Prosím o kontrolu logu

[Major.]

Po zavirování PC a přeinstalaci systemu prosím o kontrolu logu mám conducent flexpak

Logfile of HijackThis v1.99.1
Scan saved at 6:32:44, on 13.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\xp\LOCALS~1\Temp\mexe.com
C:\DOCUME~1\xp\LOCALS~1\Temp\kavss.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\totalcmd\TOTALCMD.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\ad-aware.exe" +c
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A1B0049-7BDA-475E-99A1-68C02ECBDB69}: NameServer = 172.16.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3A1B0049-7BDA-475E-99A1-68C02ECBDB69}: NameServer = 172.16.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3A1B0049-7BDA-475E-99A1-68C02ECBDB69}: NameServer = 172.16.0.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)


Thu Nov 09 17:38:33 2006 => ***** Scanning Registry and File system for Adware/Spyware *****
Thu Nov 09 17:38:33 2006 => Loading Spyware Signatures from new External Database (Size: 176740).
Thu Nov 09 17:38:38 2006 => Indexed Spyware Databases Successfully Created...

Thu Nov 09 17:38:44 2006 => Offending file found: C:\WINDOWS\gpinstall.exe
Thu Nov 09 17:38:44 2006 => System found infected with conducent flexpak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken.

Thu Nov 09 17:38:52 2006 => Checking CLSID Reference Entries...
Thu Nov 09 17:38:55 2006 => Checking Module Usage Entries...
Thu Nov 09 17:38:55 2006 => Checking User Trusted External App Entries...
Thu Nov 09 17:38:55 2006 => Checking Shared DLL Entries...
Thu Nov 09 17:38:56 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\MSXML3A.DLL". Action Taken: No Action Taken.

Thu Nov 09 17:38:56 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\AdobePDF.dll". Action Taken: No Action Taken.

Thu Nov 09 17:38:56 2006 => Checking Installer Entries...
Thu Nov 09 17:38:56 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Programz\Serials 2005\". Action Taken: No Action Taken.

Thu Nov 09 17:38:56 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "D:\Programz\". Action Taken: No Action Taken.

Thu Nov 09 17:38:56 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\WINDOWS\Installer\{AC76BA86-1033-1029-8796-100000000002}\". Action Taken: No Action Taken.

Thu Nov 09 17:38:56 2006 => Checking Shared Tools Entries...
Thu Nov 09 17:38:56 2006 => Checking File Extension Entries...
Thu Nov 09 17:38:56 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".%16%D5GQ%F7i%D7%06%94%BC9%0F%D4%CF%3D%C1%0AN%D5%24f%D4%F04%C1%DD%F0%1AI%E8tb%E9p%06G%A6%9D%BDH%3A%FA%DAI%1D%3F%0E%F0%ED%F9%C3%1BK%DD%DC%FE%1A%E8%9F%A4%0B%E0%DC%1D%8Fp%96%96O%0016%D6%CDI". Action Taken: No Action Taken.

Thu Nov 09 17:38:56 2006 => Checking Application Cache Entries...
Thu Nov 09 17:38:56 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Mozilla Firefox (1.5.0.7)". Action Taken: No Action Taken.
Mon Nov 13 06:03:21 2006 => Total Objects Scanned: 60440
Mon Nov 13 06:03:22 2006 => Total Critical Objects: 1
Mon Nov 13 06:03:23 2006 => Total Disinfected Objects: 0
Mon Nov 13 06:03:24 2006 => Total Objects Renamed: 0
Mon Nov 13 06:03:25 2006 => Total Deleted Objects: 0
Mon Nov 13 06:03:26 2006 => Total Errors: 64
Mon Nov 13 06:03:27 2006 => Time Elapsed: 06:43:32

[Reklama]

[fredik]

Máš tam jen pár zbytečností:
Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

po zaškrtnutí klikni na FixChecked

Najdi na disku a vymaž soubor označený červeně:
C:\WINDOWS\gpinstall.exe

Chybí ti tam Firewall! ten bych si doinstaloval.

Můžeš si pročistit Pc programem Ccleaner (Čistič, Problémy), návod máš tady:

[Major.]

Než jste mi odpověděl, tak se mi objevila hláška na černé obrazovce systém je poškozen, a tak přišlo to co muselo reinstalace WXP.
Teď to běží OK. Za pomoc děkuji

[Major.]

prosím o konrolu, po reinstalaci wxp SP2, používám avast 4 profesional s rezidentním štítem vše 8 součásti zapnuto, windows firewal, spybot Serch-destroy, adawra profesional s ad-watchem, znovu se objevil conducent flexpak, browser Firefox 2.0
Je to čerstva instalace proto je tam i messenger atd. ty odstraním potom,
jedná se mi o jak ho tam toho parchanta natáhnu


Logfile of HijackThis v1.99.1
Scan saved at 7:00:38, on 14.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programy\Spyware Doctor\swdoctor.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Programy\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\DOCUME~1\mlr\LOCALS~1\Temp\mexe.com
C:\DOCUME~1\mlr\LOCALS~1\Temp\kavss.exe
C:\totalcmd\TOTALCMD.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.volny.cz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.pctools.com/en/spyware-doctor/upgrade/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\Programy\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\Programy\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" +c
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Programy\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Programy\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\Programy\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E2B9398-04A3-4A85-8D10-8AF4E1EE12D0}: NameServer = 172.16.0.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Programy\Spyware Doctor\sdhelp.exe


Vysledek mwav :

Object "conducent flexpak Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\MSXML3A.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: No Action Taken.

[fredik]

Jak přesně se ti tam dostal to ti nepovím, ale je možné že se tam dostane s instalací nějakého programu.
Mělo by se jednat pravděpodobně o tento soubor: C:\WINDOWS\gpinstall.exe ale radši se podívej do logu Mwav co by to přesně mělo být.

Jestli používáš u Spyware Doctora jeho rezidentní štít, tak vypni u Ad-aware jeho rezidentní štít (Ad-Watch.exe)

Bylo by lepší místo windows firewall si nainstalovat jiný, protože ten není dostačující. Doporučil bych ti Kerio, je v češtině víc k němu najdeš zde.

V HJT můžeš fixnout zbytečnosti:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

[mijaja]

Našel jsem o tom šmejdíkovi (je to až 2 - 3 liga) toliko dvě trochu podrobnější stránky, co se týká výrobce, nebo výskytu - vypadá to, že se veze s těmi volně stažitelnými hříčkami na netu, nebo i CD. Ale možná jsem si to i ne zrovna nejlépe přeložil.....

[Major.]

Smazáno na disku a v registru :
Tue Nov 14 06:57:24 2006 => Offending file found: C:\WINDOWS\gpinstall.exe
Tue Nov 14 06:57:24 2006 => System found infected with conducent flexpak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken.
Tue Nov 14 06:57:31 2006 => Entry
"HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\MSXML3A.DLL". Action Taken: No Action Taken.
Tue Nov 14 06:57:32 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: No Action Taken.

FIX HJT: dle návodu
MWAV:
Tue Nov 14 18:30:49 2006 => **********************************************************
Tue Nov 14 18:30:50 2006 => MicroWorld Anti Virus & Spyware Toolkit Utility.
Tue Nov 14 18:30:50 2006 => Copyright © 2003-2006, MicroWorld Technologies Inc.
Tue Nov 14 18:30:50 2006 => **********************************************************
Tue Nov 14 18:30:50 2006 => Source: C:\mwav.exe
Tue Nov 14 18:30:50 2006 => Version 8.6.2 (C:\DOCUME~1\mlr\LOCALS~1\Temp\mexe.com)
Tue Nov 14 18:30:50 2006 => Log File: C:\DOCUME~1\mlr\LOCALS~1\Temp\MWAV.LOG
Tue Nov 14 18:30:50 2006 => Last Scan Date and Time: 14.11.2006 18:28:13
Tue Nov 14 18:30:50 2006 => MWAV Registered: FALSE.
Tue Nov 14 18:30:50 2006 => User Account: mlr
Tue Nov 14 18:30:50 2006 => OS Type: Windows Workstation
Tue Nov 14 18:30:50 2006 => OS: Windows XP
Tue Nov 14 18:30:50 2006 => Ver: Service Pack 2 (Build 2600)
Tue Nov 14 18:30:50 2006 => Windows Root Folder: C:\WINDOWS
Tue Nov 14 18:30:50 2006 => Windows Sys32 Folder: C:\WINDOWS\system32
Tue Nov 14 18:30:50 2006 => Local Fixed Drives: c:\,d:\
Tue Nov 14 18:30:50 2006 => MWAV Mode: Only Scan files.
Tue Nov 14 18:30:56 2006 => Downloading AntiVirus and Anti-Spyware Databases...
Tue Nov 14 18:30:58 2006 => Nothing new to download. Updates are latest.

Tue Nov 14 18:31:00 2006 => Options Selected by User:
Tue Nov 14 18:31:00 2006 => Memory Check: Enabled
Tue Nov 14 18:31:00 2006 => Registry Check: Enabled
Tue Nov 14 18:31:00 2006 => StartUp Folder Check: Enabled
Tue Nov 14 18:31:00 2006 => System Folder Check: Enabled
Tue Nov 14 18:31:00 2006 => System Area Check: Disabled
Tue Nov 14 18:31:00 2006 => Services Check: Enabled
Tue Nov 14 18:31:00 2006 => Drive Check: Disabled
Tue Nov 14 18:31:00 2006 => All Drive Check :Enabled
Tue Nov 14 18:31:00 2006 => Folder Check: Disabled

Tue Nov 14 18:31:32 2006 => ***** Scanning Registry and File system for Adware/Spyware *****
Tue Nov 14 18:31:33 2006 => Loading Spyware Signatures from new External Database (Size: 178015).
Tue Nov 14 18:31:33 2006 => Indexed Spyware Databases Successfully Created...

Tue Nov 14 18:31:40 2006 => Checking CLSID Reference Entries...
Tue Nov 14 18:31:45 2006 => Checking Module Usage Entries...
Tue Nov 14 18:31:45 2006 => Checking User Trusted External App Entries...
Tue Nov 14 18:31:45 2006 => Checking Shared DLL Entries...
Tue Nov 14 18:31:45 2006 => Checking Installer Entries...
Tue Nov 14 18:31:45 2006 => Checking Shared Tools Entries...
Tue Nov 14 18:31:45 2006 => Checking File Extension Entries...
Tue Nov 14 18:31:45 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".". Action Taken: No Action Taken.
Tue Nov 14 23:53:47 2006 => ***** Checking for specific ITW Viruses *****
Tue Nov 14 23:53:48 2006 => Checking for Welchia Virus...
Tue Nov 14 23:53:48 2006 => Checking for LovGate Virus...
Tue Nov 14 23:53:49 2006 => Checking for CodeRed Virus...
Tue Nov 14 23:53:49 2006 => Checking for OpaServ Virus...
Tue Nov 14 23:53:50 2006 => Checking for Sobig.e Virus...
Tue Nov 14 23:53:50 2006 => Checking for Winupie Virus...
Tue Nov 14 23:53:51 2006 => Checking for Swen Virus...
Tue Nov 14 23:53:51 2006 => Checking for JS.Fortnight Virus...
Tue Nov 14 23:53:52 2006 => Checking for Novarg Virus...
Tue Nov 14 23:53:52 2006 => Checking for Pagabot Virus...
Tue Nov 14 23:53:53 2006 => Checking for Parite.b Virus...
Tue Nov 14 23:53:53 2006 => Checking for Parite.a Virus...
Tue Nov 14 23:53:58 2006 => Checking for Adware.SeekSeek Virus...

Tue Nov 14 23:54:00 2006 => ***** Scanning complete. *****

Tue Nov 14 23:54:01 2006 => Total Objects Scanned: 59652
Tue Nov 14 23:54:01 2006 => Total Critical Objects: 0
Tue Nov 14 23:54:02 2006 => Total Disinfected Objects: 0
Tue Nov 14 23:54:02 2006 => Total Objects Renamed: 0
Tue Nov 14 23:54:03 2006 => Total Deleted Objects: 0
Tue Nov 14 23:54:04 2006 => Total Errors: 44
Tue Nov 14 23:54:04 2006 => Time Elapsed: 04:54:50
Tue Nov 14 23:54:05 2006 => Virus Database Date: 11/14/2006
Tue Nov 14 23:54:05 2006 => Virus Database Count: 241446

Tue Nov 14 23:54:06 2006 => Scan Completed.

Logfile of HijackThis v1.99.1
Scan saved at 0:13:28, on 15.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programy\Spyware Doctor\swdoctor.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\Programy\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\totalcmd\TOTALCMD.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.volny.cz
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.pctools.com/en/spyware-doctor/upgrade/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\Programy\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\Programy\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" +c
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Programy\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\Programy\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E2B9398-04A3-4A85-8D10-8AF4E1EE12D0}: NameServer = 172.16.0.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Programy\Spyware Doctor\sdhelp.exe


Nevím co si mám o tomto myslet:

Tue Nov 14 18:31:45 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".". Action Taken: No Action Taken.

Můžu fixnout HJT
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
odejde odinstalací po odinstalaci messengeru:
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

Co může znamenat položky 023 když vlastním licenci Avast 4 Profesionál a mám zapnutý rezidentní štít - tomu nerozumím
Co asi může vytěžovat CPU Nečinné procesy systému na 94%
Jak upravím těch 44 Total erroru

[mijaja]

To file missing neznamená, že ten soubor chybí, ale že ta služba je momentálně neaktivní - to máš služby na kontrolu mailů, na kontrolu stahovaných souborů z webu, popřípadě ony hlášky, kdy se ti na webové stránce objeví nějaký šmejd a Avast tě varuje. V ten moment se tyhle služby aktivují a chrání tě. Takže s položkami O23 si starosti nedělej.

To, co chceš fixnout, klidně můžeš. Ale jdeš na net a nemáš firewall!!

[mikel]

Co asi může vytěžovat CPU Nečinné procesy systému na 94%

To je jen špatná formulace ve Správci úloh. Neznamená to, že něco vytěžuje procesor na 94%, ale že procesor je vytížen na 6% a 94% kapacity je volné pro další procesy.

Jak upravím těch 44 Total erroru

Použij CCleaner, který umí čistit i registry od chyb.