Winlogon.exe vir

[Tequilla]

Pouzil som teda fixwareout-ten sa iba nainstaloval ale niaky log mi nevihodil, Avangera som tiez pouzil a po restarte mi vyhodi MS-Dos okno a v nom nieco o eroroch a tento log
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\pivnxcac

*******************

Script file located at: \??\C:\ipvroxdp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\cjsmkng.exe deleted successfully.
File C:\hivtvru.exe deleted successfully.
File C:\xfufinsm.exe deleted successfully.
File C:\WINDOWS\_MSRSTRT.EXE deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

A este log z hijackthis

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:23:29, on 8.7.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DrayTek\Vigor318 ADSL\CnxDslTb.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
E:\Moje Dokumenty\Utility\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 http://www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Trellian BHO Impl - {24180B00-2EB6-11d7-BD6F-004854603DCE} - C:\Program Files\TRELLIAN\Toolbar\toolbar.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolbarBrowser - {71AAABE5-1F0F-11d7-BD6F-004854603DCE} - C:\Program Files\TRELLIAN\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\DrayTek\Vigor318 ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Načítať použitie &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se8300.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1ECB1E95-59BD-4095-84A7-363608B41F0F}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{537AED10-97AB-4273-A1CB-58DFD3CBE23E}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{65EFC17C-C469-4158-9366-ABB4576DE66D}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{92C08AC2-4164-4F7B-BB99-12264CE174F7}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{F8F4B65F-6402-4744-841B-50B3222D5811}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{1ECB1E95-59BD-4095-84A7-363608B41F0F}: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\..\{1ECB1E95-59BD-4095-84A7-363608B41F0F}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8381 bytes

Ale nechapem preco mi ten fixwareout nechce hodit log

[Reklama]

[Baron Prášil]

fixwareout udělal co měl.

ještě fixni
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1ECB1E95-59BD-4095-84A7-363608B41F0F}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{537AED10-97AB-4273-A1CB-58DFD3CBE23E}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{65EFC17C-C469-4158-9366-ABB4576DE66D}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{92C08AC2-4164-4F7B-BB99-12264CE174F7}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{F8F4B65F-6402-4744-841B-50B3222D5811}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{1ECB1E95-59BD-4095-84A7-363608B41F0F}: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\..\{1ECB1E95-59BD-4095-84A7-363608B41F0F}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =

co komp?

[Tequilla]

Ja uz neviem stale ta ista tabulka aku som dal hore There is a problem with this Windows installer package Nemam este skusit ten CleanerUp ktory som tu uz popisoval od Microsoftu nemate s nim nejake skusenosti, mozno je pravda ze sa poriadne neodinstalovala ta Java z ponuky Pidat alebo odobrat Programy (Ajked ja ju tam uz nemam) a mozno z tej starej sa neodinstaloval niaky MSI balícek a preto si pri instalácií novej Javy misli ze mam nainstalovanu niaku starsiu verziu.

[fredik]

S tím prográmkem od MS nemám zkušenosti takže s tím ti neporadím.

Zkus udělat tento log.
Spusť znovu HijackThis
Klikni na tlačítko: Open the Mics Tools section (případně tlačítko Config... pokud jsi v okně kde se zobrazuje log z HJT)
Na hoře klikni na položku: Misc Tools pokud už nebudu vybraná
pak klikni pod položkou System tools na tlačítko: Open Uninstall Manager...
tam klikni na tlačítko: Save list...
ulož si daný log a jeho výsledek sem zkopíruj

Můžeš zkusit klidně starší verzi JRE (1.5.12 je aktuální) ale myslím že výsledek bude stejný.
Najdeš ji zde: Java Runtime Environment (JRE) 5.0 Update 12. Postup je stejný ale tentokrát ji hledej pod "Java Runtime Environment (JRE) 5.0 Update 12"

Někde sem narazil že bývá problém v instalátoru který je součástí JRE. Ještě bys mohl zkusit nainstalovat celé JDK javy, jejíž součástí je JRE a pak pokud by se instalace zdařila, tak pak následně odinstalovat JDK a JRE si tam nechat. Je to krapet složitější ale to bych když tak pak napsal, ale nemůžu ti zaručit že se to i pak povede k úspěšné instalaci.

PS:
Zkoušel jsi jak sem ti dával ten odkaz nainstalovat Javu do jiného adresáře něž je defaultně nastaveny v instalátoru?

[Tequilla]

No mislím si ze tam Budete hladat nieco ako stopy po Jave ale ja som tam nic nenasiel ale skusim tu Javu 6 Up-Date2 nainstalovat do ineho priecinka ono by malo byt prakticky jedno kde je nainstalovana hlavne ze pojde
Aby som nezabudol tie informácie z hijackthis uninstall_list.txt

Accent EXCEL Password Recovery 2.50
ACE Mega CoDecS Pack
Acoustica Effects Pack
Ad-Aware SE Personal
Adobe Download Manager 2.2 (Remove Only)
Adobe Flash Player 9
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.0 - Czech
Adobe Shockwave Player
AIDA32 v3.93
Antivírusový systém NOD32
Apple Software Update
Audacity 1.2.6
AVG Anti-Spyware 7.5
AviSynth 2.5
BitSpirit v3.2.2.215 Stable
CCleaner (remove only)
ConvertXtoDVD 2.0.9b
dBpowerAMP Mp4 Codec
dBpowerAMP Nero Mp4 Codec
DFX 8 for Winamp
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
DrayTek Vigor318 USB ATM/ADSL Adapter
DVD Decrypter (Remove Only)
DVD Region+CSS Free 5.9.8.3
dvdSanta 4.00
FFdshow [2006-07-16 | rev 2546]
FLV Player 1.3.3
HijackThis 2.0.0
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB926239)
Labtec Wireless Desktop
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.4)
mpegable X4 live
MSN
MSXML 4.0 SP2 (KB927978)
Need for Speed Underground 2
Nero Suite
NOD32 FiX v1.9
NVIDIA Drivers
PC Translator
Realtek AC'97 Audio
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Samsung Samples Installer
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Sunbelt Kerio Personal Firewall
ToolbarBrowser v2.4
Total Commander (Remove or Repair)
Total Video Converter 2.52
Trellian Dictionary v1.0
Trellian LiveUpgrade v2.0
Ultra Video To Flash Converter 2.0
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Vodafone 804SS USB driver Software
WIDCOMM Bluetooth Software
Winamp (remove only)
WinAVIVideoConverter
Windows Installer 3.1 (KB893803)
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows VistaTheme
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
Yahoo! Toolbar
ZipGenius 6 (6.0.1.1010)
Zoner Media Explorer 6
Zoner Photo Studio 9

[speedy123]

ahoj ja mam tiez problem s tym winlogon.exe mam avg8 a vyhadzuje mi ze je trojan vo winlogone ten hijack som stiahol ako s nim mam robit a hodit sem ten log ci co pomozte mi prosim