Trojanac i HijackThis
 

Izgleda da sam pokupio nekaj al s ničim se nemrem tog vraga rješit.

Ovak IMON od NOD32 kad se konektam na net mi prijavljuje ovo:

File - http://rf104.com/Z/img.gif
Virus - Win32/TrojanDownloader.Agent.NAV trojan

Izgleda kao da mi se to čudo konstantno hoće naselit na komp i nikak nemrem namjestit PCEX kao home page neg mi cijelo vrijeme odlazi na neku čudnu stranicu.


I evo loga od HijackThis pa kaj da maknem.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {56CBAADD-C44A-3DB1-F908-3B89CDC59286} - C:\WINDOWS\system32\msap.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...a29296baabe1d6
O17 - HKLM\System\CCS\Services\Tcpip\..\{6C31BC5

Costa i ostali, help pliz :beer:

*bump*

Sorry ali uvijek nekaj preskocim. Morat cu promjenit nacin pracenja foruma.

Definitivno moras srediti:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\hkpyp.dll/sp.html#12802
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {56CBAADD-C44A-3DB1-F908-3B89CDC59286} - C:\WINDOWS\system32\msap.dll
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...8a29296baabe1d6

E al ima jedan problem. Ako je ovo sto ja mislim da je nakon restarta ili nakon sto odredjeni put pokrenes IE ta se stvar vrati. Ako je to u pitanju onda cemo se malo namuciti.

You've got to ask yourself one question, do I feel lucky. Well, do ya punk? :D

Stvar je u tome da nemrem stavit PCEkspert kao home page, da mi se to govno oće nasrat na komp svaki put kad otvorim IE i otvara mi neke blesave stranice za download nekih spyware programa.

BTW - tnx Brit...ovaj Costa. :D Izgleda da sam ga se riješio.

Super. Nego daj mi posalji na mail: "C:\WINDOWS\system32\msap.dll". Poslije ga izbrises.

costa666@index.hr

Al ja nemam taj fajl. :confused:

Onda nis :beer: