Lūdzu, palīdziet ar "HijackThis" Žurnāls

tidi · #1 Jūlijs 2, 2009, 13:46

Man nav ne jausmas, kā jālasa šī var kāds lūdzu man palīdzēt, lūdzu, kaut ko nepareizi šeit?

Logfile of Trend Micro HijackThis v2.0.2
Scan saglabāts 07:57:12, uz 23/06/2009
Boot mode: Normal

Running procesiem:
C: \ Program Files (x86) \ Ares \ Ares.exe
C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqtra08.exe
C: \ Program Files (x86) \ HP \ QuickPlay \ QPService.exe
C: \ Program Files (x86) \ Hewlett-Packard \ HP Quick Launch Buttons \ QLBCTRL.exe
C: \ Program Files (x86) \ HP \ HP Software Update \ hpwuSchd2.exe
C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ HPWAMain.exe
C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ WiFiMsg.exe
C: \ Program Files (x86) \ Daemon Tools \ daemon.exe
C: \ Program Files (x86) \ Common Files \ Real \ Update_OB \ realsched.exe
C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ kwtbaim.exe
C: \ Program Files (x86) \ Lavasoft \ Ad-Aware \ AAWTray.exe
C: \ Program Files (x86) \ Common Files \ Research In Motion \ Auto Update \ RIMAutoUpdate.exe
C: \ Program Files (x86) \ Java \ jre6 \ bin \ jusched.exe
C: \ Program Files (x86) \ iTunes \ iTunesHelper.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashDisp.exe
C: \ Program Files (x86) \ Hewlett-Packard \ Shared \ HpqToaster.exe
C: \ Windows \ SysWOW64 \ conime.exe
C: \ Program Files \ WIDCOMM \ Bluetooth Software \ BluetoothHeadsetProxy.exe
C: \ Windows \ SysWOW64 \ DllHost.exe
C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqSTE08.exe
C: \ Program Files (x86) \ Mozilla Firefox \ firefox.exe
C: \ Program Files (x86) \ Windows Live \ Messenger \ msnmsgr.exe
C: \ Program Files (x86) \ Trend Micro \ HijackThis \ juice.exe.exe

R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, SearchAssistant =
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, CustomizeSearch =
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar, LinksFolderName =
O2 - BHO: (no name) - (02478D38-C3F9-4efb-9B51-7695ECA05670) - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files (x86) \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll
O2 - BHO: (no name) - (5C255C8A-E604-49b4-9D64-90988571CECB) - (no file)
O2 - BHO: NCO 2,0 IE BHO - (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408) - (no file)
O2 - BHO: Kiwee Toolbar - (6638A9DE-0.745-4.292-8A2E-AE530E7B9B3F) - C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ KiweeIEToolbar.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files (x86) \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4.638-B6FA-CE66B5AD205D) - C: \ Program Files (x86) \ Google \ GoogleToolbarNotifier \ 5.1.1309.3572 \ s wg.dll
O2 - BHO: Java (tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C: \ Program Files (x86) \ Java \ jre6 \ bin \ jp2ssv.dll
O2 - BHO: HP Smart BHO Class - (FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856) - C: \ Program Files (x86) \ HP \ Digital Imaging \ Smart Web Printing \ hpswp_BHO.dll
O2 - BHO: HP Print klipi - (FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7) - C: \ Program Files (x86) \ HP \ Smart Web Printing \ hpswp_framework.dll
O3 - Toolbar: (no name) - (7FEBEFE3-6B19-4.349-98D2-FFB09D4B49CA) - (no file)
O3 - Toolbar: Kiwee Toolbar - (6638A9DE-0.745-4.292-8A2E-AE530E7B9B3F) - C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ KiweeIEToolbar.dll
O4 - HKLM \ .. \ Run: [QPService] "C: \ Program Files (x86) \ HP \ QuickPlay \ QPService.exe"
O4 - HKLM \ .. \ Run: [QlbCtrl]% programfiles (x86)% \ Hewlett-Packard \ HP Quick Launch Buttons \ QlbCtrl.exe / Sākumlapa
O4 - HKLM \ .. \ Run: [UCam_Menu] "C: \ Program Files (x86) \ CyberLink \ YouCam \ MUITransfer \ MUIStartMenu.ex e" "C: \ Program Files (x86) \ CyberLink \ YouCam" Update "Programmatūra \ CyberLink \ YouCam \ 1.0 "
O4 - HKLM \ .. \ Run: [hpqSRMon] C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqSRMon.exe
O4 - HKLM \ .. \ Run: [HP Software Update] C: \ Program Files (x86) \ HP \ HP Software Update \ HPWuSchd2.exe
O4 - HKLM \ .. \ Run: [hpWirelessAssistant] C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ HPWAMain.exe
O4 - HKLM \ .. \ Run: [WAWifiMessage] C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ WiFiMsg.exe
O4 - HKLM \ .. \ Run: [Daemon Tools] "C: \ Program Files (x86) \ Daemon Tools \ daemon.exe"-lang 1.033
O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files (x86) \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot
O4 - HKLM \ .. \ Run: [KiweeHook] "C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ kwtbaim.exe"
O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files (x86) \ Adobe \ Reader 8,0 \ Reader \ Reader_sl.exe"
O4 - HKLM \ .. \ Run: [Ad-Watch] "C: \ Program Files (x86) \ Lavasoft \ Ad-Aware \ AAWTray.exe"
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files (x86) \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [BlackBerryAutoUpdate] C: \ Program Files (x86) \ Common Files \ Research In Motion \ Auto Update \ RIMAutoUpdate.exe / background
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files (x86) \ Java \ jre6 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files (x86) \ iTunes \ iTunesHelper.exe"
O4 - HKLM \ .. \ Run: [Avast!] C: \ PROGRA ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp.exe
O4 - HKCU \ .. \ Run: [Sidebar] C: \ Program Files \ Windows sānjoslas \ sidebar.exe / Autorun
O4 - HKCU \ .. \ Run: [ehTray.exe] C: \ Windows \ ehome \ ehTray.exe
O4 - HKCU \ .. \ Run: [āri] "C: \ Program Files (x86) \ Ares \ Ares.exe"-h
O4 - HKCU \ .. \ Run: [Uniblue RegistryBooster 2] C: \ Program Files (x86) \ uniblue \ registrybooster 2 \ StartRegistryBooster.exe
O4 - HKCU \ .. \ Run: [SWG] C: \ Program Files (x86) \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe
O4 - HKCU \ .. \ Run: [Windows] JOOJIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII0JIIJ IJI0IJ00C: \ Windows \ services.exe
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files (x86) \ Windows Live \ Messenger \ MsnMsgr.Exe" / background
O4 - HKUS \ S-1-5-19 \ .. \ Run: [Sidebar]% programfiles% \ Windows sānjoslas \ Sidebar.exe / detectMem (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll, ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [Sidebar]% programfiles% \ Windows sānjoslas \ Sidebar.exe / detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk =?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqtra08.exe
Ø9 - Extra button: Nosūtīt OneNote - (2670000A-7350-4f3c-8.081-5663EE0C6C49) - C: \ PROGRA ~ 2 \ Micros ~ 2 \ Office12 \ ONBttnIE.dll
Ø9 - Extra 'Tools' MENUITEM: S & galu OneNote - (2670000A-7350-4f3c-8.081-5663EE0C6C49) - C: \ PROGRA ~ 2 \ Micros ~ 2 \ Office12 \ ONBttnIE.dll
Ø9 - Extra button: HP Smart Select - (58ECB495-38F0-49cb-A538-10282ABF65E7) - C: \ Program Files (x86) \ HP \ Smart Web Printing \ hpswp_extensions.dll
Ø9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 2 \ Micros ~ 2 \ Office12 \ REFIEBAR.DLL
Ø9 - Extra button: Sūtīt Bluetooth - (CCA281CA-C863-46ef-9.331-5C8D4460577F) - C: \ Program Files \ WIDCOMM \ Bluetooth Software \ btsendto_ie.htm
Ø9 - Extra 'Tools' MENUITEM: Send to & Bluetooth Device ... - (CCA281CA-C863-46ef-9.331-5C8D4460577F) - C: \ Program Files \ WIDCOMM \ Bluetooth Software \ btsendto_ie.htm
Ø9 - Extra button: Selección inteligente de HP - (DDE87865-83C5-48c4-8.357-2F5B1AA84522) - C: \ Program Files (x86) \ HP \ Digital Imaging \ Smart Web Printing \ hpswp_BHO.dll
O13 - Gopher Prefix:
Ø20 - Winlogon Paziņot:! SASWinLogon - C: \ Program Files (x86) \ SUPERAntiSpyware \ SASWINLO.dll
O23 - Service: AG Windows Service (AGWinService) - Unknown īpašnieks - C: \ Program Files (x86) \ AGI \ Common \ Win32 \ PythonService.exe
O23 - Service: @% SystemRoot% \ system32 \ Alg.exe, -112 (ALG) - Unknown īpašnieks - C: \ Windows \ System32 \ alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc - C: \ Program Files (x86) \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: Ares tērzētavu serveri (AresChatServer) - Ares Development Group - C: \ Program Files (x86) \ Ares \ chatServer.exe
O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
O23 - Service: Avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
O23 - Service: Avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
O23 - Service: Avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc - C: \ Program Files (x86) \ Bonjour \ mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, LP - C: \ Program Files (x86) \ Hewlett-Packard \ HP Quick Launch Buttons \ Com4Qlb.exe
O23 - Service: @ dfsrres.dll, -101 (DFSR) - Unknown īpašnieks - C: \ Windows \ system32 \ DFSR.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc - C: \ Program Files (x86) \ HP Games \ My HP Spēļu konsole \ GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C: \ Program Files (x86) \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C: \ Program Files (x86) \ Hewlett-Packard \ HP veselības pārbaudi \ hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, LP - C: \ Program Files (x86) \ Hewlett-Packard \ Shared \ hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files (x86) \ Common Files \ InstallShield \ Driver \ 1.050 \ Intel 32 \ IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc - C: \ Program Files (x86) \ iPod \ bin \ iPodService.exe
O23 - Service: @ keyiso.dll, -100 (KeyIso) - Unknown īpašnieks - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C: \ Program Files (x86) \ Lavasoft \ Ad-Aware \ AAWService.exe
O23 - Service: LightScribeService Direct Disc Marķēšanas dienests (LightScribeService) - Hewlett-Packard Company - C: \ Program Files (x86) \ Common Files \ LightScribe \ LSSrvc.exe
O23 - Service: @ comres.dll, -2.797 (MSDTC) - Unknown īpašnieks - C: \ Windows \ System32 \ msdtc.exe (file missing)
O23 - Service: @% SystemRoot% \ System32 \ netlogon.dll, -102 (Netlogon) - Unknown īpašnieks - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ psbase.dll, -300 (ProtectedStorage) - Unknown īpašnieks - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown īpašnieks - C: \ Program Files (x86) \ HP \ QuickPlay \ Kernel \ TV \ QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (Qts) (QPSched) - Unknown īpašnieks - C: \ Program Files (x86) \ HP \ QuickPlay \ Kernel \ TV \ QPSched.exe
O23 - Service: CyberLink RichVideo Service (CRVS) (RichVideo) - Unknown īpašnieks - C: \ Program Files (x86) \ CyberLink \ Shared Files \ RichVideo.exe
O23 - Service: @% SystemRoot% \ system32 \ Locator.exe, -2 (RpcLocator) - Unknown īpašnieks - C: \ Windows \ system32 \ locator.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ samsrv.dll, -1 (SamSs) - Unknown īpašnieks - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ SLsvc.exe, -101 (slsvc) - Unknown īpašnieks - C: \ Windows \ system32 \ SLsvc.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ snmptrap.exe, -3 (SNMPTRAP) - Unknown īpašnieks - C: \ Windows \ System32 \ snmptrap.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ Spoolsv.exe, -1 (spolētāja) - Unknown īpašnieks - C: \ Windows \ System32 \ Spoolsv.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ ui0detect.exe, -101 (UI0Detect) - Unknown īpašnieks - C: \ Windows \ system32 \ UI0Detect.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ vds.exe, -100 (VDS) - Unknown īpašnieks - C: \ Windows \ System32 \ vds.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ vssvc.exe, -102 (VSS) - Unknown īpašnieks - C: \ Windows \ system32 \ vssvc.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ wbem \ wmiapsrv.exe, -110 (wmiApSrv) - Unknown īpašnieks - C: \ Windows \ system32 \ wbem \ WmiApSrv.exe (file missing)
O23 - Service: @% programfiles% \ Windows Media Player \ wmpnetwk.exe, -101 (WMPNetworkSvc) - Unknown īpašnieks - C: \ Program Files (x86) \ Windows Media Player \ wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Unknown īpašnieks - C: \ Windows \ system32 \ drivers \ xaudio64.exe (file missing)

--
End of failu - 12.962 bytes

**evilfantasy** · #2 Jūlijs 2, 2009, 14:16

Right click HijackThis un izvēlēties Palaist kā administratoram

Next izvēlētos Vai sistēmas skenēšanu tikai

Vieta atzīme blakus šādiem ierakstiem: (ja ir)

O2 - BHO: (no name) - (5C255C8A-E604-49b4-9D64-90988571CECB) - (no file)
O2 - BHO: NCO 2,0 IE BHO - (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408) - (no file)
O3 - Toolbar: (no name) - (7FEBEFE3-6B19-4.349-98D2-FFB09D4B49CA) - (no file)

Svarīgi: Aizveriet visus atvērtos logus, izņemot HijackThis un pēc tam noklikšķiniet uz Fix pārbaudīja.

Kad pabeigts, izbraukšanas HijackThis.

----------

Ja jums jau ir Malwarebytes būt pārliecināti, lai atjauninātu to pirms braukšanas skenēšanas!

Lejupielādēt Malwarebytes "Anti-Malware (MBAM)

Alternate MBAM download saiti

Veiciet dubultklikšķi uz mbam-setup.exe un sekojiet norādījumiem, lai instalētu programmu.
Gada beigās, pārliecinieties atzīmes atrodas blakus šādi:
- Update Malwarebytes "Anti-Malware
- Launch Malwarebytes "Anti-Malware
Pēc tam noklikšķiniet uz Apdare.
Ja atjaunināšana ir atrasts, tas lejupielādētu un instalētu jaunāko versiju.
Kad programma ir piekrauts, izvēlieties Veikt quick scan, Tad noklikšķiniet uz Scan.
Kad skenēšana ir pabeigta, noklikšķiniet uz OK, Tad Parādīt rezultātus apskatīt rezultātus.
Pārliecinieties, ka viss ir pārbaudīts, un noklikšķiniet uz Noņemt atlasīto.
Kad dezinfekcija ir pabeigta, log atvērsies Notepad un jums var tikt piedāvāts restartēt. (Skatīt Extra piezīmi)
Log tiek automātiski saglabāts ar MBAM un to var apskatīt, noklikšķinot Baļķi cilnē MBAM.
Kopēt un ielīmēt visu ziņojumu savā nākamajā atbildi.

Extra Piezīme: Ja MBAM sastopas failu, kas ir grūta, Jums tiks parādīts 1 of 2 uzvednes, noklikšķiniet uz Labi, lai nu un ļaujiet MBAM rīkoties ar dezinfekcijas procesu, ja prasīts restartēt datoru, lūdzu, dariet to nekavējoties.

tidi · #3 Jūlijs 12, 2009, 19:29

I'm sorry man bija tik ilgi, lai pēc atbildi šeit MBAM log izskatās diezgan labi, lai man, pateicoties daudz vīrietis really appreciate it

Malwarebytes "Anti-Malware 1,38
Database version: 2325
Windows 6.0.6001 Service Pack 1

12/07/2009 10:26:34
mbam-log-2009-07-12 (22-26-34). txt

Scan type: Quick Scan
Objekti skenēts: 74.665
Pagājušo laiku: 2 minūte (s), 52 second (s)

Memory Processes Inficētie: 0
Memory Modules Inficētie: 0
Registry Keys Inficētie: 0
Reģistra vērtības Inficētie: 0
Registry Data Items Infected: 0
Mapes Inficētie: 0
Faili Inficētie: 0

Atmiņas procesi Inficētie:
(No ļaunprātīgs preces konstatētas)

Memory Modules Inficētie:
(No ļaunprātīgs preces konstatētas)

Registry Keys Inficētie:
(No ļaunprātīgs preces konstatētas)

Reģistra vērtības Inficētie:
(No ļaunprātīgs preces konstatētas)

Registry Data Items Infected:
(No ļaunprātīgs preces konstatētas)

Mapes Inficētie:
(No ļaunprātīgs preces konstatētas)

Faili Inficētie:
(No ļaunprātīgs preces konstatētas)