log ..

przez **bigbercik** » 01 Maj 2008, 09:56

Znów czuje, że jakieś gówno mi siedzi ... zeby znów nie bylo jak ostatnio dodam Mam viste a log z HijackThis

PS jakiś krótki ten scan ..

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:55:42, on 2008-05-01 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: D:\Windows\system32\Dwm.exe D:\Windows\system32\taskeng.exe D:\Windows\Explorer.EXE D:\Program Files\Windows Defender\MSASCui.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe D:\Users\kicii\Desktop\ECC 5.2\ECC 5.2.exe D:\Users\kicii\AppData\Local\Temp\counter.exe D:\Windows\system32\conime.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Windows\system32\SearchFilterHost.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [StartCCC] D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [VistaFirewallControl] D:\Program Files\VistaFirewallControl\VistaFirewallControl.exe O4 - HKLM\..\Run: [outlook] D:\Program Files\outlook\outlook.exe /auto O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "D:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Windows] C:\WINDOWS\services.exe O4 - HKCU\..\Run: [Sidebar] D:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Steam Client Service - Valve Corporation - D:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: VistaFirewallService - Sphinx Software - D:\Program Files\VistaFirewallControl\VistaFirewallService.exe -- End of file - 6485 bytes

przez **pp3088** » 01 Maj 2008, 11:25

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O13 - Gopher Prefix:

To zfiksować w HJT. To bezwpisowe resztki programów, więc możesz się nie bać. Poproszę o loga z Silent Runners.

przez **huber2t** » 01 Maj 2008, 16:34

Czy silent runners będzie nam potrzebne, watpie w to daj log z Deckard's System Scanner

zfixuj to co ci kazał moderator + to:

fix w HijackThis

O4 - HKLM\..\Run: [outlook] D:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [Windows] C:\WINDOWS\services.exe

Pobierz Avenger

wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: D:\Program Files\outlook\outlook.exe /auto C:\WINDOWS\services.exe

kopiuj to i klikasz na Paste Script from Clipboard wybierasz Execute oraz Potwierdzasz i zgadzasz się na restart klikając OK.
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

przez **bigbercik** » 01 Maj 2008, 17:00

huber2t napisał(a):zfixuj to co ci kazał moderator + to:

nie zabardzo wiem jak

to co usunolem

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows Vista ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at D:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: could not open file "D:\Program Files\outlook\outlook.exe /auto" Deletion of file "D:\Program Files\outlook\outlook.exe /auto" failed! Status: 0xc0000033 (STATUS_OBJECT_NAME_INVALID) --> an object cannot have this name Error: file "C:\WINDOWS\services.exe" not found! Deletion of file "C:\WINDOWS\services.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate.

PS jak z Deckard's System Scanner skonczy skanowac dam log

Proszę

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by kicii on 2008-05-01 16:58:16 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 5 Restore Point(s) -- 11: 2008-05-01 14:31:16 UTC - RP36 - Installed Grand Theft Auto Vice City 10: 2008-05-01 14:19:05 UTC - RP34 - Installed Grand Theft Auto Vice City 9: 2008-05-01 11:26:52 UTC - RP32 - Configured Microsoft Office Enterprise 2007 8: 2008-04-29 08:14:24 UTC - RP30 - Installed Java(TM) 6 Update 5 7: 2008-04-25 06:41:12 UTC - RP29 - Windows Update -- First Restore Point -- 1: 2008-04-22 21:56:02 UTC - RP22 - Instalacja pakietu sterownika urządzenia: Bison Urządzenia do obrazowania Backed up registry hives. Performed disk cleanup. [color=red]Total Physical Memory: 1022 MiB (1024 MiB recommended).[/color] -- HijackThis (run as kicii.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:01:02, on 2008-05-01 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: D:\Windows\system32\taskeng.exe D:\Windows\system32\Dwm.exe D:\Windows\Explorer.EXE D:\Windows\system32\conime.exe D:\Program Files\Windows Defender\MSASCui.exe D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe D:\Program Files\Unlocker\UnlockerAssistant.exe D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe D:\Windows\ehome\ehtray.exe D:\Program Files\Tlen.pl\tlen.exe D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe D:\Windows\ehome\ehmsas.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe D:\Users\kicii\Desktop\dss.exe D:\Windows\system32\SearchFilterHost.exe D:\PROGRA~1\TRENDM~1\HIJACK~1\kicii.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [StartCCC] D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [VistaFirewallControl] D:\Program Files\VistaFirewallControl\VistaFirewallControl.exe O4 - HKLM\..\Run: [outlook] D:\Program Files\outlook\outlook.exe /auto O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "D:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [Sidebar] D:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Ati External Event Utility - ATI Technologies Inc. - D:\Windows\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Steam Client Service - Valve Corporation - D:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: VistaFirewallService - Sphinx Software - D:\Program Files\VistaFirewallControl\VistaFirewallService.exe -- End of file - 6682 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 VistaFirewallService - "d:\program files\vistafirewallcontrol\vistafirewallservice.exe" <Not Verified; Sphinx Software; Vista-Wall extended control for Vista Firewall> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: Description: Device ID: ACPI\ENE0100\3&33FD14CA&0 Manufacturer: Name: PNP Device ID: ACPI\ENE0100\3&33FD14CA&0 Service: -- Scheduled Tasks ------------------------------------------------------------- 2008-05-01 15:30:23 418 --ah----- D:\Windows\Tasks\User_Feed_Synchronization-{5DF67957-D34F-46F9-9229-A49C48A3D00B}.job -- Files created between 2008-04-01 and 2008-05-01 ----------------------------- 2008-05-01 16:31:32 0 d-------- D:\GTA-VC 2008-05-01 09:53:55 0 d-------- D:\Program Files\Trend Micro 2008-05-01 09:48:55 0 d-------- D:\Program Files\SkanerOnline 2008-04-29 10:19:11 0 d-------- D:\Windows\Sun 2008-04-29 10:15:15 0 d-------- D:\Program Files\Java 2008-04-29 10:14:58 0 d-------- D:\Program Files\Common Files\Java 2008-04-28 21:40:02 0 d-------- D:\Program Files\PhotoScape 2008-04-26 20:20:56 0 d-------- D:\Program Files\Tibia 2008-04-26 14:21:11 0 d-------- D:\Program Files\uTorrent 2008-04-24 18:53:54 0 d-------- D:\Program Files\Valve 2008-04-24 18:42:42 0 d-------- D:\Program Files\sXe Injected 2008-04-24 15:20:52 0 d-------- D:\Users\All Users\Insight Software Solutions 2008-04-24 14:51:05 0 d-------- D:\TrackMania Nations ESWC 2008-04-23 23:00:46 1160 --a------ D:\Windows\mozver.dat 2008-04-23 22:41:14 0 d-------- D:\Users\All Users\Adobe 2008-04-23 22:40:33 0 d-------- D:\Program Files\Common Files\Adobe 2008-04-23 15:04:34 0 d-------- D:\Program Files\TrackMania Nations ESWC 2008-04-23 14:50:58 0 d-------- D:\Program Files\Common Files\Onet.pl 2008-04-23 14:50:57 0 d-------- D:\Program Files\Onet 2008-04-22 23:56:54 0 d-------- D:\Windows\BisonC07 2008-04-22 23:53:18 0 d-------- D:\Windows\BUVC_AP 2008-04-22 23:53:17 0 d--h----- D:\Program Files\InstallShield Installation Information 2008-04-22 23:52:15 0 d-------- D:\Users\All Users\Google 2008-04-22 23:52:01 0 d-------- D:\Program Files\Google 2008-04-22 23:51:33 0 d-------- D:\Users\All Users\Skype 2008-04-22 23:35:04 0 d-------- D:\Users\All Users\Xerox 2008-04-22 21:33:49 0 d-------- D:\Program Files\Common Files\Steam 2008-04-22 21:33:48 0 d-------- D:\Program Files\Steam 2008-04-21 20:50:10 0 d-------- D:\Program Files\Tlen.pl 2008-04-21 15:46:00 0 d-------- D:\Windows\system32\Kaspersky Lab <KASPER~1> 2008-04-21 11:24:47 62464 --a------ D:\Windows\system32\bszip.dll <Not Verified; BigSpeedSoft; BigSpeed Zip DLL> 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\tracert.com 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\tasklist.com 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\taskkill.com 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\regedit.com 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\ping.com 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\netstat.com 2008-04-21 11:24:30 0 ---hs---- D:\Windows\system32\cmd.com 2008-04-21 11:24:30 0 d--hs---- D:\Program Files\outlook 2008-04-21 11:10:35 0 d-------- D:\Program Files\VistaFirewallControl 2008-04-21 10:46:51 0 d-------- D:\Users\All Users\Grisoft 2008-04-21 10:22:19 0 d-------- D:\Program Files\Common Files\Thraex Software 2008-04-21 09:57:00 0 d-------- D:\Program Files\BearShare 2008-04-20 14:47:52 0 d-------- D:\Program Files\Microsoft Works 2008-04-20 14:45:58 0 d-------- D:\Windows\PCHEALTH 2008-04-20 14:45:58 0 d-------- D:\Program Files\Microsoft.NET 2008-04-20 14:43:49 0 d-------- D:\Program Files\Microsoft Visual Studio 8 2008-04-20 14:41:30 0 d-------- D:\Users\All Users\Microsoft Help 2008-04-20 14:38:44 0 dr-h----- D:\MSOCache 2008-04-20 08:55:15 0 d-------- D:\VundoFix Backups 2008-04-19 20:17:40 0 d-------- D:\Windows\Panther 2008-04-19 20:15:49 538916 --a------ D:\Windows\system32\perfh015.dat 2008-04-19 20:15:49 87672 --a------ D:\Windows\system32\perfc015.dat 2008-04-19 20:15:06 0 d-------- D:\Windows\system32\drivers\pl-PL 2008-04-19 20:15:06 0 d-------- D:\Windows\pl-PL 2008-04-19 20:15:04 0 d-------- D:\Windows\system32\pl 2008-04-19 20:03:47 0 d-------- D:\Windows.old 2008-04-19 13:17:25 0 d--hs---- D:\Windows\Installer 2008-04-19 13:16:11 0 d-------- D:\Program Files\ATI Technologies 2008-04-19 13:16:10 0 d-------- D:\Program Files\ATI 2008-04-19 13:07:42 0 d-------- D:\Program Files\Gadu-Gadu 2008-04-19 13:00:02 0 d-------- D:\Windows\system32\Macromed 2008-04-19 11:34:14 0 d-------- D:\Program Files\WapSter 2008-04-19 10:41:58 0 --a------ D:\Windows\nsreg.dat 2008-04-19 10:29:05 0 d--hs---- D:\Users\Default\Ustawienia lokalne 2008-04-19 10:29:05 0 d--hs---- D:\Users\Default\Szablony 2008-04-19 10:29:05 0 d--hs---- D:\Users\Default\Moje dokumenty 2008-04-19 10:29:05 0 d--hs---- D:\Users\Default\Menu Start 2008-04-19 10:29:05 0 d--hs---- D:\Users\Default\Dane aplikacji 2008-04-19 10:29:05 0 d--hs---- D:\Users\All Users\Ulubione 2008-04-19 10:29:05 0 d--hs---- D:\Users\All Users\Szablony 2008-04-19 10:29:05 0 d--hs---- D:\Users\All Users\Pulpit 2008-04-19 10:29:05 0 d--hs---- D:\Users\All Users\Menu Start 2008-04-19 10:29:05 0 d--hs---- D:\Users\All Users\Dokumenty 2008-04-19 10:29:05 0 d--hs---- D:\Users\All Users\Dane aplikacji 2008-04-19 10:22:54 0 d-------- D:\Windows\SoftwareDistribution 2008-04-19 10:20:46 0 d-------- D:\Windows\Debug 2008-04-19 10:18:52 0 d-------- D:\Windows\Prefetch -- Find3M Report --------------------------------------------------------------- 2008-05-01 16:49:02 0 d-------- D:\Users\kicii\AppData\Roaming\uTorrent 2008-05-01 16:38:57 0 d-------- D:\Program Files\Common Files 2008-05-01 13:39:39 0 d-------- D:\Program Files\MSBuild 2008-04-29 10:45:41 0 d-------- D:\Users\kicii\AppData\Roaming\Czat 2008-04-26 20:21:22 0 d-------- D:\Users\kicii\AppData\Roaming\Tibia 2008-04-25 08:55:15 0 d-------- D:\Users\kicii\AppData\Roaming\Google 2008-04-23 22:44:16 0 d-------- D:\Users\kicii\AppData\Roaming\Adobe 2008-04-23 14:55:16 0 d-------- D:\Users\kicii\AppData\Roaming\Kamerzysta 2008-04-23 14:55:16 0 d-------- D:\Users\kicii\AppData\Roaming\AutoUpdate 2008-04-22 23:52:49 0 d-------- D:\Users\kicii\AppData\Roaming\InstallShield 2008-04-22 15:42:57 0 d-------- D:\Users\kicii\AppData\Roaming\Desktopicon 2008-04-21 20:50:26 0 d-------- D:\Users\kicii\AppData\Roaming\Tlen.pl 2008-04-21 10:47:04 0 d-------- D:\Users\kicii\AppData\Roaming\Grisoft 2008-04-19 20:15:06 0 d-------- D:\Program Files\Windows Photo Gallery 2008-04-19 20:15:06 0 d-------- D:\Program Files\Windows Journal 2008-04-19 20:15:06 0 d-------- D:\Program Files\Windows Collaboration 2008-04-19 20:15:06 0 d-------- D:\Program Files\Movie Maker 2008-04-19 13:22:34 0 d-------- D:\Users\kicii\AppData\Roaming\ATI 2008-04-19 13:08:50 0 d-------- D:\Users\kicii\AppData\Roaming\Gadu-Gadu 2008-04-19 13:00:27 0 d-------- D:\Users\kicii\AppData\Roaming\Macromedia 2008-04-19 12:11:15 174 --ahs---- D:\Program Files\desktop.ini 2008-04-19 12:03:59 0 d-------- D:\Program Files\Windows Calendar 2008-04-19 12:03:57 0 d-------- D:\Program Files\Windows Mail 2008-04-19 12:03:54 0 d-------- D:\Program Files\Windows Defender 2008-04-19 12:03:36 0 d-------- D:\Program Files\Windows Sidebar 2008-04-19 10:41:47 0 d-------- D:\Users\kicii\AppData\Roaming\Mozilla 2008-04-19 10:32:02 0 d-------- D:\Users\kicii\AppData\Roaming\Identities 2008-04-19 10:29:05 0 d-------- D:\Program Files\Windows NT -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="D:\Program Files\Windows Defender\MSASCui.exe" [2008-04-19 11:41] "StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25] "VistaFirewallControl"="D:\Program Files\VistaFirewallControl\VistaFirewallControl.exe" [2008-01-24 13:51] "outlook"="D:\Program Files\outlook\outlook.exe" [] "UnlockerAssistant"="D:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 07:10] "Onet.pl AutoUpdate"="D:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" [] "Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16] "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="D:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-19 11:21] "WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" [] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04] "ehTray.exe"="D:\Windows\ehome\ehTray.exe" [2006-11-02 14:35] "Komunikator"="D:\Program Files\Tlen.pl\tlen.exe" [2008-01-15 17:09] "Steam"="d:\program files\steam\steam.exe" [2008-04-23 13:18] "swg"="D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-04-22 23:52] D:\Users\kicii\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e4a8a54-0de9-11dd-9546-806e6f6e6963}] AutoRun\command- E:\Setup.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] D:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-05-01 17:02:04 ------------

przez **huber2t** » 01 Maj 2008, 17:03

Nie dało się usunąć

Najpierw zfixuj to co zapodął moder a po tym zfixuj to co ja ci kazałem

przez **bigbercik** » 01 Maj 2008, 17:09

Tylko co mam zrobic pokolei ? nie zabardzo kumam w tych postach

przez **huber2t** » 01 Maj 2008, 17:11

zrób tak

fix w hijackthis

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - D:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O13 - Gopher Prefix:
O4 - HKLM\..\Run: [outlook] D:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [Windows] C:\WINDOWS\services.exe

Log z Dss jest czysty

Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum

przez **bigbercik** » 01 Maj 2008, 17:16

Tzn ? mam otworzyc HijackThis i co nacisnoc? pokolei ? nie znam zabardzo angielskiego..

przez **huber2t** » 01 Maj 2008, 17:18

włącz HijackThis >> Do a system scan only >> zaznacz w okienku podane wpisy >> klik na Fix checked

przez **bigbercik** » 01 Maj 2008, 17:29

zrobilem i co dalej ?

przez **huber2t** » 01 Maj 2008, 17:45

Przeskanuj komputer tym (uruchom przez IE) http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum

przez **pp3088** » 01 Maj 2008, 19:22

C:\WINDOWS\services.exe

To wygląda na "Image File Execution Options", dlatego prosiłem o SR.

przez **huber2t** » 01 Maj 2008, 19:24

No tak masz racje, ale to na pierwszy rzut oka widac że to wirus

normalna scieżka do tego pliku wygląda tak:
C:\WINDOWS\system32\services.exe

przez **pp3088** » 01 Maj 2008, 23:28

huber2t napisał(a):No tak masz racje, ale to na pierwszy rzut oka widac że to wirus

normalna scieżka do tego pliku wygląda tak:
C:\WINDOWS\system32\services.exe

Przecież wiem. Tyle, żę Image File Execution Options jest powiązane wlasnie z takim plikiem. Choć możliwość jest zerowa praktycznie. Ja bym przeskanował na http://virusscan.jotti.org/

przez **bigbercik** » 03 Maj 2008, 10:44

jotti, nic nie wykryl ale mój anty wirus wykryl
Name Trojan.Filco.A
Location c:\windows\services.exe

yy co do kasperskiego później dam loga

log ..

log ..

Kto jest na forum