Internet Security Center

bobasek_89 · 2 Luty 2007 16:04

Witam. Od jakiegoś czasu zaczęły mi wyskakiwać reklamy w IE (używam firefoxa) i w firefoxie odpala mi się domena ‘Internet Security Center’. Piszą w niej coś, że mam zawirusowany komputer i powinienem ściągnąć ich antywirusa i przeskanować kompa. Ale domyślam się, że to syf jak każdy inny. Dlatego tu jestem :P.

HijackThis :

Logfile of HijackThis v1.99.1 Scan saved at 17:04:05, on 2007-02-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ewido anti-malware\ewidoctrl.exe E:\Program Files\InterBase6.5\bin\ibguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Ipwindows\ipwins.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Konnekt\konnekt.exe D:\Instalki\client uptime-project.net\client.exe C:\DOCUME~1\UKASZ~1\MOJEDO~1\PPPATC~1\mmc.exe C:\Documents and Settings\Łukasz\Dane aplikacji?ppPatch??rss.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe E:\Program Files\InterBase6.5\bin\ibserver.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files{C4061DA0-04BE-1045-1126-020515000030}\Update.exe C:\Program Files\DC++\DCPlusPlus.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Instalki\utorrent.exe D:\Uzytki\logi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {A5467AE1-C079-CDF1-5524-9B1BC70515E0} - C:\WINDOWS\system32\bqevz.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1{34061~1\Bar888.dll O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” O4 - HKLM…\Run: [HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [p2p networking] p2pnetworking.exe O4 - HKLM…\Run: [{C4061DA0-04BE-1045-1126-020515000030}] “C:\Program Files\Common Files{C4061DA0-04BE-1045-1126-020515000030}\Update.exe” mc-110-12-0000137 O4 - HKLM…\Run: [ipWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKLM…\Run: [DllRunning] rundll32.exe “C:\WINDOWS\system32\myoyyrsf.dll”,setvm O4 - HKLM…\RunServices: [p2p networking] p2pnetworking.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Konnekt] “C:\Program Files\Konnekt\konnekt.exe” /autostart O4 - HKCU…\Run: [uptime-Project] D:\Instalki\client uptime-project.net\client.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Roua] “C:\DOCUME~1\UKASZ~1\MOJEDO~1\PPPATC~1\mmc.exe” -vt yazb O4 - HKCU…\Run: [Dyvcgglu] C:\Documents and Settings\Łukasz\Dane aplikacji?ppPatch??rss.exe O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: taskmgr.exe O8 - Extra context menu item: Download All Files by HiDownload - C:\Program Files\HiDownload\HDGetAll.htm O8 - Extra context menu item: Download by HiDownload - C:\Program Files\HiDownload\HDGet.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000137 (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - E:\Program Files\InterBase6.5\bin\ibguard.exe O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - E:\Program Files\InterBase6.5\bin\ibserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

SilentRunners :

“Silent Runners.vbs”, revision 43, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Konnekt” = ““C:\Program Files\Konnekt\konnekt.exe” /autostart” [“Stamina”] “Uptime-Project” = “D:\Instalki\client uptime-project.net\client.exe” [null data] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Roua” = ““C:\DOCUME~1\UKASZ~1\MOJEDO~1\PPPATC~1\mmc.exe” -vt yazb” [null data] “Dyvcgglu” = (value not set) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “HP Software Update” = ““C:\Program Files\HP\HP Software Update\HPWuSchd2.exe”” [“Hewlett-Packard Company”] “HP Component Manager” = ““C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”” [“Hewlett-Packard Company”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “RemoteControl” = ““C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “p2p networking” = “p2pnetworking.exe” [null data] “{C4061DA0-04BE-1045-1126-020515000030}” = ““C:\Program Files\Common Files{C4061DA0-04BE-1045-1126-020515000030}\Update.exe” mc-110-12-0000137” [null data] “IpWins” = “C:\Program Files\Ipwindows\ipwins.exe” [null data] “DllRunning” = “rundll32.exe “C:\WINDOWS\system32\myoyyrsf.dll”,setvm” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {031F120A-BBAF-45d8-B306-375F2A6B9398}(Default) = “XBTP05231” -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~2\a120_tb.dll” [“IE Toolbar”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {34985592-4E4C-420A-8A25-5F070715920C}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\yayywxw.dll” [null data] {46A4E9D9-B30E-452A-8157-DBBEC8573B03}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [null data] {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\oidcaisg.dll” [null data] {6935542D-8084-476C-BC2E-9E8282B02CA5}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\xxyxv.dll” [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = “SSVHelper Class” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] {A5467AE1-C079-CDF1-5524-9B1BC70515E0}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\bqevz.dll” [null data] {C1B4DEC2-2623-438e-9CA2-C9043AB28508}(Default) = “Bar888” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\COMMON~1{34061~1\Bar888.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! “{54D9498B-CF93-414F-8984-8CE7FDE0D391}” = “ewido shell guard” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\shellhook.dll” ["TODO: "] INFECTION WARNING! “{34985592-4E4C-420A-8A25-5F070715920C}” = “*g” (unwritable string) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\yayywxw.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! xxyxv\DLLName = “C:\WINDOWS\system32\xxyxv.dll” [null data] INFECTION WARNING! yayywxw\DLLName = “yayywxw.dll” [null data] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Łukasz\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Łukasz” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\Łukasz\Menu Start\Programy\Autostart “OpenOffice.org 2.0” -> shortcut to: “C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe” [file not found] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “HP Digital Imaging Monitor” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”] “HP Image Zone - szybkie uruchamianie” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s” [null data] INFECTION WARNING! “taskmgr.exe” [“Windows Installer”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{1CE4EE89-2D5C-4361-AF3B-D902AB545381}” = “Alcohol Soft - Alcohol 120% Toolbar” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll” [“IE Toolbar”] “{74DD705D-6834-439C-A735-A6DBE2677452}” = “&VSAdd-in” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{F053C368-5458-45B2-9B4D-D8914BDDDBFF}” = “TextAloud” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\TEXTAL~1\TAForIE.dll” [empty string] “{1CE4EE89-2D5C-4361-AF3B-D902AB545381}” = “Alcohol Soft - Alcohol 120% Toolbar” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll” [“IE Toolbar”] “{C1B4DEC2-2623-438E-9CA2-C9043AB28508}” = “Bar888” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\COMMON~1{34061~1\Bar888.dll” [null data] “{74DD705D-6834-439C-A735-A6DBE2677452}” = “&VSAdd-in” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [null data] Explorer Bars Dormant Explorer Bars in “View, Explorer Bar” menu HKLM\Software\Classes\CLSID{F053C368-5458-45B2-9B4D-D8914BDDDBFF}\ = “TextAloud” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\TEXTAL~1\TAForIE.dll” [empty string] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll” [“Sun Microsystems, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ Missing lines (compared with English-language version): “{A5467AE1-C079-CDF1-5524-9B1BC70515E0}” = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\bqevz.dll” [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ewido security suite control, ewido security suite control, “C:\Program Files\ewido anti-malware\ewidoctrl.exe” [“ewido networks”] InterBase Guardian, InterBaseGuardian, “E:\Program Files\InterBase6.5\bin\ibguard.exe” [“Borland Software Corporation”] InterBase Server, InterBaseServer, “E:\Program Files\InterBase6.5\bin\ibserver.exe” [“Borland Software Corporation”] NVIDIA Driver Helper Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 140 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 40 seconds. ---------- (total run time: 209 seconds)

No i jako, że mam już tego dość chciałbym się jakoś od tego zabezpieczyć ‘za darmo’ i bez dużego obciążenia systemu. Czyli jakiś delikatny soft, który ochroni mnie wreszcie od tego całego syfu. Z góry dziękuję za pomoc.

adam9870 · 2 Luty 2007 16:50

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.

Start => uruchom => cmd => wpisz

W trybie awaryjnym z wyłączonym przywracaniem systemu usuń:

C:\WINDOWS\system32\yayywxw.dll C:\WINDOWS\system32\xxyxv.dll R3 - URLSearchHook: (no name) - {A5467AE1-C079-CDF1-5524-9B1BC70515E0} - C:\WINDOWS\system32\bqevz.dll O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1{34061~1\Bar888.dll O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll O4 - HKLM…\Run: [p2p networking] p2pnetworking.exe O4 - HKLM…\Run: [{C4061DA0-04BE-1045-1126-020515000030}] “C:\Program Files\Common Files{C4061DA0-04BE-1045-1126-020515000030}\Update.exe” mc-110-12-0000137 O4 - HKLM…\Run: [ipWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKLM…\Run: [DllRunning] rundll32.exe “C:\WINDOWS\system32\myoyyrsf.dll”,setvm O4 - HKLM…\RunServices: [p2p networking] p2pnetworking.exe O4 - HKCU…\Run: [Roua] “C:\DOCUME~1\UKASZ~1\MOJEDO~1\PPPATC~1\mmc.exe” -vt yazb O4 - HKCU…\Run: [Dyvcgglu] C:\Documents and Settings\Łukasz\Dane aplikacji?ppPatch??rss.exe O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000137 (file missing)

Pliki i foldery zaznaczone kasujesz ręcznie z dysku natomiast wpisy w HijackThis.

Sam tak ustawiałeś? Jeśli nie to także usuń.

Poczytaj o usuwaniu plików i folderów z pytajnikiem - Usuwanie PurityScan.

Użyj narzędzia SmitFraudFix z opcji numer 2 w trybie awaryjnym.

Zastosuj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Po wykonaniu wklej nowy log z HJT, Silenta, ComboFix, c:\rapport.txt.

Stgmp · 2 Luty 2007 17:09

Firewall Comodo Pro http://www.personalfirewall.comodo.com/ Antywirus AntiVir Personal Edition Classic http://dobreprogramy.com/index.php?dz=2&id=388&t=30 ,prawidłowa konfiguracja jest na tej stronie http://antivir-polska.info/ program antyszpiegowski Ad-aware SE Personal 1.06 http://dobreprogramy.com/index.php?dz=2&id=107&t=82

bobasek_89 · 3 Luty 2007 12:25

Więc zrobiłem wszystko co się dało. cmd jest zablokowane (‘aktualnie inny program korzysta z tego pliku’), okno IE wyskakuje nadal. Pousuwałem co się dało, poskanowałem czym było trzeba. Tutaj daje logi:

HijackThis :

Logfile of HijackThis v1.99.1 Scan saved at 13:22:27, on 2007-02-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Konnekt\konnekt.exe D:\Instalki\client uptime-project.net\client.exe E:\Program Files\InterBase6.5\bin\ibguard.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe E:\Program Files\InterBase6.5\bin\ibserver.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\wbem\wmiprvse.exe D:\Uzytki\logi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” O4 - HKLM…\Run: [HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [DllRunning] rundll32.exe “C:\WINDOWS\system32\qmhwlkix.dll”,setvm O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Konnekt] “C:\Program Files\Konnekt\konnekt.exe” /autostart O4 - HKCU…\Run: [uptime-Project] D:\Instalki\client uptime-project.net\client.exe O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: taskmgr.exe O8 - Extra context menu item: Download All Files by HiDownload - C:\Program Files\HiDownload\HDGetAll.htm O8 - Extra context menu item: Download by HiDownload - C:\Program Files\HiDownload\HDGet.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - E:\Program Files\InterBase6.5\bin\ibguard.exe O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - E:\Program Files\InterBase6.5\bin\ibserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

SilentRunners :

“Silent Runners.vbs”, revision 43, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Konnekt” = ““C:\Program Files\Konnekt\konnekt.exe” /autostart” [“Stamina”] “Uptime-Project” = “D:\Instalki\client uptime-project.net\client.exe” [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “HP Software Update” = ““C:\Program Files\HP\HP Software Update\HPWuSchd2.exe”” [“Hewlett-Packard Company”] “HP Component Manager” = ““C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”” [“Hewlett-Packard Company”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “RemoteControl” = ““C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “DllRunning” = “rundll32.exe “C:\WINDOWS\system32\qmhwlkix.dll”,setvm” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {031F120A-BBAF-45d8-B306-375F2A6B9398}(Default) = “XBTP05231” -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~2\a120_tb.dll” [“IE Toolbar”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {46A4E9D9-B30E-452A-8157-DBBEC8573B03}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [file not found] {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\oidcaisg.dll” [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = “SSVHelper Class” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] {8413CBC6-0171-4038-8007-78A5A7062A74}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\xxyxv.dll” [null data] {A5467AE1-C079-CDF1-5524-9B1BC70515E0}(Default) = (no title provided) -> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\bqevz.dll” [file not found] {C1B4DEC2-2623-438e-9CA2-C9043AB28508}(Default) = “Bar888” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\COMMON~1{34061~1\Bar888.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! “{54D9498B-CF93-414F-8984-8CE7FDE0D391}” = “ewido shell guard” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\shellhook.dll” ["TODO: "] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! xxyxv\DLLName = “C:\WINDOWS\system32\xxyxv.dll” [null data] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “Łukasz” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\Łukasz\Menu Start\Programy\Autostart “OpenOffice.org 2.0” -> shortcut to: “C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe” [file not found] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “HP Digital Imaging Monitor” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”] “HP Image Zone - szybkie uruchamianie” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s” [null data] INFECTION WARNING! “taskmgr.exe” [“Windows Installer”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{1CE4EE89-2D5C-4361-AF3B-D902AB545381}” = “Alcohol Soft - Alcohol 120% Toolbar” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll” [“IE Toolbar”] “{74DD705D-6834-439C-A735-A6DBE2677452}” = “&VSAdd-in” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{F053C368-5458-45B2-9B4D-D8914BDDDBFF}” = “TextAloud” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\TEXTAL~1\TAForIE.dll” [empty string] “{1CE4EE89-2D5C-4361-AF3B-D902AB545381}” = “Alcohol Soft - Alcohol 120% Toolbar” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll” [“IE Toolbar”] Explorer Bars Dormant Explorer Bars in “View, Explorer Bar” menu HKLM\Software\Classes\CLSID{F053C368-5458-45B2-9B4D-D8914BDDDBFF}\ = “TextAloud” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\TEXTAL~1\TAForIE.dll” [empty string] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll” [“Sun Microsystems, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ewido security suite control, ewido security suite control, “C:\Program Files\ewido anti-malware\ewidoctrl.exe” [“ewido networks”] InterBase Guardian, InterBaseGuardian, “E:\Program Files\InterBase6.5\bin\ibguard.exe” [“Borland Software Corporation”] InterBase Server, InterBaseServer, “E:\Program Files\InterBase6.5\bin\ibserver.exe” [“Borland Software Corporation”] NVIDIA Driver Helper Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 140 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 41 seconds. ---------- (total run time: 203 seconds)

ComboFix :

Nie działa (włącza się i wyłącza…) podejrzewam, że to przez niedziałanie cmd.

rapport.txt :

SmitFraudFix v2.138 Scan done at 12:38:52,71, 2007-02-03 Run from C:\Documents and Settings\ťukasz\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\UKASZ~1\Ulubione\Online Security Test.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End Coś jeszcze?

adam9870 · 3 Luty 2007 12:35

Ściągasz program KillBox, zaznaczasz Delete on reboot , w polu full path of file wklej ścieżki:

C:\WINDOWS\system32\qmhwlkix.dll

C:\WINDOWS\system32\oidcaisg.dll

C:\WINDOWS\system32\xxyxv.dll

po wklejeniu każdej ścieżki z osobna klikasz na czerwonego iksa, ale dopiero po wklejeniu ostatniej zgadzasz się na restart.

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “DllRunning”=- [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{46A4E9D9-B30E-452A-8157-DBBEC8573B03}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{8413CBC6-0171-4038-8007-78A5A7062A74}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{A5467AE1-C079-CDF1-5524-9B1BC70515E0}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{C1B4DEC2-2623-438e-9CA2-C9043AB28508}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyxv] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] “{74DD705D-6834-439C-A735-A6DBE2677452}”=-

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Pytam ponownie:

Sam ustawiałeś? Jeśli nie to usuń plik.

Po wykonaniu wklej nowy log z Silenta oraz log numer 1 z L2Mfix.

bobasek_89 · 3 Luty 2007 13:05

KillBox sobie nie radzi… (klik)

taskmgr.exe? Nie wiem za bardzo co to jest… Ale nie pamiętam żebym ustawiał coś o podobnej nazwie… Więc jest mi to nieznane.

Fix.rega robić nawet jeśli nie udało się killboxem usunąć tych dlli? Czy zrobić teraz fix.rega?

adam9870 · 3 Luty 2007 13:24

Zrobimy nieco inaczej.

Pobierz The avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\system32\qmhwlkix.dll C:\WINDOWS\system32\oidcaisg.dll C:\WINDOWS\system32\xxyxv.dll C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe Registry values to delete: “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” | “DllRunning” “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser” | “{74DD705D-6834-439C-A735-A6DBE2677452}” Registry keys to delete: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{46A4E9D9-B30E-452A-8157-DBBEC8573B03} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{8413CBC6-0171-4038-8007-78A5A7062A74} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{A5467AE1-C079-CDF1-5524-9B1BC70515E0} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{C1B4DEC2-2623-438e-9CA2-C9043AB28508} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyxv

=> Kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po resecie może pojawić się okienko na dosłownie kilka sekund oraz log w notatniku. Wejdź tam gdzie masz avangera i skasuj plik backup.zip czyli np. c:\avanger\backup.zip.

Po wykonaniu nie musisz już stosować pliku FIX.REG, a tylko pokaż logi, o które prosiłem.

bobasek_89 · 3 Luty 2007 14:49

HijackThis

Logfile of HijackThis v1.99.1 Scan saved at 15:48:42, on 2007-02-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ewido anti-malware\ewidoctrl.exe E:\Program Files\InterBase6.5\bin\ibguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Konnekt\konnekt.exe D:\Instalki\client uptime-project.net\client.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\notepad.exe E:\Program Files\InterBase6.5\bin\ibserver.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\Uzytki\logi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: XBTP05231 - {031F120A-BBAF-45d8-B306-375F2A6B9398} - C:\PROGRA~1\ALCOHO~1\ALCOHO~2\a120_tb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” O4 - HKLM…\Run: [HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe” O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Konnekt] “C:\Program Files\Konnekt\konnekt.exe” /autostart O4 - HKCU…\Run: [uptime-Project] D:\Instalki\client uptime-project.net\client.exe O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: Download All Files by HiDownload - C:\Program Files\HiDownload\HDGetAll.htm O8 - Extra context menu item: Download by HiDownload - C:\Program Files\HiDownload\HDGet.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - E:\Program Files\InterBase6.5\bin\ibguard.exe O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - E:\Program Files\InterBase6.5\bin\ibserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

L2Mfix opcja 1 :

L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] “DLLName”=“cscdll.dll” “Logon”=“WinlogonLogonEvent” “Logoff”=“WinlogonLogoffEvent” “ScreenSaver”=“WinlogonScreenSaverEvent” “Startup”=“WinlogonStartupEvent” “Shutdown”=“WinlogonShutdownEvent” “StartShell”=“WinlogonStartShellEvent” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] “DLLName”=“wlnotify.dll” “Logon”=“SCardStartCertProp” “Logoff”=“SCardStopCertProp” “Lock”=“SCardSuspendCertProp” “Unlock”=“SCardResumeCertProp” “Enabled”=dword:00000001 “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “StartShell”=“SchedStartShell” “Logoff”=“SchedEventLogOff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] “Logoff”=“WLEventLogoff” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 “DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] “DLLName”=“WlNotify.dll” “Lock”=“SensLockEvent” “Logon”=“SensLogonEvent” “Logoff”=“SensLogoffEvent” “Safe”=dword:00000001 “MaxWait”=dword:00000258 “StartScreenSaver”=“SensStartScreenSaverEvent” “StopScreenSaver”=“SensStopScreenSaverEvent” “Startup”=“SensStartupEvent” “Shutdown”=“SensShutdownEvent” “StartShell”=“SensStartShellEvent” “PostShell”=“SensPostShellEvent” “Disconnect”=“SensDisconnectEvent” “Reconnect”=“SensReconnectEvent” “Unlock”=“SensUnlockEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “Logoff”=“TSEventLogoff” “Logon”=“TSEventLogon” “PostShell”=“TSEventPostShell” “Shutdown”=“TSEventShutdown” “StartShell”=“TSEventStartShell” “Startup”=“TSEventStartup” “MaxWait”=dword:00000258 “Reconnect”=“TSEventReconnect” “Disconnect”=“TSEventDisconnect” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] “DLLName”=“wlnotify.dll” “Logon”=“RegisterTicketExpiredNotificationEvent” “Logoff”=“UnregisterTicketExpiredNotificationEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] “SV1”="" “Alcohol Search”="" ********************************************************************************** Shell Extension key: ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ mwfhgdan.dll Wed 2007-01-31 21:40:56 A… 76 412 74,62 K opnkj.dll Wed 2007-01-31 21:40:22 …SH. 277 262 270,76 K vbzip10.dll Mon 2006-12-25 14:07:20 A… 147 456 144,00 K 3 items found: 3 files (1 H/S), 0 directories. Total of file sizes: 501 130 bytes 489,38 K Locate .tmp files: C:\WINDOWS\SYSTEM32\ vxyxx~1.tmp Thu 2007-02-01 0:43:56 A.SH. 472 248 461,18 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 472 248 bytes 461,18 K ********************************************************************************** Directory Listing of system files: Wolumin w stacji C to Dysk C Numer seryjny woluminu: C406-1DA0 Katalog: C:\WINDOWS\System32 2007-02-03 15:44 488˙542 vxyxx.ini 2007-02-03 13:22 472˙694 vxyxx.bak1 2007-02-03 13:07 406 xiklwhmq.ini 2007-02-03 13:00 474˙429 kklnn.ini 2007-02-03 12:52 472˙694 kklnn.bak1 2007-02-03 12:52 277˙134 nnlkk.dll.vir 2007-02-03 11:32 970˙262 fsryyoym.ini 2007-02-01 00:43 472˙248 vxyxx.tmp2 2007-01-31 21:40 277˙262 opnkj.dll 2006-10-22 14:01 2006-10-22 13:15 2004-08-03 23:44 363˙520 p2pnetworking.exe 10 plik(˘w) 4˙269˙191 bajt˘w 2 katalog(˘w) 1˙795˙825˙664 bajt˘w wolnych

Avanger też sobie chyba nie radzi.

////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Syntax error in line — does not appear to be a valid registry path. Line will be ignored. Error code: 0 Line: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser" | "{74DD705D-6834-439C-A735-A6DBE2677452} Error: could not execute export batch. Error code: 0 ////////////////////////////////////////// Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\vlklbbye ******************* Script file located at: ??\C:\Documents and Settings\nmekdtmg.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\qmhwlkix.dll deleted successfully. File C:\WINDOWS\system32\oidcaisg.dll deleted successfully. File C:\WINDOWS\system32\xxyxv.dll deleted successfully. File C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DllRunning deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{46A4E9D9-B30E-452A-8157-DBBEC8573B03} deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{8413CBC6-0171-4038-8007-78A5A7062A74} deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{A5467AE1-C079-CDF1-5524-9B1BC70515E0} deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{C1B4DEC2-2623-438e-9CA2-C9043AB28508} deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyxv deleted successfully. Completed script processing. ******************* Finished! Terminate.

link (po kliknięciu zielonego światełka)… I co teraz?

adam9870 · 3 Luty 2007 15:08

Przeskanuj plik C:\WINDOWS\SYSTEM32\mwfhgdan.dll oraz C:\WINDOWS\System32\fsryyoym.ini na stronie http://virusscan.jotti.org/ lub http://www.virustotal.com/vt/, a jeśli okażą się szkodnikami to doklej do nich ścieżki do skryptu w Avengerze.

Uruchom Avenger’a => zaznacz opcję Input script manually => kliknij w lupkę => w okienku, które się otworzy wklej:

=> Kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po resecie może pojawić się okienko na dosłownie kilka sekund oraz log w notatniku. Wejdź tam gdzie masz avangera i skasuj plik backup.zip czyli np. c:\avanger\backup.zip.

Przeskanuj ewido skoro je masz.

Po wykonaniu wklej nowy log z Silenta i L2mfix.

bobasek_89 · 3 Luty 2007 15:32

C:\WINDOWS\SYSTEM32\mwfhgdan.dll był zawirusowany więc usunąłem avengerem, C:\WINDOWS\System32\fsryyoym.ini był czysty. Tutaj log:

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ftuamrsl ******************* Script file located at: ??\C:\WINDOWS\lxwngumo.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\SYSTEM32\opnkj.dll deleted successfully. File C:\WINDOWS\SYSTEM32\vxyxx~1.tmp deleted successfully. File C:\WINDOWS\System32\vxyxx.ini deleted successfully. File C:\WINDOWS\System32\vxyxx.bak1 deleted successfully. File C:\WINDOWS\System32\xiklwhmq.ini deleted successfully. File C:\WINDOWS\System32\kklnn.ini deleted successfully. File C:\WINDOWS\System32\kklnn.bak1 deleted successfully. File C:\WINDOWS\System32\nnlkk.dll.vir deleted successfully. File C:\WINDOWS\System32\vxyxx.tmp2 not found! Deletion of file C:\WINDOWS\System32\vxyxx.tmp2 failed! Could not process line: C:\WINDOWS\System32\vxyxx.tmp2 Status: 0xc0000034 File C:\WINDOWS\System32\p2pnetworking.exe deleted successfully. File C:\WINDOWS\SYSTEM32\mwfhgdan.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

Silent:

“Silent Runners.vbs”, revision 43, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Konnekt” = ““C:\Program Files\Konnekt\konnekt.exe” /autostart” [“Stamina”] “Uptime-Project” = “D:\Instalki\client uptime-project.net\client.exe” [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “HP Software Update” = ““C:\Program Files\HP\HP Software Update\HPWuSchd2.exe”” [“Hewlett-Packard Company”] “HP Component Manager” = ““C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”” [“Hewlett-Packard Company”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “RemoteControl” = ““C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {031F120A-BBAF-45d8-B306-375F2A6B9398}(Default) = “XBTP05231” -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~2\a120_tb.dll” [“IE Toolbar”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = “SSVHelper Class” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! “{54D9498B-CF93-414F-8984-8CE7FDE0D391}” = “ewido shell guard” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\shellhook.dll” ["TODO: "] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “Łukasz” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\Łukasz\Menu Start\Programy\Autostart “OpenOffice.org 2.0” -> shortcut to: “C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe” [file not found] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “HP Digital Imaging Monitor” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”] “HP Image Zone - szybkie uruchamianie” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s” [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{1CE4EE89-2D5C-4361-AF3B-D902AB545381}” = “Alcohol Soft - Alcohol 120% Toolbar” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll” [“IE Toolbar”] “{74DD705D-6834-439C-A735-A6DBE2677452}” = “&VSAdd-in” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{F053C368-5458-45B2-9B4D-D8914BDDDBFF}” = “TextAloud” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\TEXTAL~1\TAForIE.dll” [empty string] “{1CE4EE89-2D5C-4361-AF3B-D902AB545381}” = “Alcohol Soft - Alcohol 120% Toolbar” [from CLSID] -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll” [“IE Toolbar”] Explorer Bars Dormant Explorer Bars in “View, Explorer Bar” menu HKLM\Software\Classes\CLSID{F053C368-5458-45B2-9B4D-D8914BDDDBFF}\ = “TextAloud” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\PROGRA~1\TEXTAL~1\TAForIE.dll” [empty string] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}” -> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll” [“Sun Microsystems, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ewido security suite control, ewido security suite control, “C:\Program Files\ewido anti-malware\ewidoctrl.exe” [“ewido networks”] InterBase Guardian, InterBaseGuardian, “E:\Program Files\InterBase6.5\bin\ibguard.exe” [“Borland Software Corporation”] InterBase Server, InterBaseServer, “E:\Program Files\InterBase6.5\bin\ibserver.exe” [“Borland Software Corporation”] NVIDIA Driver Helper Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 235 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 33 seconds. ---------- (total run time: 289 seconds)

L2MFIX:

L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] “DLLName”=“cscdll.dll” “Logon”=“WinlogonLogonEvent” “Logoff”=“WinlogonLogoffEvent” “ScreenSaver”=“WinlogonScreenSaverEvent” “Startup”=“WinlogonStartupEvent” “Shutdown”=“WinlogonShutdownEvent” “StartShell”=“WinlogonStartShellEvent” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] “DLLName”=“wlnotify.dll” “Logon”=“SCardStartCertProp” “Logoff”=“SCardStopCertProp” “Lock”=“SCardSuspendCertProp” “Unlock”=“SCardResumeCertProp” “Enabled”=dword:00000001 “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “StartShell”=“SchedStartShell” “Logoff”=“SchedEventLogOff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] “Logoff”=“WLEventLogoff” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 “DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] “DLLName”=“WlNotify.dll” “Lock”=“SensLockEvent” “Logon”=“SensLogonEvent” “Logoff”=“SensLogoffEvent” “Safe”=dword:00000001 “MaxWait”=dword:00000258 “StartScreenSaver”=“SensStartScreenSaverEvent” “StopScreenSaver”=“SensStopScreenSaverEvent” “Startup”=“SensStartupEvent” “Shutdown”=“SensShutdownEvent” “StartShell”=“SensStartShellEvent” “PostShell”=“SensPostShellEvent” “Disconnect”=“SensDisconnectEvent” “Reconnect”=“SensReconnectEvent” “Unlock”=“SensUnlockEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “Logoff”=“TSEventLogoff” “Logon”=“TSEventLogon” “PostShell”=“TSEventPostShell” “Shutdown”=“TSEventShutdown” “StartShell”=“TSEventStartShell” “Startup”=“TSEventStartup” “MaxWait”=dword:00000258 “Reconnect”=“TSEventReconnect” “Disconnect”=“TSEventDisconnect” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] “DLLName”=“wlnotify.dll” “Logon”=“RegisterTicketExpiredNotificationEvent” “Logoff”=“UnregisterTicketExpiredNotificationEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] “SV1”="" “Alcohol Search”="" ********************************************************************************** Shell Extension key: ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ vbzip10.dll Mon 2006-12-25 14:07:20 A… 147 456 144,00 K 1 item found: 1 file, 0 directories. Total of file sizes: 147 456 bytes 144,00 K Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Wolumin w stacji C to Dysk C Numer seryjny woluminu: C406-1DA0 Katalog: C:\WINDOWS\System32 2007-02-03 11:32 970˙262 fsryyoym.ini 2006-10-22 14:01 2006-10-22 13:15 1 plik(˘w) 970˙262 bajt˘w 2 katalog(˘w) 1˙796˙472˙832 bajt˘w wolnych

Hm?

Gutek · 3 Luty 2007 19:54

Już Ok - Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177 albo jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

bobasek_89 · 3 Luty 2007 23:08

A nie chciałbym za bardzo niczego zepsuć… A że jestem newbie, więc; jak używać aby nic nie zepsuć?

adam9870 · 4 Luty 2007 09:09

Opis czyszczenia rejestru przy pomocy programu jv16 PowerTools:

http://forum.dobreprogramy.pl/viewtopic … 108#427108

Opis czyszczenia rejestru przy pomocy programu RegCleaner:

Narzędzia => czyszczenie rejestru => wykonaj wszystkie wyżej wymienione => poczekaj aż skończy szukać => postaw ptaszek przy zaznaczonych pozycjach => Usuń zaznaczone.

bobasek_89 · 4 Luty 2007 09:21

Ok, to jeszcze w ramach upewnienia… bo pamiętam, że kiedyś jv16 power Tool czyściłem rejestr, a później miałem problemy z systemem (nie działały kodeki i inne tego typu problemy). Dlatego naprawdę wolę się upewnić, czy to jest bezpieczne? I dlaczego jv 16 power tool mi coś pokiełbasił?.. (nie mam ochoty formatować dysku jak coś zepsuje… :?)

adam9870 · 4 Luty 2007 09:30

Cóż, żaden program nie jest doskonały. Nie wykluczone również, że Ty źle się posługiwałeś programem.

Jeśli obawiasz się jakiś szkód to przed użyciem któregoś z programów wykonaj na wszelki wypadek kopię zapasową rejestru. Potem w razie jakiś problemów będziesz mógł w łatwy sposób skorzystać z tej kopii.

http://forum.dobreprogramy.pl/viewtopic.php?t=74592