prosím o kontrolu.na ploše pořád nápis YOUR PRIVACY IS IN DANGER.pořád se mi otvíraji stranky s nejakejma fake antivirama at to stahnu, vedle času na lište napsano: VIRUS ALERT!!strašně zpomalenej PC..CPU 100% nonstop . pls moc help.nevim jak dal MWAV nic nesmazal..diks
Logfile of HijackThis v1.99.1
Scan saved at 14:42: VIRUS ALERT!, on 23.7.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rmctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\wincmd\TOTALCMD.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Prog\Security\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: QXK Olive - {7E1C93A1-907F-4F3F-955A-5B46BA08457D} - C:\WINDOWS\kgxmotapvqf.dll
O2 - BHO: Cole2k Media Toolbar Helper - {C672F4AB-780B-45C0-BAEC-91F455C86F8D} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Cole2k Media Toolbar - {2D2DE234-AB9F-4345-9D17-94FA78BA37E3} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: qndsfmao - {8925A538-F508-4A3E-8AF9-6C39E2D3AE7B} - C:\WINDOWS\qndsfmao.dll
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [bc6f63eb] rundll32.exe "C:\WINDOWS\system32\vavhhleo.dll",b
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - Startup: Zástupce - speedfan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Zástupce - TOTALCMD.lnk = C:\wincmd\TOTALCMD.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: kvxqmtre - {2A79AAE2-2F51-4394-B9DA-75F4374849FC} - C:\WINDOWS\kvxqmtre.dll
O21 - SSODL: evgratsm - {8DAD8161-D4AE-4218-88EF-4BF9FF8FE410} - C:\WINDOWS\evgratsm.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
Prosím o kontrolu logu nutné
-
fredik
- člen Security týmu
-
Master Level 7
- Příspěvky: 4680
- Registrován: červenec 06
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu nutné
Stáhni ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
It may take a while to get a response, because the "HJT Team" are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Re: Prosím o kontrolu logu nutné
tak sem to stahnul...spustil jsem, začlo to neco ukladat, mazat..restartoval se pocitac..ComboFix se spustil.ale nic to nedelalo porad tam bylo napsano : Preparing log Report.Do not run any programs atd...Potom porad vyskakovala tabulka Správce zakázal upravy registrůů..a nic 
-
fredik
- člen Security týmu
-
Master Level 7
- Příspěvky: 4680
- Registrován: červenec 06
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu nutné
Zkus se mrknout jestli ten log nemáš tam kde bylo napsáno, případně pak zde: C:\ComboFix\ComboFix.txt
Jinak pokud máš ComboFix na ploše tak požij tento příkaz:
Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře:
"%userprofile%\Plocha\ComboFix.exe" /f3m a dej Ok.
- pak sem vlož log co se ti zobrazí.
Jinak pokud máš ComboFix na ploše tak požij tento příkaz:
Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře:
"%userprofile%\Plocha\ComboFix.exe" /f3m a dej Ok.
- pak sem vlož log co se ti zobrazí.
It may take a while to get a response, because the "HJT Team" are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Re: Prosím o kontrolu logu nutné
tak je to tady:
((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.
2008-07-23 17:31 . 2008-07-23 17:31 <DIR> d-------- C:\WINDOWS\privacy_danger
2008-07-23 12:39 . 2008-07-23 12:40 5,419,064 --a------ C:\WINDOWS\REGBK16.ZIP
2008-07-23 12:11 . 2008-07-15 06:46 503,808 --a------ C:\WINDOWS\kgxmotapvqf.dll
2008-07-23 12:11 . 2008-07-15 06:46 401,408 --a------ C:\WINDOWS\kvxqmtre.dll
2008-07-23 12:11 . 2008-07-15 06:46 348,160 --a------ C:\WINDOWS\evgratsm.dll
2008-07-23 12:11 . 2008-07-15 06:46 167,936 --a------ C:\WINDOWS\agpqlrfm.exe
2008-07-23 12:11 . 2008-07-15 06:46 159,744 --a------ C:\WINDOWS\qndsfmao.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 17:31 --------- d-----w C:\Documents and Settings\Adam\Data aplikací\MegauploadToolbar
2008-07-23 15:52 --------- d-----w C:\Program Files\ICQToolbar
2008-07-23 13:37 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2008-07-23 11:17 --------- d-----w C:\Program Files\SpeedFan
2008-07-23 09:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-23 09:37 --------- d-----w C:\Documents and Settings\Adam\Data aplikací\Hamachi
2008-06-09 19:24 --------- d-----w C:\Documents and Settings\Vlada\Data aplikací\MEGAUPLOADTOOLBAR
2008-06-09 18:49 --------- d-----w C:\Documents and Settings\Vlada\Data aplikací\Skype
2008-06-09 12:19 --------- d-----w C:\Program Files\Sun
2008-06-09 12:18 --------- d-----w C:\Program Files\Java
2008-06-07 16:08 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2008-06-04 19:11 --------- d-----w C:\Program Files\ScreenShots
2008-06-01 18:53 --------- d-----w C:\Program Files\Bonjour
2008-06-01 18:29 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-01 18:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 13:44 --------- d-----w C:\Program Files\MP Software
2008-06-01 13:43 --------- d-----w C:\Program Files\Mandomartis
2008-06-01 12:26 --------- d-----w C:\Documents and Settings\Adam\Data aplikací\Nvu
2008-06-01 12:25 --------- d-----w C:\Program Files\Nvu
2008-06-01 11:55 --------- d-----w C:\Program Files\BlueVoda Website Builder
2008-06-01 11:54 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-01 11:47 --------- d-----w C:\Program Files\Web Studio
2008-06-01 11:43 --------- d-----w C:\Program Files\FFFF
2008-05-31 10:59 --------- d-----w C:\Program Files\VirtualDJ
2008-05-30 06:36 --------- d-----w C:\Documents and Settings\Mamka\Data aplikací\uTorrent
2008-05-28 14:18 5,106,697 ----a-w C:\WINDOWS\REGBK15.ZIP
2008-05-25 10:01 --------- d---a-w C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-05-04 19:47 5,120,207 ----a-w C:\WINDOWS\REGBK14.ZIP
2007-04-16 19:32 3,118,878 ----a-w C:\Program Files\FTPORTX.EXE
.
((((((((((((((((((((((((((((( snapshot@2008-07-23_17.13.22.62 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-23 10:55:18 73,326 ----a-w C:\WINDOWS\system32\perfc005.dat
+ 2008-07-23 14:59:32 73,326 ----a-w C:\WINDOWS\system32\perfc005.dat
- 2008-07-23 10:55:18 62,286 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-23 14:59:32 62,286 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-23 10:55:18 397,976 ----a-w C:\WINDOWS\system32\perfh005.dat
+ 2008-07-23 14:59:32 397,976 ----a-w C:\WINDOWS\system32\perfh005.dat
- 2008-07-23 10:55:18 400,624 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-23 14:59:33 400,624 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E1C93A1-907F-4F3F-955A-5B46BA08457D}]
2008-07-15 06:46 503808 --a------ C:\WINDOWS\kgxmotapvqf.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C672F4AB-780B-45C0-BAEC-91F455C86F8D}]
2008-01-06 20:09 798720 --a------ C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}"= "C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll" [2008-01-06 20:09 798720]
"{8925A538-F508-4A3E-8AF9-6C39E2D3AE7B}"= "C:\WINDOWS\qndsfmao.dll" [2008-07-15 06:46 159744]
[HKEY_CLASSES_ROOT\clsid\{2d2de234-ab9f-4345-9d17-94fa78ba37e3}]
[HKEY_CLASSES_ROOT\clsid\{8925a538-f508-4a3e-8af9-6c39e2d3ae7b}]
[HKEY_CLASSES_ROOT\qndsfmao.1]
[HKEY_CLASSES_ROOT\TypeLib\{4CD31694-4DD4-491B-A20D-C4EA0FA3CC11}]
[HKEY_CLASSES_ROOT\qndsfmao]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}"= "C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll" [2008-01-06 20:09 798720]
[HKEY_CLASSES_ROOT\clsid\{2d2de234-ab9f-4345-9d17-94fa78ba37e3}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP2005"="C:\Program Files\QIP\qip.exe" [2008-07-01 18:34 3256320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.
2008-07-23 17:31 . 2008-07-23 17:31 <DIR> d-------- C:\WINDOWS\privacy_danger
2008-07-23 12:39 . 2008-07-23 12:40 5,419,064 --a------ C:\WINDOWS\REGBK16.ZIP
2008-07-23 12:11 . 2008-07-15 06:46 503,808 --a------ C:\WINDOWS\kgxmotapvqf.dll
2008-07-23 12:11 . 2008-07-15 06:46 401,408 --a------ C:\WINDOWS\kvxqmtre.dll
2008-07-23 12:11 . 2008-07-15 06:46 348,160 --a------ C:\WINDOWS\evgratsm.dll
2008-07-23 12:11 . 2008-07-15 06:46 167,936 --a------ C:\WINDOWS\agpqlrfm.exe
2008-07-23 12:11 . 2008-07-15 06:46 159,744 --a------ C:\WINDOWS\qndsfmao.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 17:31 --------- d-----w C:\Documents and Settings\Adam\Data aplikací\MegauploadToolbar
2008-07-23 15:52 --------- d-----w C:\Program Files\ICQToolbar
2008-07-23 13:37 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2008-07-23 11:17 --------- d-----w C:\Program Files\SpeedFan
2008-07-23 09:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-23 09:37 --------- d-----w C:\Documents and Settings\Adam\Data aplikací\Hamachi
2008-06-09 19:24 --------- d-----w C:\Documents and Settings\Vlada\Data aplikací\MEGAUPLOADTOOLBAR
2008-06-09 18:49 --------- d-----w C:\Documents and Settings\Vlada\Data aplikací\Skype
2008-06-09 12:19 --------- d-----w C:\Program Files\Sun
2008-06-09 12:18 --------- d-----w C:\Program Files\Java
2008-06-07 16:08 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2008-06-04 19:11 --------- d-----w C:\Program Files\ScreenShots
2008-06-01 18:53 --------- d-----w C:\Program Files\Bonjour
2008-06-01 18:29 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-01 18:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 13:44 --------- d-----w C:\Program Files\MP Software
2008-06-01 13:43 --------- d-----w C:\Program Files\Mandomartis
2008-06-01 12:26 --------- d-----w C:\Documents and Settings\Adam\Data aplikací\Nvu
2008-06-01 12:25 --------- d-----w C:\Program Files\Nvu
2008-06-01 11:55 --------- d-----w C:\Program Files\BlueVoda Website Builder
2008-06-01 11:54 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-01 11:47 --------- d-----w C:\Program Files\Web Studio
2008-06-01 11:43 --------- d-----w C:\Program Files\FFFF
2008-05-31 10:59 --------- d-----w C:\Program Files\VirtualDJ
2008-05-30 06:36 --------- d-----w C:\Documents and Settings\Mamka\Data aplikací\uTorrent
2008-05-28 14:18 5,106,697 ----a-w C:\WINDOWS\REGBK15.ZIP
2008-05-25 10:01 --------- d---a-w C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-05-04 19:47 5,120,207 ----a-w C:\WINDOWS\REGBK14.ZIP
2007-04-16 19:32 3,118,878 ----a-w C:\Program Files\FTPORTX.EXE
.
((((((((((((((((((((((((((((( snapshot@2008-07-23_17.13.22.62 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-23 10:55:18 73,326 ----a-w C:\WINDOWS\system32\perfc005.dat
+ 2008-07-23 14:59:32 73,326 ----a-w C:\WINDOWS\system32\perfc005.dat
- 2008-07-23 10:55:18 62,286 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-23 14:59:32 62,286 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-23 10:55:18 397,976 ----a-w C:\WINDOWS\system32\perfh005.dat
+ 2008-07-23 14:59:32 397,976 ----a-w C:\WINDOWS\system32\perfh005.dat
- 2008-07-23 10:55:18 400,624 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-23 14:59:33 400,624 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E1C93A1-907F-4F3F-955A-5B46BA08457D}]
2008-07-15 06:46 503808 --a------ C:\WINDOWS\kgxmotapvqf.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C672F4AB-780B-45C0-BAEC-91F455C86F8D}]
2008-01-06 20:09 798720 --a------ C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}"= "C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll" [2008-01-06 20:09 798720]
"{8925A538-F508-4A3E-8AF9-6C39E2D3AE7B}"= "C:\WINDOWS\qndsfmao.dll" [2008-07-15 06:46 159744]
[HKEY_CLASSES_ROOT\clsid\{2d2de234-ab9f-4345-9d17-94fa78ba37e3}]
[HKEY_CLASSES_ROOT\clsid\{8925a538-f508-4a3e-8af9-6c39e2d3ae7b}]
[HKEY_CLASSES_ROOT\qndsfmao.1]
[HKEY_CLASSES_ROOT\TypeLib\{4CD31694-4DD4-491B-A20D-C4EA0FA3CC11}]
[HKEY_CLASSES_ROOT\qndsfmao]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}"= "C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll" [2008-01-06 20:09 798720]
[HKEY_CLASSES_ROOT\clsid\{2d2de234-ab9f-4345-9d17-94fa78ba37e3}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP2005"="C:\Program Files\QIP\qip.exe" [2008-07-01 18:34 3256320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
-
fredik
- člen Security týmu
-
Master Level 7
- Příspěvky: 4680
- Registrován: červenec 06
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu nutné
Ten log z Combofix jsi našel nebo jsi použil druhou variantu, protože ten log není celý?
Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: QXK Olive - {7E1C93A1-907F-4F3F-955A-5B46BA08457D} - C:\WINDOWS\kgxmotapvqf.dll
O3 - Toolbar: qndsfmao - {8925A538-F508-4A3E-8AF9-6C39E2D3AE7B} - C:\WINDOWS\qndsfmao.dll
O4 - HKLM\..\Run: [bc6f63eb] rundll32.exe "C:\WINDOWS\system32\vavhhleo.dll",b
O21 - SSODL: kvxqmtre - {2A79AAE2-2F51-4394-B9DA-75F4374849FC} - C:\WINDOWS\kvxqmtre.dll
O21 - SSODL: evgratsm - {8DAD8161-D4AE-4218-88EF-4BF9FF8FE410} - C:\WINDOWS\evgratsm.dll
po zaškrtnutí klikni na tlačítko Fix Checked
Stáhni si Avenger (by Swandog46) a spusť ho pod účtem administrátora.
- objeví se ti hláška kterou odklikni přes Ok
Vlož si tam tento celý skript označený zeleně:
Files to delete:
C:\WINDOWS\kgxmotapvqf.dll
C:\WINDOWS\kvxqmtre.dll
C:\WINDOWS\evgratsm.dll
C:\WINDOWS\agpqlrfm.exe
C:\WINDOWS\qndsfmao.dll
C:\WINDOWS\system32\vavhhleo.dll
Folders to delete:
C:\WINDOWS\privacy_danger
- označ si celý skript a zkopíruj do schránky
- pak si ho vlož do avengeru přes toto tlačítko
- skrip se ti vloží do prázdného okna pod nadpisem: Input script here:
- pak klikni na tlačítko Execute
Budeš dotázán na to jestli chceš provést skript tak zvol Ano
- po proběhnutí prvního kroku budeš dotázán na na restart počítače tak zvol znovu Ano
Vlož sem pak log z Avengeru a dej sem i nový log z ComboFix. Pokud by ti nevyběhl log tak použij druhou variantu co byla zmíněna.
Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: QXK Olive - {7E1C93A1-907F-4F3F-955A-5B46BA08457D} - C:\WINDOWS\kgxmotapvqf.dll
O3 - Toolbar: qndsfmao - {8925A538-F508-4A3E-8AF9-6C39E2D3AE7B} - C:\WINDOWS\qndsfmao.dll
O4 - HKLM\..\Run: [bc6f63eb] rundll32.exe "C:\WINDOWS\system32\vavhhleo.dll",b
O21 - SSODL: kvxqmtre - {2A79AAE2-2F51-4394-B9DA-75F4374849FC} - C:\WINDOWS\kvxqmtre.dll
O21 - SSODL: evgratsm - {8DAD8161-D4AE-4218-88EF-4BF9FF8FE410} - C:\WINDOWS\evgratsm.dll
po zaškrtnutí klikni na tlačítko Fix Checked
Stáhni si Avenger (by Swandog46) a spusť ho pod účtem administrátora.
- objeví se ti hláška kterou odklikni přes Ok
Vlož si tam tento celý skript označený zeleně:
Files to delete:
C:\WINDOWS\kgxmotapvqf.dll
C:\WINDOWS\kvxqmtre.dll
C:\WINDOWS\evgratsm.dll
C:\WINDOWS\agpqlrfm.exe
C:\WINDOWS\qndsfmao.dll
C:\WINDOWS\system32\vavhhleo.dll
Folders to delete:
C:\WINDOWS\privacy_danger
- označ si celý skript a zkopíruj do schránky
- pak si ho vlož do avengeru přes toto tlačítko
- skrip se ti vloží do prázdného okna pod nadpisem: Input script here:
- pak klikni na tlačítko Execute
Budeš dotázán na to jestli chceš provést skript tak zvol Ano
- po proběhnutí prvního kroku budeš dotázán na na restart počítače tak zvol znovu Ano
Vlož sem pak log z Avengeru a dej sem i nový log z ComboFix. Pokud by ti nevyběhl log tak použij druhou variantu co byla zmíněna.
It may take a while to get a response, because the "HJT Team" are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Re: Prosím o kontrolu logu nutné
tu druhou variantu..vse udelám
Re: Prosím o kontrolu logu nutné
log z avengeru
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Error: file "C:\WINDOWS\kgxmotapvqf.dll" not found!
Deletion of file "C:\WINDOWS\kgxmotapvqf.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
File "C:\WINDOWS\kvxqmtre.dll" deleted successfully.
File "C:\WINDOWS\evgratsm.dll" deleted successfully.
File "C:\WINDOWS\agpqlrfm.exe" deleted successfully.
File "C:\WINDOWS\qndsfmao.dll" deleted successfully.
Error: file "C:\WINDOWS\system32\vavhhleo.dll" not found!
Deletion of file "C:\WINDOWS\system32\vavhhleo.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Folder "C:\WINDOWS\privacy_danger" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Error: file "C:\WINDOWS\kgxmotapvqf.dll" not found!
Deletion of file "C:\WINDOWS\kgxmotapvqf.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
File "C:\WINDOWS\kvxqmtre.dll" deleted successfully.
File "C:\WINDOWS\evgratsm.dll" deleted successfully.
File "C:\WINDOWS\agpqlrfm.exe" deleted successfully.
File "C:\WINDOWS\qndsfmao.dll" deleted successfully.
Error: file "C:\WINDOWS\system32\vavhhleo.dll" not found!
Deletion of file "C:\WINDOWS\system32\vavhhleo.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Folder "C:\WINDOWS\privacy_danger" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Re: Prosím o kontrolu logu nutné
a combofix..ale porad toho tam je nejak malo...zase sem musel druhou variantou
ComboFix 08-07-14.2 - Adam 2008-07-23 21:32:16.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.679 [GMT 2:00]
Running from: C:\Documents and Settings\Adam\Plocha\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Adam\Oblíbené položky\Error Cleaner.url
C:\Documents and Settings\Adam\Oblíbené položky\Privacy Protector.url
C:\Documents and Settings\Adam\Oblíbené položky\Spyware&Malware Protection.url
C:\Documents and Settings\Adam\Plocha\Error Cleaner.url
C:\Documents and Settings\Adam\Plocha\Privacy Protector.url
C:\Documents and Settings\Adam\Plocha\Spyware&Malware Protection.url
C:\Documents and Settings\Mamka\Oblíbené položky\Error Cleaner.url
C:\Documents and Settings\Mamka\Oblíbené položky\Privacy Protector.url
C:\Documents and Settings\Mamka\Oblíbené položky\Spyware&Malware Protection.url
C:\Documents and Settings\Mamka\Plocha\Error Cleaner.url
C:\Documents and Settings\Mamka\Plocha\Privacy Protector.url
C:\Documents and Settings\Mamka\Plocha\Spyware&Malware Protection.url
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.
2008-07-23 12:39 . 2008-07-23 12:40 5,419,064 --a------ C:\WINDOWS\REGBK16.ZIP
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 15:52 --------- d-----w C:\Program Files\ICQToolbar
2008-07-23 11:17 --------- d-----w C:\Program Files\SpeedFan
2008-07-23 09:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-09 12:19 --------- d-----w C:\Program Files\Sun
2008-06-09 12:18 --------- d-----w C:\Program Files\Java
2008-06-04 19:11 --------- d-----w C:\Program Files\ScreenShots
2008-06-01 18:53 --------- d-----w C:\Program Files\Bonjour
2008-06-01 18:29 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-01 18:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 13:44 --------- d-----w C:\Program Files\MP Software
2008-06-01 13:43 --------- d-----w C:\Program Files\Mandomartis
2008-06-01 12:25 --------- d-----w C:\Program Files\Nvu
2008-06-01 11:55 --------- d-----w C:\Program Files\BlueVoda Website Builder
2008-06-01 11:54 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-01 11:47 --------- d-----w C:\Program Files\Web Studio
2008-06-01 11:43 --------- d-----w C:\Program Files\FFFF
2008-05-31 10:59 --------- d-----w C:\Program Files\VirtualDJ
2008-05-28 14:18 5,106,697 ----a-w C:\WINDOWS\REGBK15.ZIP
2008-05-04 19:47 5,120,207 ----a-w C:\WINDOWS\REGBK14.ZIP
2007-04-16 19:32 3,118,878 ----a-w C:\Program Files\FTPORTX.EXE
.
ComboFix 08-07-14.2 - Adam 2008-07-23 21:32:16.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.679 [GMT 2:00]
Running from: C:\Documents and Settings\Adam\Plocha\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Adam\Oblíbené položky\Error Cleaner.url
C:\Documents and Settings\Adam\Oblíbené položky\Privacy Protector.url
C:\Documents and Settings\Adam\Oblíbené položky\Spyware&Malware Protection.url
C:\Documents and Settings\Adam\Plocha\Error Cleaner.url
C:\Documents and Settings\Adam\Plocha\Privacy Protector.url
C:\Documents and Settings\Adam\Plocha\Spyware&Malware Protection.url
C:\Documents and Settings\Mamka\Oblíbené položky\Error Cleaner.url
C:\Documents and Settings\Mamka\Oblíbené položky\Privacy Protector.url
C:\Documents and Settings\Mamka\Oblíbené položky\Spyware&Malware Protection.url
C:\Documents and Settings\Mamka\Plocha\Error Cleaner.url
C:\Documents and Settings\Mamka\Plocha\Privacy Protector.url
C:\Documents and Settings\Mamka\Plocha\Spyware&Malware Protection.url
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.
2008-07-23 12:39 . 2008-07-23 12:40 5,419,064 --a------ C:\WINDOWS\REGBK16.ZIP
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 15:52 --------- d-----w C:\Program Files\ICQToolbar
2008-07-23 11:17 --------- d-----w C:\Program Files\SpeedFan
2008-07-23 09:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-09 12:19 --------- d-----w C:\Program Files\Sun
2008-06-09 12:18 --------- d-----w C:\Program Files\Java
2008-06-04 19:11 --------- d-----w C:\Program Files\ScreenShots
2008-06-01 18:53 --------- d-----w C:\Program Files\Bonjour
2008-06-01 18:29 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-01 18:28 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 13:44 --------- d-----w C:\Program Files\MP Software
2008-06-01 13:43 --------- d-----w C:\Program Files\Mandomartis
2008-06-01 12:25 --------- d-----w C:\Program Files\Nvu
2008-06-01 11:55 --------- d-----w C:\Program Files\BlueVoda Website Builder
2008-06-01 11:54 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-01 11:47 --------- d-----w C:\Program Files\Web Studio
2008-06-01 11:43 --------- d-----w C:\Program Files\FFFF
2008-05-31 10:59 --------- d-----w C:\Program Files\VirtualDJ
2008-05-28 14:18 5,106,697 ----a-w C:\WINDOWS\REGBK15.ZIP
2008-05-04 19:47 5,120,207 ----a-w C:\WINDOWS\REGBK14.ZIP
2007-04-16 19:32 3,118,878 ----a-w C:\Program Files\FTPORTX.EXE
.
-
fredik
- člen Security týmu
-
Master Level 7
- Příspěvky: 4680
- Registrován: červenec 06
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu nutné
Stáhni si Deckard's System Scanner (DSS) a ulož si ho na plochu
- ukonči všechna aktivní okna a spusť ho
- potvrď licenční podmínky a postupuj podle pokynů
- začne prohlídka systému
- po ukončení kontroly program vytvoří dva logy a zobrazí je: main.txt a extra.txt, tak sem vlož obsah souboru/logu main.txt
- jinak jsou logy uloženy v adresáři: c:\Deckard\System Scanner\
- ukonči všechna aktivní okna a spusť ho
- potvrď licenční podmínky a postupuj podle pokynů
- začne prohlídka systému
- po ukončení kontroly program vytvoří dva logy a zobrazí je: main.txt a extra.txt, tak sem vlož obsah souboru/logu main.txt
- jinak jsou logy uloženy v adresáři: c:\Deckard\System Scanner\
It may take a while to get a response, because the "HJT Team" are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Re: Prosím o kontrolu logu nutné
provedeno...main.txt
Deckard's System Scanner v20071014.68
Run by Adam on 2008-07-23 21:49:49
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 3 Restore Point(s) --
3: 2008-07-23 19:49:56 UTC - RP3 - Deckard's System Scanner Restore Point
2: 2008-07-23 14:46:34 UTC - RP2 - ComboFix created restore point
1: 2008-07-23 14:40:56 UTC - RP1 - Kontrolní bod systému
Backed up registry hives.
Performed disk cleanup.
System Drive C: has 1.52 GiB (less than 15%) free.
-- HijackThis (run as Adam.exe) ------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 21:50, on 2008-07-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rmctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\wincmd\TOTALCMD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
D:\download\zatim\dss.exe
D:\Prog\Security\Adam.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Cole2k Media Toolbar Helper - {C672F4AB-780B-45C0-BAEC-91F455C86F8D} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Cole2k Media Toolbar - {2D2DE234-AB9F-4345-9D17-94FA78BA37E3} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: evgratsm - {3D2D9F5A-D6A5-4BAE-B672-51F5F86D78E0} - C:\WINDOWS\evgratsm.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
-- HijackThis Fixed Entries (D:\Prog\Security\backups\) ------------------------
backup-20080723-212127-134 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
backup-20080723-212127-215 O2 - BHO: QXK Olive - {7E1C93A1-907F-4F3F-955A-5B46BA08457D} - C:\WINDOWS\kgxmotapvqf.dll
backup-20080723-212127-320 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
backup-20080723-212127-444 O3 - Toolbar: qndsfmao - {8925A538-F508-4A3E-8AF9-6C39E2D3AE7B} - C:\WINDOWS\qndsfmao.dll
backup-20080723-212127-499 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
backup-20080723-212127-625 O21 - SSODL: evgratsm - {8DAD8161-D4AE-4218-88EF-4BF9FF8FE410} - C:\WINDOWS\evgratsm.dll
backup-20080723-212127-711 O21 - SSODL: kvxqmtre - {2A79AAE2-2F51-4394-B9DA-75F4374849FC} - C:\WINDOWS\kvxqmtre.dll
backup-20080723-212127-715 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys <Not Verified; IVT Corporation; BlueSoleil(c)>
R0 giveio - c:\windows\system32\giveio.sys
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R1 meiudf - c:\windows\system32\drivers\meiudf.sys <Not Verified; Matsushita Electric Industrial Co.,Ltd.; >
R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys <Not Verified; IVT Corporation; Windows (R) 2000 DDK driver>
S3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys
S3 catchme - c:\combofix\catchme.sys (file missing)
S3 Devx - c:\windows\system32\drivers\devx.sys
S3 kvpndev (Kerio VPN adapter) - c:\windows\system32\drivers\kvpndrv.sys <Not Verified; Kerio Technologies; Kerio VPN driver>
S3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 VtPr - c:\windows\system32\drivers\vtpr.sys
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>
R2 DVD-RAM_Service - c:\windows\system32\dvdramsv.exe <Not Verified; Matsushita Electric Industrial Co., Ltd.; >
S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID:
Description: Řadič RAID
Device ID: PCI\VEN_105A&DEV_3373&SUBSYS_80F51043&REV_02\3&267A616A&0&40
Manufacturer:
Name: Řadič RAID
PNP Device ID: PCI\VEN_105A&DEV_3373&SUBSYS_80F51043&REV_02\3&267A616A&0&40
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Řadič RAID
Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78
Manufacturer:
Name: Řadič RAID
PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78
Service:
-- Scheduled Tasks -------------------------------------------------------------
2007-11-07 13:50:42 356 --a------ C:\WINDOWS\Tasks\Pareto UNS.job
2007-01-13 23:02:55 298 --a------ C:\WINDOWS\Tasks\XoftSpy.job
-- Files created between 2008-06-23 and 2008-07-23 -----------------------------
2008-07-23 21:35:21 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-07-23 16:40:44 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-23 16:40:43 68096 --a------ C:\WINDOWS\zip.exe
2008-07-23 16:40:43 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-23 16:40:43 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-23 16:40:43 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-23 16:40:43 98816 --a------ C:\WINDOWS\sed.exe
2008-07-23 16:40:43 80412 --a------ C:\WINDOWS\grep.exe
2008-07-23 16:40:43 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
-- Find3M Report ---------------------------------------------------------------
2008-07-23 21:12:23 0 d-------- C:\Documents and Settings\Adam\Data aplikací\MegauploadToolbar
2008-07-23 17:52:06 0 d-------- C:\Program Files\ICQToolbar
2008-07-23 16:59:32 397976 --a------ C:\WINDOWS\system32\perfh005.dat
2008-07-23 16:59:32 73326 --a------ C:\WINDOWS\system32\perfc005.dat
2008-07-23 13:17:56 0 d-------- C:\Program Files\SpeedFan
2008-07-23 11:53:54 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-23 11:37:32 0 d-------- C:\Documents and Settings\Adam\Data aplikací\Hamachi
2008-06-09 14:19:10 0 d-------- C:\Program Files\Sun
2008-06-09 14:18:32 0 d-------- C:\Program Files\Java
2008-06-04 21:11:38 0 d-------- C:\Program Files\ScreenShots
2008-06-01 21:59:26 0 d-------- C:\Documents and Settings\Adam\Data aplikací\Adobe
2008-06-01 20:53:09 0 d-------- C:\Program Files\Bonjour
2008-06-01 20:29:44 0 d-------- C:\Program Files\Common Files
2008-06-01 20:29:44 0 d-------- C:\Program Files\Common Files\Macrovision Shared
2008-06-01 20:28:03 0 d-------- C:\Program Files\Common Files\Adobe
2008-06-01 15:44:24 0 d-------- C:\Program Files\MP Software
2008-06-01 15:43:34 0 d-------- C:\Program Files\Mandomartis
2008-06-01 14:26:01 0 d-------- C:\Documents and Settings\Adam\Data aplikací\Nvu
2008-06-01 14:25:57 0 d-------- C:\Program Files\Nvu
2008-06-01 13:55:26 0 d-------- C:\Program Files\BlueVoda Website Builder
2008-06-01 13:54:17 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2008-06-01 13:47:27 0 d-------- C:\Program Files\Web Studio
2008-06-01 13:43:30 0 d-------- C:\Program Files\FFFF
2008-05-31 20:19:55 978 --a----c- C:\WINDOWS\eReg.dat
2008-05-31 12:59:13 0 d-------- C:\Program Files\VirtualDJ
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C672F4AB-780B-45C0-BAEC-91F455C86F8D}]
2008-01-06 20:09 798720 --a------ C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}"= C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll [2008-01-06 20:09 798720]
[-HKEY_CLASSES_ROOT\CLSID\{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="C:\WINDOWS\System32\rmctrl.exe" [2003-03-18 19:01]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 21:10]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-14 18:06]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP2005"="C:\Program Files\QIP\qip.exe" [2008-07-01 18:34]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"evgratsm"= {3D2D9F5A-D6A5-4BAE-B672-51F5F86D78E0} - C:\WINDOWS\evgratsm.dll [ ]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli scecli scecli scecli
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Schedule
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4fee374e-8f67-11dc-8a9a-0011d8516088}]
AutoRun\command- F:\Autorun.exe
-- End of Deckard's System Scanner: finished at 2008-07-23 21:51:27 ------------
Deckard's System Scanner v20071014.68
Run by Adam on 2008-07-23 21:49:49
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 3 Restore Point(s) --
3: 2008-07-23 19:49:56 UTC - RP3 - Deckard's System Scanner Restore Point
2: 2008-07-23 14:46:34 UTC - RP2 - ComboFix created restore point
1: 2008-07-23 14:40:56 UTC - RP1 - Kontrolní bod systému
Backed up registry hives.
Performed disk cleanup.
System Drive C: has 1.52 GiB (less than 15%) free.
-- HijackThis (run as Adam.exe) ------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 21:50, on 2008-07-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rmctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\wincmd\TOTALCMD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
D:\download\zatim\dss.exe
D:\Prog\Security\Adam.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Cole2k Media Toolbar Helper - {C672F4AB-780B-45C0-BAEC-91F455C86F8D} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Cole2k Media Toolbar - {2D2DE234-AB9F-4345-9D17-94FA78BA37E3} - C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: evgratsm - {3D2D9F5A-D6A5-4BAE-B672-51F5F86D78E0} - C:\WINDOWS\evgratsm.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
-- HijackThis Fixed Entries (D:\Prog\Security\backups\) ------------------------
backup-20080723-212127-134 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
backup-20080723-212127-215 O2 - BHO: QXK Olive - {7E1C93A1-907F-4F3F-955A-5B46BA08457D} - C:\WINDOWS\kgxmotapvqf.dll
backup-20080723-212127-320 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
backup-20080723-212127-444 O3 - Toolbar: qndsfmao - {8925A538-F508-4A3E-8AF9-6C39E2D3AE7B} - C:\WINDOWS\qndsfmao.dll
backup-20080723-212127-499 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
backup-20080723-212127-625 O21 - SSODL: evgratsm - {8DAD8161-D4AE-4218-88EF-4BF9FF8FE410} - C:\WINDOWS\evgratsm.dll
backup-20080723-212127-711 O21 - SSODL: kvxqmtre - {2A79AAE2-2F51-4394-B9DA-75F4374849FC} - C:\WINDOWS\kvxqmtre.dll
backup-20080723-212127-715 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys <Not Verified; IVT Corporation; BlueSoleil(c)>
R0 giveio - c:\windows\system32\giveio.sys
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R1 meiudf - c:\windows\system32\drivers\meiudf.sys <Not Verified; Matsushita Electric Industrial Co.,Ltd.; >
R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys <Not Verified; IVT Corporation; Windows (R) 2000 DDK driver>
S3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys
S3 catchme - c:\combofix\catchme.sys (file missing)
S3 Devx - c:\windows\system32\drivers\devx.sys
S3 kvpndev (Kerio VPN adapter) - c:\windows\system32\drivers\kvpndrv.sys <Not Verified; Kerio Technologies; Kerio VPN driver>
S3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys <Not Verified; IVT Corporation; BlueSoleil>
S3 VtPr - c:\windows\system32\drivers\vtpr.sys
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>
R2 DVD-RAM_Service - c:\windows\system32\dvdramsv.exe <Not Verified; Matsushita Electric Industrial Co., Ltd.; >
S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID:
Description: Řadič RAID
Device ID: PCI\VEN_105A&DEV_3373&SUBSYS_80F51043&REV_02\3&267A616A&0&40
Manufacturer:
Name: Řadič RAID
PNP Device ID: PCI\VEN_105A&DEV_3373&SUBSYS_80F51043&REV_02\3&267A616A&0&40
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Řadič RAID
Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78
Manufacturer:
Name: Řadič RAID
PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78
Service:
-- Scheduled Tasks -------------------------------------------------------------
2007-11-07 13:50:42 356 --a------ C:\WINDOWS\Tasks\Pareto UNS.job
2007-01-13 23:02:55 298 --a------ C:\WINDOWS\Tasks\XoftSpy.job
-- Files created between 2008-06-23 and 2008-07-23 -----------------------------
2008-07-23 21:35:21 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-07-23 16:40:44 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-23 16:40:43 68096 --a------ C:\WINDOWS\zip.exe
2008-07-23 16:40:43 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-23 16:40:43 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-23 16:40:43 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-23 16:40:43 98816 --a------ C:\WINDOWS\sed.exe
2008-07-23 16:40:43 80412 --a------ C:\WINDOWS\grep.exe
2008-07-23 16:40:43 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
-- Find3M Report ---------------------------------------------------------------
2008-07-23 21:12:23 0 d-------- C:\Documents and Settings\Adam\Data aplikací\MegauploadToolbar
2008-07-23 17:52:06 0 d-------- C:\Program Files\ICQToolbar
2008-07-23 16:59:32 397976 --a------ C:\WINDOWS\system32\perfh005.dat
2008-07-23 16:59:32 73326 --a------ C:\WINDOWS\system32\perfc005.dat
2008-07-23 13:17:56 0 d-------- C:\Program Files\SpeedFan
2008-07-23 11:53:54 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-23 11:37:32 0 d-------- C:\Documents and Settings\Adam\Data aplikací\Hamachi
2008-06-09 14:19:10 0 d-------- C:\Program Files\Sun
2008-06-09 14:18:32 0 d-------- C:\Program Files\Java
2008-06-04 21:11:38 0 d-------- C:\Program Files\ScreenShots
2008-06-01 21:59:26 0 d-------- C:\Documents and Settings\Adam\Data aplikací\Adobe
2008-06-01 20:53:09 0 d-------- C:\Program Files\Bonjour
2008-06-01 20:29:44 0 d-------- C:\Program Files\Common Files
2008-06-01 20:29:44 0 d-------- C:\Program Files\Common Files\Macrovision Shared
2008-06-01 20:28:03 0 d-------- C:\Program Files\Common Files\Adobe
2008-06-01 15:44:24 0 d-------- C:\Program Files\MP Software
2008-06-01 15:43:34 0 d-------- C:\Program Files\Mandomartis
2008-06-01 14:26:01 0 d-------- C:\Documents and Settings\Adam\Data aplikací\Nvu
2008-06-01 14:25:57 0 d-------- C:\Program Files\Nvu
2008-06-01 13:55:26 0 d-------- C:\Program Files\BlueVoda Website Builder
2008-06-01 13:54:17 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2008-06-01 13:47:27 0 d-------- C:\Program Files\Web Studio
2008-06-01 13:43:30 0 d-------- C:\Program Files\FFFF
2008-05-31 20:19:55 978 --a----c- C:\WINDOWS\eReg.dat
2008-05-31 12:59:13 0 d-------- C:\Program Files\VirtualDJ
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C672F4AB-780B-45C0-BAEC-91F455C86F8D}]
2008-01-06 20:09 798720 --a------ C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}"= C:\Program Files\Cole2k Media Toolbar\v3.2.0.0\Cole2k_Media_Toolbar.dll [2008-01-06 20:09 798720]
[-HKEY_CLASSES_ROOT\CLSID\{2D2DE234-AB9F-4345-9D17-94FA78BA37E3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="C:\WINDOWS\System32\rmctrl.exe" [2003-03-18 19:01]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 21:10]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-14 18:06]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP2005"="C:\Program Files\QIP\qip.exe" [2008-07-01 18:34]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"evgratsm"= {3D2D9F5A-D6A5-4BAE-B672-51F5F86D78E0} - C:\WINDOWS\evgratsm.dll [ ]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli scecli scecli scecli
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Schedule
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4fee374e-8f67-11dc-8a9a-0011d8516088}]
AutoRun\command- F:\Autorun.exe
-- End of Deckard's System Scanner: finished at 2008-07-23 21:51:27 ------------
-
fredik
- člen Security týmu
-
Master Level 7
- Příspěvky: 4680
- Registrován: červenec 06
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu nutné
V HJT fixni ještě toto:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
O21 - SSODL: evgratsm - {3D2D9F5A-D6A5-4BAE-B672-51F5F86D78E0} - C:\WINDOWS\evgratsm.dll (file missing)
Doporučil bych ti aktualizovat Javu:
- Stáhni si poslední verzi Java Runtime Environment (JRE) 6 Update 7
- Posuň se dolů kde je napsáno Java Runtime Environment (JRE) 6 Update 7 a klikni na tlačítko Download
- Načte se ti nová stránka
- Pod nadpisem Select Platform and Language for your download:
* u položky Platform: vyber OS který používáš
* zatrhni možnost kde je napsáno: I agree to the Java SE Runtime Environment 6 License Agreement
* klikni na tlačítko Continue >>
- Načte se ti nová stránka
- Klikni na odkaz pro stažení pod položkou: Windows Offline Installation
a ulož si ho na disk
- Ukonči běžící programy které máš spuštěné, hlavě webový prohlížeč
- Jdi přes Start -> Ovládací panely -> Přidat nebo odebrat programy a odinstaluj všechny staré verze Javy
- Podívej se po položkách s názvem Java Runtime Environment (JRE or J2SE)
* příklady starých verzí v Přidat nebo odebrat programy:
- Odinstaluj postupně po sobě případné všechny staré verze Javy
- Po skončení odinstalovaní restartuj Pc.
- Pak už jen spusť instalaci poslední verze ze souboru jre-6u7-windows-i586-p.exe, který sis stáhl na začátku
Pro lepší zabezpečení bych ti doporučil doinstalovat firewall, můžeš si vybrat některý zde uvedený nebo některý jiný z odkazu: Přehled osobních firewallů
Firewally zdarma:
Kerio - přehledný, větší možnosti nastavení, náročnější na systémové prostředky, v češtině
ZoneAlarm - jednoduchý, kompatibilní, nenáročný na systémové prostředky, málo možností nastavení, v angličtině + návod
Comodo - kvalitní, pokročilý, s mnoha funkcemi, originálně v angličtině (nepoužít jeho malware scaner, nebo přes něj odstranit co najde)
Používáš starší verzi HijackThis, pokud by sis někdy příště dával zkontrolovat log, tak si stáhni aktuální verzi zde a tu starou před použitím vymaž.
Máš ještě problémy? Mrkni se jestli se ti zobrazují disky, vedle hodin nemáš nápis VIRUS ALERT ...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
O21 - SSODL: evgratsm - {3D2D9F5A-D6A5-4BAE-B672-51F5F86D78E0} - C:\WINDOWS\evgratsm.dll (file missing)
Doporučil bych ti aktualizovat Javu:
- Stáhni si poslední verzi Java Runtime Environment (JRE) 6 Update 7
- Posuň se dolů kde je napsáno Java Runtime Environment (JRE) 6 Update 7 a klikni na tlačítko Download
- Načte se ti nová stránka
- Pod nadpisem Select Platform and Language for your download:
* u položky Platform: vyber OS který používáš
* zatrhni možnost kde je napsáno: I agree to the Java SE Runtime Environment 6 License Agreement
* klikni na tlačítko Continue >>
- Načte se ti nová stránka
- Klikni na odkaz pro stažení pod položkou: Windows Offline Installation
a ulož si ho na disk
- Ukonči běžící programy které máš spuštěné, hlavě webový prohlížeč
- Jdi přes Start -> Ovládací panely -> Přidat nebo odebrat programy a odinstaluj všechny staré verze Javy
- Podívej se po položkách s názvem Java Runtime Environment (JRE or J2SE)
* příklady starých verzí v Přidat nebo odebrat programy:
- J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 8
Java 2 Runtime Environment, SE v1.4.2
- Odinstaluj postupně po sobě případné všechny staré verze Javy
- Po skončení odinstalovaní restartuj Pc.
- Pak už jen spusť instalaci poslední verze ze souboru jre-6u7-windows-i586-p.exe, který sis stáhl na začátku
Pro lepší zabezpečení bych ti doporučil doinstalovat firewall, můžeš si vybrat některý zde uvedený nebo některý jiný z odkazu: Přehled osobních firewallů
Firewally zdarma:
Kerio - přehledný, větší možnosti nastavení, náročnější na systémové prostředky, v češtině
ZoneAlarm - jednoduchý, kompatibilní, nenáročný na systémové prostředky, málo možností nastavení, v angličtině + návod
Comodo - kvalitní, pokročilý, s mnoha funkcemi, originálně v angličtině (nepoužít jeho malware scaner, nebo přes něj odstranit co najde)
Používáš starší verzi HijackThis, pokud by sis někdy příště dával zkontrolovat log, tak si stáhni aktuální verzi zde a tu starou před použitím vymaž.
Máš ještě problémy? Mrkni se jestli se ti zobrazují disky, vedle hodin nemáš nápis VIRUS ALERT ...
It may take a while to get a response, because the "HJT Team" are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Pokud máte nějaký problém, tak mi neposílejte SZ/PM zprávy s logy a dejte je do fóra. Na tyto SZ není možno odpovědět
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 79 hostů