PC Ekspert Forum - View Single Post - HijackThis

Antonic · 18.06.2008., 13:34

pozdrav. evo sta mi se dogadjalo dosad i sta sam napravija. link

evo mog hijackthis loga

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:09:02, on 18.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Program Files\Kirby Alarm\kirbyalarm.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Aveva\VM11.6\Hull\Bin\pmapsvc.exe
C:\Aveva\VM11.6\Hull\Bin\ea312.exe
C:\Aveva\VM11.6\Hull\Bin\ea316.exe
C:\Aveva\VM11.6\Hull\Bin\ea311_bmt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadwin PrintScreen 2.6] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kirby Alarm.lnk = C:\Program Files\Kirby Alarm\kirbyalarm.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Send this URL to WTR - Web The Ripper 2 - {c23e2132-960c-44fc-8ebd-39b37aa4de78} - C:\Program Files\npSoftware\WTR - Web The Ripper 2\wtr.ie.html (file missing)
O9 - Extra 'Tools' menuitem: WTR - Web The Ripper 2 - {c23e2132-960c-44fc-8ebd-39b37aa4de78} - C:\Program Files\npSoftware\WTR - Web The Ripper 2\wtr.ie.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O20 - AppInit_DLLs: C,aqddma.dll,sfzyqv.dll,buxflf.dll,kqnqys.dll,xwfeyx.dll,gryyqi.dll,nicozftp00.dll,msosmhfp00.dll,msoscqit00.dll,fmsiocps.dll,mmzzdw.dll,msosdohs00.dll,bwcnbf.dll,yqzqgx.dll,kryuoq.dll,niwvwt.dll,wadpkl.dll,wckufq.dll,kywunz.dll,mmnlyw.dll,kjplgc.dll,xztrez.dll,xmaler.dll,kynzvj.dll,piuoah.dll,zztxfx.dll,rfpsjb.dll,ohoqgc.dll,mlpvxd.dll,fgmmqm.dll,hleipp.dll,uvznzo.dll,zdvzhb.dll,pdgbvm.dll,nyyxnh.dll,cdmpjj.dll,iskmwe.dll,pojsal.dll,phtwfu.dll,hczycn.dll,uitira.dll,npjmrf.dll,nwzolt.dll,xweqmp.dll,kwxiwi.dll,xbyuft.dll,xeqkuu.dll,uqqoxx.dll,nptkxz.dll,plwadh.dll,zgjazl.dll,ervaql.dll,ulkrso.dll,nexryy.dll,hfpgtd.dll,zvwuzz.dll,gctkva.dll,agyqeb.dll,eiegqo.dll,rukpju.dll,pnqzpb.dll,fmjajk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: FlexLm - Unknown owner - \\server\cadcentre\Flexman 3.1\lmgrd.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Vantage Marine Napa Surface Server (NapaSurfaceServer) - AVEVA AB - C:\Aveva\VM11.6\Hull\Bin\ea316.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PowerRPC Portmapper - Unknown owner - C:\Aveva\VM11.6\Hull\Bin\pmapsvc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: VANTAGE Marine Database Server (TribonDatabaseServer) - AVEVA AB - C:\Aveva\VM11.6\Hull\Bin\ea314.exe
O23 - Service: VANTAGE Marine Surface Server (TribonSurfaceServer) - AVEVA AB - C:\Aveva\VM11.6\Hull\Bin\ea315.exe
O24 - Desktop Component 0: (no name) - file://server/TB_PROJECTS/STANDARDI/STANDARDI%20HR%20BRODOGRADNJE/svigif/04701.gif

--

End of file - 6263 bytes

nicozftp00.dll ovo je file kojeg mi je nasa adaware. obrisa sam ga. ili sam bar mislija da sam ga obrisa....ocito ne...

18.06.2008., 13:34	#269
Antonic Premium Moj komp Datum registracije: Oct 2007 Lokacija: International Postovi: 216	pozdrav. evo sta mi se dogadjalo dosad i sta sam napravija. link evo mog hijackthis loga Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:09:02, on 18.6.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe C:\Program Files\Kirby Alarm\kirbyalarm.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\CNAB4RPK.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Aveva\VM11.6\Hull\Bin\pmapsvc.exe C:\Aveva\VM11.6\Hull\Bin\ea312.exe C:\Aveva\VM11.6\Hull\Bin\ea316.exe C:\Aveva\VM11.6\Hull\Bin\ea311_bmt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadwin PrintScreen 2.6] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Kirby Alarm.lnk = C:\Program Files\Kirby Alarm\kirbyalarm.exe O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: Send this URL to WTR - Web The Ripper 2 - {c23e2132-960c-44fc-8ebd-39b37aa4de78} - C:\Program Files\npSoftware\WTR - Web The Ripper 2\wtr.ie.html (file missing) O9 - Extra 'Tools' menuitem: WTR - Web The Ripper 2 - {c23e2132-960c-44fc-8ebd-39b37aa4de78} - C:\Program Files\npSoftware\WTR - Web The Ripper 2\wtr.ie.html (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx O20 - AppInit_DLLs: C,aqddma.dll,sfzyqv.dll,buxflf.dll,kqnqys.dll,xwfeyx.dll,gryyqi.dll,nicozftp00.dll,msosmhfp00.dll,msoscqit00.dll,fmsiocps.dll,mmzzdw.dll,msosdohs00.dll,bwcnbf.dll,yqzqgx.dll,kryuoq.dll,niwvwt.dll,wadpkl.dll,wckufq.dll,kywunz.dll,mmnlyw.dll,kjplgc.dll,xztrez.dll,xmaler.dll,kynzvj.dll,piuoah.dll,zztxfx.dll,rfpsjb.dll,ohoqgc.dll,mlpvxd.dll,fgmmqm.dll,hleipp.dll,uvznzo.dll,zdvzhb.dll,pdgbvm.dll,nyyxnh.dll,cdmpjj.dll,iskmwe.dll,pojsal.dll,phtwfu.dll,hczycn.dll,uitira.dll,npjmrf.dll,nwzolt.dll,xweqmp.dll,kwxiwi.dll,xbyuft.dll,xeqkuu.dll,uqqoxx.dll,nptkxz.dll,plwadh.dll,zgjazl.dll,ervaql.dll,ulkrso.dll,nexryy.dll,hfpgtd.dll,zvwuzz.dll,gctkva.dll,agyqeb.dll,eiegqo.dll,rukpju.dll,pnqzpb.dll,fmjajk.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: FlexLm - Unknown owner - \\server\cadcentre\Flexman 3.1\lmgrd.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Vantage Marine Napa Surface Server (NapaSurfaceServer) - AVEVA AB - C:\Aveva\VM11.6\Hull\Bin\ea316.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PowerRPC Portmapper - Unknown owner - C:\Aveva\VM11.6\Hull\Bin\pmapsvc.exe O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe O23 - Service: VANTAGE Marine Database Server (TribonDatabaseServer) - AVEVA AB - C:\Aveva\VM11.6\Hull\Bin\ea314.exe O23 - Service: VANTAGE Marine Surface Server (TribonSurfaceServer) - AVEVA AB - C:\Aveva\VM11.6\Hull\Bin\ea315.exe O24 - Desktop Component 0: (no name) - file://server/TB_PROJECTS/STANDARDI/STANDARDI%20HR%20BRODOGRADNJE/svigif/04701.gif -- End of file - 6263 bytes nicozftp00.dll ovo je file kojeg mi je nasa adaware. obrisa sam ga. ili sam bar mislija da sam ga obrisa....ocito ne...