTRANSLATOR\WEBIE.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97B27F1E-EF66-4010-9FB5-360232BE4784}: NameServer = 160.218.10.200 160.218.43.200
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - FirebirdSQL Project - C:\Program Files\firebird\bin\ibserver.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\windows\System32\oodag.exe
O23 - Service: SDEService - Unknown owner - C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

Zatím díky za pomoc.

Uživatelský avatar
mijaja
Tvůrce článků
Level 6.5
Level 6.5
Příspěvky: 4136
Registrován: září 05
Bydliště: Zlín
Pohlaví: Muž

Příspěvekod mijaja » 28 črc 2006 06:40

Vypni obnovu systému a nastartuj do nouzáku. Potom bys měl nejdříve odinstalovat celou složku Zyl Softu

Pokud nenajdeš tyto procesy v Taskmanageru a přitom HJT je ukazuje v běžících procesech, tak si otevři taskmanager Hijackthisu (přečti si návod v mém podpisu) a zastav je tam:
C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe
C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe
F:\wall\hotkeyp.exe

Možná tam už taky nebudou po odinstalaci Zyl Softu.

V HJT fixni:

F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [ShutDown] C:\Program Files\Zyl Soft\Shut Down Expert\ShutDown.exe /Startup
O4 - HKCU\..\Run: [HotkeyP] F:\wall\hotkeyp.exe 0
O9 - Extra button: Expekt.com Poker - {3852AC86-965F-4abe-A75F-3DCB7E81A4B2} - C:\Program Files\expektMPP\MPPoker.exe - tohle bys mohl nejdříve zkontrolovat na Jotti - jestli je nezávadný, nech si ho. Jestli je v něm šmejd - fix a pryč.

Tuhle službu zastav
O23 - Service: SDEService - Unknown owner - C:\Program Files\Zyl Soft\Shut Down Expert\SDEServ.exe

Všechno červené potom vymaž, vyčisti komp CCleanerem (návod a link v podpisu) a restartuj do normálu a dej nový log. Zároveň bys mohl udělat log z MWAVu - návod a link opšt v podpisu.

danmaz
nováček
Příspěvky: 14
Registrován: červenec 06
Pohlaví: Nespecifikováno

Příspěvekod danmaz » 28 črc 2006 16:31

HiJackThis log


Logfile of HijackThis v1.99.1
Scan saved at 16:27:23, on 28.7.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\firebird\bin\ibguard.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\windows\Explorer.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\System32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\windows\System32\svchost.exe
C:\Program Files\firebird\bin\ibserver.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\windows\SOUNDMAN.EXE
C:\windows\System32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\windows\System32\RUNDLL32.EXE
C:\windows\System32\ctfmon.exe
C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
C:\Program Files\Messenger\msmsgs.exe
C:\windows\System32\wuauclt.exe
C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\mexe.com
C:\DOCUME~1\VLASTN~1\LOCALS~1\Temp\kavss.exe
C:\Program Files\GTRAN\GTDialer X\GTdialer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\NOTEPAD.EXE
C:\Documents and Settings\Vlastník\Plocha\Čištění\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\PCTRANSLATOR\WEBIE.DLL
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\PCTRANSLATOR\WEBIE.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Clock Tray Skins\ClockTraySkins.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PCTRANSLATOR\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\PCTRANSLATOR\WEBIE.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97B27F1E-EF66-4010-9FB5-360232BE4784}: NameServer = 160.218.10.200 160.218.43.200
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - FirebirdSQL Project - C:\Program Files\firebird\bin\ibserver.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\windows\System32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

MWAV log


Fri Jul 28 14:34:32 2006 => Offending file found: C:\Documents and Settings\All Users\Nabídka Start\programy\norton utilities\norton disk doctor.lnk
Fri Jul 28 14:34:32 2006 => System found infected with powerreg scheduler Spyware/Adware (norton disk doctor.lnk)!

Fri Jul 28 14:34:31 2006 => Offending file found: C:\Documents and Settings\All Users\Nabídka Start\Programy\norton utilities\norton disk doctor.lnk
Fri Jul 28 14:34:31 2006 => System found infected with powerreg scheduler Spyware/Adware (norton disk doctor.lnk)! Action taken: No Action Taken.

Fri Jul 28 14:34:22 2006 => Offending Folder found: C:\Documents and Settings\Vlastník\Data aplikací\microgaming
Fri Jul 28 14:34:22 2006 => Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.

Fri Jul 28 14:34:23 2006 => Offending file found: C:\Documents and Settings\Vlastník\Plocha\csm2002fe\install.dat
Fri Jul 28 14:34:23 2006 => System found infected with zlob Trojan-Downloader (install.dat)! Action taken: No Action Taken.

Fri Jul 28 14:34:18 2006 => Offending Folder found: C:\Program Files\vvsn
Fri Jul 28 14:34:18 2006 => Object "whenu.weathercast Spyware/Adware" found in File System! Action Taken: No Action Taken.

Fri Jul 28 14:34:17 2006 => Offending file found: C:\windows\System32\objsafe.tlb
Fri Jul 28 14:34:17 2006 => System found infected with roings Spyware/Adware (objsafe.tlb)! Action taken: No Action Taken.

Fri Jul 28 14:34:17 2006 => Offending Folder found: C:\windows\isrvs
Fri Jul 28 14:34:17 2006 => Object "desktop search Spyware/Adware" found in File System! Action Taken: No Action Taken.


Fri Jul 28 14:34:16 2006 => Offending file found: C:\windows\gpinstall.exe
Fri Jul 28 14:34:17 2006 => System found infected with conducent flexpak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken.

Fri Jul 28 14:34:16 2006 => Offending file found: C:\windows\delprot.ini
Fri Jul 28 14:34:16 2006 => System found infected with desktop search Spyware/Adware (delprot.ini)! Action taken: No Action Taken.

Fri Jul 28 14:34:15 2006 => System found infected with coolwebsearch Spyware/Adware ({0e1230f8-ea50-42a9-983c-d22abc2eed3b})! Action taken: No Action Taken.

Fri Jul 28 14:41:13 2006 => ***** Scanning complete. *****

Fri Jul 28 14:41:13 2006 => Total Objects Scanned: 26351
Fri Jul 28 14:41:13 2006 => Total Critical Objects: 10
Fri Jul 28 14:41:13 2006 => Total Disinfected Objects: 0
Fri Jul 28 14:41:14 2006 => Total Objects Renamed: 0
Fri Jul 28 14:41:14 2006 => Total Deleted Objects: 0
Fri Jul 28 14:41:14 2006 => Total Errors: 11
Fri Jul 28 14:41:14 2006 => Time Elapsed: 01:37:39
Fri Jul 28 14:41:14 2006 => Virus Database Date: 7/28/2006
Fri Jul 28 14:41:14 2006 => Virus Database Count: 210495

Fri Jul 28 14:41:14 2006 => Scan Completed.

Uživatelský avatar
mijaja
Tvůrce článků
Level 6.5
Level 6.5
Příspěvky: 4136
Registrován: září 05
Bydliště: Zlín
Pohlaví: Muž

Příspěvekod mijaja » 28 črc 2006 17:20

Takže podle HijackThisu už není nic aktivního. A podle mwavu ještě najdi zlikviduj tyto soubory:

C:\Documents and Settings\All Users\Nabídka Start\programy\norton utilities\norton disk doctor.lnk
C:\Documents and Settings\Vlastník\Data aplikací\microgaming
C:\Documents and Settings\Vlastník\Plocha\csm2002fe\install.dat
C:\Program Files\vvsn
C:\windows\System32\objsafe.tlb
C:\windows\isrvs
C:\windows\gpinstall.exe
C:\windows\delprot.ini

Těm souborům microgaming, vvsn a isrvs chybí přípony. Nebo je tam v logu Mwavu neměly?

Pak tam máš nějaký pozůstatek CoolWebSearchu - Na to si stáhni z mého linku Důležité..... CWShredder a projdi s ním komp. Potom ještě jednou CCleanerem a proces očisty by měl být hotov.

No a už ti zbývá jen nainstalovat firewall a SP2


Člověk který mi tenhle počítač stavěl mi řekl,že nemám instalovat firewall,že radši vždycky přijede a přeinstaluje wokna,tak nevím.


Zrovna takové jednání bych čekal od člověka, který se ti chce dostat do kompu, kdykoliv si vzpomene. Jestli mu věříš, je to tvoje věc.

Uživatelský avatar
El Diablo
Moderátor
Elite Level 11.5
Elite Level 11.5
Příspěvky: 14099
Registrován: červen 06
Bydliště: In Hell
Pohlaví: Muž

Příspěvekod El Diablo » 28 črc 2006 18:12

Nebo, pokud si to nechá zaplatit = trvalý zdroj příjmů.... :lol:
RTFM!!! UBCD - Ultimate Boot CD Zkusili jste to vypnout a zapnout? Aneb z PIO do DMA a zpět... :) * Jak provést Clear CMOS
Kdo se moc ptá, málo googlí. Doporučený freeware

i5 3570K, ASRock Z77 Extreme, 16GB Corsair, 120GB SSD Kingston +2TB Samsung, Gigabyte Radeon HD7870, Sharkoon ReX8VE, XL-747H

danmaz
nováček
Příspěvky: 14
Registrován: červenec 06
Pohlaví: Nespecifikováno

Příspěvekod danmaz » 28 črc 2006 22:03

K počítači se dostanu až v neděli,tak potom to projedu a kouknu na ty přípony,jinak díky za rady,poslechnu a nainstaluju firewall.Zatím všem mockrát děkuju.

danmaz
nováček
Příspěvky: 14
Registrován: červenec 06
Pohlaví: Nespecifikováno

Příspěvekod danmaz » 01 srp 2006 11:34

Soubory zlikvidovány,ty soubory bez přípon byly složky,tak jsem je smazal,Coolwebsearch to nenašlo a nainstaloval jsem Kerio.

Díky Všem za pomoc.


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: CommonCrawl [Bot] a 4 hosti