prosze o pomoc

Gość: meg IP: *.adsl.proxad.net 24.12.06, 16:27

jeszcze raz poprosze bardzo o wasza pomoc.....
zainstalowal mi sie " Antivermins " jakis pseudo-antywirus.

komputer byl juz skanowany przez moj antywirus i evido.

wklejam loga z hijackthis
z gory bardzo dziekuje za pomoc
i przesylam moje serdeczne zycznia z okazji Swiat Bozego Nardzenia

Logfile of HijackThis v1.99.1
Scan saved at 16:16:25, on 24/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\eMule\emule.exe
C:\Documents and Settings\Magdalena\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.nouvelobs.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer = proxy.free.fr:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {05BD4499-46F6-6133-18BC-D9150A0F1432} - C:\DOCUME~1
\LON~1\APPLIC~1\MPEGIS~1\traysurf.exe (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-
5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows
Live\WindowsLiveLogin.dll
O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} -
C:\Program Files\Video ActiveX Object\iesplugin.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1
\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control
Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet
Security\UrlLstCk.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1
\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -
lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [signwindowlocksdeaf] C:\Documents and Settings\All
Users\Application Data\Bike drive sign window\Option Fork.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition
Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Date cdrom] C:\DOCUME~1\LON~1\APPLIC~1\CHINBU~1
\datasoap.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft
ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\microsoft
office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-
00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -
C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-
9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %
windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 -
{85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file
missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %
windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-
f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .avi: C:\Program Files\Internet
Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .wav: C:\Program Files\Internet
Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF:
START_PAGE_URL=home.fra.chello.fr/ssi/welcome/welcome.php?
url=home&src=ie
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient
Class) -
messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
O16 -

Obserwuj wątek

Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 01:43

wklejam rowniez loga z findlopu:

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6CA7-15B8

R‚pertoire de C:\Documents and Settings\L‚on\Application Data

01/09/2006 19:01 2ÿ508 $_hpcst$.hpc
02/09/2006 19:45 <REP> Adobe
03/09/2006 19:23 <REP> AdobeUM
11/05/2006 21:30 <REP> Ahead
19/09/2006 13:26 <REP> aMule
24/05/2006 17:13 <REP> CHINBU~1 chin burn dale
05/07/2006 14:19 <REP> CYBERL~1 CyberLink
11/10/2006 12:34 <REP> FLIGHT~1.ORG flightgear.org
11/10/2006 12:34 <REP> fltk.org
28/07/2006 10:33 57ÿ192 GDIPFO~1.DAT GDIPFONTCACHEV1.DAT
19/12/2006 19:43 <REP> Google
15/06/2006 07:56 <REP> Help
16/08/2004 18:19 <REP> IDENTI~1 Identities
07/07/2006 19:27 <REP> KAZAAL~1 Kazaa Lite
29/05/2006 19:24 <REP> Lavasoft
01/09/2006 12:03 <REP> LEADER~1 Leadertech
16/09/2006 10:36 <REP> MACROM~1 Macromedia
23/05/2006 15:57 <REP> MICROS~2 Microsoft Web Folders
23/05/2006 16:16 <REP> Mozilla
22/05/2006 22:11 <REP> MPEGIS~1 mpeg iso
24/12/2006 17:48 2ÿ481 QUICKZ~1.INI QuickZip45.ini
19/12/2006 05:39 <REP> Real
18/12/2006 21:55 <REP> Shareaza
01/09/2006 12:03 <REP> Sonic
24/02/2005 09:39 <REP> Sun
24/02/2005 09:47 <REP> Symantec
23/05/2006 16:16 <REP> Talkback
23/05/2006 16:16 <REP> THUNDE~1 Thunderbird
19/12/2006 05:00 <REP> vlc
24/02/2005 09:45 <REP> YOU'VE~1 You've Got Pictures Screensaver
3 fichier(s) 62ÿ181 octets
27 R‚p(s) 56ÿ551ÿ899ÿ136 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6CA7-15B8

R‚pertoire de C:\Documents and Settings\All Users\Application Data

13/05/2006 07:02 305 ADDR_F~1.HTM addr_file.html
02/09/2006 19:47 <REP> Adobe
23/09/2005 23:18 <REP> Ahead
21/12/2006 18:02 <REP> ANTIVI~1 AntiVir PersonalEdition Classic
30/01/2006 21:33 <REP> AOL
17/08/2006 17:50 <REP> Avg7
24/05/2006 17:05 <REP> BIKEDR~1 Bike drive sign window
24/04/2005 14:20 <REP> CYBERL~1 CyberLink
20/03/2006 19:43 <REP> DVDSHR~1 DVD Shrink
19/12/2006 18:47 <REP> Google
18/09/2005 11:56 <REP> LaForet
07/04/2006 19:13 <REP> MESSEN~1 Messenger Plus!
26/07/2006 18:39 <REP> PIXELS~1 pixelStorm
24/04/2005 14:15 <REP> QUICKT~1 QuickTime
16/08/2004 18:28 <REP> SBSI
04/02/2006 20:04 <REP> SPYBOT~1 Spybot - Search & Destroy
11/11/2005 15:45 <REP> Symantec
30/01/2006 21:42 <REP> WINDOW~1 Windows Genuine Advantage
26/01/2006 21:51 <REP> Zylom
1 fichier(s) 305 octets
18 R‚p(s) 56ÿ551ÿ899ÿ136 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6CA7-15B8

R‚pertoire de C:\Program Files

25/12/2006 01:32 <REP> .
25/12/2006 01:32 <REP> ..
19/12/2005 05:17 20ÿ454 100.png
24/09/2006 18:47 122ÿ360 1AVATA~1.EXE 1avatars009.exe
07/05/2006 11:24 <REP> 3DO
23/12/2006 21:40 <REP> 7-Zip
18/04/2005 21:32 <REP> Aashima
31/03/2006 19:57 <REP> Adobe
03/02/2006 17:47 <REP> Ahead
30/01/2006 23:06 <REP> ALWILS~1 Alwil Software
21/12/2006 18:03 <REP> ANTIVI~1 AntiVir PersonalEdition Classic
19/09/2006 18:27 <REP> ANtsP2P
19/09/2006 14:48 <REP> Ares
29/10/2006 19:18 <REP> AxBx
06/12/2006 16:54 <REP> Boonty
06/12/2006 16:56 <REP> BOONTY~1 BoontyGames
04/06/2006 19:56 <REP> CEDPST~1.0 CEDP Stealer 4.0
04/02/2006 19:18 <REP> chello
22/05/2006 16:50 <REP> CHINBU~1 chin burn dale
24/04/2005 14:20 <REP> CYBERL~1 CyberLink
23/05/2006 21:02 <REP> D-Tools
21/06/2002 00:01 626ÿ801 DECOUV~1.EXE DecouvOrdi.exe
27/08/2005 11:47 <REP> DISNEY~1 Disney Interactive
20/03/2006 19:43 <REP> DVDSHR~1 DVD Shrink
20/09/2006 13:45 50ÿ592 DSINST~1.EXE D‚sinstallDecouvOrdi 2-1.exe
28/10/2005 18:55 <REP> EAGAME~1 EA GAMES
29/10/2006 19:17 <REP> ELCOMS~1 ElcomSoft
24/12/2006 23:37 <REP> eMule
02/11/2005 23:30 <REP> ewido
27/05/2006 09:52 <REP> EWIDOA~1 ewido anti-malware
25/12/2006 01:21 <REP> FICHIE~1 Fichiers communs
09/12/2005 15:45 <REP> FILESU~1 FileSubmit
24/06/2002 22:33 22ÿ920 fin.swf
19/08/2005 14:50 <REP> FISHAQ~1 Fish Aquarium 3D Screensaver
29/10/2006 19:19 <REP> FLIGHT~1 FlightGear
26/03/2006 15:36 <REP> GARFIE~1 Garfield part 1
19/12/2006 18:47 <REP> Google
24/12/2006 10:57 <REP> Grisoft
24/09/2006 18:47 122ÿ360 h.exe
03/12/2005 23:35 <REP> ILLUST~1 Illustrate
22/05/2006 16:53 <REP> INCRED~1 IncrediMail
24/08/2005 14:29 276 install.cmd
24/06/2002 16:37 1ÿ152ÿ451 INSTAL~1.EXE InstallDecouvOrdi.exe
09/12/2005 15:52 <REP> INTELL~1 intelliScore Polyphonic WAV to
MIDI Converter Demo
05/12/2006 19:49 <REP> INTERN~1 Internet Explorer
22/05/2006 16:50 <REP> iPhox
24/02/2005 09:39 <REP> Java
19/04/2005 22:37 <REP> K-Lite
09/12/2005 15:52 <REP> KAZAAL~1 Kazaa Lite
26/05/2006 15:21 <REP> Lavasoft
24/02/2005 09:45 <REP> Learn2.com
20/06/2002 23:59 5ÿ204 license.txt
24/06/2002 22:37 2ÿ016 LISEZ-~1.TXT Lisez-moi.txt
09/12/2005 15:52 <REP> LITTLE~1 Little Big Adventure 2
07/05/2005 14:38 <REP> LOV

Drzewko
Od najstarszego
Od najnowszego

Gość: Kolobos Re: prosze o pomoc IP: *.crowley.pl 24.12.06, 16:37

Doklej koncowke log'a ktora sie nie zmiescila z racji limitu na forum.

Uzyj: siri.urz.free.fr/Fix/SmitfraudFix_En.php zrob to co masz opisane pod "Clean" po uzyciu utworzy sie log, ktory wklej na forum.

> zainstalowal mi sie " Antivermins " jakis pseudo-antywirus.

Sam sie zainstalowal? ;-)

Sciagnij i uzyj:
www.geekstogo.com/forum/index.php?act=dscript&CODE=showdetails&f_id=14
Wynik wklej na forum lub sama usun w:
C:\WINDOWS\tasks\ plik job ktory wyswietli sie w findlop i bedzie mial sciezke:
C:\Documents and Settings\All Users\Application Data

W hjt usun:
> F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
> O2 - BHO: (no name) - {05BD4499-46F6-6133-18BC-D9150A0F1432} - C:\DOCUME~1
> \LON~1\APPLIC~1\MPEGIS~1\traysurf.exe (file missing)
> O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} -
> C:\Program Files\Video ActiveX Object\iesplugin.dll (file missing)
> O4 - HKLM\..\Run: [signwindowlocksdeaf] C:\Documents and Settings\All
> Users\Application Data\Bike drive sign window\Option Fork.exe <- katalog Bike.. usun z dysku.
> O4 - HKCU\..\Run: [Date cdrom] C:\DOCUME~1\LON~1\APPLIC~1\CHINBU~1
> \datasoap.exe <- katalog CH... usun z dysku.
- Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 01:40
  
  Dzieki Kolobos, naprawde wielkie dzieki
  juz nie ma problemu
  
  SmitFraudFix v2.131
  
  Rapport fait à 1:16:27,50, 25/12/2006
  Executé à partir de C:\Documents and Settings\L‚on\Bureau\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Le type du système de fichiers est NTFS
  Fix executé en mode normal
  
  »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTas
  kScheduler]
  "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"
  
  [HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32]
  @="C:\WINDOWS\system32\cthkpcv.dll"
  
  [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-
  7b56fb11140b}\InProcServer32]
  @="C:\WINDOWS\system32\cthkpcv.dll"
  
  »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
  
  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
  
  GenericRenosFix by S!Ri
  
  C:\WINDOWS\system32\cthkpcv.dll -> Hoax.Win32.Renos.gen.i
  C:\WINDOWS\system32\cthkpcv.dll -> Deleted
  
  »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
  
  C:\WINDOWS\alexaie.dll supprimé
  C:\WINDOWS\BTGrab.dll supprimé
  C:\WINDOWS\dlmax.dll supprimé
  C:\WINDOWS\Pynix.dll supprimé
  C:\WINDOWS\system32\jao.dll supprimé
  C:\WINDOWS\system32\questmod.dll supprimé
  C:\WINDOWS\system32\runsrv32.dll supprimé
  C:\WINDOWS\system32\runsrv32.exe supprimé
  C:\WINDOWS\system32\shellgui32.dll supprimé
  C:\WINDOWS\system32\tcpservice2.exe supprimé
  C:\WINDOWS\system32\txfdb32.dll supprimé
  C:\WINDOWS\system32\udpmod.dll supprimé
  
  »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "System"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
  
  Nettoyage terminé.
  
  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Reboot
  
  C:\WINDOWS\system32\winsrv32.exe supprimé
  
  »»»»»»»»»»»»»»»»»»»»»»»» Fin
  - Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 01:43
    
    wklejam rowniez loga z findlopu:
    
    Le volume dans le lecteur C s'appelle HDD
    Le num‚ro de s‚rie du volume est 6CA7-15B8
    
    R‚pertoire de C:\Documents and Settings\L‚on\Application Data
    
    01/09/2006 19:01 2ÿ508 $_hpcst$.hpc
    02/09/2006 19:45 <REP> Adobe
    03/09/2006 19:23 <REP> AdobeUM
    11/05/2006 21:30 <REP> Ahead
    19/09/2006 13:26 <REP> aMule
    24/05/2006 17:13 <REP> CHINBU~1 chin burn dale
    05/07/2006 14:19 <REP> CYBERL~1 CyberLink
    11/10/2006 12:34 <REP> FLIGHT~1.ORG flightgear.org
    11/10/2006 12:34 <REP> fltk.org
    28/07/2006 10:33 57ÿ192 GDIPFO~1.DAT GDIPFONTCACHEV1.DAT
    19/12/2006 19:43 <REP> Google
    15/06/2006 07:56 <REP> Help
    16/08/2004 18:19 <REP> IDENTI~1 Identities
    07/07/2006 19:27 <REP> KAZAAL~1 Kazaa Lite
    29/05/2006 19:24 <REP> Lavasoft
    01/09/2006 12:03 <REP> LEADER~1 Leadertech
    16/09/2006 10:36 <REP> MACROM~1 Macromedia
    23/05/2006 15:57 <REP> MICROS~2 Microsoft Web Folders
    23/05/2006 16:16 <REP> Mozilla
    22/05/2006 22:11 <REP> MPEGIS~1 mpeg iso
    24/12/2006 17:48 2ÿ481 QUICKZ~1.INI QuickZip45.ini
    19/12/2006 05:39 <REP> Real
    18/12/2006 21:55 <REP> Shareaza
    01/09/2006 12:03 <REP> Sonic
    24/02/2005 09:39 <REP> Sun
    24/02/2005 09:47 <REP> Symantec
    23/05/2006 16:16 <REP> Talkback
    23/05/2006 16:16 <REP> THUNDE~1 Thunderbird
    19/12/2006 05:00 <REP> vlc
    24/02/2005 09:45 <REP> YOU'VE~1 You've Got Pictures Screensaver
    3 fichier(s) 62ÿ181 octets
    27 R‚p(s) 56ÿ551ÿ899ÿ136 octets libres
    Le volume dans le lecteur C s'appelle HDD
    Le num‚ro de s‚rie du volume est 6CA7-15B8
    
    R‚pertoire de C:\Documents and Settings\All Users\Application Data
    
    13/05/2006 07:02 305 ADDR_F~1.HTM addr_file.html
    02/09/2006 19:47 <REP> Adobe
    23/09/2005 23:18 <REP> Ahead
    21/12/2006 18:02 <REP> ANTIVI~1 AntiVir PersonalEdition Classic
    30/01/2006 21:33 <REP> AOL
    17/08/2006 17:50 <REP> Avg7
    24/05/2006 17:05 <REP> BIKEDR~1 Bike drive sign window
    24/04/2005 14:20 <REP> CYBERL~1 CyberLink
    20/03/2006 19:43 <REP> DVDSHR~1 DVD Shrink
    19/12/2006 18:47 <REP> Google
    18/09/2005 11:56 <REP> LaForet
    07/04/2006 19:13 <REP> MESSEN~1 Messenger Plus!
    26/07/2006 18:39 <REP> PIXELS~1 pixelStorm
    24/04/2005 14:15 <REP> QUICKT~1 QuickTime
    16/08/2004 18:28 <REP> SBSI
    04/02/2006 20:04 <REP> SPYBOT~1 Spybot - Search & Destroy
    11/11/2005 15:45 <REP> Symantec
    30/01/2006 21:42 <REP> WINDOW~1 Windows Genuine Advantage
    26/01/2006 21:51 <REP> Zylom
    1 fichier(s) 305 octets
    18 R‚p(s) 56ÿ551ÿ899ÿ136 octets libres
    Le volume dans le lecteur C s'appelle HDD
    Le num‚ro de s‚rie du volume est 6CA7-15B8
    
    R‚pertoire de C:\Program Files
    
    25/12/2006 01:32 <REP> .
    25/12/2006 01:32 <REP> ..
    19/12/2005 05:17 20ÿ454 100.png
    24/09/2006 18:47 122ÿ360 1AVATA~1.EXE 1avatars009.exe
    07/05/2006 11:24 <REP> 3DO
    23/12/2006 21:40 <REP> 7-Zip
    18/04/2005 21:32 <REP> Aashima
    31/03/2006 19:57 <REP> Adobe
    03/02/2006 17:47 <REP> Ahead
    30/01/2006 23:06 <REP> ALWILS~1 Alwil Software
    21/12/2006 18:03 <REP> ANTIVI~1 AntiVir PersonalEdition Classic
    19/09/2006 18:27 <REP> ANtsP2P
    19/09/2006 14:48 <REP> Ares
    29/10/2006 19:18 <REP> AxBx
    06/12/2006 16:54 <REP> Boonty
    06/12/2006 16:56 <REP> BOONTY~1 BoontyGames
    04/06/2006 19:56 <REP> CEDPST~1.0 CEDP Stealer 4.0
    04/02/2006 19:18 <REP> chello
    22/05/2006 16:50 <REP> CHINBU~1 chin burn dale
    24/04/2005 14:20 <REP> CYBERL~1 CyberLink
    23/05/2006 21:02 <REP> D-Tools
    21/06/2002 00:01 626ÿ801 DECOUV~1.EXE DecouvOrdi.exe
    27/08/2005 11:47 <REP> DISNEY~1 Disney Interactive
    20/03/2006 19:43 <REP> DVDSHR~1 DVD Shrink
    20/09/2006 13:45 50ÿ592 DSINST~1.EXE D‚sinstallDecouvOrdi 2-1.exe
    28/10/2005 18:55 <REP> EAGAME~1 EA GAMES
    29/10/2006 19:17 <REP> ELCOMS~1 ElcomSoft
    24/12/2006 23:37 <REP> eMule
    02/11/2005 23:30 <REP> ewido
    27/05/2006 09:52 <REP> EWIDOA~1 ewido anti-malware
    25/12/2006 01:21 <REP> FICHIE~1 Fichiers communs
    09/12/2005 15:45 <REP> FILESU~1 FileSubmit
    24/06/2002 22:33 22ÿ920 fin.swf
    19/08/2005 14:50 <REP> FISHAQ~1 Fish Aquarium 3D Screensaver
    29/10/2006 19:19 <REP> FLIGHT~1 FlightGear
    26/03/2006 15:36 <REP> GARFIE~1 Garfield part 1
    19/12/2006 18:47 <REP> Google
    24/12/2006 10:57 <REP> Grisoft
    24/09/2006 18:47 122ÿ360 h.exe
    03/12/2005 23:35 <REP> ILLUST~1 Illustrate
    22/05/2006 16:53 <REP> INCRED~1 IncrediMail
    24/08/2005 14:29 276 install.cmd
    24/06/2002 16:37 1ÿ152ÿ451 INSTAL~1.EXE InstallDecouvOrdi.exe
    09/12/2005 15:52 <REP> INTELL~1 intelliScore Polyphonic WAV to
    MIDI Converter Demo
    05/12/2006 19:49 <REP> INTERN~1 Internet Explorer
    22/05/2006 16:50 <REP> iPhox
    24/02/2005 09:39 <REP> Java
    19/04/2005 22:37 <REP> K-Lite
    09/12/2005 15:52 <REP> KAZAAL~1 Kazaa Lite
    26/05/2006 15:21 <REP> Lavasoft
    24/02/2005 09:45 <REP> Learn2.com
    20/06/2002 23:59 5ÿ204 license.txt
    24/06/2002 22:37 2ÿ016 LISEZ-~1.TXT Lisez-moi.txt
    09/12/2005 15:52 <REP> LITTLE~1 Little Big Adventure 2
    07/05/2005 14:38 <REP> LOV
    - Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 01:44
      
      c.d.
      
      09/12/2005 15:52 <REP> LITTLE~1 Little Big Adventure 2
      07/05/2005 14:38 <REP> LOVELY~1 Lovely Cats
      05/06/2006 11:28 110ÿ625 MCOINS~1.EXE mcoinstall.exe
      22/04/2006 23:37 <REP> MEDIAG~1 MediaGateway
      07/06/2006 19:26 <REP> MEEGOS~1 Meegos Creator
      23/05/2006 21:02 <REP> MESSEN~1 Messenger
      09/12/2006 18:57 <REP> MESSEN~3 Messenger Plus! Live
      23/05/2006 21:03 <REP> MESSEN~2 MessengerPlus! 3
      24/12/2006 11:59 <REP> MI3AA1~1 Microsoft ActiveSync
      02/05/2006 19:02 <REP> MICROS~4 Microsoft AntiSpyware
      31/07/2005 11:50 <REP> MICROS~1 microsoft frontpage
      27/07/2006 19:48 <REP> MICROS~3 microsoft office
      24/02/2005 09:53 <REP> MICROS~2 Microsoft Works
      20/06/2002 20:08 10 MOTDEP~1.TXT motdepasse.txt
      16/08/2004 18:06 <REP> MOVIEM~1 Movie Maker
      23/05/2006 16:16 <REP> MOZILL~1 Mozilla Thunderbird
      04/06/2006 19:47 <REP> MSN
      16/08/2004 18:03 <REP> MSNGAM~1 MSN Gaming Zone
      23/12/2006 21:41 <REP> MSNMES~1 MSN Messenger
      07/12/2006 17:47 <REP> MSNREA~1 MSN Reaper
      04/06/2006 18:58 <REP> MSN-PFr
      08/12/2006 17:31 <REP> Msncolor
      04/06/2006 18:49 <REP> MSNCOL~1.FR) MsnColor5
      (MsnTrucAstuce.free.fr)
      16/11/2006 03:08 <REP> MSXML4~1.0 MSXML 4.0
      16/08/2004 18:06 <REP> NETMEE~1 NetMeeting
      05/06/2006 14:37 <REP> NITRON~1 nitroname
      23/05/2006 21:03 <REP> NORTON~1 Norton Internet Security
      16/08/2004 18:03 <REP> ONLINE~1 Online Services
      24/06/2002 22:31 725ÿ257 ORDINA~1.SWF ordinateur.swf
      20/09/2006 13:29 1ÿ113ÿ514 ORDINA~1.ZIP ordinateur.zip
      17/12/2006 03:04 <REP> OUTLOO~1 Outlook Express
      08/05/2005 18:11 <REP> PHOTOF~1 PhotoFiltre
      03/02/2002 16:45 123 phrase.txt
      09/09/2006 20:04 <REP> POCKET~1 Pocket BlockOut
      23/05/2006 21:03 <REP> QUICKT~1 QuickTime
      05/07/2006 08:47 <REP> QUICKZ~1 QuickZip4
      24/02/2005 09:44 <REP> Real
      16/08/2004 18:07 <REP> SERVIC~1 Services en ligne
      18/12/2006 21:55 <REP> Shareaza
      03/10/2000 19:32 4ÿ222 son.swf
      25/09/2006 19:37 <REP> Sonic
      10/11/2005 15:34 <REP> SP2CON~1 SP2 Connection Patcher
      31/05/2006 21:56 <REP> SPYBOT~1 Spybot - Search & Destroy
      23/05/2006 15:11 <REP> Support.com
      20/04/2005 22:33 <REP> SYMNET~1 SymNetDrv
      10/12/2006 13:26 <REP> Team17
      25/09/2006 19:38 <REP> UBISOFT
      22/05/2006 16:53 <REP> WAREZP~1 Warez P2P Client
      22/12/2006 13:50 <REP> WINDOW~3 Windows Media Connect 2
      22/12/2006 16:16 <REP> WINDOW~2 Windows Media Player
      16/08/2004 18:03 <REP> WINDOW~1 Windows NT
      03/10/2005 16:00 <REP> WINDOW~4 Windows XP Fun Pack
      16/08/2004 18:11 <REP> xerox
      29/08/2006 16:27 <REP> Yahoo!
      16 fichier(s) 4ÿ079ÿ185 octets
      91 R‚p(s) 56ÿ551ÿ886ÿ848 octets libres
      - Gość: Kolobos Re: prosze o pomoc IP: *.crowley.pl 25.12.06, 03:22
        
        Usun z C:\Documents and Settings\L‚on\Application Date ten katalog:
        24/05/2006 17:13 <REP> CHINBU~1 chin burn dale
        
        Z C:\Documents and Settings\All Users\Application Data ten:
        
        24/05/2006 17:05 <REP> BIKEDR~1 Bike drive sign window
        
        Z C:\Program Files ten:
        22/05/2006 16:50 <REP> CHINBU~1 chin burn dale
        
        Wklej tez koncowke log'a z hijackthis o ktora prosilem.
        
        Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 20:52
        
        Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 20:54
        
        c.d. i dzieki za pomoc:
        
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
        messenger.zone.msn.com/binary/ZIntro.cab32846.cab
        O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) -
        messenger.zone.msn.com/binary/Bankshot.cab31267.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) -
        game01.zylom.com/activex/zylomgamesplayer.cab
        O16 - DPF: {C58EFA10-2CC0-4C50-8C77-B326555EC1B7} (clsDefault Class) -
        quickfix2.chello.fr/quickfix2/asp/LaunchApp.CAB
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
        fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) -
        messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1
        \MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1
        \MSNMES~1\MSGRAP~1.DLL
        O20 - AppInit_DLLs: pushow35.dll
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} -
        C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) -
        Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
        O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA
        GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32
        \Ati2evxx.exe
        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation -
        C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown
        owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner -
        c:\APPS\Powercinema\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program
        Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
        O23 - Service: Generic Service for HID Keyboard Input Collections
        (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
        Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32
        \IDriverT.exe
        O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
        O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
        Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program
        Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        
        Gość: Kolobos Re: prosze o pomoc IP: *.crowley.pl 25.12.06, 21:55
        
        Odinstaluj Nortona, w hjt usun jeszcze:
        O20 - AppInit_DLLs: pushow35.dll
        Plik usun z dysku.
        
        Zainstalu tez ewido tak jak pisalem.
        
        Gość: meg Re: prosze o pomoc IP: *.adsl.proxad.net 25.12.06, 23:27
        
        kolobos
        wiem ze to pytanie a la blondynka ale:
        JAK ondinstalowac nortona?????
        :-)
        
        Gość: Kolobos Re: prosze o pomoc IP: *.crowley.pl 26.12.06, 00:25
        
        W dodaj usun-programy w panelu sterowania.
        
        Gość: meg Re: prosze o pomoc IP: 193.17.48.* 26.12.06, 13:53
        
        ale ja nie mam nortona w tym panelu....
        dlatego pytam
        
        wieczorem bede szukac na forum moze juz ktos mial ten problem......
        
        Gość: Kolobos Re: prosze o pomoc IP: *.crowley.pl 26.12.06, 14:02
        
        service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039
        
        Gość: meg Re: prosze o pomoc IP: 193.17.48.* 26.12.06, 16:42
        
        dzieki za pomoc
        :-)

Najnowsze z forum Wirusy, trojany, spyware

Zaloguj się