log z mwav
Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "tencent qq Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ultimate defender Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
Object "smitfraud Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "zlob Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "savenow Adware" found in File System! Action Taken: No Action Taken
HijackThis utilita + LOGY k posouzeni
- Baron Prášil
- Začátečník
-
- Registrován: 08. čer 2006
- jansimo
- Nováček
-
- Registrován: 06. čer 2007
- Baron Prášil
- Začátečník
-
- Registrován: 08. čer 2006
- jansimo
- Nováček
-
- Registrován: 06. čer 2007
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
prosím o kontrolu logu - problem se svchost.exe
Logfile of HijackThis v1.99.1
Scan saved at 10:20:51, on 2.7.2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\system32\taskeng.exe
D:\Windows\Explorer.EXE
D:\Windows\System32\oodtray.exe
D:\Windows\RtHDVCpl.exe
D:\Program Files\ESET\nod32kui.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\systern.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Opera\Opera.exe
D:\Windows\System32\mobsync.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Users\martin\AppData\Roaming\Opera\Opera\profile\cache4\temporary_download\jeefogui.com
D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Users\martin\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [Microsoft] systern.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
O4 - HKCU\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: d:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - -"D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Windows Genuine Advantage (svchost) - Unknown owner - D:\Windows\svchost.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
nemuzu ho dostat pryc, mel by to byt ten oznaceny, nasel jsem toto http://www.spyware.cz/go.php?p=viry&t=popis&id=203, ale nepomaha...
Scan saved at 10:20:51, on 2.7.2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\system32\taskeng.exe
D:\Windows\Explorer.EXE
D:\Windows\System32\oodtray.exe
D:\Windows\RtHDVCpl.exe
D:\Program Files\ESET\nod32kui.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\systern.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Opera\Opera.exe
D:\Windows\System32\mobsync.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Users\martin\AppData\Roaming\Opera\Opera\profile\cache4\temporary_download\jeefogui.com
D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Users\martin\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [Microsoft] systern.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
O4 - HKCU\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: d:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - -"D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Windows Genuine Advantage (svchost) - Unknown owner - D:\Windows\svchost.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
nemuzu ho dostat pryc, mel by to byt ten oznaceny, nasel jsem toto http://www.spyware.cz/go.php?p=viry&t=popis&id=203, ale nepomaha...
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
- Baron Prášil
- Začátečník
-
- Registrován: 08. čer 2006
a to proto,že nemáš slušnej firewall a běžej ti dva antispywerový programy současně.to potom chudák nod 
takže vypni štít defendera.
zastav a typ spuštění nastav na zakázáno této službě
Windows Genuine Advantage (svchost)
služby spustíš napsáním příkazu services.msc do Spustit... v nabídce START a klik na OK
ve správci úloh ukonči
systern.exe
fixni
v okně programu HJT zaškrtni nalevo u položek co napíšu a potom klik na Fix checked
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
O13 - Gopher Prefix:
potom použij Avenger http://www.viry.cz/forum/viewtopic.php?t=21484
a tento skript
po restartu pošli log z Avengera a log z nového HiJackThis_v2
a mrkni se po nějakým firewallu pro vistu
takže vypni štít defendera.
zastav a typ spuštění nastav na zakázáno této službě
Windows Genuine Advantage (svchost)
služby spustíš napsáním příkazu services.msc do Spustit... v nabídce START a klik na OK
ve správci úloh ukonči
systern.exe
fixni
v okně programu HJT zaškrtni nalevo u položek co napíšu a potom klik na Fix checked
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
O13 - Gopher Prefix:
potom použij Avenger http://www.viry.cz/forum/viewtopic.php?t=21484
a tento skript
Kód: Vybrat vše
D:\Windows\system32\systern.exe
D:\Windows\svchost.exea mrkni se po nějakým firewallu pro vistu
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
díky za rady, jinak....avenger mi pod vistou nejede 
po fixnutí mi to vyhodí log
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:50:38, on 2.7.2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\Explorer.EXE
D:\Windows\System32\mobsync.exe
D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
D:\Program Files\ESET\nod32kui.exe
D:\Windows\system32\taskeng.exe
D:\Windows\System32\oodtray.exe
D:\Windows\RtHDVCpl.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Program Files\Opera\Opera.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Windows\system32\mmc.exe
D:\Windows\system32\Taskmgr.exe
D:\Windows\system32\NOTEPAD.EXE
D:\Windows\system32\SearchFilterHost.exe
D:\Users\martin\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [WinFast Schedule] D:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule2] C:\Program Files (x86)\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule3] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule4] C:\Program Files (x86)\WinFast\WFTVFM\WFWIZ.exe
O4 - HKCU\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - -"D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" (file missing)
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe" (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
--
End of file - 6448 bytes
a tato služba Windows Genuine Advantage (svchost) neni v services.msc k nalezení...
po fixnutí mi to vyhodí log
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:50:38, on 2.7.2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\Explorer.EXE
D:\Windows\System32\mobsync.exe
D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
D:\Program Files\ESET\nod32kui.exe
D:\Windows\system32\taskeng.exe
D:\Windows\System32\oodtray.exe
D:\Windows\RtHDVCpl.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Program Files\Opera\Opera.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Windows\system32\mmc.exe
D:\Windows\system32\Taskmgr.exe
D:\Windows\system32\NOTEPAD.EXE
D:\Windows\system32\SearchFilterHost.exe
D:\Users\martin\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [WinFast Schedule] D:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule2] C:\Program Files (x86)\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule3] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule4] C:\Program Files (x86)\WinFast\WFTVFM\WFWIZ.exe
O4 - HKCU\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - -"D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" (file missing)
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe" (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
--
End of file - 6448 bytes
a tato služba Windows Genuine Advantage (svchost) neni v services.msc k nalezení...
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
po restartu...
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:00:54, on 2.7.2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\Explorer.EXE
D:\Windows\system32\taskeng.exe
D:\Windows\System32\oodtray.exe
D:\Windows\RtHDVCpl.exe
D:\Program Files\ESET\nod32kui.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\systern.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Users\martin\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft] systern.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [WinFast Schedule] D:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunServices: [94265434] adrzhfm.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule2] C:\Program Files (x86)\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule3] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule4] C:\Program Files (x86)\WinFast\WFTVFM\WFWIZ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - -"D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" (file missing)
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe" (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
--
End of file - 6618 bytes
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:00:54, on 2.7.2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\Explorer.EXE
D:\Windows\system32\taskeng.exe
D:\Windows\System32\oodtray.exe
D:\Windows\RtHDVCpl.exe
D:\Program Files\ESET\nod32kui.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\systern.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Users\martin\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft] systern.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [WinFast Schedule] D:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunServices: [94265434] adrzhfm.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule2] C:\Program Files (x86)\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule3] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule4] C:\Program Files (x86)\WinFast\WFTVFM\WFWIZ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] d:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [Absolute StartUp monitor] D:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - -"D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" (file missing)
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe" (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
--
End of file - 6618 bytes
- rary
- Začátečník
-
- Registrován: 20. čer 2006
v taskmanagerovi ukonči:
systern.exe
V HJT fixni:
O4 - HKLM\..\Run: [Microsoft] systern.exe
O4 - HKLM\..\RunServices: [94265434] adrzhfm.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
Tento soubor najdi a nechej ho otestovat na Virustotalu:
adrzhfm.exe
Pro lepší nalezení si zapni zobrazovat skryté a systémové soubory.
Poté sem zkopíruj výsledek.
Ale žádný dobrák to nebude.
Poté si stáhni FileASSASSIN
Spusť ten stažený soubor a FileASSASSIN se nainstaluje.
Poté ho spusť a do volného řádku zkopíruj tento text:
D:\Windows\system32\systern.exe
Nechej zatrhlý co je + však musíš zatrhnout k tomu ještě Delete File. Poté klikni na Execute. Pokud ten soubor bude úspěšně smazán tak by ti měla vyskočit hláška kde odklikni OK.
Poté sem dej nový log z HJT.
A udělej scan MWAVem
a poté až skončí scanování tak sem dej ten log. Návod jaký log sem vložit je v tom odkazu
systern.exe
V HJT fixni:
O4 - HKLM\..\Run: [Microsoft] systern.exe
O4 - HKLM\..\RunServices: [94265434] adrzhfm.exe
O4 - HKLM\..\RunServices: [Microsoft] systern.exe
Tento soubor najdi a nechej ho otestovat na Virustotalu:
adrzhfm.exe
Pro lepší nalezení si zapni zobrazovat skryté a systémové soubory.
Poté sem zkopíruj výsledek.
Ale žádný dobrák to nebude.
Poté si stáhni FileASSASSIN
Spusť ten stažený soubor a FileASSASSIN se nainstaluje.
Poté ho spusť a do volného řádku zkopíruj tento text:
D:\Windows\system32\systern.exe
Nechej zatrhlý co je + však musíš zatrhnout k tomu ještě Delete File. Poté klikni na Execute. Pokud ten soubor bude úspěšně smazán tak by ti měla vyskočit hláška kde odklikni OK.
Poté sem dej nový log z HJT.
A udělej scan MWAVem
a poté až skončí scanování tak sem dej ten log. Návod jaký log sem vložit je v tom odkazu
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
toto je nejdulezitejsi, co nasel, krome neplatny reg. klíčů
Mon Jul 02 13:10:47 2007 => Offending file found: D:\Windows\system32\svchost32.exe
Mon Jul 02 13:10:47 2007 => System found infected with killav.nbd Browser Hijacker (svchost32.exe)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:47 2007 => Offending file found: D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5\5o9sn7b3\owacolors[1].css
Mon Jul 02 13:10:47 2007 => System found infected with whenu.savenow Spyware/Adware (owacolors[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:47 2007 => Offending file found: D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5\5z7hzu34\owastyle[1].css
Mon Jul 02 13:10:47 2007 => System found infected with whenu.savenow Spyware/Adware (owastyle[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:48 2007 => Offending file found: D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5\wt28bcu3\style30[1].css
Mon Jul 02 13:10:48 2007 => System found infected with whenu.savenow Spyware/Adware (style30[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\AppData\Roaming\microsoft\digital locker\urls.bin
Mon Jul 02 13:10:49 2007 => System found infected with powerstrip Spyware/Adware (urls.bin)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Desktop\adobe acrobat 8\adobe.acrobat.8.professionnal.full\acrobat 8.0 cz mini\acrobat\howto\cze\secure.html
Mon Jul 02 13:10:49 2007 => System found infected with smitfraud Browser Hijacker (secure.html)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\amazon.com.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (amazon.com.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\koĺˇ\amazon.com.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (amazon.com.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\koĺˇ\ebay.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\opera\koĺˇ\amazon.com.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (amazon.com.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\opera\koĺˇ\ebay.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:50 2007 => Offending file found: D:\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\content.ie5\5o9sn7b3\owacolors[1].css
Mon Jul 02 13:10:50 2007 => System found infected with whenu.savenow Spyware/Adware (owacolors[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:50 2007 => Offending file found: D:\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\content.ie5\5z7hzu34\owastyle[1].css
Mon Jul 02 13:10:50 2007 => System found infected with whenu.savenow Spyware/Adware (owastyle[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:50 2007 => Offending file found: D:\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\content.ie5\wt28bcu3\style30[1].css
Mon Jul 02 13:10:50 2007 => System found infected with whenu.savenow Spyware/Adware (style30[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:47 2007 => Offending file found: D:\Windows\system32\svchost32.exe
Mon Jul 02 13:10:47 2007 => System found infected with killav.nbd Browser Hijacker (svchost32.exe)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:47 2007 => Offending file found: D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5\5o9sn7b3\owacolors[1].css
Mon Jul 02 13:10:47 2007 => System found infected with whenu.savenow Spyware/Adware (owacolors[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:47 2007 => Offending file found: D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5\5z7hzu34\owastyle[1].css
Mon Jul 02 13:10:47 2007 => System found infected with whenu.savenow Spyware/Adware (owastyle[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:48 2007 => Offending file found: D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5\wt28bcu3\style30[1].css
Mon Jul 02 13:10:48 2007 => System found infected with whenu.savenow Spyware/Adware (style30[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\AppData\Roaming\microsoft\digital locker\urls.bin
Mon Jul 02 13:10:49 2007 => System found infected with powerstrip Spyware/Adware (urls.bin)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Desktop\adobe acrobat 8\adobe.acrobat.8.professionnal.full\acrobat 8.0 cz mini\acrobat\howto\cze\secure.html
Mon Jul 02 13:10:49 2007 => System found infected with smitfraud Browser Hijacker (secure.html)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\amazon.com.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (amazon.com.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\koĺˇ\amazon.com.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (amazon.com.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\koĺˇ\ebay.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\opera\koĺˇ\amazon.com.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (amazon.com.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:49 2007 => Offending file found: D:\Users\martin\Favorites\koš\opera\koĺˇ\ebay.url
Mon Jul 02 13:10:49 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:50 2007 => Offending file found: D:\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\content.ie5\5o9sn7b3\owacolors[1].css
Mon Jul 02 13:10:50 2007 => System found infected with whenu.savenow Spyware/Adware (owacolors[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:50 2007 => Offending file found: D:\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\content.ie5\5z7hzu34\owastyle[1].css
Mon Jul 02 13:10:50 2007 => System found infected with whenu.savenow Spyware/Adware (owastyle[1].css)! Action taken: Nic nebylo provedeno.
Mon Jul 02 13:10:50 2007 => Offending file found: D:\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\content.ie5\wt28bcu3\style30[1].css
Mon Jul 02 13:10:50 2007 => System found infected with whenu.savenow Spyware/Adware (style30[1].css)! Action taken: Nic nebylo provedeno.
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
log po restartu
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:53:05, on 2.7.2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\system32\taskeng.exe
D:\Windows\Explorer.EXE
D:\Windows\System32\mobsync.exe
D:\Windows\System32\oodtray.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Users\martin\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [WinFast Schedule] D:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule2] C:\Program Files (x86)\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule3] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule4] C:\Program Files (x86)\WinFast\WFTVFM\WFWIZ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe" (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
--
End of file - 6325 bytes
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:53:05, on 2.7.2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal
Running processes:
D:\Windows\system32\Dwm.exe
D:\Windows\system32\taskeng.exe
D:\Windows\Explorer.EXE
D:\Windows\System32\mobsync.exe
D:\Windows\System32\oodtray.exe
D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Windows\ehome\ehtray.exe
D:\Program Files\DAEMON Tools Pro\DTProAgent.exe
D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
D:\Windows\ehome\ehmsas.exe
D:\Windows\system32\wbem\unsecapp.exe
D:\Users\martin\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [OODefragTray] D:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [GBB36X Configure] D:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [WinFastDTV] D:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [WinFast Schedule] D:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule2] C:\Program Files (x86)\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule3] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\RunOnce: [WinFast Schedule4] C:\Program Files (x86)\WinFast\WFTVFM\WFWIZ.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WFWIZ_vista – zástupce.lnk = D:\Program Files\WinFast\WFDTV\WFWIZ_vista.exe
O4 - Global Startup: Akcelerátor spuštění AutoCADu.lnk = D:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Download Using &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: @D:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @D:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vista
O17 - HKLM\Software\..\Telephony: DomainName = vista
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF7D966E-7E8F-4154-9AA0-BA0859DCA4DB}: NameServer = 192.168.16.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vista
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\Windows\system32\oodag.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - D:\Windows\system32\pr2ah4nc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - -"D:\Program Files\CyberLink\Shared files\RichVideo.exe" (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - -D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
--
End of file - 6325 bytes
- Baron Prášil
- Začátečník
-
- Registrován: 08. čer 2006
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
nesurfuji, ale obcas se mi na pocitac prihlási neter...Baron Prášil píše:smaž v nouzovým režimu
D:\Windows\system32\svchost32.exe
a všechno ve složce
D:\Users\martin\AppData\Local\microsoft\windows\temporary internet files\content.ie5
neserfuješ s Internet Explorerem,že ne?
nebude svchost32.exe chybet?jinak diky za rady. moc me to pomohlo
- Baron Prášil
- Začátečník
-
- Registrován: 08. čer 2006
svchost32.exe - dyť sis to sám vygooglil
http://www.bleepingcomputer.com/startup ... 12549.html
takže mám tomu rozumět tak,že je problém vyřešenej?
neteři udělej účet s omezenými právy!!
http://www.bleepingcomputer.com/startup ... 12549.html
takže mám tomu rozumět tak,že je problém vyřešenej?
neteři udělej účet s omezenými právy!!
- m1112
- Začátečník
-
- Registrován: 12. zář 2006
- Bydliště: Cesky Tesin
- Kontaktovat uživatele:
ano, ještě jednou díky, problém je vyřešený, v počítači se zatím usídlil Kaspersky internet security, vypadá super, tak uvidím...Baron Prášil píše:svchost32.exe - dyť sis to sám vygooglil
http://www.bleepingcomputer.com/startup ... 12549.html
takže mám tomu rozumět tak,že je problém vyřešenej?
neteři udělej účet s omezenými právy!!
počítač je jak dětská pr....
- Baron Prášil
- Začátečník
-
- Registrován: 08. čer 2006
- mixo
- Nováček
-
- Registrován: 09. úno 2005
zamrza mi internet
zdravim
mam taky problem. ked surfujem na nete, tak mi po cca 10sekundach zamrzne prehliadac (mozilla firefox) a ked kliknem tak napise not responding. potom sa to rozbehne a po chvili zase zamrzne
tu je log z HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:37:17, on 2.10.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Avast4\aswUpdSv.exe
D:\Program Files\Avast4\ashServ.exe
D:\PROGRA~1\Avast4\ashDisp.exe
D:\Program Files\ICQLite\ICQLite.exe
D:\Program Files\Eset\nod32kui.exe
D:\WINDOWS\System32\rundll32.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Eset\nod32krn.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\Avast4\ashWebSv.exe
D:\Program Files\Avast4\ashMaiSv.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\programy\wincmd\WINCMD32.EXE
D:\WINDOWS\System32\taskmgr.exe
d:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\spyware\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ICQ Lite] D:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Avast4\ashWebSv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
--
End of file - 3758 bytes
mam taky problem. ked surfujem na nete, tak mi po cca 10sekundach zamrzne prehliadac (mozilla firefox) a ked kliknem tak napise not responding. potom sa to rozbehne a po chvili zase zamrzne
tu je log z HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:37:17, on 2.10.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Avast4\aswUpdSv.exe
D:\Program Files\Avast4\ashServ.exe
D:\PROGRA~1\Avast4\ashDisp.exe
D:\Program Files\ICQLite\ICQLite.exe
D:\Program Files\Eset\nod32kui.exe
D:\WINDOWS\System32\rundll32.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Eset\nod32krn.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\Avast4\ashWebSv.exe
D:\Program Files\Avast4\ashMaiSv.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\programy\wincmd\WINCMD32.EXE
D:\WINDOWS\System32\taskmgr.exe
d:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\spyware\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ICQ Lite] D:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Avast4\ashWebSv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
--
End of file - 3758 bytes
- likc
- Začátečník
-
- Registrován: 30. čer 2006
Nekolik zasadnich problemu.
1 neaktualni system - nainstaluj SP2 (a dejme tomu i IE, pokud ho pouzivas)
2 nemas firewall - nainstaluj - comodo/kerio nebo jine.
3 pouzivas vice antiviru naraz. Ponech jen 1 antivir (a 1 antispy).
jinak v logu nic nevidim, az to udelas, uvidis, jestli se to zlepsi nebo pak posli dalsi log a budem badat dal.
1 neaktualni system - nainstaluj SP2 (a dejme tomu i IE, pokud ho pouzivas)
2 nemas firewall - nainstaluj - comodo/kerio nebo jine.
3 pouzivas vice antiviru naraz. Ponech jen 1 antivir (a 1 antispy).
jinak v logu nic nevidim, az to udelas, uvidis, jestli se to zlepsi nebo pak posli dalsi log a budem badat dal.