Prosim o kontrolu

lafin · Příspěvekod **lafin** » 22 čer 2007 20:44

Logfile of HijackThis v1.99.1
Scan saved at 20:40:17, on 22. 6. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [wipe mix loud locks] C:\Documents and Settings\All Users\Application Data\Logstartwipemix\WipeHtm.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [LINK BONE] C:\DOCUME~1\Laco\APPLIC~1\EXTRAA~1\BarbAxisSoap.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4993743718
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F40AD30-0617-4B03-A9FD-408951387EC6}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{38604665-D15B-4775-9800-2BF7544B3A2E}: NameServer = 192.168.0.1
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE

Reklama

Baron Prášil · Příspěvekod **Baron Prášil** » 22 čer 2007 21:26

fixni
v okně programu HJT zaškrtni nalevo u položek co napíšu a potom klik na Fix checked

O4 - HKLM\..\Run: [wipe mix loud locks] C:\Documents and Settings\All Users\Application Data\Logstartwipemix\WipeHtm.exe
O4 - HKCU\..\Run: [LINK BONE] C:\DOCUME~1\Laco\APPLIC~1\EXTRAA~1\BarbAxisSoap.exe

použij Lopfind podle návodu tady
http://www.viry.cz/forum/viewtopic.php?t=34528

a pošli z něho log

lafin · Příspěvekod **lafin** » 24 čer 2007 11:42

NoLop! Log by Skate_Punk_21

Fix running from: C:\Documents and Settings\Laco\Desktop
[24. 6. 2007]
[11:31:31]

---Infection Files Found/Removed---
C:\WINDOWS\tasks\AC958C2890AE3DB8.job

Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**

---Listing AppData sub directories---

C:\Documents and Settings\Administrator\Application Data\Identities
C:\Documents and Settings\Administrator\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Adobe Systems
C:\Documents and Settings\All Users\Application Data\Ashampoo
C:\Documents and Settings\All Users\Application Data\Autodesk
C:\Documents and Settings\All Users\Application Data\Avg7 -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Cyberlink
C:\Documents and Settings\All Users\Application Data\Grisoft
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Lavasoft
C:\Documents and Settings\All Users\Application Data\Locktime
C:\Documents and Settings\All Users\Application Data\Logstartwipemix
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Real -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Soliddocuments
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Temp -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Dominika\Application Data\Adobe
C:\Documents and Settings\Dominika\Application Data\Ahead
C:\Documents and Settings\Dominika\Application Data\Avg7
C:\Documents and Settings\Dominika\Application Data\Corel
C:\Documents and Settings\Dominika\Application Data\Icqlite
C:\Documents and Settings\Dominika\Application Data\Identities
C:\Documents and Settings\Dominika\Application Data\Lavasoft
C:\Documents and Settings\Dominika\Application Data\Locktime
C:\Documents and Settings\Dominika\Application Data\Macromedia
C:\Documents and Settings\Dominika\Application Data\Megauploadtoolbar -- EMPTY Directory
C:\Documents and Settings\Dominika\Application Data\Microsoft
C:\Documents and Settings\Dominika\Application Data\Mozilla
C:\Documents and Settings\Dominika\Application Data\Myphoneexplorer
C:\Documents and Settings\Dominika\Application Data\Real
C:\Documents and Settings\Dominika\Application Data\Soliddocuments
C:\Documents and Settings\Dominika\Application Data\Vlc
C:\Documents and Settings\Dominika\Application Data\Zoner
C:\Documents and Settings\Jana\Application Data\Adobe
C:\Documents and Settings\Jana\Application Data\Ahead
C:\Documents and Settings\Jana\Application Data\Avg7
C:\Documents and Settings\Jana\Application Data\Corel
C:\Documents and Settings\Jana\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Jana\Application Data\Identities
C:\Documents and Settings\Jana\Application Data\Locktime
C:\Documents and Settings\Jana\Application Data\Macromedia
C:\Documents and Settings\Jana\Application Data\Megauploadtoolbar -- EMPTY Directory
C:\Documents and Settings\Jana\Application Data\Microsoft
C:\Documents and Settings\Jana\Application Data\Mozilla
C:\Documents and Settings\Jana\Application Data\Soliddocuments
C:\Documents and Settings\Jana\Application Data\Sun
C:\Documents and Settings\Jana\Application Data\Vlc
C:\Documents and Settings\Jana\Application Data\Zoner
C:\Documents and Settings\Laco\Application Data\Adobe
C:\Documents and Settings\Laco\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Ahead
C:\Documents and Settings\Laco\Application Data\Ashampoo Photo Commander 5 -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Autodesk
C:\Documents and Settings\Laco\Application Data\Bitdownload
C:\Documents and Settings\Laco\Application Data\Bsplayer
C:\Documents and Settings\Laco\Application Data\Corel
C:\Documents and Settings\Laco\Application Data\Dvdcss
C:\Documents and Settings\Laco\Application Data\Extra About
C:\Documents and Settings\Laco\Application Data\Garmin
C:\Documents and Settings\Laco\Application Data\Google
C:\Documents and Settings\Laco\Application Data\Gps Utility
C:\Documents and Settings\Laco\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Icqlite -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Identities
C:\Documents and Settings\Laco\Application Data\Lavasoft -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Locktime
C:\Documents and Settings\Laco\Application Data\Macromedia
C:\Documents and Settings\Laco\Application Data\Media Player Classic
C:\Documents and Settings\Laco\Application Data\Microsoft
C:\Documents and Settings\Laco\Application Data\Mozilla
C:\Documents and Settings\Laco\Application Data\Myphoneexplorer
C:\Documents and Settings\Laco\Application Data\Oti
C:\Documents and Settings\Laco\Application Data\Plaux
C:\Documents and Settings\Laco\Application Data\Real
C:\Documents and Settings\Laco\Application Data\Soliddocuments
C:\Documents and Settings\Laco\Application Data\Sun
C:\Documents and Settings\Laco\Application Data\Utorrent
C:\Documents and Settings\Laco\Application Data\Vlc
C:\Documents and Settings\Laco\Application Data\Wordtopdf
C:\Documents and Settings\Laco\Application Data\Zoner
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft

Baron Prášil · Příspěvekod **Baron Prášil** » 24 čer 2007 16:47

pošli novej log z hijackthis ,ale hijackthis.exe přejmenuj na test.exe

sakiri · Příspěvekod **sakiri** » 24 čer 2007 17:14

+

Jak ti dával Baron Prášil ten odkaz tak se podívej jestli nemáš nainstalovaný některý z těch podvodných programů.Pokud ano tak ho odinstaluj.

Poté si stáhni Avenger a spusť ho pod účtem administrátora.

Zaškrtni volbu - Input script manually a klikni na ikonku lupy vyskočí prázdné okno kam zkopíruj ten tučně označený text:
Folders to delete:
C:\Documents and Settings\All Users\Application Data\Logstartwipemix
C:\Documents and Settings\Laco\Application Data\Bitdownload
C:\Documents and Settings\Laco\Application Data\Extra About

A klikni na Done.
Poté klikni na ikonku Semafory.

Vyskočí hláška kde odklikni Yes poté další hláška kde odklikni Yes.
PC se restartuje.Po restartu by ti měl "vyběhnout" log z Avengeru tak ho sem zkopíruj.

+ bych prosil pak nový log z NoLop + log z Avengeru.

lafin · Příspěvekod **lafin** » 24 čer 2007 19:03

AVENGER

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\yfyasvfy

*******************

Script file located at: \??\C:\WINDOWS\system32\sejbjsvp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Folder C:\Documents and Settings\All Users\Application Data\Logstartwipemix deleted successfully.
Folder C:\Documents and Settings\Laco\Application Data\Bitdownload deleted successfully.
Folder C:\Documents and Settings\Laco\Application Data\Extra About deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

------------------------------------------------------------------------------------------------------------------------

HJT (premenovane na test.exe)

Logfile of HijackThis v1.99.1
Scan saved at 18:59:01, on 24. 6. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\test.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: wssclient - {8D99D2A3-317C-4929-8A5D-21140259D93A} - c:\PROGRA~1\wss.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [LINK BONE] C:\DOCUME~1\Laco\APPLIC~1\EXTRAA~1\BarbAxisSoap.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4993743718
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F40AD30-0617-4B03-A9FD-408951387EC6}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{38604665-D15B-4775-9800-2BF7544B3A2E}: NameServer = 192.168.0.1
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE

------------------------------------------------------------------------------------------------------------------------

NoLop

NoLop! Log by Skate_Punk_21

Fix running from: C:\Program Files\Mozilla Firefox
[24. 6. 2007]
[19:01:24]

---Infection Files Found/Removed---
NO INFECTION FILES FOUND - Cleaning Aborted.

---Listing AppData sub directories---

C:\Documents and Settings\Administrator\Application Data\Identities
C:\Documents and Settings\Administrator\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Adobe Systems
C:\Documents and Settings\All Users\Application Data\Ashampoo
C:\Documents and Settings\All Users\Application Data\Autodesk
C:\Documents and Settings\All Users\Application Data\Avg7 -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Cyberlink
C:\Documents and Settings\All Users\Application Data\Grisoft
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Lavasoft
C:\Documents and Settings\All Users\Application Data\Locktime
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Real -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Soliddocuments
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Temp -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Dominika\Application Data\Adobe
C:\Documents and Settings\Dominika\Application Data\Ahead
C:\Documents and Settings\Dominika\Application Data\Avg7
C:\Documents and Settings\Dominika\Application Data\Corel
C:\Documents and Settings\Dominika\Application Data\Icqlite
C:\Documents and Settings\Dominika\Application Data\Identities
C:\Documents and Settings\Dominika\Application Data\Lavasoft
C:\Documents and Settings\Dominika\Application Data\Locktime
C:\Documents and Settings\Dominika\Application Data\Macromedia
C:\Documents and Settings\Dominika\Application Data\Megauploadtoolbar -- EMPTY Directory
C:\Documents and Settings\Dominika\Application Data\Microsoft
C:\Documents and Settings\Dominika\Application Data\Mozilla
C:\Documents and Settings\Dominika\Application Data\Myphoneexplorer
C:\Documents and Settings\Dominika\Application Data\Real
C:\Documents and Settings\Dominika\Application Data\Soliddocuments
C:\Documents and Settings\Dominika\Application Data\Vlc
C:\Documents and Settings\Dominika\Application Data\Zoner
C:\Documents and Settings\Jana\Application Data\Adobe
C:\Documents and Settings\Jana\Application Data\Ahead
C:\Documents and Settings\Jana\Application Data\Avg7
C:\Documents and Settings\Jana\Application Data\Corel
C:\Documents and Settings\Jana\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Jana\Application Data\Identities
C:\Documents and Settings\Jana\Application Data\Locktime
C:\Documents and Settings\Jana\Application Data\Macromedia
C:\Documents and Settings\Jana\Application Data\Megauploadtoolbar -- EMPTY Directory
C:\Documents and Settings\Jana\Application Data\Microsoft
C:\Documents and Settings\Jana\Application Data\Mozilla
C:\Documents and Settings\Jana\Application Data\Soliddocuments
C:\Documents and Settings\Jana\Application Data\Sun
C:\Documents and Settings\Jana\Application Data\Vlc
C:\Documents and Settings\Jana\Application Data\Zoner
C:\Documents and Settings\Laco\Application Data\Adobe
C:\Documents and Settings\Laco\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Ahead
C:\Documents and Settings\Laco\Application Data\Ashampoo Photo Commander 5 -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Autodesk
C:\Documents and Settings\Laco\Application Data\Bsplayer
C:\Documents and Settings\Laco\Application Data\Corel
C:\Documents and Settings\Laco\Application Data\Dvdcss
C:\Documents and Settings\Laco\Application Data\Garmin
C:\Documents and Settings\Laco\Application Data\Google
C:\Documents and Settings\Laco\Application Data\Gps Utility
C:\Documents and Settings\Laco\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Icqlite -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Identities
C:\Documents and Settings\Laco\Application Data\Lavasoft -- EMPTY Directory
C:\Documents and Settings\Laco\Application Data\Locktime
C:\Documents and Settings\Laco\Application Data\Macromedia
C:\Documents and Settings\Laco\Application Data\Media Player Classic
C:\Documents and Settings\Laco\Application Data\Microsoft
C:\Documents and Settings\Laco\Application Data\Mozilla
C:\Documents and Settings\Laco\Application Data\Myphoneexplorer
C:\Documents and Settings\Laco\Application Data\Oti
C:\Documents and Settings\Laco\Application Data\Plaux
C:\Documents and Settings\Laco\Application Data\Real
C:\Documents and Settings\Laco\Application Data\Soliddocuments
C:\Documents and Settings\Laco\Application Data\Sun
C:\Documents and Settings\Laco\Application Data\Utorrent
C:\Documents and Settings\Laco\Application Data\Vlc
C:\Documents and Settings\Laco\Application Data\Wordtopdf
C:\Documents and Settings\Laco\Application Data\Zoner
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft

Baron Prášil · Příspěvekod **Baron Prášil** » 25 čer 2007 15:55

fixni
O2 - BHO: wssclient - {8D99D2A3-317C-4929-8A5D-21140259D93A} - c:\PROGRA~1\wss.dll

a pošli novej log z hijackthis

Prosim o kontrolu

Prosim o kontrolu

NOlop log

Kdo je online