Proszę o sprawdzenie loga - komp się muli.

przez **Mefisto** » 07 Lip 2007, 13:35

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:31:02, on 2007-07-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\System32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\Mixer.exe E:\Program Files\ATI Technologies\ATI.ACE\cli.exe E:\Program Files\Eset\nod32kui.exe E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\WINDOWS\system32\ctfmon.exe E:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe E:\Program Files\PowerMenu 1.51\PowerMenu.exe E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE E:\Program Files\Eset\nod32krn.exe E:\WINDOWS\system32\wscntfy.exe E:\Program Files\Total Commander\TOTALCMD.EXE E:\Program Files\eMule\emule.exe E:\Program Files\Mozilla Firefox\firefox.exe E:\Program Files\Winamp\winamp.exe E:\Program Files\Gadu-Gadu\gg.exe E:\Program Files\Winamp\winamp.exe E:\Program Files\HijackThis 1.99.1\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [ATIPTA] "E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [nod32kui] "E:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WhenUSave] "E:\Program Files\Save\Save.exe" O4 - HKCU\..\Run: [SpeedX] E:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe O4 - Startup: PowerMenu.lnk = E:\Program Files\PowerMenu 1.51\PowerMenu.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Program Files\Eset\nod32krn.exe

Strasznie mi się czasem komp zamula RAM-u jest dużo wolnego (100mb~) nie wiem co sie dzieje, a przecież trzeba temu jakoś zaradzić dlatego zacznę od sprawdzenia czystości komputera ;]

przez **LucaS** » 07 Lip 2007, 13:44

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [WhenUSave] "E:\Program Files\Save\Save.exe"

to do usunięcia.

A co do problemu: Powyłączaj zbędne usługi z autostartu.
Zdefregmentuj dysk, wyczyść rejestr.

przez **Mefisto** » 07 Lip 2007, 13:49

A czym jest to coś? Trojan/keylogger? W autostarcie mam mało co -zawsze usuwam zbędne rzecz, dysk zdefragmentuje ;p

przez **pp3088** » 07 Lip 2007, 14:00

Jest to spyware, instalowany z BearShare`m. Dodaj log z Combofix. Przeczyść rejestr oraz użyj CCleanera.

przez **Mefisto** » 07 Lip 2007, 14:02

Skąd mogę wziąć Combofix?

przez **Bozz** » 07 Lip 2007, 14:11

ComboFix

przez **Mefisto** » 07 Lip 2007, 14:19

Kod: Zaznacz wszystko: "Marcin" - 2007-07-07 14:13:23 - ComboFix 07-07-07.3 - Dodatek Service Pack 2 [color=red][b]FAT32 [/b][/color] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) E:\DOCUME~1\ALLUSE~1\DANEAP~1.\TEMP E:\DOCUME~1\ALLUSE~1\DANEAP~1.\TEMP\D1B5B4F1.TMP ((((((((((((((((((((((((( Files Created from 2007-06-07 to 2007-07-07 ))))))))))))))))))))))))))))))) 2007-07-07 14:12 51,200 --a------ E:\WINDOWS\nircmd.exe 2007-07-07 13:30 <DIR> d-------- E:\Program Files\HijackThis 1.99.1 2007-07-06 20:55 <DIR> d-------- E:\Program Files\MyPortal 2007-07-04 20:50 <DIR> d-------- E:\Program Files\UO Screenshot Utility 2007-07-03 19:12 <DIR> d-------- E:\DOCUME~1\Hildek\DANEAP~1\Mp3tag 2007-07-01 21:22 <DIR> d-------- E:\Program Files\TibiaTestserver 2007-07-01 21:22 <DIR> d-------- E:\DOCUME~1\Hildek\DANEAP~1\TibiaTestserver 2007-07-01 12:06 <DIR> d-------- E:\Program Files\GSC Game World 2007-07-01 11:56 <DIR> d-------- E:\Program Files\GameBoost 2007-07-01 11:49 <DIR> d-------- E:\Program Files\YourWare Solutions 2007-07-01 11:45 <DIR> d-------- E:\Program Files\Lavalys 2007-06-30 17:00 <DIR> d-------- E:\Program Files\eMule 2007-06-30 16:58 <DIR> d-------- E:\Program Files\DAEMON Tools 2007-06-30 16:47 <DIR> d-------- E:\Program Files\Orban 2007-06-30 14:31 682,232 --a------ E:\WINDOWS\system32\drivers\sptd.sys 2007-06-29 14:34 <DIR> d-------- E:\Program Files\Odkurzacz 2007-06-29 14:18 <DIR> d-------- E:\Program Files\Lavasoft 2007-06-29 14:18 <DIR> d-------- E:\Program Files\Common Files\Wise Installation Wizard 2007-06-29 11:53 17,920 --a------ E:\WINDOWS\system32\mdimon.dll 2007-06-29 11:51 <DIR> d-------- E:\WINDOWS\SHELLNEW 2007-06-29 11:51 <DIR> d-------- E:\Program Files\Microsoft.NET 2007-06-29 11:51 <DIR> d-------- E:\Program Files\Microsoft Works 2007-06-29 11:45 <DIR> d-------- E:\Program Files\IrfanView 2007-06-29 11:44 <DIR> d-------- E:\Program Files\ATITool 2007-06-29 11:43 <DIR> d-------- E:\Program Files\Mp3tag 2007-06-29 11:39 <DIR> d-------- E:\Program Files\Gadu-Gadu 2007-06-29 11:38 740,442 --a------ E:\WINDOWS\system32\divx.dll 2007-06-29 11:38 73,728 --a------ E:\WINDOWS\system32\dpl100.dll 2007-06-29 11:38 593,920 --a------ E:\WINDOWS\system32\xvidcore.dll 2007-06-29 11:38 348,160 --a------ E:\WINDOWS\system32\msvcr71.dll 2007-06-29 11:38 3,596,288 --a------ E:\WINDOWS\system32\qt-dx331.dll 2007-06-29 11:38 217,088 --a------ E:\WINDOWS\system32\yv12vfw.dll 2007-06-29 11:38 180,224 --a------ E:\WINDOWS\system32\xvidvfw.dll 2007-06-29 11:38 10,752 --a------ E:\WINDOWS\system32\ff_vfw.dll 2007-06-29 11:38 1,565,480 --a------ E:\WINDOWS\system32\wmv9vcm.dll 2007-06-29 11:38 <DIR> d-------- E:\Program Files\K-Lite Codec Pack 2007-06-29 11:37 <DIR> d-------- E:\Program Files\SubEdit-Player 2007-06-29 11:34 <DIR> d-------- E:\Program Files\xp-AntiSpy 2007-06-29 11:34 <DIR> d-------- E:\Program Files\Total Commander 2007-06-28 11:39 9,464 --------- E:\WINDOWS\system32\drivers\cdralw2k.sys 2007-06-28 11:39 9,336 --------- E:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-06-28 11:39 43,528 --------- E:\WINDOWS\system32\drivers\PxHelp20.sys 2007-06-28 11:39 129,784 --------- E:\WINDOWS\system32\pxafs.dll 2007-06-28 11:39 <DIR> d-------- E:\Program Files\Winamp 2007-06-26 15:52 <DIR> d-------- E:\DOCUME~1\Hildek\DANEAP~1\Tibia 2007-06-25 17:37 512,096 --a------ E:\WINDOWS\system32\drivers\amon.sys 2007-06-25 17:37 298,104 --a------ E:\WINDOWS\system32\imon.dll 2007-06-25 17:37 15,424 --a------ E:\WINDOWS\system32\drivers\nod32drv.sys 2007-06-24 19:29 28,307 --a------ E:\WINDOWS\system32\drivers\GDTdiIcpt.sys 2007-06-24 19:26 <DIR> d-------- E:\DOCUME~1\LOCALS~1\Menu Start 2007-06-24 19:25 <DIR> d-------- E:\WINDOWS\SoftwareDistribution 2007-06-24 19:19 95,424 --------- E:\WINDOWS\system32\drivers\slnthal.sys 2007-06-24 19:19 937,984 --------- E:\WINDOWS\system32\winbrand.dll 2007-06-24 19:19 9,728 --------- E:\WINDOWS\system32\comsdupd.exe 2007-06-24 19:19 896,512 --------- E:\WINDOWS\system32\wmspdmoe.dll 2007-06-24 19:19 88,064 --------- E:\WINDOWS\system32\p2pnetsh.dll 2007-06-24 19:19 870,784 --------- E:\WINDOWS\system32\ati3d1ag.dll 2007-06-24 19:19 86,016 --------- E:\WINDOWS\system32\p2pgasvc.dll 2007-06-24 19:19 86,016 --------- E:\WINDOWS\system32\mdmxsdk.dll 2007-06-24 19:19 81,920 --------- E:\WINDOWS\system32\ieencode.dll 2007-06-24 19:19 81,408 --------- E:\WINDOWS\system32\wscsvc.dll 2007-06-24 19:19 8,192 --------- E:\WINDOWS\system32\smbinst.exe 2007-06-24 19:19 8,192 --------- E:\WINDOWS\system32\bitsprx2.dll 2007-06-24 19:19 78,464 --------- E:\WINDOWS\system32\drivers\usbvideo.sys 2007-06-24 19:19 75,776 --------- E:\WINDOWS\system32\strmfilt.dll 2007-06-24 19:19 73,832 --------- E:\WINDOWS\system32\slcoinst.dll 2007-06-24 19:19 73,796 --------- E:\WINDOWS\system32\slserv.exe 2007-06-24 19:19 73,216 --------- E:\WINDOWS\system32\drivers\atintuxx.sys 2007-06-24 19:19 71,680 --------- E:\WINDOWS\system32\blastcln.exe 2007-06-24 19:19 7,680 --------- E:\WINDOWS\system32\kbdsmsno.dll 2007-06-24 19:19 7,680 --------- E:\WINDOWS\system32\kbdsmsfi.dll 2007-06-24 19:19 7,168 --------- E:\WINDOWS\system32\kbdukx.dll 2007-06-24 19:19 7,168 --------- E:\WINDOWS\system32\kbdno1.dll 2007-06-24 19:19 7,168 --------- E:\WINDOWS\system32\kbdfi1.dll 2007-06-24 19:19 7,168 --------- E:\WINDOWS\system32\hccoin.dll 2007-06-24 19:19 7,168 --------- E:\WINDOWS\system32\bitsprx3.dll 2007-06-24 19:19 685,056 --------- E:\WINDOWS\system32\drivers\hsfcxts2.sys 2007-06-24 19:19 67,584 --------- E:\WINDOWS\system32\drivers\sdbus.sys 2007-06-24 19:19 63,663 --------- E:\WINDOWS\system32\drivers\ati1rvxx.sys 2007-06-24 19:19 63,488 --------- E:\WINDOWS\system32\drivers\atinxsxx.sys 2007-06-24 19:19 60,416 --------- E:\WINDOWS\system32\fwcfg.dll 2007-06-24 19:19 6,656 --------- E:\WINDOWS\system32\kbdinmal.dll 2007-06-24 19:19 6,656 --------- E:\WINDOWS\system32\kbdinben.dll 2007-06-24 19:19 6,144 --------- E:\WINDOWS\system32\kbdmlt48.dll 2007-06-24 19:19 6,144 --------- E:\WINDOWS\system32\kbdmlt47.dll 2007-06-24 19:19 6,144 --------- E:\WINDOWS\system32\kbdinbe1.dll 2007-06-24 19:19 6,016 --------- E:\WINDOWS\system32\drivers\smbali.sys 2007-06-24 19:19 59,648 --------- E:\WINDOWS\system32\drivers\rfcomm.sys 2007-06-24 19:19 57,856 --------- E:\WINDOWS\system32\drivers\atinbtxx.sys 2007-06-24 19:19 56,623 --------- E:\WINDOWS\system32\drivers\ati1btxx.sys 2007-06-24 19:19 526,848 --------- E:\WINDOWS\system32\p2psvc.dll 2007-06-24 19:19 52,736 --------- E:\WINDOWS\system32\mspmsnsv.dll 2007-06-24 19:19 52,224 --------- E:\WINDOWS\system32\drivers\atinraxx.sys 2007-06-24 19:19 50,688 --------- E:\WINDOWS\system32\btpanui.dll 2007-06-24 19:19 50,176 --------- E:\WINDOWS\system32\xmlprovi.dll 2007-06-24 19:19 5,632 --------- E:\WINDOWS\system32\kbdmaori.dll 2007-06-24 19:19 49,152 --------- E:\WINDOWS\system32\powercfg.exe 2007-06-24 19:19 484,864 --------- E:\WINDOWS\system32\wmspdmod.dll 2007-06-24 19:19 48,640 --------- E:\WINDOWS\system32\pnrpnsp.dll 2007-06-24 19:19 46,464 --------- E:\WINDOWS\system32\drivers\gagp30kx.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-28 09:37:28 79,408 ----a-w E:\WINDOWS\system32\perfc015.dat 2007-06-28 09:37:28 458,022 ----a-w E:\WINDOWS\system32\perfh015.dat 2007-06-22 13:19:30 -------- d-----w E:\Program Files\Usługi online 2007-06-04 13:18:48 9,344 ----a-w E:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 13:17:02 8,320 ----a-w E:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 13:14:56 6,272 ----a-w E:\WINDOWS\system32\drivers\AWRTPD.sys 2007-04-13 13:19:52 7,680 ----a-w E:\WINDOWS\system32\lsdelete.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2005-09-24 06:12 63136 --a------ E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05] "C-Media Mixer"="Mixer.exe" [2003-04-06 11:39 E:\WINDOWS\mixer.exe] "ATICCC"="E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41] "nod32kui"="E:\Program Files\Eset\nod32kui.exe" [2007-06-25 17:37] "RegistryMechanic"="" [] "SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="E:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "SpeedX"="E:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe" [2006-06-27 14:11] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoStartMenuMFUprogramsList"=1 (0x1) "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ClearRecentDocsOnExit"=1 (0x1) "NoStartMenuMFUprogramsList"=1 (0x1) "NoWinKeys"=1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-07 14:16:03 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-07 14:16:29 E:\ComboFix-quarantined-files.txt ... 2007-07-07 14:16 --- E O F ---

przez **pp3088** » 07 Lip 2007, 14:27

Niestety, ale jest czysto.

przez **Mefisto** » 07 Lip 2007, 14:31

Ok dzięki, mówiłeś, że ten plik save.exe jest spyware z BearShare a jeśli ja nie używałem w ogóle bearshare to skąd to mam?

Proszę o sprawdzenie loga - komp się muli.

Proszę o sprawdzenie loga - komp się muli.

Kto jest na forum