pokapoka

Logfile of HiJackThis v1.99.1
Scan saved at 19:00:01, on 02.10.2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\etb\pokapoka72.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\hij\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.the818search-co.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.the818search-co.com/sp2.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.the818search-co.com/sp2.php
F2 - REG:system.ini: UserInit=userinit.exe,xpjava.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [System service72] C:\WINDOWS\etb\pokapoka72.exe
O4 - HKLM\..\Run: [Microsoft Update] wuamkop32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [Windows Security] win.pif
O4 - HKLM\..\RunServices: [Microsoft Update] wuamkop32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\RunServices: [Windows Security] win.pif
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe

dau o bere cui ma ajuta

CE ROBOT ESTIIIIIIIIIII !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  

ti-am raspuns pe PM

Downloadeaza System Security Suite si goleste Temporary Files (bifezi Temporary Files la My Computer si Internet Explorer).

Ca sa scapi de Pokapoka, foloseste LQFix. Instalezi, lasi setarile pe default, doar la "Launch LQfix" sa vezi sa fie bifat.
Pc-ul se va restarta la final.

Scaneaza apoi cu Spybot, cu update la zi.

Pt virusi scaneaza online aici:
http://housecall.trendmicro.com/

Instaleaza si patch-urile astea de Windows (ideal ar fi sa pui SP1 macar):
http://www.microsoft...&displaylang=en
http://www.microsoft...&displaylang=en

Apoi posteaza un nou log de HiJackThis, sa vedem ce a mai ramas...

Bafta!

LATER EDIT: Foloseste si removal tool-ul asta pt Gaobot si instealeaza patch-urile indicate acolo:
http://securityrespo...gaobot.afj.html

Edited by dorutoru, 02 October 2005 - 19:22.

prima data scaneaza cu blacklight cum ti-am spus pe pm, daca nu poti incerca ce a zis dorutoru sau mai gasim alte solutii.pana la urma se rezolva.