A pop-up-virus

durial666 · #1 31 siječanj 2008, 05:25

JA držati uzimajući ovaj okvir pojaviti svaki put kad idem kroz poput My Documents Računalo ili sl. ... Također se pojavljuju kad koristim IE ali ne i kad koristim Firefox. Ja sam nekoliko programa koji se koriste, a ipak još uvijek gleda ga. Mogao je svibanj biti rootkit (nada ne).

Moj Evidencije: --

ESET Online Scanner
# Version = 4
# OnlineScanner.ocx = 1.0.0.56
# OnlineScannerDLLA.dll = 1, 0, 0, 51
# OnlineScannerDLLW.dll = 1, 0, 0, 51
# OnlineScannerUninstaller.exe = 1, 0, 0, 49
# Vers_standard_module = 2836 (20080130)
# Vers_arch_module = 1,063 (20080117)
# Vers_adv_heur_module = 1,060 (20070601)
# EOSSerial = 86fa0ec02340bf40b27cfd3ccc323dee
# End = završio
# Remove_checked = true
# Unwanted_checked = true
# Utc_time = 2008-01-31 02:29:31
# Local_time = 2008-01-31 02:29:31 (+0000, GMT Standard Time)
# Zemlje = "United Kingdom"
# Osver = 6.0.6000 NT
Skenirane = # 306177
# Pronašao = 0
# Scan_time = 8875

SUPERAntiSpyware Scan Prijava
http://www.superantispyware.com

Generirano 01/31/2008 at 02:32

Application Version: 3/9/1008

Core Pravila Database Version: 3391
Trace Pravila Database Version: 1383

Scan type: Cijela Scan
Ukupno Scan Vrijeme: 02:21:07

Memorija predmeta skenirane: 834
Memorija prijetnje otkrivena: 0
Registry stavke skenirane: 7637
Matični prijetnje otkrivena: 0
File skenirane podatke: 66364
File prijetnje otkrivena: 6

Adware.Tracking Cookie
C: \ Users \ Chris \ AppData \ Roaming \ Microsoft \ Windows \ C ookies \ Chris @ tribalfusion [2]. Txt
C: \ Users \ Chris \ AppData \ Roaming \ Microsoft \ Windows \ C ookies \ chris@adopt.euroclick [2]. Txt

Trojan.Media-Codec/V5-Intaller
C: \ Users \ Chris \ Desktop \ INSTALL_PLAYER_3912994 (2). E XE
C: \ Users \ Chris \ Desktop \ INSTALL_PLAYER_3912994.EXE
C: \ Windows \ prefekt \ INSTALL_PLAYER_3912994 (2). Exe-03357FA6.pf
C: \ Windows \ prefekt \ INSTALL_PLAYER_3912994.EXE-9E95D8EF.pf

HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan spremljena u 12:05:19, dana 31/01/2008
Platforma: Windows Vista (Winnt 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Pokretanje procesa:
C: \ Windows \ System32 \ smss.exe
C: \ Windows \ system32 \ csrss.exe
C: \ Windows \ system32 \ wininit.exe
C: \ Windows \ system32 \ csrss.exe
C: \ Windows \ system32 \ services.exe
C: \ Windows \ system32 \ lsass.exe
C: \ Windows \ system32 \ lsm.exe
C: \ Windows \ system32 \ Winlogon.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ Microsoft.Net \ Framework \ v3.0 \ WPF \ Presen tationFontCache.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ system32 \ SLsvc.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe
C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
C: \ Windows \ System32 \ spoolsv.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ system32 \ Dwm.exe
C: \ Windows \ Explorer.exe
C: \ Program Files \ Windows Defender \ MSASCui.exe
C: \ Windows \ RtHDVCpl.exe
C: \ Program Files \ Toshiba \ Power Saver \ TPwrMain.exe
C: \ Program Files \ Toshiba \ SmoothView \ SmoothView.exe
C: \ Program Files \ Toshiba \ FlashCards \ TCrdMain.exe
C: \ Program Files \ a-kvadratna Anti-zaštita od zlonamjernih programa \ a2service.exe
C: \ Windows \ system32 \ agrsmsvc.exe
C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Bonjour \ mDNSResponder.exe
C: \ Program Files \ Toshiba \ ConfigFree \ CFSvcs.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ system32 \ TODDSrv.exe
C: \ Program Files \ Toshiba \ Power Saver \ TosCoSrv.exe
C: \ Program Files \ Toshiba \ Bluetooth Toshiba Stack \ TosBtSrv.exe
C: \ Program Files \ Common Files \ Ulead Systems \ DVD \ ULCDRSvr.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ system32 \ SearchIndexer.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
C: \ Windows \ system32 \ taskeng.exe
C: \ Windows \ system32 \ taskeng.exe
C: \ Program Files \ Toshiba \ Utilities \ KeNotify.exe
C: \ Program Files \ Toshiba \ ConfigFree \ NDSTray.exe
C: \ Program Files \ Toshiba \ Toshiba Online Product Information \ TOPI.exe
C: \ Program Files \ IDM \ Desktop SMS \ DesktopSMS.exe
C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
C: \ Program Files \ Toshiba \ Registration \ ToshibaRegistration.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashDisp.exe
C: \ Program Files \ Camera Assistant Software Toshiba za \ traybar.exe
C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ LaunchApplication.exe
C: \ Program Files \ iTunes \ iTunesHelper.exe
C: \ Program Files \ a-kvadratna Anti-zaštita od zlonamjernih programa \ a2guard.exe
C: \ Program Files \ Windows Sidebar \ sidebar.exe
C: \ Program Files \ Toshiba \ TOSCDSPD \ TOSCDSPD.exe
C: \ Program Files \ MSN Messenger \ msnmsgr.exe
C: \ Windows \ ehome \ ehtray.exe
C: \ Windows \ system32 \ wbem \ wmiprvse.exe
C: \ Program Files \ Veoh Networks \ Veoh \ VeohClient.exe
C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe
C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
C: \ Program Files \ Fantastičan Plamen Screensaver \ FantasticFlameAgent.exe
C: \ Windows \ ehome \ ehmsas.exe
C: \ Windows \ System32 \ rundll32.exe
C: \ Program Files \ Synaptics \ SynTP \ SynToshiba.exe
C: \ Program Files \ Camera Assistant Software Toshiba za \ CEC_MAIN.exe
C: \ Program Files \ Windows Sidebar \ sidebar.exe
C: \ Program Files \ PC Connectivity Solution \ ServiceLayer.exe
C: \ Program Files \ Toshiba \ ConfigFree \ CFSwMgr.exe
C: \ Program Files \ Windows Mail \ WinMail.exe
C: \ Program Files \ iPod \ bin \ iPodService.exe
C: \ Program Files \ MSN Messenger \ usnsvc.exe
C: \ Program Files \ Microsoft Office \ OFFICE11 \ WINWORD.EXE
C: \ Program Files \ Mozilla Firefox \ firefox.exe
C: \ Windows \ system32 \ Msiexec.exe
C: \ Program Files \ PrevxCSI \ prevxcsi.exe
C: \ Program Files \ Spybot - Search & Destroy \ SpybotSD.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ system32 \ SearchProtocolHost.exe
C: \ Windows \ system32 \ SearchFilterHost.exe
C: \ Program Files \ Trend Micro \ HijackThis \ Sniper.exe.exe

R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.altavista.com/audio/default
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, SearchAssistant =
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, CustomizeSearch =
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Postavke, ProxyOverride = *. lokalne
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar, LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Instalira \ cpn \ yt.dll
O1 - Hosts::: 1 localhost
O2 - BHO: Yahoo! Toolbar Helper - (02478D38-C3F9-4EFB-9B51-7695ECA05670) - C: \ Program Files \ Yahoo! \ Companion \ Instalira \ cpn \ yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 7,0 \ ActiveX \ AcroIEHelper.dll
O2 - BHO: megaupload Toolbar - (4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C) - C: \ programa ~ 1 \ MEGAUP ~ 1 \ MEGAUP ~ 1.DLL
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ programa ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ ssv.dll
O2 - BHO: (no name) - (7E853D72-626A-48EC-A868-BA8D5E23E045) - (no file)
O2 - BHO: Igrač - (83FD1F86-B40A-41EE-8512-929F005ED2A8) - C: \ Windows \ orgnavi.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Instalira \ cpn \ yt.dll
O3 - Toolbar: megaupload Toolbar - (4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C) - C: \ programa ~ 1 \ MEGAUP ~ 1 \ MEGAUP ~ 1.DLL
O4 - HKLM \ .. \ Run: [Windows Defender]% ProgramFiles% \ Windows Defender \ MSASCui.exe-hide
O4 - HKLM \ .. \ Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM \ .. \ Run: [TPwrMain]% ProgramFiles% \ Toshiba \ Power Saver \ TPwrMain.EXE
O4 - HKLM \ .. \ Run: [HSON]% ProgramFiles% \ Toshiba \ TBS \ HSON.exe
O4 - HKLM \ .. \ Run: [SmoothView]% ProgramFiles% \ Toshiba \ SmoothView \ SmoothView.exe
O4 - HKLM \ .. \ Run: [00TCrdMain]% ProgramFiles% \ Toshiba \ FlashCards \ TCrdMain.exe
O4 - HKLM \ .. \ Run: [KeNotify] C: \ Program Files \ Toshiba \ Utilities \ KeNotify.exe
O4 - HKLM \ .. \ Run: [HWSetup] C: \ Program Files \ Toshiba \ Utilities \ HWSetup.exe hwSetUP
O4 - HKLM \ .. \ Run: [SVPWUTIL] C: \ Program Files \ Toshiba \ Utilities \ SVPWUTIL.exe SVPwUTIL
O4 - HKLM \ .. \ Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM \ .. \ Run: [tropski šešir] C: \ Program Files \ Toshiba \ Toshiba Online Product Information \ topi.exe-početni
O4 - HKLM \ .. \ Run: [Desktop SMS] C: \ Program Files \ IDM \ Desktop SMS \ DesktopSMS.exe / auto
O4 - HKLM \ .. \ Run: [NvSvc] RUNDLL32.EXE C: \ Windows \ system32 \ nvsvc.dll, nvsvcStart
O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ Windows \ system32 \ NvCpl.dll, NvStartup
O4 - HKLM \ .. \ Run: [NvMediaCenter] RUNDLL32.EXE C: \ Windows \ system32 \ NvMcTray.dll, NvTaskbarInit
O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
O4 - HKLM \ .. \ Run: [Toshiba Registration] C: \ Program Files \ Toshiba \ Registration \ ToshibaRegistration.exe
O4 - HKLM \ .. \ Run: [avast!] C: \ programa ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp.exe
O4 - HKLM \ .. \ Run: [Camera Assistant Software] "C: \ Program Files \ Camera Assistant Software Toshiba za \ traybar.exe"
O4 - HKLM \ .. \ Run: [PCSuiteTrayApplication] C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ LaunchApplication.exe-početni
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe"
O4 - HKLM \ .. \ Run: [A-kvadratna] "C: \ Program Files \ a-kvadratna Anti-zaštita od zlonamjernih programa \ a2guard.exe" / d = 60
O4 - HKLM \ .. \ Run: [PrevxCSI] "C: \ Program Files \ PrevxCSI \ prevxcsi.exe"-boot
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ jusched.exe"
O4 - HKCU \ .. \ Run: [Sidebar] C: \ Program Files \ Windows Sidebar \ sidebar.exe / Autorun
O4 - HKCU \ .. \ Run: [TOSCDSPD] C: \ Program Files \ Toshiba \ TOSCDSPD \ TOSCDSPD.exe
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files \ MSN Messenger \ MsnMsgr.Exe" / background
O4 - HKCU \ .. \ Run: [ehTray.exe] C: \ Windows \ ehome \ ehTray.exe
O4 - HKCU \ .. \ Run: [Veoh] "C: \ Program Files \ Veoh Networks \ Veoh \ VeohClient.exe" / VeohHide
O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe
O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
O4 - HKUS \ S-1-5-19 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll, ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'NETWORK SERVICE')
O4 - HKUS \ S-1-5-18 \ .. \ Run: [Nokia.PCSync] C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ PcSync2.exe / NoDialog (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [Nokia.PCSync] C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ PcSync2.exe / NoDialog (User 'Default user')
O4 - Global Startup: Fantastičan Plamen Agent.lnk = C: \ Program Files \ Fantastičan Plamen Screensaver \ FantasticFlameAgent.exe
O8 - Extra kontekst meni stavka: E & zvezi u Microsoft Excel - res: / / C: \ programa ~ 1 \ MICROS ~ 3 \ OFFICE11 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ npjpi160_04.dll
O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ npjpi160_04.dll
O9 - Extra button: Send to OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ programa ~ 1 \ MICROS ~ 3 \ Office12 \ ONBttnIE.dll
O9 - Extra 'Tools' MENUITEM: S & kraj OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ programa ~ 1 \ MICROS ~ 3 \ Office12 \ ONBttnIE.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ programa ~ 1 \ MICROS ~ 3 \ OFFICE11 \ REFIEBAR.DLL
O9 - Extra button: eBay - (C08CAF1D-C0A3-40D5-9970-06D067EAC017) -- http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?EN (file missing)
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ programa ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' MENUITEM: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ programa ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O13 - smolastoga Prefiks:
O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (YInstStarter Class) - C: \ Program Files \ Yahoo! \ Common \ yinsthelper.dll
O16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) (OnlineScanner Control) -- http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: (5C051655-FCD5-4969-9182-770EA5AA5565) (Solitaire Showdown Class) -- http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: (5D6F45B3-9043-443D-A792-115447494D24) (UnoCtrl Class) -- http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
O16 - DPF: (C3F79A2B-B9B4-4A66-B012-3EE46475B072) (MessengerStatsClient Class) -- http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: (D4323BF2-006A-4440-A2F5-27E3E7AB25F8) (Virtools WebPlayer Class) -- http://a532.g.akamai.net/f/532/6712/.../installer.exe
O16 - DPF: (F5A7706B-B9C0-4C89-A715-7A0C6B05DD48) (minolovac Zastave klase) -- http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: (F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8) (GoPetsWeb Control) -- https: / / secure.gopetslive.com / dev / GoPetsWeb.cab
O20 - Winlogon Obavijesti:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll
O23 - Service: A-kvadratna Anti-zaštita od zlonamjernih programa Service (a2AntiMalware) - Emsi Software GmbH - C: \ Program Files \ a-kvadratna Anti-zaštita od zlonamjernih programa \ a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C: \ Windows \ system32 \ agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
O23 - Service: Id_String1.6844F930_1628_4223_B5CC_5BB94B879762 # # # # (Bonjour Service) - Apple Computer, Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - Toshiba CORPORATION - C: \ Program Files \ Toshiba \ ConfigFree \ CFSvcs.exe
O23 - Service: Symantec Lic NetConnect usluga (CLTNetCnService) - Unknown vlasnika - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd - C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Izdavač \ FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C: \ Program Files \ PC Connectivity Solution \ ServiceLayer.exe
O23 - Service: Toshiba Optical Disc Drive Service (TODDSrv) - Toshiba Corporation - C: \ Windows \ system32 \ TODDSrv.exe
O23 - Service: Toshiba Power Saver (TosCoSrv) - Toshiba Corporation - C: \ Program Files \ Toshiba \ Power Saver \ TosCoSrv.exe
O23 - Service: Bluetooth Service Toshiba - Toshiba CORPORATION - C: \ Program Files \ Toshiba \ Bluetooth Toshiba Stack \ TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc - C: \ Program Files \ Common Files \ Ulead Systems \ DVD \ ULCDRSvr.exe

--
End of file - 14403 bytes

Im 'gonna dodaj par logove iz drugih programa za: --

A-kvadratna

A-kvadratna Anti-zaštita od zlonamjernih programa - Verzija 3.1
Last update: 31/01/2008 01:16:41

Scan postavke:

Objekti: Memorija, Tragovi, Cookies, C: \, E: \
Scan arhivi: Uključeno
Heuristike: Uključeno
REKLAME Scan: Uključeno

Scan početak: 31/01/2008 01:46:59

C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 43 otkrivena: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 72 otkrivena: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 80 otkrivena: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 161 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 162 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 167 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 181 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 210 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 282 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 283 detektiranih: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 338 detektiranih: Trace.TrackingCookie
C: \ Program Files \ DarkandLight \ Launcher.exe otkrivena: Trojan-Spy.Win32.Banker.gez

Skenirane

Files: 160756
Tragovi: 296173
Cookies: 381
Procesi: 87

Pronašao

Files: 1
Tragovi: 0
Cookies: 11
Procesi: 0
Registry tipke: 0

Scan Kraj: 31/01/2008 04:13:41
Scan Time: 2:26:42

C: \ Program Files \ DarkandLight \ Launcher.exe obrisan: Trojan-Spy.Win32.Banker.gez
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 43 obrisan: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 72 obrisan: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 80 obrisan: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 161 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 162 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 167 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 181 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 210 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 282 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 283 obrisane: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro files \ xqe1wgaj.default \ cookies.txt: 338 obrisane: Trace.TrackingCookie

Izbrisano:

Files: 1
Tragovi: 0
Cookies: 11

Kada koristite Spybot S & D JA držati uzimajući jednak problem

**evilfantasy** · #2 31 siječanj 2008, 08:24

Dobrodošli na TCF.

Preuzimanje SmitfraudFix (by S! Ri) na svoj Desktop.

Ekstrakt svi kartoteka na vaš Destop.
A zove SmitfraudFix folder će biti kreiran na vašem Desktopu.

[Lista]

POZORNO PROČITAJTE Sve ove upute POČETNA PRIJE čine ništa. Pitaj bilo kojeg pitanja koja vas svibanj imati prije početka.

Vi svibanj želite ispisati ovim uputama ili kopirajte i zalijepite ih u notepad i spremi ga na radnoj površini kako nećete biti u mogućnosti vidjeti ovu stranicu u sigurnom načinu rada

Molim ponovno pokrenuti računalo u sigurnom načinu rada kuckanje po tipku F8 prije pokretanja sustava Windows da biste učitali i odaberete Safe Mode.

Otvorite SmitfraudFix mapu na radnoj površini, a zatim dvokliknite smitfraudfix.cmd datoteku da biste pokrenuli alat.

Odaberite opciju # 2 - Čisto utipkajući 2 i pritisnite Enter.

Program će započeti čišćenje Vašeg računala i idi kroz niz čišćenje procesa. Pričekajte za alat za potpuni i Disk Cleanup do kraja.
- Ovaj proces može potrajati neko vrijeme ovisno o vašem računalu, pa vas molimo budite strpljivi.
Kada je završena, ona će se automatski zatvoriti i te bi trebao nastaviti sa sljedećim korakom.

Bit ćete upitani: "Matični čišćenje - Želite li očistiti registry? "Odgovor Da utipkajući Y i pritisnite Enter.

Alat će također provjeriti ako Wininet.dll zaraženo. Ako je zaraženo i čistu verziju pronađe, bit ćete upitani za zamjenu zaraženih Wininet.dll s čistim datoteku.
Odgovor Da na pitanje "Zamijenite zaražene datoteke?"Utipkajući Y i pritisnite Enter.

A pokretanje svibanj biti potrebno kako bi završili proces čišćenja. Izvještaj se može naći i na korijenu pogona sustava, obično na C: \ rapport.txt

Predloženi korak:

Da biste vratili Trusted site i Restricted zonu, odaberite 3 i pritisnite Enter.

Vas će se tražiti: Vraćanje Trusted Zone? odgovor Y (da) i pritisnite Enter za brisanje pouzdanih zonu.

Sada ponovno podizanje sustava u normalnom načinu rada i post ovaj novi rapport.txt u sljedećem postu.

UPOZORENJE Running ovu opciju ne okužen na računalo će maknuti radna površina pozadina. Tako se samo jednom!

----------

Sljedeća pokretati nove Hijackthis skenirati i poslati log.

----------

Next post molimo dodaj
SmitfraudFix log
Novi Hijackthis log

Slične teme
Nit	Temu Započeo	Forum	Odgovori	Zadnji Post
Virus Pitanje - Može bilo tko reći mene ako JA svibanj imati virus	billozz	Virus, Spyware i sigurnost	1	2. travanj 2009 13:58
Moji prijatelji MAC ima virus ... Umm ... yeah ... virus ...	cheesepuff	Virus, Spyware i sigurnost	3	29. listopad 2008 12:58
Virus pomoć	jam90	Virus, Spyware i sigurnost	1	28. srpnja 2008 07:26
Virus	lolli_pop	Virus, Spyware i sigurnost	13	17. studeni 2007 09:42
Virus?	carpious	Virus, Spyware i sigurnost	12	6. svibanj 2007 09:49