nebezpečná stránka Fakaheda.eu ? HJT

[Damned]

Soubor C:\WINDOWS\dsez0684.dat zkontroluj na Virustotalu a vlož mi sem odkaz na výsledek.

Poklepej na ikonu OTL na ploše.Ujisti se , že máš všechny ostatní aplikace a prohlížeče zavřeny.
Pod Vlastní skenování/Opravy do okénka vlož následující text, zobrazený zeleně:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Documents and Settings\prolimit\Local Settings\Data aplikací\Google\Update\1.2.183.39\npGoogleOneClick8.dll
@Alternate Data Stream - 200 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:8927A071
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:0B4227B4
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:07BF512B
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:888AFB86

:Services
SRV - (LCS)
SRV - (gupdatem) Služba Google Update (gupdatem)
SRV - (gupdate) Služba Google Update (gupdate)

:Files
C:\WINDOWS\System32\ezsidmv.dat
C:\WINDOWS\System32\Access.dat
C:\WINDOWS\System32\d3d8caps.dat
C:\Documents and Settings\prolimit\Local Settings\Data aplikací\a4504e2d
C:\Documents and Settings\prolimit\Plocha\RK_Quarantine
C:\WINDOWS\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\system32\*.tmp.dll
C:\WINDOWS\tasks\SA.DAT
C:\WINDOWS\system32\SET*.tmp
C:\Recycler
C:\$RECYCLE.BIN
C:\RECYCLER
C:\Windows\tasks\*.job

:Reg

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

Poté klikni nahoře na Opravit. Nech program nerušeně běžet, na konci se provede restart PC.
Po restartu se objeví log , prosím zkopíruj sem celý jeho obsah.

[FIDLIK]

File name:
dsez0684.dat
Submission date:
2011-11-11 13:37:05 (UTC)
Current status:
finished
Result:
0/ 43 (0.0%)

Už mi jde FTP.. teď se dám to OTL

--- Doplnění předchozího příspěvku (11 Lis 2011 14:58) ---

All processes killed
========== OTL ==========
Process explorer.exe killed successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin\ deleted successfully.
File C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll not found.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=8\ deleted successfully.
File C:\Documents and Settings\prolimit\Local Settings\Data aplikací\Google\Update\1.2.183.39\npGoogleOneClick8.dll not found.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:8927A071 deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:0B4227B4 deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:07BF512B deleted successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:888AFB86 deleted successfully.
========== SERVICES/DRIVERS ==========
Error: No service named SRV - (LCS) was found to stop!
Service\Driver key SRV - (LCS) not found.
Error: No service named SRV - (gupdatem) Služba Google Update (gupdatem) was found to stop!
Service\Driver key SRV - (gupdatem) Služba Google Update (gupdatem) not found.
Error: No service named SRV - (gupdate) Služba Google Update (gupdate) was found to stop!
Service\Driver key SRV - (gupdate) Služba Google Update (gupdate) not found.
========== FILES ==========
C:\WINDOWS\System32\ezsidmv.dat moved successfully.
C:\WINDOWS\System32\Access.dat moved successfully.
C:\WINDOWS\System32\d3d8caps.dat moved successfully.
C:\Documents and Settings\prolimit\Local Settings\Data aplikací\a4504e2d\U folder moved successfully.
C:\Documents and Settings\prolimit\Local Settings\Data aplikací\a4504e2d folder moved successfully.
File\Folder C:\Documents and Settings\prolimit\Plocha\RK_Quarantine not found.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
C:\WINDOWS\System32\CONFIG.TMP moved successfully.
File\Folder C:\WINDOWS\system32\*.tmp.dll not found.
C:\WINDOWS\tasks\SA.DAT moved successfully.
File\Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\RECYCLER\S-1-5-21-583907252-706699826-1606980848-1003 folder moved successfully.
C:\RECYCLER folder moved successfully.
File\Folder C:\$RECYCLE.BIN not found.
File\Folder C:\RECYCLER not found.
File\Folder C:\Windows\tasks\*.job not found.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 405 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: prolimit
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 49152 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 43251820 bytes
->Flash cache emptied: 993 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 41.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: prolimit
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 11112011_145142

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[Damned]

Smaž složku C:\_OTL a vysypej Koš.

Stáhni si OTC, spusť ho a postupuj dle návodu.

Zkontroluj si zda máš zapnutý Systém obnovy. Jak se chová PC?

[FIDLIK]

jak to tak vypadá problém zmizel :)).. na tokové stránky už si budu dávat pozor.. ikdyž sem tohle teda nečekal. Jak řikám FTP jede a jak to tak pozoruju vyřešil ste i problém s freezama kterej sem v minulé kontrole(2 týdny zpátky) nevyřešil.. takže vám za to moc děkuju :)).. dneska tu nechám zkontrolovat ještě sestry notebook což je teda prasárna.. byl bych velice rád kdyby ste se toho upět ujal vy.. ste mazák Moc Vám děkuji ! dávám vyřešeno !

[Damned]

Dobrá, kdyby něco, tak se zase zastav.

[Orcus]

Co sem tak zběžně proletěl, tak bych pro sichr změnil heslo na FTP server.

[FIDLIK]

změněno