Komp i net muli

[kamil13-93 (Kamilwapielsk)]

Ostatnio komp troche muli, zresztą net też. Załączam log z HJT

Logfile of HijackThis v1.99.1 Scan saved at 18:00:26, on 2007-01-29 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe D:\Programy\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\mysvcc.exe C:\WINDOWS\system32\sysem.exe C:\WINDOWS\system32\sysem.exe C:\WINDOWS\system32\RaConfig.exe D:\Programy\Winamp\winamp.exe D:\Programy\Gadu-Gadu\gg.exe D:\Programy\Winamp\winamp.exe C:\WINDOWS\system32\ssrvc.exe C:\WINDOWS\system32\mlm4.exe C:\DOCUME~1\KAMIL\USTAWI~1\Temp\Rar$EX00.204\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Programy\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Programy\FlashGet\getflash.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\Programy\FlashGet\fgiebar.dll O4 - HKLM…\Run: [msvcc25] svcchost.exe O4 - HKLM…\Run: [mysvcig38] mysvcc.exe O4 - HKLM…\Run: [sysemls] C:\WINDOWS\system32\sysem.exe O4 - HKLM…\Run: [jon315] C:\WINDOWS\system32\ssrvc.exe O4 - HKLM…\Run: [ml34] C:\WINDOWS\system32\mlm4.exe O4 - HKLM…\RunServices: [msvcc25] svcchost.exe O4 - HKLM…\RunServices: [mysvcig38] mysvcc.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Programy\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [sysemls] C:\WINDOWS\system32\sysem.exe O4 - HKCU…\Run: [jon315] C:\WINDOWS\system32\ssrvc.exe O4 - HKCU…\Run: [ml34] C:\WINDOWS\system32\mlm4.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - D:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - D:\Programy\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\FlashGet.exe O17 - HKLM\System\CCS\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CCS\Services\Tcpip…{C6C1AC7A-CA1D-4134-AA37-63CC257DF144}: NameServer = 85.255.114.106,85.255.112.123 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS1\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS2\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programy\Alcohol 120\StarWind\StarWindService.exe

[Joan (Joan Sunshine)]

Fajnie jak przy tej ilości syfu tylko “trochę muli” :lol:

Użyj narzędzia FixWareOut

O4 - HKLM…\Run: [msvcc25] svcchost.exe O4 - HKLM…\Run: [mysvcig38] mysvcc.exe O4 - HKLM…\Run: [sysemls] C:\WINDOWS\system32\sysem.exe O4 - HKLM…\Run: [jon315] C:\WINDOWS\system32\ssrvc.exe O4 - HKLM…\Run: [ml34] C:\WINDOWS\system32\mlm4.exe O4 - HKLM…\RunServices: [msvcc25] svcchost.exe O4 - HKLM…\RunServices: [mysvcig38] mysvcc.exe O4 - HKCU…\Run: [sysemls] C:\WINDOWS\system32\sysem.exe O4 - HKCU…\Run: [jon315] C:\WINDOWS\system32\ssrvc.exe O4 - HKCU…\Run: [ml34] C:\WINDOWS\system32\mlm4.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CCS\Services\Tcpip…{C6C1AC7A-CA1D-4134-AA37-63CC257DF144}: NameServer = 85.255.114.106,85.255.112.123 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS1\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS2\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123

Zaznaczone pliki ręcznie z dysku w awaryjnym bez przywracania systemu wywalasz, wpisy fixujesz.

Nowe logi HJT + Silent + C:\Fixwareout\report.txt

Złączono Posty : 29.01.2007 (Pon) 18:19

Fafik1987 > chyba żartujesz :!:

[kamil13-93 (Kamilwapielsk)]

HJT:

Logfile of HijackThis v1.99.1 Scan saved at 18:38:04, on 2007-01-29 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe D:\Programy\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svcchost.exe C:\WINDOWS\System32\mysvcc.exe C:\WINDOWS\system32\sysem.exe C:\WINDOWS\system32\ssrvc.exe C:\WINDOWS\system32\mlm4.exe D:\Programy\Gadu-Gadu\gg.exe C:\WINDOWS\system32\sysem.exe C:\WINDOWS\system32\ssrvc.exe C:\WINDOWS\system32\mlm4.exe C:\WINDOWS\system32\RaConfig.exe D:\Programy\Winamp\winamp.exe D:\Programy\WinRAR\WinRAR.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\Programy\Winamp\winamp.exe D:\Programy\Opera\Opera.exe C:\WINDOWS\System32\WScript.exe C:\DOCUME~1\KAMIL\USTAWI~1\Temp\Rar$EX44.250\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Programy\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O4 - HKLM…\Run: [msvcc25] svcchost.exe O4 - HKLM…\Run: [mysvcig38] mysvcc.exe O4 - HKLM…\Run: [sysemls] C:\WINDOWS\system32\sysem.exe O4 - HKLM…\Run: [jon315] C:\WINDOWS\system32\ssrvc.exe O4 - HKLM…\Run: [ml34] C:\WINDOWS\system32\mlm4.exe O4 - HKLM…\RunServices: [msvcc25] svcchost.exe O4 - HKLM…\RunServices: [mysvcig38] mysvcc.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Programy\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [sysemls] C:\WINDOWS\system32\sysem.exe O4 - HKCU…\Run: [jon315] C:\WINDOWS\system32\ssrvc.exe O4 - HKCU…\Run: [ml34] C:\WINDOWS\system32\mlm4.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - D:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - D:\Programy\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Programy\FlashGet\FlashGet.exe O17 - HKLM\System\CCS\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CCS\Services\Tcpip…{C6C1AC7A-CA1D-4134-AA37-63CC257DF144}: NameServer = 85.255.114.106,85.255.112.123 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS1\Services\Tcpip…{4F630544-FCAD-4B4B-B350-9D464F65D6F5}: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.106 85.255.112.123 O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programy\Alcohol 120\StarWind\StarWindService.exe

Silent Runners:

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““D:\Programy\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “sysemls” = “C:\WINDOWS\system32\sysem.exe” [null data] “jon315” = “C:\WINDOWS\system32\ssrvc.exe” [null data] “ml34” = “C:\WINDOWS\system32\mlm4.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “msvcc25” = “svcchost.exe” [null data] “mysvcig38” = “mysvcc.exe” [null data] “sysemls” = “C:\WINDOWS\system32\sysem.exe” [null data] “jon315” = “C:\WINDOWS\system32\ssrvc.exe” [null data] “ml34” = “C:\WINDOWS\system32\mlm4.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\001\ {++} “bfurunonceex” = “||C:\fixwareout\SUB\BFU.exe C:\fixwareout\SUB\XP-2K2.bfu” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = “flashget urlcatch” -> {HKLM…CLSID} = “FGCatchUrl” \InProcServer32(Default) = “D:\Programy\FlashGet\jccatch.dll” [“www.flashget.com”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”]

report.txt

Fixwareout Last edited 1/27/2007 Post this report in the forums please … Prerun check »»»»» HKLM run and Winlogon System values C:\WINDOWS\system32\kddpr.exe will be moved to C:\WINDOWS\temp\kddpr.ren at reboot. »»»»» System restarted … Reg Entries that were deleted … Random Runs removed from HKLM … PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names… »»»»» Search five digit cs, dm kd and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal Other suspects. »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool. »»»»» Postrun check »»»»» HKLM run »»»»» Winlogon System value “system”="" »»»»» »»»»» Current runs [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “msvcc25”=“svcchost.exe” “mysvcig38”=“mysvcc.exe” “sysemls”=“C:\WINDOWS\system32\sysem.exe” “jon315”=“C:\WINDOWS\system32\ssrvc.exe” “ml34”=“C:\WINDOWS\system32\mlm4.exe” [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE”

[Gutek]

Fafik1987 nie pisz, jak się nie orientujesz w temacie

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Nie zostało zrobione to co napisał Joan powtórz instrukcję i daj nowe logi Silenta ucięty