trojan win32/Agent.BI, please help me!!!

kovino · Příspěvek od **kovino** » sob 12. bře 2005, 12:56

Caute mam velky problem s trojanom win32/Agent.BI, nod32 ho zisti v operacnej pamati, ale nedokaze ho odstranit, neviete mi poradit ako sa ho zbavit z oper. pamate, inak je aj na disku, ked napadnute subory vymazem, tak sa aj tak opat vytvoria, neviem co s tym. Inak posielam aj log s hijacku, ale asi nepomoze, ale zaujimalo by ma este ako sa zbavit tohoto, aj ked to v hijacku fixnem, tak sa to tam opat objavi. Dakujem za kazdu pomoc!!
-----------------------------------------------
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\WINDOWS\system32\shdocpe.dll/security.htm#subID=BSW;677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocpe.dll/asst.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
-----------------------------------------------
Logfile of HijackThis v1.98.2
Scan saved at 12:53:38, on 12. 3. 2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ntnut.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\nod\nod32kui.exe
C:\Program Files\nod\nod32krn.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tweak-XP Pro\AdBlocker.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Eurotel Akcelerator Plus\NGSpawner.exe
C:\Program Files\Eurotel Akcelerator Plus\NettGain1200_C.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\crwk32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
C:\WINDOWS\netxr.exe
C:\Program Files\nod\nod32.exe
D:\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\WINDOWS\system32\shdocpe.dll/security.htm#subID=BSW;677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocpe.dll/asst.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:9090 ftp=localhost:9093 https=localhost:9092
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost; 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {95595C72-5D9C-0109-122D-63FD127A8BCC} - C:\WINDOWS\system32\atlbd32.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Setup experation] C:\WINDOWS\system32\dllcache\svchost.exe
O4 - HKLM\..\Run: [FastStart] C:\WINDOWS\system32\ntnut.exe home
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\STARDOCK\WINCUS~1\BOOTSKIN\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\nod\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [BlockAds] "C:\Program Files\Tweak-XP Pro\AdBlocker.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Eurotel Akcelerator Plus.lnk = C:\Program Files\Eurotel Akcelerator Plus\NGSpawner.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {23232323-2323-2323-2323-232323291122} - file://c:\x.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BF9D5BA-2C8A-42A5-B8BA-0A7DFB281A86}: NameServer = 194.154.230.66 194.154.230.74
O17 - HKLM\System\CCS\Services\Tcpip\..\{43696961-9563-4B8A-89F4-9CBF97C4508B}: NameServer = 209.47.15.118,64.157.143.38
O17 - HKLM\System\CS3\Services\Tcpip\..\{1BF9D5BA-2C8A-42A5-B8BA-0A7DFB281A86}: NameServer = 194.154.230.66 194.154.230.74
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O21 - SSODL: yYjGfxrTSyRmG - {2C6111EE-86CB-BB44-8938-913C5FC68BC9} - C:\WINDOWS\System32\nn.dll
O21 - SSODL: mtklef - {64EC4E14-691C-4EDF-D892-EFDF87FCC738} - C:\WINDOWS\System32\izfl32.dll
O21 - SSODL: mtklef - {64EC4E14-691C-4EDF-D892-EFDF87FCC738} - C:\WINDOWS\System32\izfl32.dll

hook · Příspěvek od **hook** » sob 12. bře 2005, 13:09

C:\WINDOWS\system32\ntnut.exe - ukonci a smaz z disku
C:\WINDOWS\crwk32.exe - to same
C:\WINDOWS\netxr.exe - to same

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\WINDOWS\system32\shdocpe.dll/security.htm#subID=BSW;677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kwlun.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://shdocpe.dll/asst.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {95595C72-5D9C-0109-122D-63FD127A8BCC} - C:\WINDOWS\system32\atlbd32.dll
O4 - HKLM\..\Run: [FastStart] C:\WINDOWS\system32\ntnut.exe home
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {23232323-2323-2323-2323-232323291122} - file://c:\x.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O21 - SSODL: yYjGfxrTSyRmG - {2C6111EE-86CB-BB44-8938-913C5FC68BC9} - C:\WINDOWS\System32\nn.dll
O21 - SSODL: mtklef - {64EC4E14-691C-4EDF-D892-EFDF87FCC738} - C:\WINDOWS\System32\izfl32.dll
O21 - SSODL: mtklef - {64EC4E14-691C-4EDF-D892-EFDF87FCC738} - C:\WINDOWS\System32\izfl32.dll

fix v hijacku

nevidim FW

hook · Příspěvek od **hook** » sob 12. bře 2005, 13:11

a poslete sem log z noveho Hijacku verze 1.99.1 a stahnete si SP2

hook · Příspěvek od **hook** » sob 12. bře 2005, 14:39

vypni obnovu systemu, smaz docasny soubory internetu a smaz obsah slozky windows\temp, potom ukonci ty tri procesy, najdi je na disku a smaz je, potom oznac ty polozky v hijacku a klikni na "FIX CHECKED", potom si stahni service pack 2....FW je firewall - http://www.microsoft.com/cze/security/p ... rewall.asp

az to udelas stahni si novy hijackthis http://humanoid.chytrak.cz/HijackThis.exe a posli sem log

kovino · Příspěvek od **kovino** » sob 12. bře 2005, 16:11

Tak tu je ten log..., ale stale mam ten virus v operacnej pamati, neviem ako sa ho zbavit:((
---------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:03:12, on 12. 3. 2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\nod32\nod32krn.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\d3iq32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\system32\ipkx.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tweak-XP Pro\AdBlocker.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Eurotel Akcelerator Plus\NGSpawner.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\Program Files\Eurotel Akcelerator Plus\NettGain1200_C.exe
D:\hijackthis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DABFF8C3-DF48-F11C-290D-D7CD732B35CC} - C:\WINDOWS\system32\javakr.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Setup experation] C:\WINDOWS\system32\dllcache\svchost.exe
O4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",run
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\STARDOCK\WINCUS~1\BOOTSKIN\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [ipkx.exe] C:\WINDOWS\system32\ipkx.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\nod32\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunOnce: [d3iq32.exe] C:\WINDOWS\d3iq32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [BlockAds] "C:\Program Files\Tweak-XP Pro\AdBlocker.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Eurotel Akcelerator Plus.lnk = C:\Program Files\Eurotel Akcelerator Plus\NGSpawner.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BF9D5BA-2C8A-42A5-B8BA-0A7DFB281A86}: NameServer = 194.154.230.66 194.154.230.74
O17 - HKLM\System\CCS\Services\Tcpip\..\{43696961-9563-4B8A-89F4-9CBF97C4508B}: NameServer = 209.47.15.118,64.157.143.38
O17 - HKLM\System\CS3\Services\Tcpip\..\{1BF9D5BA-2C8A-42A5-B8BA-0A7DFB281A86}: NameServer = 194.154.230.66 194.154.230.74
O21 - SSODL: yYjGfxrTSyRmG - {2C6111EE-86CB-BB44-8938-913C5FC68BC9} - C:\WINDOWS\System32\nn.dll
O21 - SSODL: yYjGfxrTSyRmG - {2C6111EE-86CB-BB44-8938-913C5FC68BC9} - C:\WINDOWS\System32\nn.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\nod32\nod32krn.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Panda Preventium+ Service (PREVSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe (file missing)
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Network Security Service (NSS) (Ź 6QÔő'Ş´ĆĐ8) - Unknown owner - C:\WINDOWS\atljg32.exe (file missing)

hook · Příspěvek od **hook** » sob 12. bře 2005, 16:23

C:\WINDOWS\d3iq32.exe - ukonci proces, pak ho najdi a smaz
C:\WINDOWS\system32\ipkx.exe - to samy

tohle fixni v hijacku

O2 - BHO: (no name) - {DABFF8C3-DF48-F11C-290D-D7CD732B35CC} - C:\WINDOWS\system32\javakr.dll
O4 - HKLM\..\Run: [ipkx.exe] C:\WINDOWS\system32\ipkx.exe
O4 - HKLM\..\RunOnce: [d3iq32.exe] C:\WINDOWS\d3iq32.exe
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O21 - SSODL: yYjGfxrTSyRmG - {2C6111EE-86CB-BB44-8938-913C5FC68BC9} - C:\WINDOWS\System32\nn.dll
O21 - SSODL: yYjGfxrTSyRmG - {2C6111EE-86CB-BB44-8938-913C5FC68BC9} - C:\WINDOWS\System32\nn.dll
O23 - Service: Network Security Service (NSS) (Ź 6QÔő'Ş´ĆĐ8) - Unknown owner - C:\WINDOWS\atljg32.exe (file missing)

a s tim FW se omlouvam, bezi ti XP firewall

kovino · Příspěvek od **kovino** » sob 12. bře 2005, 16:49

Problem vyrieseny, comp je opat cisty:) Diky moc za tvoju pomoc, velmi si mi pomohol hook!!!

hook · Příspěvek od **hook** » sob 12. bře 2005, 17:17

neni zac, stahni si service pack 2 - to uz je nutnost, nastav noda na maximalni citlivost - sken, pak to projed programem z myho podpisu(dej full system scan) a programem ad-aware http://www.majorgeeks.com/download506.html