Mohli byste mi to zkontrolovat?

[Asar]

Logfile of HijackThis v1.99.1
Scan saved at 11:10:41, on 29.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PowerS.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Media Key\MagicKey.exe
C:\Program Files\Media Key\OSD.EXE
C:\Program Files\Prolink\PlayTV\TVRMVCR.EXE
D:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
D:\Program Files\LeechGet 2005\LeechGet.exe
D:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.karneval.cz:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {B71B15CE-3093-459C-B764-AEB2486F2273} - (no file)
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LeechGet] "D:\Program Files\LeechGet 2005\LeechGet.exe" -intray
O4 - Global Startup: Media Key.lnk = C:\Program Files\Media Key\MagicKey.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV\TVRMVCR.EXE
O8 - Extra context menu item: Analyzovat LeechGetem - file://D:\Program Files\LeechGet 2005\\Parser.html
O8 - Extra context menu item: Download LeechGetem - file://D:\Program Files\LeechGet 2005\\AddUrl.html
O8 - Extra context menu item: Download s průvodcem LeechGetu - file://D:\Program Files\LeechGet 2005\\Wizard.html
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0059539328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1093892328
O16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} -
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

MWAV:
Sat Jul 29 11:15:13 2006 => Offending file found: C:\Documents and Settings\Administrator\Plocha\internet.lnk
Sat Jul 29 11:15:13 2006 => System found infected with ezula Spyware/Adware (internet.lnk)! Action taken: No Action Taken.

Sat Jul 29 11:15:21 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\MMJB.exe" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 11:15:21 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Oko.exe" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 11:15:21 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\RegCloneDVD2.exe" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 11:15:21 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup98" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 11:15:21 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\yourapp.Exe" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 11:19:42 2006 => ***** Scanning complete. *****

Sat Jul 29 11:19:42 2006 => Total Objects Scanned: 20978
Sat Jul 29 11:19:43 2006 => Total Critical Objects: 1
Sat Jul 29 11:19:43 2006 => Total Disinfected Objects: 0
Sat Jul 29 11:19:43 2006 => Total Objects Renamed: 0
Sat Jul 29 11:19:43 2006 => Total Deleted Objects: 0
Sat Jul 29 11:19:43 2006 => Total Errors: 8
Sat Jul 29 11:19:43 2006 => Time Elapsed: 00:05:52
Sat Jul 29 11:19:43 2006 => Virus Database Date: 7/29/2006
Sat Jul 29 11:19:43 2006 => Virus Database Count: 209807

Sat Jul 29 11:19:43 2006 => Scan Completed.

Prosím o rady, jak se zbavit té ezuly.
Dík

[Reklama]

[mijaja]

Zkontroluj na Jottiscanu soubory:

C:\Program Files\Media Key\MagicKey.exe
C:\Program Files\Media Key\OSD.EXE
C:\Program Files\Prolink\PlayTV\TVRMVCR.EXE
D:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\PowerS.exe

V HijackThisu fixni:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: (no name) - {B71B15CE-3093-459C-B764-AEB2486F2273} - (no file)
O16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} -



C:\Documents and Settings\Administrator\Plocha\internet.lnk - ikonku smaž!

Napiš, jak dopadly ty soubory na Jottiscanu. Podle toho bychom pokračovali. Ta ezula se ti hlásí v nějakém souboru? Protože Mwav hlásí jen jeden kritický objekt a to by měla být ta ikonka internetu. Nedělal jsi tyto skeny po projetí kompu antivirem? Potom je možné, že antivir odstranil tohoto šmejda nyní a on se po restartu opět vrátí z Obnovy systému. V tom případě bys musel Obnovu vypnout.

[Asar]

Internet.ink - smazána
HiJackThis - fixnuto

Jottiscan - u všech status OK, Found nothing

Ezulu mi nic nehlásilo, až MWAV.
Zkusim MWAV ještě jednou jestli ji to zase najde.
Díky moc

[Asar]

MWAV už Ezulu nehlásí.Ale stále ukazuje:
Sat Jul 29 12:38:01 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\MMJB.exe" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 12:38:02 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\RegCloneDVD2.exe" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 12:38:02 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup98" refers to invalid object "blank". Action Taken: No Action Taken.

Sat Jul 29 12:38:02 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\yourapp.Exe" refers to invalid object "blank". Action Taken: No Action Taken.

Je to v pořádku, nebo mam ty registry smazat?
Ale všiml jsem si ještě:
Sat Jul 29 12:37:16 2006 => ERROR!!! Invalid Entry system32\DRIVERS\AGRSM.sys in SYSTEM\CurrentControlSet\Services\AgereSoftModem...

Sat Jul 29 12:37:21 2006 => ERROR!!! Invalid Entry \??\D:\Program files\VirtualDub\dTVdrvNT.sys in SYSTEM\CurrentControlSet\Services\dTVdrvNT...

Sat Jul 29 12:37:23 2006 => ERROR!!! Invalid Entry \??\E:\INSTALL\GMSIPCI.SYS in SYSTEM\CurrentControlSet\Services\GMSIPCI...

Dík

[mijaja]

S těmahle chybama už nic nenaděláme. To jsou legální soubory woken, nebo aplikací vzájemným působením přepsané, nebo nějak modifikované. To už nejsou viry, ani jiní šmejdi. Tady bys musel reinstalovat systém a při instalaci některých dalších používaných programů ti stejně ty systémové opět přepíšou. Takže tohle bych už neřešil.