Dziwne problemz+trojan,log

Przelomowa · 8 Wrzesień 2006 21:43

mam problem.na dysku c,co jakis czas zapisuje mi sie takie cosŁ to jest w pliku ktorz moge otwoyzc pryz pomocy notatnika.

############################################################# 22:23:41 | CMDLINE = 22:23:41 | COMMONFILES = C:\Program Files\Common Files\ 22:23:41 | DISK1TARGET = 22:23:41 | FOLDER_DESKTOP = C:\Documents and Settings\All Users\Pulpit\ 22:23:41 | FOLDER_PROGRAMS = C:\Documents and Settings\All Users\Menu Start\Programy\ 22:23:41 | FOLDER_STARTMENU = C:\Documents and Settings\All Users\Menu Start\ 22:23:41 | FOLDER_STARTUP = C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ 22:23:41 | INFOFILENAME = 22:23:41 | INSTALLDIR = E:\ 22:23:41 | ISRES = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}_isres.dll 22:23:41 | ISUSER = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}_isuser.dll 22:23:41 | ISVERSION = 7.7.0.262 22:23:41 | MEDIA = DATA 22:23:41 | PRODUCT_GUID = {6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6} 22:23:41 | SHELL_OBJECT_FOLDER = 22:23:41 | SRCDIR = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}\ 22:23:41 | SRCDISK = C: 22:23:41 | SUPPORTDIR = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}\ 22:23:41 | TARGETDIR = E:\ 22:23:41 | TARGETDISK = E: 22:23:41 | UNINSTALLKEY = InstallShield_{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6} 22:23:41 | UNINSTALL_DISPLAYNAME = Mobile Phone Manager 22:23:41 | UNINSTALL_STRING = 22:23:41 | WINDIR = C:\WINDOWS\ 22:23:41 | WINDISK = C: 22:23:41 | WINSYSDISK = C: 22:23:41 | WINSYSDIR = C:\WINDOWS\system32\ 22:23:41 | USERNAME = delemelka 22:23:42 | VersionMsi = 3.00 22:23:42 | ProductVersion = 3.04.40.43 22:23:42 | no Esi in Setup 22:23:42 | no RIM BBDesktop in Setup 22:23:42 | found GPRS MA in Setup 22:23:42 | BUILD_DATE :10/18/04 13:50:42 22:23:42 | OS: Windows XP 22:23:42 | OS: ServicePack: 2 22:23:42 | OS: user is logged in under NT with administator rights. 22:23:42 | OS: the shell is Explorer. 22:23:42 | OS: the processor is Intel. 22:23:42 | OS: operating system’s version: 5.1 22:23:42 | OS: Windows Version: 5.1 22:23:42 | ############################################################# 22:29:14 | Log file created 9-6-2006 22:29:14 | Time: 22:29:14 22:29:14 | ############################################################# 22:29:14 | # DEBUG INFO # 22:29:14 | ############################################################# 22:29:14 | CMDLINE = 22:29:14 | COMMONFILES = C:\Program Files\Common Files\ 22:29:14 | DISK1TARGET = C:\Program Files\InstallShield Installation Information{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6} 22:29:14 | FOLDER_DESKTOP = C:\Documents and Settings\All Users\Pulpit\ 22:29:14 | FOLDER_PROGRAMS = C:\Documents and Settings\All Users\Menu Start\Programy\ 22:29:14 | FOLDER_STARTMENU = C:\Documents and Settings\All Users\Menu Start\ 22:29:14 | FOLDER_STARTUP = C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ 22:29:14 | INFOFILENAME = 22:29:14 | INSTALLDIR = E:\ 22:29:14 | ISRES = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}_isres.dll 22:29:14 | ISUSER = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}_isuser.dll 22:29:14 | ISVERSION = 7.7.0.262 22:29:14 | MEDIA = DATA 22:29:14 | PRODUCT_GUID = {6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6} 22:29:14 | SHELL_OBJECT_FOLDER = Mobile Phone Manager 22:29:14 | SRCDIR = C:\Program Files\InstallShield Installation Information{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}\ 22:29:14 | SRCDISK = C: 22:29:14 | SUPPORTDIR = C:\DOCUME~1\Patrysia\USTAWI~1\Temp{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}\ 22:29:14 | TARGETDIR = E:\ 22:29:14 | TARGETDISK = E: 22:29:14 | UNINSTALLKEY = InstallShield_{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6} 22:29:14 | UNINSTALL_DISPLAYNAME = Mobile Phone Manager 22:29:14 | UNINSTALL_STRING = C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6} /l1045 22:29:14 | WINDIR = C:\WINDOWS\ 22:29:14 | WINDISK = C: 22:29:14 | WINSYSDISK = C: 22:29:14 | WINSYSDIR = C:\WINDOWS\system32\ 22:29:14 | USERNAME = delemelka 22:29:14 | VersionMsi = 3.00 22:29:14 | ProductVersion = 3.04.40.43 22:29:14 | no Esi in Setup 22:29:14 | no RIM BBDesktop in Setup 22:29:14 | found GPRS MA in Setup 22:29:14 | BUILD_DATE :10/18/04 13:50:42 22:29:14 | OS: Windows XP 22:29:14 | OS: ServicePack: 2 22:29:14 | OS: user is logged in under NT with administator rights. 22:29:14 | OS: the shell is Explorer. 22:29:14 | OS: the processor is Intel. 22:29:14 | OS: operating system’s version: 5.1 22:29:14 | OS: Windows Version: 5.1 22:29:14 | ############################################################# 22:29:14 | try to run: cmd /c “C:\Program Files\InstallShield Installation Information{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}\pre.bat " 22:29:18 | run: cmd /c “C:\Program Files\InstallShield Installation Information{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}\pre.bat “finished Wait 22:29:18 | Debug: ProgDefGroupType is COMMON! 22:29:18 | ### OnBegin() end 22:29:18 | ## begin GetPhoneFromIni() 22:29:18 | Warning: can’t read phone from E:\SETUP\phone.ini 22:29:18 | set PhoneType to: 22:29:18 | ## begin GetPhoneFromIni() 22:29:18 | ## begin checkCommandlineAllowed 22:29:18 | CMDLINE = ‘’ 22:29:18 | ## end checkCommandlineAllowed 22:29:18 | ## begin SetShownComponents() 22:29:18 | Warning: No phone selected set Default 22:29:18 | ## end SetShownComponents() 22:29:18 | Commandline: 22:29:30 | Type of Setup 22:29:30 | uninstalling SX1 Addon if present 22:29:30 | try to run: E:\bin\sx1Addon-uninst.exe /S 22:29:30 | Error: starting E:\bin\sx1Addon-uninst.exe /S 22:29:30 | End uninstalling SX1 Addon 22:29:31 | Error: can not access SCfgSrv.EnvironmentServer 22:29:31 | unregister SPhoneObserver.exe 22:29:31 | try to run: E:\bin\SPhoneObserver.exe /unregserver 22:29:31 | Error: starting E:\bin\SPhoneObserver.exe /unregserver 22:29:31 | starting: ComponentRemoveAll() 22:29:47 | BEGIN unistall GPRS_MODEM 22:29:47 | try to run: E:\GPRS\setup.exe -d -p"E:\GPRSv2” -m"C:\Documents and Settings\All Users\Menu Start\Programy\Mobile Phone Manager” 22:29:47 | Error: starting E:\GPRS\setup.exe -d -p"E:\GPRSv2” -m"C:\Documents and Settings\All Users\Menu Start\Programy\Mobile Phone Manager" 22:29:47 | END unistall GPRS_MODEM 22:29:47 | ## installDriver 22:29:47 | try to install E:\driver\Actser\uninstall device.inf 22:29:47 | Error: install Driver E:\driver\Actser\uninstall device.inf File do not exists 22:29:47 | ## END installDriver 22:29:47 | try to run: E:\driver\C65USB-remove\simodrm.exe /s 22:29:47 | Error: starting E:\driver\C65USB-remove\simodrm.exe /s

tego jest duzo wiecej,to jet dluzsze,ale przeszlam tylko fragment.

ponadto, moje znaki na klawiaturze ulegly przetasowaniu,tak gdzie jest y to jest z i odwrontie,inne znaki tez niedzialaja poprawnie.niewiem czy to robota tego wirusa__ w zalaczeniu przesylam loga.powiem tylko jeszcze ze skanowalam kompa spzware temrinator i ewido,polecil mi je ktos.ok,teray czas na loga

Logfile of HijackThis v1.99.1 Scan saved at 23:44:08, on 2006-09-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\keyhook.exe C:\Program Files\iPlus\iPlusChecker.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPlus\iPlusFlashSkin.exe E:\ewido anti-spyware 4.0\guard.exe E:\ewido anti-spyware 4.0\ewido.exe E:\Avant Browser\avant.exe C:\Program Files\Gadu-Gadu\gg.exe E:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM…\Run: [iPlusManager] “C:\Program Files\iPlus\iPlusChecker.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [!ewido] “E:\ewido anti-spyware 4.0\ewido.exe” /minimized O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - E:\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - E:\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Otwórz w nowym Avant Browser - E:\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony… - E:\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Podświetl - E:\Avant Browser\Highlight.htm O8 - Extra context menu item: Szukaj - E:\Avant Browser\Search.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus … nicode.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://netpanel.gem.pl/netpanel2/WebInstaller.dll O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab O17 - HKLM\System\CCS\Services\Tcpip…{DA3D4266-B1AF-49ED-95F5-481FE70500A2}: NameServer = 212.2.96.51 212.2.96.52 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

Bieniol · 8 Wrzesień 2006 21:48

Log jest czysty

Panel sterowania --> opcje regionalne i językowe --> języki --> szczegóły --> i zmień na “Polski (programisty)”

Przelomowa · 8 Wrzesień 2006 21:51

FENKJU --WIELKIE DZIEKI