|
| |||||||
| Registrovať | Site Spy | Zoznam členov | Darovanie | Hľadať | Dnešné príspevky | Označiť témy ako prečítané | Pravidlá fóra |
 |
 |
| | Thread Tools |
|
#1
6 októbra 2008, 23:30
| |||
| |||
| Kliknutím na tlačidlo, pípanie a skryté iexplore.exe proces Nazdar, Akákoľvek pomoc v tejto otázke oveľa apprecated. SAS, SSD a anti-malware Nedarí sa mi nájsť to, čo vôbec mám. Tu je to, čo sa deje: 1) Ak nie je pripojený modem, konštantný kliknutím pochádza z môjho počítača (předpokládám, že niečo sa snaží otvoriť Iexplorer.exe 2) príležitostne beebing (jeden na rozdiel od všetkých, čo som kedy počul), pípne trikrát alebo štyrikrát 3) Je-li pripojení k modemu, Iexplorer.exe beží (aj keď som nikdy v programe Internet Explorer), a keď som vypnúť proces sa otvoril hneď späť hore. Mnohokrát děkuji za všetky pomoci, tu je HJT log: Logfile z HijackThis v1.99.1 Skenovanie uložený v 11:15:50 hodín, dňa 10.6.2008 Platforma: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Bežiace procesy: C: \ WINDOWS \ System32 \ Smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ PROGRA ~ 1 \ ESRI \ License \ arcgis9x \ lmgrd.exe C: \ Program Files \ TOSHIBA \ Power Management \ CeEPwrSvc.exe C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ DefWatch.exe C: \ Program Files \ Executive Software \ Diskeeper \ DkService.exe C: \ WINDOWS \ system32 \ DVDRAMSV.exe C: \ PROGRA ~ 1 \ ESRI \ License \ arcgis9x \ ARCGIS.exe C: \ Program Files \ Hotspot Štít \ bin \ openvpnas.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ Rtvscan.exe C: \ Program Files \ Common Files \ SafeNet Sentinel \ Sentinel Ochrana Server \ WinNT \ spnsrvnt.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ wscntfy.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ Explorer.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ Apoint2K \ Apoint.exe C: \ Program Files \ TOSHIBA \ Power Management \ CePMTray.exe C: \ Program Files \ TOSHIBA \ Touchpad \ TPTray.exe C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ SYMANT ~ 1 \ vptray.exe C: \ WINDOWS \ Samsung \ PanelMgr \ ssmmgr.exe C: \ WINDOWS \ HCWemMON.exe C: \ Program Files \ Apoint2K \ Apntex.exe C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ SpyNoMore \ SNM.exe C: \ WINDOWS \ system32 \ Ctfmon.exe C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe C: \ Program Files \ initio \ Button Manager v1.836 \ inihid.exe C: \ Program Files \ ArcSoft \ TotalMedia Backup & Record \ uBBMonitor.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ WINDOWS \ system32 \ QH8jvpp4.exe C: \ Program Files \ Real \ RealPlayer \ RealPlay.exe C: \ Program Files \ HijackThis \ HijackThis.exe R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = www.google.ca R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Local Page = R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Local Page = R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, Proxyserver = 64.34.113.100:80 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Nastavenia, ProxyOverride = 127.0.0.1 O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 7.0 \ ActiveX \ AcroIEHelper.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll O2 - BHO: SSVHelper triedy - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll O4 - HKLM \ .. \ Run: [Apoint] C: \ Program Files \ Apoint2K \ Apoint.exe O4 - HKLM \ .. \ Run: [CeEPOWER] C: \ Program Files \ TOSHIBA \ Power Management \ CePMTray.exe O4 - HKLM \ .. \ Run: [TPNF] C: \ Program Files \ TOSHIBA \ Touchpad \ TPTray.exe O4 - HKLM \ .. \ Run: [vptray] C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ SYMANT ~ 1 \ vptray.exe O4 - HKLM \ .. \ Run: [Samsung PanelMgr] C: \ WINDOWS \ Samsung \ PanelMgr \ ssmmgr.exe / autorun O4 - HKLM \ .. \ Run: [emMON] HCWemMON.exe O4 - HKLM \ .. \ Run: [KernelFaultCheck]% systemroot% \ system32 \ dumprep 0-k O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot O4 - HKLM \ .. \ Run: [QuickTime Úloha] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [AtiPTA] atiptaxx.exe O4 - HKLM \ .. \ Run: [SNM] C: \ Program Files \ SpyNoMore \ SNM.exe / štarte O4 - HKLM \ .. \ Run: [Free Download Manager] C: \ Program Files \ Free Download Manager \ fdm.exe-autorun O4 - HKCU \ .. \ Run: [Cttfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe O4 - HKCU \ .. \ Run: [WMPNSCFG] C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe O4 - HKLM \ .. \ Run: [updateMgr] "C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ AdobeUpdateManager.exe" AcRdB7_0_9-reboot 1 O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - Startup: Adobe Media Player.lnk =? O4 - Global Startup: Button Manager v1.836.lnk =? O4 - Global Startup: instiki.bat O4 - Global Startup: Linksys EasyLink Advisor.lnk = C: \ Program Files \ Linksys \ Linksys EasyLink radca \ Linksys EasyLink Advisor.exe O4 - Global Startup: Povedz Time.lnk = C: \ Program Files \ Say the Time \ SayTime.exe O4 - Global Startup: TotalMedia Zálohovanie Monitor.lnk = C: \ Program Files \ ArcSoft \ TotalMedia Backup & Record \ uBBMonitor.exe O8 - Extra kontextového menu položku: E & xportovať do programu Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ micros ~ 2 \ Office10 \ EXCEL.EXE/3000 O9 - Extra tlačidlá: (bez názvu) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll O9 - Extra tlačidlá: Výskum - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ micros ~ 2 \ Office11 \ REFIEBAR.DLL O9 - Extra tlačidlá: (bez názvu) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Vyhľadávanie & & Destroy Konfigurácia - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll O9 - Extra tlačidlá: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe Ø15 - Trusted rozsah IP: 206.161.125.149 Ø15 - ProtocolDefaults: 'http' protokol je v My Computer Zone, by mal byť Internet Zone (HKLM) O16 - DPF: ppctlcab -- http://www.pestscan.com/scanner/ppctlcab.cab O16 - DPF: (04E214E5-63AF-4236-83C6-A7ADCBF9BD02) (HouseCall Control) -- http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: (22E5D91F-89E6-4405-AD9C-0AF27BA6F06B) (HidInputMonitorX Control) - file: / / D: \ components \ hidinputmonitorx.ocx O16 - DPF: (4F63D44B-6274-4D60-8AB1-CAA7116B8AF3) (A9Helper.A9) - file: / / D: \ components \ A9.ocx O16 - DPF: (74D05D43-3236-11D4-BDCD-00C04F9A3B61) (HouseCall Control) -- http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: (BAC01377-73DD-4796-854D-2A8997E3D68A) (Yahoo! Fotky Jednoduché Upload Jet Class) -- http://us.dl1.yimg.com/download.yaho...opper1_4us.cab O16 - DPF: (E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD) -- http://download.abacast.com/download...basetup145.cab O20 - Winlogon Upozornenie:! SASWinLogon - C: \ Program Files \ SuperAntiSpyware \ SASWINLO.dll O20 - Winlogon Notify: NavLogon - C: \ WINDOWS \ system32 \ NavLogon.dll O20 - Winlogon Upozornenie: WgaLogon - C: \ WINDOWS \ O21 - SSODL: WPDShServiceObj - (AAA288BA-9A4C-45B0-95D7-94D524869DB5) - C: \ WINDOWS \ system32 \ WPDShServiceObj.dll O23 - Service: Adobe LM Service - Neznámy vlastník - C: \ Program Files \ Common Files \ Adobe Systems Shared \ Service \ Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: ArcGIS License Manager - Unknown owner - C: \ PROGRA ~ 1 \ ESRI \ License \ arcgis9x \ lmgrd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: ATI Smart - Neznámy vlastník - C: \ WINDOWS \ system32 \ ati2sgag.exe O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC - C: \ Program Files \ TOSHIBA \ Power Management \ CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe O23 - Service: DefWatch - Symantec Corporation - C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ DefWatch.exe O23 - Service: Diskeeper - Executive Software International, Inc - C: \ Program Files \ Executive Software \ Diskeeper \ DkService.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co, Ltd - C: \ WINDOWS \ system32 \ DVDRAMSV.exe O23 - Service: Hotspot Štít Service (HotspotShieldService) - Neznámy vlastník - C: \ Program Files \ Hotspot Štít \ bin \ openvpnas.exe O23 - Service: InstallDriver Tabuľka Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ Rtvscan.exe O23 - Service: PML Driver HPZ12 - HP - C: \ WINDOWS \ system32 \ HPZipm12.exe O23 - Service: Sentinel Ochrana Server (SentinelProtectionServer) - SafeNet, Inc - C: \ Program Files \ Common Files \ SafeNet Sentinel \ Sentinel Ochrana Server \ WinNT \ spnsrvnt.exe |
|
#2
7 októbra 2008, 00:28
| |||
| |||
| Kliknutím na tlačidlo, pípanie a skryté iexplore.exe proces Bežíte zastaralú verziu HijackThis. Nainštalujte si prosím novú verziu HijackThis, ale nebeží to až po tom, čo dokončil SDFix je to proces,. Stiahnuť TrendMicro HijackThis.exe (Hjt) na ploche.
---------- Prosím tlač týchto usmernení, ktoré budú potrebné neskôr, keď si prístup k Internetu nie je k dispozícii. Stiahnuť SDFix by AndyManchesta a uložiť do počítača. Ak používate tento nástroj, musíte použiť Správca účtu alebo na účet Správne právo
Otvorte zložku SDFix a dvakrát kliknite na RunThis.bat na spustenie skriptu.
__________________  |
|
#3
7 októbra 2008, 02:15
| |||
| |||
| Kliknutím na tlačidlo, pípanie a skryté iexplore.exe proces Ďakujeme za vašu pomoc, To je jeden škaredý! Problém je ešte stále prebieha, aj keď môj počítač má asi 20 minút na oddych po spustení SDFix. SDFix a HiJackThis logami sú nasledovné: A opäť veľa, veľa byť zaviazaný SD Oprava: SDFix: Version 1.230 Run by Owner v pon 10.06.2008 v 1159: pm Microsoft Windows XP [Verzia 5.1.2600] Spustenie Od: C: \ SDFix Kontrola Služby : Meno : tdssserv Cesta : \ \ System32 \ drivers \ TDSSserv.sys tdssserv - zrušený Obnova Štandardné bezpečnostné Hodnoty Obnova predvoleného súboru Hosts Restartem Kontrola súborov : Trojan Súbory Nájdeno: C: \ WINDOWS \ SYSTEM32 \ CQVJNG.EXE - zrušený C: \ WINDOWS \ SYSTEM32 \ FTPUPD.EXE - zrušený C: \ WINDOWS \ SYSTEM32 \ NTBLTF.EXE - zrušený C: \ WINDOWS \ SYSTEM32 \ PUOGNR.EXE - zrušený Odstránenie Temp Súbory Kontrola ADS : Konečná kontrola : catchme 0.3.1361.2 W2K/XP/Vista - rootkit / stealth malware detektor by Gmer, http://www.gmer.net Rootkit scan 2008-10-07 00:20:58 Windows 5.1.2600 Service Pack 2 NTFS skenování skrytých procesov ... skenování skrytých služby a systém úľového ... [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ d346prt \ Cfg \ 0Jf40] skenování skrytých položiek registra ... [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ (56CA5D3B-3002-4E7B-90FE-071D8FDF3814)] "DisplayName" = "DAEMON Tools" skenování skrytých súborov ... scan úspešne dokončená skryté procesy: 0 skryté služby: 0 skryté súbory: 0 Ostatné služby : Autorizovaný aplikácií Kľúčové Export: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ sharedaccess \ Parameters \ firewallpolicy \ štandardný profil \ authorizedapplications \ list] "% Windir% \ \ system32 \ \ Sessmgr.exe" = "% windir% \ \ system M32 \ \ Sessmgr.exe: *: Enabled: @ xpsp2res.dll, -22019" "C: \ \ Program Files \ \ Internet Explorer \ \ iexplore.exe" = "C: \ \ Program Files \ \ Internet Explorer \ \ iexplore.exe: *: Disabled: Internet Explorer" "C: \ \ Program Files \ \ bittornado \ \ btdownloadgui.exe" = "C: \ \ Program Files \ \ bittornado \ \ btdownloadgui.exe: *: Enabled: btd ownloadgui" "C: \ \ Program Files \ \ LimeWire \ \ LimeWire.exe" = "C: \ \ Program Files \ \ LimeWire \ \ LimeWire.exe: *: Enabled: LimeWire" "C: \ \ Program Files \ \ MSN Messenger \ \ MsnMsgr.Exe" = "C: \ \ Program Files \ \ MSN Messenger \ \ MsnMsgr.Exe: *: Enabled: MSN Messenger 6.2" "C: \ \ Program Files \ \ Messenger \ \ Msmsgs.exe" = "C: \ \ Program Files \ \ Messenger \ \ Msmsgs.exe: *: Enabled: Windows Messenger" "C: \ \ Program Files \ \ GameHouse \ \ TextTwist \ \ TextTwist.exe" = "C: \ \ P rogram Files \ \ GameHouse \ \ TextTwist \ \ TextTwist.exe: *: Enable ed: Super TextTwist" "C: \ \ Program Files \ \ Hexacto Games \ \ Lemonade Tycoon \ \ Lemonade.exe" = "C: \ \ Program Files \ \ Hexacto Games \ \ Lemonade Tycoon \ \ Lemonade.exe: *: Disabled: Lemonade" "C: \ \ Program Files \ \ Mozilla Firefox \ \ firefox.exe" = "C: \ \ Program Files \ \ Mozilla Firefox \ \ firefox.exe: *: Enabled: Firefox" "C: \ \ Program Files \ \ Global Star \ \ Age of Sail II \ \ privateer.exe" = "C: \ \ Program Files \ \ Global Star \ \ Age of Sail II \ \ privateer.exe: *: Enabled : lupič " "C: \ \ Program Files \ \ Windows Media Player \ \ wmplayer.exe" = "C: \ \ Program Files \ \ Windows Media Player \ \ wmplayer.exe: *: Disabled: Windows Media Player" "C: \ \ Program Files \ \ Real \ \ RealPlayer \ \ realplay.exe" = "C: \ \ PROGRA m Files \ \ Real \ \ RealPlayer \ \ realplay.exe: *: Enabled: Re alPlayer" "C: \ \ Program Files \ \ Atari-Infogrames \ \ Civilization III Gold Edition \ \ Civ3PTW \ \ Civilization3x.exe" = "C: \ \ Program Files \ \ Atari-Infogrames \ \ Civilization III Gold Edition \ \ Civ3PTW \ \ Civilization3x.exe: *: Enabled: Civ ilization3X " "C: \ \ Program Files \ \ BitTorrent \ \ bittorrent.exe" = "C: \ \ Program Files \ \ BitTorrent \ \ bittorrent.exe: *: Enabled: BitTor nájomné" "C: \ \ Program Files \ \ Kerio \ \ Personal Firewall \ \ PERSFW.exe" = "C: \ \ Program Files \ \ Kerio \ \ Personal Firewall \ \ PERSFW.exe: *: Enabled: Kerio Personal Firewall Engine" "C: \ \ Program Files \ \ TVUPlayer \ \ TVUPlayer.exe" = "C: \ \ Program Files \ \ TVUPlayer \ \ TVUPlayer.exe: *: Enabled: tvu Herec Komponent" "C: \ \ Program Files \ \ SopCast \ \ SopCast.exe" = "C: \ \ Program Files \ \ SopCast \ \ SopCast.exe: *: Enabled: Sopcast" "C: \ \ Documents and Settings \ \ Owner \ \ Data aplikací \ \ SopCast \ \ adv \ \ SopAdver.exe" = "C: \ \ Documents and Settings \ \ Owner \ \ Data aplikací \ \ SopCast \ \ adv \ \ SopAdver.exe: *: Enabled: SopAdve r " "C: \ \ Program Files \ \ QuickTime \ \ QuickTimePlayer.exe" = "C: \ \ Progra m Files \ \ QuickTime \ \ QuickTimePlayer.exe: *: Enabled: Qu ickTime Player" "C: \ \ Program Files \ \ Veoh Networks \ \ Veoh \ \ VeohClient.exe" = "C: \ \ Program Files \ \ Veoh Networks \ \ Veoh \ \ VeohClient.exe: *: Enabled: Veoh klient" "C: \ \ Documents and Settings \ \ Owner \ \ Local Settings \ \ Temp \ \ Charon.exe" = "C: \ \ Documents and Settings \ \ Owner \ \ Local Settings \ \ Temp \ \ Charon.exe: * : Enabled: Charon - proxy kontrola / skenovacie program. " "C: \ \ ruby \ \ bin \ \ ruby.exe" = "C: \ \ ruby \ \ bin \ \ ruby.exe: *: Enabled: Ruby interpret" "C: \ \ Program Files \ \ Azureus \ \ Azureus.exe" = "C: \ \ Program Files \ \ Azureus \ \ Azureus.exe: *: Enabled: Azureus (2)" "C: \ \ Program Files \ \ VideoLAN \ \ VLC \ \ vlc.exe" = "C: \ \ Program Files \ \ VideoLAN \ \ VLC \ \ vlc.exe: *: Enabled: VLC media player" "C: \ \ Program Files \ \ Google \ \ Google Talk \ \ googletalk.exe" = "C: \ \ Program Files \ \ Google \ \ Google Talk \ \ googletalk.exe: *: Enabled: Google Talk" "C: \ \ Program Files \ \ SopCast \ \ adv \ \ SopAdver.exe" = "C: \ \ Program Files \ \ SopCast \ \ adv \ \ SopAdver.exe: *: Enabled: SopCas t adver" "C: \ \ Documents and Settings \ \ Owner \ \ Data aplikací \ \ PowerChallenge \ \ PowerSoccer \ \ PowerSoccer.exe" = "C: \ \ Documents and Settings \ \ Owner \ \ Data aplikací \ \ PowerChallenge \ \ PowerSoccer \ \ PowerSoccer.exe: *: Enabled: PowerSoccer " "C: \ \ Documents and Settings \ \ len \ \ Data aplikací \ \ PowerChallenge \ \ PowerSoccer \ \ PowerSoccer.exe" = "C: \ \ Documents and Settings \ \ len \ \ Data aplikací \ \ PowerChallenge \ \ PowerSoccer \ \ PowerSoccer.exe: *: Enabled: PowerSoccer " "C: \ \ Program Files \ \ Common Files \ \ SafeNet Sentinel \ \ Sentinel pre ochranu Server \ \ WinNT \ \ spnsrvnt.exe" = "C: \ \ Program Files \ \ Common Files \ \ SafeNet Sentinel \ \ Sentinel pre ochranu Server \ \ WinNT \ \ spnsrvnt.exe: *: Disabled: Sentinel pre ochranu Server " "C: \ \ Program Files \ \ NHL 2008 \ \ nhl2008.exe" = "C: \ \ Program Files \ \ NHL 2008 \ \ nhl2008.exe: *: Enabled: nhl2008" "C: \ \ Program Files \ \ iTunes \ \ iTunes.exe" = "C: \ \ Program Files \ \ iTunes \ \ iTunes.exe: *: Enabled: iTunes" "C: \ \ Program Files \ \ KONAMI \ \ Pro Evolution Soccer 2008 v USA \ \ PES2008.exe" = "C: \ \ Program Files \ \ KONAMI \ \ Pro Evolution Soccer 2008 v USA \ \ PES2008.exe: *: Enabled : Pro Evolution Soccer 2008 " "C: \ \ WINDOWS \ \ system32 \ \ drivers \ \ svchost.exe" = "C: \ \ WINDOWS \ \ system32 \ \ drivers \ \ svchost.exe: *: Zakážte d: svchost" [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ sharedaccess \ Parameters \ firewallpolicy \ domainpr ofile \ authorizedapplications \ list] "% Windir% \ \ system32 \ \ Sessmgr.exe" = "% windir% \ \ system M32 \ \ Sessmgr.exe: *: Enabled: @ xpsp2res.dll, -22019" "C: \ \ Program Files \ \ MSN Messenger \ \ MsnMsgr.Exe" = "C: \ \ Program Files \ \ MSN Messenger \ \ MsnMsgr.Exe: *: Enabled: MSN Messenger 6.2" Zostávajúce súbory : Súbor Preddavky: - C: \ SDFix \ zálohovanie \ backups.zip Skryté súbory s atribútmi : Streda 13 október 2004 1694208 .. SH. --- "C: \ Program Files \ Messenger \ Msmsgs.exe" Po. 15.září 2008 1562960 A. SHR --- "C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll" Po. 7.července 2008 1429840 A. SHR --- "C: \ Program Files \ Spybot - Search & Destroy \ SDUpdate.exe" Po. 7.července 2008 4891472 A. SHR --- "C: \ Program Files \ Spybot - Search & Destroy \ SpybotSD.exe" Út. 16.září 2008 1833296 A. SHR --- "C: \ Program Files \ Spybot - Search & Destroy \ SUPERAntiSpyware.exe" Pá. 27.leden 2006 4348 A.SH. --- "C: \ Documents and Settings \ All Users \ DRM \ DRMv1.bak" So. 14.června 2008 50688 ... H. --- "C: \ Documents and Settings \ len \ Plocha \ ~ WRL0001.tmp" So. 14.června 2008 50176 ... H. --- "C: \ Documents and Settings \ len \ Plocha \ ~ WRL1778.tmp" Po. 3.marca 2008 176.128 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ Interop.NetworkCore.dll" Po. 3.marca 2008 36864 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LelaAccount.dll" Po. 3.marca 2008 200.704 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LelaNetwork.dll" Po. 3.marca 2008 143.360 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LelaNetworkLib.dll" Po. 3.marca 2008 20480 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LelaPrint.dll" Po. 3.marca 2008 176.128 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LelaResource.dll" Po. 3.marca 2008 151.552 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LelaServices.dll" Po. 3.marca 2008 110.592 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ Linksys EasyLink Advisor.exe" Po. 3.marca 2008 18879808 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ LinksysUpdaterSetup.exe" Po. 3.marca 2008 270.336 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ log4net.dll" Po. 3.marca 2008 8353080 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ PlatformSetup.exe" Po. 23.apríla 2007 0 A.SH. --- "C: \ Documents and Settings \ All Users \ DRM \ Cache \ Indiv01.tmp" Št. 16. augusta 2007 0 A.SH. --- "C: \ Documents and Settings \ All Users \ DRM \ Cache \ Indiv02.tmp" Št. 16. augusta 2007 0 A.SH. --- "C: \ Documents and Settings \ All Users \ DRM \ Cache \ Indiv03.tmp" So. 20.října 2007 0 A.SH. --- "C: \ Documents and Settings \ All Users \ DRM \ Cache \ Indiv04.tmp" Nie. 21.října 2007 87552 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL0029.tmp" Nie. 21.října 2007 85504 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL0207.tmp" Nie. 21.října 2007 88576 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL0362.tmp" Nie. 21.října 2007 88576 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL1369.tmp" Nie. 21.října 2007 81920 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL1945.tmp" Nie. 21.října 2007 84992 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL2108.tmp" Nie. 21.října 2007 88576 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL2659.tmp" Nie. 21.října 2007 87552 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL2779.tmp" Nie. 21.října 2007 86016 ... H. --- "C: \ Documents and Settings \ len \ Desktop \ analytik oct2007 \ ~ WRL2918.tmp" So. 9. júna 2007 33280 ... H. --- "C: \ Documents and Settings \ len \ Local Settings \ Temp \ ~ WRL1284.tmp" Út. 27.prosince 2005 33280 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL0003.tmp" Út. 27.prosince 2005 33792 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL0774.tmp" Út. 27.prosince 2005 34816 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL0804.tmp" Út. 27.prosince 2005 33792 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL1393.tmp" Út. 27.prosince 2005 36864 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL1707.tmp" Út. 27.prosince 2005 33280 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL2134.tmp" Út. 27.prosince 2005 35840 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL2768.tmp" Út. 27.prosince 2005 33280 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL3330.tmp" Út. 27.prosince 2005 36352 ... H. --- "C: \ Documents and Settings \ len \ My Documents \ seasmoke \ ~ WRL3500.tmp" Po. 3.ledna 2005 25088 ... H. --- "C: \ Documents and Settings \ Owner \ My Documents \ My Overuje \ ~ WRL2003.tmp" Po. 3.ledna 2005 25088 ... H. --- "C: \ Documents and Settings \ Owner \ My Documents \ My Overuje \ ~ WRL3264.tmp" Po. 17.dubna 2006 40960 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ~ WRL2617.tmp" Po. 25.září 2006 38400 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ~ WRL2726.tmp" Nie. 24.Septembra 2006 30720 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ~ WRL3228.tmp" Nie. 16.dubna 2006 38912 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ~ WRL3396.tmp" Po. 3.marca 2008 81920 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ ar \ LelaResource.resources.dll" Po. 3.marca 2008 69632 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ da \ LelaResource.resources.dll" Po. 3.marca 2008 73728 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ de \ LelaResource.resources.dll" Po. 3.marca 2008 94208 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ el \ LelaResource.resources.dll" Po. 3.marca 2008 77824 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ en-US \ LelaAccount.resources.dll" Po. 3.marca 2008 446.464 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ en-US \ LelaNetwork.resources.dll" Po. 3.marca 2008 11407360 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ en-US \ LelaResource.resources.dll" Po. 3.marca 2008 1916928 A. SHR --- "C: \ Program Files \ Linksys \ Linksys EasyLink radca \ en-US \ Linksys EasyLink Advisor.resources.dll" Út. 25.března 2008 26112 ... H. --- "C: \ Documents and Settings \ All Users \ Dokumenty \ Happy House Info \ 2008 \ ~ WRL0454.tmp" Št. 27. marca 2008 22016 ... H. --- "C: \ Documents and Settings \ All Users \ Dokumenty \ Happy House Info \ 2008 \ ~ WRL1118.tmp" Pá. 7.dubna 2006 3595264 ... H. --- "C: \ Documents and Settings \ Owner \ Data aplikací \ Microsoft \ Word \ ~ WRL2168.tmp" Pá. 7.dubna 2006 3593728 ... H. --- "C: \ Documents and Settings \ Owner \ Data aplikací \ Microsoft \ Word \ ~ WRL2962.tmp" St 5. apríla 2006 4252160 ... H. --- "C: \ Documents and Settings \ Owner \ Data aplikací \ Microsoft \ Word \ ~ WRL3217.tmp" Pá. 27.leden 2006 4348 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ Hudba \ License Backup \ drmv1key.bak" So. 30 septembra 2006 20 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ Hudba \ License Backup \ drmv1lic.bak" Pá. 27.ledna 2006 400 A.SH. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ Hudba \ License Backup \ drmv2key.bak" Po. 18.září 2006 32256 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Biotech 206B \ ~ WRL0004.tmp" Út. 31.října 2006 114.688 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Biotech 206B \ ~ WRL1340.tmp" Nie. 17.září 2006 30720 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Biotech 206B \ ~ WRL2439.tmp" Po. 18.září 2006 32256 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Biotech 206B \ ~ WRL3767.tmp" St 21.září 2005 26624 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem laboratória 120 \ ~ WRL0005.tmp" So. 26.novembra 2005 27136 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem laboratória 120 \ ~ WRL3662.tmp" Po. 13.června 2005 30208 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL0386.tmp" Nie. 5.června 2005 25088 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL0788.tmp" Nie. 5.června 2005 25600 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL0794.tmp" Po. 13.června 2005 30208 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL1533.tmp" St 1.června 2005 24064 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL1817.tmp" Po. 13.června 2005 31232 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL2720.tmp" Út. 14.června 2005 35840 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL2966.tmp" Út. 14.června 2005 36864 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL3073.tmp" Št. 9. júna 2005 28160 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Eng 150 \ ~ WRL3453.tmp" Št. 2.februára 2006 382.464 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL0003.tmp" Pá. 7.dubna 2006 3594240 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL0004.tmp" St 5. apríla 2006 4243968 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL0010.tmp" St 5. apríla 2006 4254720 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL0303.tmp" So. 4.februára 2006 928.256 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL0501.tmp" Nie. 5. februára 2006 591.360 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL0928.tmp" St 5. apríla 2006 4254720 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL1029.tmp" St 5. apríla 2006 24064 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL1104.tmp" So. 4.februára 2006 384.000 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL1259.tmp" St 5. apríla 2006 4243456 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL1375.tmp" St 5. apríla 2006 4244992 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL1969.tmp" Št. 6.dubna 2006 710.656 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2066.tmp" Pá. 31.marca 2006 35840 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2175.tmp" Út. 28.března 2006 185.856 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2368.tmp" Pá. 31.marca 2006 65024 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2573.tmp" Út. 4. apríla 2006 4242944 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2686.tmp" Nie. 5. februára 2006 891.904 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2700.tmp" So. 4.februára 2006 507.392 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2881.tmp" St 5. apríla 2006 4244480 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL2992.tmp" St 5. apríla 2006 24576 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3160.tmp" St 5. apríla 2006 4242432 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3277.tmp" So. 4.februára 2006 928.768 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3387.tmp" St 5. apríla 2006 4251648 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3591.tmp" So. 4.februára 2006 383.488 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3770.tmp" St 5. apríla 2006 4243456 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3900.tmp" St 5. apríla 2006 4243456 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL3905.tmp" So. 4.februára 2006 382.976 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ ENVR 253 \ ~ WRL4065.tmp" Št. 23.marca 2006 27648 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Envrionmental \ ~ WRL3569.tmp" So. 25. novembra 2006 20480 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Geog 220 \ ~ WRL1016.tmp" Po. 4.prosince 2006 27648 ... H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ Geog 220 \ ~ WRL2705.tmp" Nie. 6.března 2005 56832 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ fyziky 11 \ ~ WRL3235.tmp" Nie. 20.února 2005 36864 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ fyziky 11 \ ~ WRL3307.tmp" Nie. 13.listopadu 2005 27648 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL0952.tmp" Nie. 13.listopadu 2005 27648 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL1162.tmp" Nie. 13.listopadu 2005 26112 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL1539.tmp" Nie. 13.listopadu 2005 24576 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL1964.tmp" Nie. 13.listopadu 2005 27136 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL2068.tmp" Nie. 13.listopadu 2005 28672 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL3230.tmp" Nie. 13.listopadu 2005 27648 A.. H. --- "C: \ Documents and Settings \ Owner \ Dokumenty \ škola \ chem 120 laboratórií \ chem teórie \ ~ WRL3512.tmp" Hotovo! Tento únos: Logfile Trend Micro HijackThis v2.0.2 Skenovanie uložený v 2:12:20 AM, dňa 10.7.2008 Platforma: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Zavádzacia mód: Normálny Bežiace procesy: C: \ WINDOWS \ System32 \ Smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ Spoolsv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ PROGRA ~ 1 \ ESRI \ License \ arcgis9x \ lmgrd.exe C: \ Program Files \ TOSHIBA \ Power Management \ CeEPwrSvc.exe C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ DefWatch.exe C: \ Program Files \ Executive Software \ Diskeeper \ DkService.exe C: \ PROGRA ~ 1 \ ESRI \ License \ arcgis9x \ ARCGIS.exe C: \ WINDOWS \ system32 \ DVDRAMSV.exe C: \ Program Files \ Hotspot Štít \ bin \ openvpnas.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ Rtvscan.exe C: \ Program Files \ Common Files \ SafeNet Sentinel \ Sentinel Ochrana Server \ WinNT \ spnsrvnt.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ system32 \ wscntfy.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ Explorer.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ Apoint2K \ Apoint.exe C: \ Program Files \ TOSHIBA \ Power Management \ CePMTray.exe C: \ Program Files \ TOSHIBA \ Touchpad \ TPTray.exe C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ SYMANT ~ 1 \ vptray.exe C: \ Program Files \ Apoint2K \ Apntex.exe C: \ WINDOWS \ Samsung \ PanelMgr \ ssmmgr.exe C: \ WINDOWS \ HCWemMON.exe C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ SpyNoMore \ SNM.exe C: \ WINDOWS \ system32 \ Ctfmon.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe C: \ Program Files \ initio \ Button Manager v1.836 \ inihid.exe C: \ Program Files \ ArcSoft \ TotalMedia Backup & Record \ uBBMonitor.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ WINDOWS \ system32 \ QH8jvpp4.exe C: \ PROGRA ~ 1 \ WinZip \ winzip32.exe C: \ Documents and Settings \ Vlastník \ Local Settings \ Temp \ HijackThis.exe C: \ Program Files \ Windows NT \ Accessories \ Wordpad.exe R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = www.google.ca R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Local Page = R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Local Page = R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, Proxyserver = 64.34.113.100:80 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Nastavenia, ProxyOverride = 127.0.0.1 O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 7.0 \ ActiveX \ AcroIEHelper.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll O2 - BHO: SSVHelper triedy - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll O4 - HKLM \ .. \ Run: [Apoint] C: \ Program Files \ Apoint2K \ Apoint.exe O4 - HKLM \ .. \ Run: [CeEPOWER] C: \ Program Files \ TOSHIBA \ Power Management \ CePMTray.exe O4 - HKLM \ .. \ Run: [TPNF] C: \ Program Files \ TOSHIBA \ Touchpad \ TPTray.exe O4 - HKLM \ .. \ Run: [vptray] C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ SYMANT ~ 1 \ vptray.exe O4 - HKLM \ .. \ Run: [Samsung PanelMgr] C: \ WINDOWS \ Samsung \ PanelMgr \ ssmmgr.exe / autorun O4 - HKLM \ .. \ Run: [emMON] HCWemMON.exe O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot O4 - HKLM \ .. \ Run: [QuickTime Úloha] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [AtiPTA] atiptaxx.exe O4 - HKLM \ .. \ Run: [SNM] C: \ Program Files \ SpyNoMore \ SNM.exe / štarte O4 - HKLM \ .. \ Run: [Free Download Manager] C: \ Program Files \ Free Download Manager \ fdm.exe-autorun O4 - HKCU \ .. \ Run: [Cttfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe O4 - HKCU \ .. \ Run: [WMPNSCFG] C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe O4 - HKLM \ .. \ Run: [updateMgr] "C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ AdobeUpdateManager.exe" AcRdB7_0_9-reboot 1 O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - HKUS \ S-1-5-18 \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [CTFMON.EXE] C: \ WINDOWS \ system32 \ CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Media Player.lnk =? O4 - Global Startup: Button Manager v1.836.lnk =? O4 - Global Startup: instiki.bat O4 - Global Startup: Linksys EasyLink Advisor.lnk = C: \ Program Files \ Linksys \ Linksys EasyLink radca \ Linksys EasyLink Advisor.exe O4 - Global Startup: Povedz Time.lnk = C: \ Program Files \ Say the Time \ SayTime.exe O4 - Global Startup: TotalMedia Zálohovanie Monitor.lnk = C: \ Program Files \ ArcSoft \ TotalMedia Backup & Record \ uBBMonitor.exe O8 - Extra kontextového menu položku: E & xportovať do programu Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ micros ~ 2 \ Office10 \ EXCEL.EXE/3000 O9 - Extra tlačidlá: (bez názvu) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.5.0_06 \ bin \ ssv.dll O9 - Extra tlačidlá: Výskum - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ micros ~ 2 \ Office11 \ REFIEBAR.DLL O9 - Extra tlačidlá: (bez názvu) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Vyhľadávanie & & Destroy Konfigurácia - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ Program Files \ Spybot - Search & Destroy \ SDHelper.dll O9 - Extra tlačidlá: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ Msmsgs.exe O10 - Neznámy súbor Winsock LSP: c: \ windows \ system32 \ nwprovau.dll Ø15 - Trusted rozsah IP: 206.161.125.149 Ø15 - ProtocolDefaults: 'http' protokol je v My Computer Zone, by mal byť Internet Zone (HKLM) O16 - DPF: ppctlcab -- http://www.pestscan.com/scanner/ppctlcab.cab O16 - DPF: (04E214E5-63AF-4236-83C6-A7ADCBF9BD02) (HouseCall Control) -- http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: (22E5D91F-89E6-4405-AD9C-0AF27BA6F06B) (HidInputMonitorX Control) - file: / / D: \ components \ hidinputmonitorx.ocx O16 - DPF: (4F63D44B-6274-4D60-8AB1-CAA7116B8AF3) (A9Helper.A9) - file: / / D: \ components \ A9.ocx O16 - DPF: (74D05D43-3236-11D4-BDCD-00C04F9A3B61) (HouseCall Control) -- http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: (BAC01377-73DD-4796-854D-2A8997E3D68A) (Yahoo! Fotky Jednoduché Upload Jet Class) -- http://us.dl1.yimg.com/download.yaho...opper1_4us.cab O16 - DPF: (E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD) -- http://download.abacast.com/download...basetup145.cab O20 - Winlogon Upozornenie:! SASWinLogon - C: \ Program Files \ SuperAntiSpyware \ SASWINLO.dll O23 - Service: Adobe LM Service - Neznámy vlastník - C: \ Program Files \ Common Files \ Adobe Systems Shared \ Service \ Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: ArcGIS License Manager - Unknown owner - C: \ PROGRA ~ 1 \ ESRI \ License \ arcgis9x \ lmgrd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: ATI Smart - Neznámy vlastník - C: \ WINDOWS \ system32 \ ati2sgag.exe O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC - C: \ Program Files \ TOSHIBA \ Power Management \ CeEPwrSvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe O23 - Service: DefWatch - Symantec Corporation - C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ DefWatch.exe O23 - Service: Diskeeper - Executive Software International, Inc - C: \ Program Files \ Executive Software \ Diskeeper \ DkService.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co, Ltd - C: \ WINDOWS \ system32 \ DVDRAMSV.exe O23 - Service: Hotspot Štít Service (HotspotShieldService) - Neznámy vlastník - C: \ Program Files \ Hotspot Štít \ bin \ openvpnas.exe O23 - Service: InstallDriver Tabuľka Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C: \ Program Files \ Symantec_Client_Security \ Symantec AntiVirus \ Rtvscan.exe O23 - Service: PML Driver HPZ12 - HP - C: \ WINDOWS \ system32 \ HPZipm12.exe O23 - Service: Sentinel Ochrana Server (SentinelProtectionServer) - SafeNet, Inc - C: \ Program Files \ Common Files \ SafeNet Sentinel \ Sentinel Ochrana Server \ WinNT \ spnsrvnt.exe -- End of file - 9148 bytes |
|
#4
7. októbra 2008, 09:48
| |||
| |||
| Kliknutím na tlačidlo, pípanie a skryté iexplore.exe proces Zakázať to Spybot TeaTimer Zatiaľ čo TeaTimer je vynikajúcim nástrojom pre prevenciu spywaru, môže tiež zasahovať do HijackThis fixes. Prosím zakáže TeaTimer teraz, kým sú čisté. 1. Kliknite pravým tlačidlom Spybot v systémovej lište (vyzerá ako kalendár s visiacim zámkom symbol). Vybrať Koniec Spybot S & D tuzemského 2. Plynúť Spybot S & D 3. Prejsť na Spôsob menuA uistite sa, že Pokročilý režim vybratá. 4. Na ľavej strane vyberte Nástroje > Ubytovaný nepotvrdíte Tuzemského TeaTimer a OK žiadne rýchle a Restart počítači. Poznámka: Ak TeaTimer dáva varovanie po tom, že niektoré zmeny boli vykonané, aby sa tento namiesto blokovania ju. Ak TeaTimer nebude vypnúť potom odinštalovať Spybot, kým sme sa vykonáva čistenie. ---------- HijackThis a vyberte Otvoriť Do systému kontrolovať len. Umiestnite zatržítko vedľa týchto poznámok: (ak existuje) Ø15 - Trusted rozsah IP: 206.161.125.149 Ø15 - ProtocolDefaults: 'http' protokol je v My Computer Zone, by mal byť Internet Zone (HKLM) Dôležité upozornenie: Zatvorte všetky okná okrem HijackThis a potom kliknite na tlačidlo Fix kontrolované. Jednou vyplnený, výstup HijackThis. ---------- Stiahnite ComboFix by subs z jedného z nižšie uvedených odkazov. Isteže top uložiť do Desktop. Link # 1 Link # 2 ** Poznámka: Je dôležité, že je uložený priamo na váš Desktop Zavrieť všetky otvorené webové prehliadače. (Firefox, Internet Explorer, atď) pred začatím ComboFix. Dočasne znemožniť tvoj antivirus, A akékoľvek Anti-Spyware Ochrana v reálnom čase pred vykonávajúci kontrolu. Kliknite tento odkaz zobraziť zoznam bezpečnostných programov, ktoré by mali byť zakázané, a ako je zakázať. Dvojitým kliknutím combofix.exe & sledovať inštrukcie. Po dokončení bude vyrábať ComboFix log pre vás. Post ComboFix log V ďalšej odpovedi. Dôležité upozornenie: Don't mouseclick ComboFix okná, ak je v chode. To môže spôsobiť, že na stánku. Nezabudnite re-umožní váš antivírus a antispyware ochrany pri ComboFix je kompletná.
__________________ |
|
#5
7 októbra 2008, 18:34
| |||
| |||
| Kliknutím na tlačidlo, pípanie a skryté iexplore.exe proces |
|
#6
7 októbra 2008, 18:44
| |||
| |||
| Kliknutím na tlačidlo, pípanie a skryté iexplore.exe proces [*] Ukáž ŠTART potom RUN[*] Teraz zadajte ComboFix / u v runbox [*] Uistite sa, že tam je priestor medzi ComboFix a / u [*] Potom stlačte Vstup. ---------- Stiahnuť OTMoveIt2 by Oldtimer a uložiť ho do svojho Desktop. Poznámka: Ak prevádzkujete na Vista, právo-kliknite na OTMoveIt2.exe a vyberte Spustiť ako správca. 1. Double-kliknite OTMoveIt2.exe spustite. 2. Skopírujte riadky v codebox nižšie. Kód: [kill explorer] C: \ WINDOWS \ system32 \ xVB47F7a.exe C: \ DOCUME ~ 1 \ Owner \ LOCALS ~ 1 \ Temp \ RGI5.tmp EmptyTemp [start explorer] 4. Kliknutím na červenú Moveit! tlačidlo. 5. Kopírovať všetko v okne Výsledky (v rámci zelenej bar) a vložte ho do vašej ďalšej odpoveď. 6. Zavrieť OTMoveIt2 Poznámka: Ak súbor alebo priečinok nedá presunúť okamžite môžete byť vyzvaní na reštartovanie počítača za účelom ukončenia procesu prechodu. Je-li vyzvaní k reštartu, vyberte Áno. Ak sa tak nestane, reštartujte rovnako. ---------- Po vyslanie OTMoveIt2 log. 1. Dvojitým kliknutím OTMoveIt2.exe začať ju. Vista užívateľov kliknite pravým tlačidlom myši a vybrať Spustiť ako správca 2. Kliknite na CleanUp! tlačidlo. 3. OTMoveIt2 stiahne zoznam z Internetu, je-li váš firewall alebo iné obrannej programy výstrahy vám umožňujú prístup. 4. Kliknite ÁNO na ďalšie riadku (zoznam stiahnuť Chcete začať cleanup procesu?)
---------- Spustiť CCleaner. ---------- Spustiť tento online scan. Tento skener vyžaduje Internet Explorer Pomocou ESET NOD32 Online Scanner 1. Zaškrtnite pole vedľa Áno, prijímam Podmienky používania. 2. Kliknite Začať 3. Na otázku, umožňujú nainštalovať ovládací prvok ActiveX 4. Kliknite Začať 5. Uistite sa, že voľba Odstrániť zistenia ohrozenia a možnosť Scan nechcené aplikácie je kontrola označená. 6. Kliknite Scan 7. Počkajte na skenovanie do konca 8. Použite notepadu otvoriť logfile sa nachádza na C: \ Program Files \ EsetOnlineScanner \ log.txt 9. Pridať o C: \ Program Files \ EsetOnlineScanner \ log.txt Prihláste sa do svojho budúceho odpoveď.
__________________ |
