Spy bot neco nasel Vyřešeno

[PinkGirl]

Ahoj,

pri otevrenem netu vyskocilo jakesi okno od spy botu a ''nejak se trepalo'' - inicializace, tak sem hned pustila test
a cosi nasel pod zalozkou na Firefoxu;
[www.spywareinfo.com/~merijn/cwschronicles.html#smartsearch]

Zalozku jsem smazala, a dalsi test uz nasel zase jenom Cookies od Flocka.
Mawarebytes nic nenasel

http://uloz.to/1191779/initialization.jpg
http://uloz.to/1191778/1.jpg

Nejak mi to nejde vlozit jinam, tak je to asponna uloz-to, snad to pujde otevrit, kdyz ted uloz nejak nefacha.
Je to nejak spatny ? Diky
...
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "video activex access Trojan" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Parentis Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "TitanShield Antispyware Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
Object "SmitFraud Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "CyberSitter Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Backdoor (IRCBot) Trojans Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Spyware.ExpressKeylog Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
Object "DiskKnight Adware" found in File System! Action Taken: No Action Taken.
Entry "HKCR\Search.CustomWordbreaker" refers to invalid object "{9E175BB4-F52A-11D8-B9A5-505054503030}". Action Taken: No Action Taken.
Entry "HKCR\Search.CustomWordbreaker.1" refers to invalid object "{9E175BB4-F52A-11D8-B9A5-505054503030}". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\Program Files\Java\jre1.6.0_04\bin\javaws.exe"". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\Program Files\Java\jre1.6.0_07\bin\javaws.exe"". Action Taken: No Action Taken.

[Reklama]

[jaro3]

Vítej na fóru PC-HELP!

V logu MWAV nic není, jedná se o pouze zbytky pod odvirování.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[PinkGirl]

Dekan :)
Neni to muj notas, jen si ho muzu pujcovat, ..ale nesmim ho vratit nemocnej :( i kdyz ma dva a tento kolikrat muzu mit i nekolik dni. Hlavne do skoly, ale aji na filmy a tak.
Diky za pomoc. Ja se pak diky vam necham pochvalit, jak jsem to zvladla :)
Katka

Malwarebytes' Anti-Malware 1.33
Database version: 1670
Windows 6.0.6001 Service Pack 1

20/01/2009 14:53:17
mbam-log-2009-01-20 (14-53-17).txt

Scan type: Quick Scan
Objects scanned: 44080
Time elapsed: 5 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[jaro3]

Vlož ještě log z hJT.

[PinkGirl]

to nevim, jak se pouziva ..jeslti jen staci kliknout na ikonu ?
Teda precetla jsem navod, ale tam je samy ..nedelej to, nemaz to, a tak jeslti to muzu jen spustit ? a nic to neudela.

[jaro3]

návod je zde : viewtopic.php?f=70&t=5119
Jen spustíš program Hijackthis.

[PinkGirl]

Jojo, dekan, to jsem nastudovala, jen jsem nevedela, jestli to muzu jakoze jen tak pustit a nic to neudela
Jsem to HJT poznala podle nazvu ikony, kdyz ma aji lupu, ze asik neco hleda :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25:02, on 20/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\V0250Mon.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Windows\system32\SearchFilterHost.exe
C:\totalcmd\tcmadmin.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [V0250Mon.exe] C:\Windows\V0250Mon.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: QuickSet.lnk = ?
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 6180 bytes

[jaro3]

Nic závadného tam nevidím.
Fixni podle návodu:

Kód: Vybrat vše

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Napiš jak se chová comp a Spybot.

[PinkGirl]

Dekujuuu.
Ja jsem byla poucenna co jako ma delat, kdyby bylo nejhur :) ..prej zalest pod perinu. A kdyz ma ne vcera vyskocil ten Spybot, tak to byla fakt sranda.
Moc dekuji, zase budu vypadat chytre

Jo, Spy bot nedela nic, od vcerejska co tak vyskocil, a kompl facha. Akorat sem ho teda pustila a napsal, ze je tam 1350 temporary objects ..tak sem klikla, ze je chci vymazat (ptal se ano/ne) a ted jsem ho jeste pustila. Ja vam teda jeste nepisi, jeslti ted neco najde.

[jaro3]

Není zač ..
takže jestli nejsou problémy,tak vyčisti systém CCleanerem
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
Aktualizuj Spybota, kdyby něco napiš.

[PinkGirl]

Ccleaner pouzivam porad podle pouceni a navodu.
Jen Spybot najednou vcera vylitnul a to byla fakt sranda. To ATF je nainstalovane, tak podle toho navodu to udelam.

[jaro3]

Použila si MWAV, tak můžeš ještě udělat toto:
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš