Jump to content

SUBIECTE NOI
« 1 / 5 »
RSS
Realizare acoperis foisor DIY

Realizare acoperis foisor DIY

Monitorizat, statistici, blocare ...

Pete maro pe haine spalate
 Ce inseamna sacru?

Decodor digi kaon na 1000hd

Dacia papuc diesel curge ulei din...

recomandare curatare DPF
 Amenajare teren in prezent cu pla...

AMONG WOLVES (2023)

Extindere sistem fotovoltaic

Aparat test rapid sange
 cerneala compatibila peste cea or...

problema baterie AW5

Verbatim: Printabil sau regular?

Aproape jumatate de milion dintre...
 

Accesare site

- - - - -
Last Updated: Oct 08 2005 12:19, Started by dodi1965 , Oct 08 2005 10:45  
  ·  
  • Please log in to reply
5 replies to this topic

#1
dodi1965
Posted 08 October 2005 - 10:45

dodi1965

    Junior Member

  • Grup: Members
  • Posts: 227
  • Înscris: 01.02.2005
Am o problema
IE tot incearca sa acceseze siteul 195.95.218.100, de unde vrea sa culeaga Win32:Adan-094 si 078. Folosesc Avast! care blocheaza accesul. Ad-Adware nu gaseste nimic. Nu pot rula regedit sau regcleaner.

help!!

atasez logul Hijackthis:

Logfile of HiJackThis v1.99.1
Scan saved at 11:44:38, on 08.10.2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\ESB.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hijack\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [ESB] C:\WINDOWS\System32\ESB.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\popcorn72.exe rundll.dll,LoadMouseProfile
O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\System32\hgqhp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} (OSInfo Control) - http://www.sis.com/ocis/OSInfo.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {16095503-786F-4097-AED6-5D567A26D760} (SiS_OCX Control) - http://www.sis.com/o...utodetectNT.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122559784554
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.rav.ro/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A7C73DF-2D36-4F0A-95C1-EC53CF82D1BC}: NameServer = 85.255.113.100,85.255.112.7
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF66FCD3-EAA6-40AE-B45F-CC1119E3E254}: NameServer = 85.255.113.100,85.255.112.7
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe


10x

#2
UnForsaken
Posted 08 October 2005 - 10:51

UnForsaken

    Senior Member

  • Grup: Senior Members
  • Posts: 2,693
  • Înscris: 11.02.2005
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe

Cunosti programul asta? Daca nu, sterge-l! Mai mult ca sigur asta e pb. ta.

#3
dodi1965
Posted 08 October 2005 - 11:02

dodi1965

    Junior Member

  • Grup: Members
  • Posts: 227
  • Înscris: 01.02.2005
uite ce este:

SiS Compatible Super VGA Keyboard Daemon

si este instalat mai demult, 28 iulie 2005, problema o am de 2-3 zile!

#4
UNBREAKABLE
Posted 08 October 2005 - 11:14

UNBREAKABLE

    Member

  • Grup: Members
  • Posts: 816
  • Înscris: 07.12.2004
cred ca asta e  problema...
O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\System32\hgqhp.exe

hgqhp.exe - Trojan.Flush.F DNS Trojan (is also known as: SpoofDNS [McAfee], Trojan.DnsChange [SOFTWIN])

Quote

Trojan.Flush.F is a Trojan horse that modifies the DNS server settings on a
compromised computer and redirects the browser to potentially malicious Web sites.

Mai mutle detalii si instructiuni pt. eliminare gasesti aici...

Edited by UNBREAKABLE, 08 October 2005 - 11:33.

#5
dodi1965
Posted 08 October 2005 - 12:13

dodi1965

    Junior Member

  • Grup: Members
  • Posts: 227
  • Înscris: 01.02.2005
cred ca am scapat!! :D
10x to all!!! :peacefingers:

#6
dorutoru
Posted 08 October 2005 - 12:19

dorutoru

    Member

  • Grup: Members
  • Posts: 861
  • Înscris: 04.09.2003
Posteaza un nou log sa vedem daca chiar ai scapat.
Urmatoarele intrari nu ar mai trebui sa apara:
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{9A7C73DF-2D36-4F0A-95C1-EC53CF82D1BC}: NameServer = 85.255.113.100,85.255.112.7
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF66FCD3-EAA6-40AE-B45F-CC1119E3E254}: NameServer = 85.255.113.100,85.255.112.7

De asemenea, verifica sa nu mai ai fisierul: C:\WINDOWS\System32\khooker.exe

In plus, vezi ca versiunea free de FlashGet e adware!

Anunturi

Second Opinion Second Opinion

Folosind serviciul second opinion ne puteți trimite RMN-uri, CT -uri, angiografii, fișiere .pdf, documente medicale.

Astfel vă vom putea da o opinie neurochirurgicală, fără ca aceasta să poată înlocui un consult de specialitate. Răspunsurile vor fi date prin e-mail în cel mai scurt timp posibil (de obicei în mai putin de 24 de ore, dar nu mai mult de 48 de ore). Second opinion – Neurohope este un serviciu gratuit.

www.neurohope.ro
Back to Dezbateri despre securitatea IT

▶ 0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Forumul Softpedia
  2. → Soft Related / OS
  3. → Antivirus & Security
  4. → Dezbateri despre securitatea IT
Forumul Softpedia foloseste "cookies" pentru a imbunatati experienta utilizatorilor Accept
Pentru detalii si optiuni legate de cookies si datele personale, consultati Politica de utilizare cookies si Politica de confidentialitate