PC-HELP.CZ

pls o kontrolu logu, je to segry notebook, je to buchta a pořád leze kam nemá, takže jí pořád padá spojení (jak přes Wifi, tak přes kabel...)

Logfile of HijackThis v1.99.1
Scan saved at 13:48:57, on 22.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
c:\Hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7B7A2B86-D581-4AF7-A35C-BB0DBCBEA7E6}: NameServer = 10.60.1.1,10.100.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7CEEFE7-8549-498F-88E8-7FEDC91DB2C7}: NameServer = 10.60.1.1,10.100.0.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

V tomhle žádnou hrůzu nevidím. Udělej raději log z MWAVu.

Wed Nov 22 17:06:03 2006 => Offending Folder found: C:\Documents and Settings\All Users\Data aplikací\cyberlink\powerdvd\ipower\images\hd
Wed Nov 22 17:06:03 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.

Wed Nov 22 17:08:23 2006 => Scanning File C:\DOCUME~1\HP\LOCALS~1\Temp\Spyware.sdb

Wed Nov 22 17:06:04 2006 => Offending file found: C:\Documents and Settings\All Users\Nabídka Start\programy\programy\daemon tools\uninstall.lnk
Wed Nov 22 17:06:04 2006 => System found infected with trust cleaner Trojan (uninstall.lnk)! Action taken: No Action Taken.

Wed Nov 22 17:06:03 2006 => Offending file found: C:\Documents and Settings\HP\Nabídka Start\Programy\programy\nimo codec pack\uninstall.lnk
Wed Nov 22 17:06:03 2006 => System found infected with trust cleaner Trojan (uninstall.lnk)! Action taken: No Action Taken.

Wed Nov 22 17:05:56 2006 => System found infected with emedia codec Browser Hijacker ({6bf52a52-394a-11d3-b153-00c04f79faa6})! Action taken: No Action Taken.
Wed Nov 22 17:05:57 2006 => System found infected with emedia codec Browser Hijacker ({6bf52a52-394a-11d3-b153-00c04f79faa6})! Action taken: No Action Taken.


Wed Nov 22 17:08:29 2006 => ***** Scanning complete. *****

Wed Nov 22 17:08:29 2006 => Total Objects Scanned: 29407
Wed Nov 22 17:08:29 2006 => Total Critical Objects: 7
Wed Nov 22 17:08:29 2006 => Total Disinfected Objects: 0
Wed Nov 22 17:08:29 2006 => Total Objects Renamed: 0
Wed Nov 22 17:08:29 2006 => Total Deleted Objects: 0
Wed Nov 22 17:08:29 2006 => Total Errors: 6
Wed Nov 22 17:08:29 2006 => Time Elapsed: 00:06:00
Wed Nov 22 17:08:29 2006 => Virus Database Date: 11/22/2006
Wed Nov 22 17:08:29 2006 => Virus Database Count: 243842

Wed Nov 22 17:08:29 2006 => Scan Completed.

nesedí sice total critical objects a toho co jsem našel v logu,ale snad to pomůže....

RičPič

Možná je to právě ten co chybí, ale uvidíme. Takže cesty tam jsou:

C:\Documents and Settings\All Users\Data aplikací\cyberlink\powerdvd\ipower\images\hd - tohle se mi nezdá - to máš PowerDVD někde z torrentu?
C:\DOCUME~1\HP\LOCALS~1\Temp\Spyware.sdb
C:\Documents and Settings\All Users\Nabídka Start\programy\programy\daemon tools\uninstall.lnk
C:\Documents and Settings\HP\Nabídka Start\Programy\programy\nimo codec pack\uninstall.lnk

všechno červené smaž.

6bf52a52-394a-11d3-b153-00c04f79faa6 - to jsou pozůstatky v registru po MediaCodecu a už nejsou nebezpečné - můžeš je zkusit vyhledat a zlikvidovat v regeditu.

A ten poslední.......

torrenty nestahuju, a segra už vůbec ne,takže z toho to bejt nemůže...
C:\DOCUME~1\HP\LOCALS~1\Temp\Spyware.sdb tohle se vrací zpátky

projel jsem mwav znovu a našel už jenom toto (total critical objects):
Wed Nov 22 17:58:47 2006 => System found infected with emedia codec Browser Hijacker ({6bf52a52-394a-11d3-b153-00c04f79faa6})! Action taken: No Action Taken.
Wed Nov 22 17:58:47 2006 => System found infected with emedia codec Browser Hijacker ({6bf52a52-394a-11d3-b153-00c04f79faa6})! Action taken: No Action Taken.

to je asi ten codec...
tak snad už je to čistý, uvidíme jak se bude chovat teď....

RičPič

Ten soubor Spyware.sdb si vytváří Mwav při skenu takže se nediv že se tam objevuje znova.