Fusher123
(Fusher Jacek)
28 Grudzień 2006 16:05
#1
Niedawno kliknałem na jeden link z gg ( chodzi o te podejrzane linki) i wiem ze to wirus więc prosze o sprawdzenie logów
Logfile of HijackThis v1.99.1 Scan saved at 17:06:57, on 2006-12-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE G:\programy\AVAST\aswUpdSv.exe G:\programy\AVAST\ashServ.exe G:\programy\bluesolei\BTNtService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe G:\programy\AVAST\ashDisp.exe G:\programy\hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe G:\programy\daemon\DAEMON Tools\daemon.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe G:\programy\hp\Digital Imaging\Unload\hpqcmon.exe G:\programy\hp\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Gadu-Gadu\gg.exe G:\programy\bluesolei\BlueSoleil.exe G:\programy\hp\Digital Imaging\bin\hpqtra08.exe G:\programy\hp\HP Share-to-Web\hpgs2wnf.exe G:\programy\AVAST\ashMaiSv.exe G:\programy\AVAST\ashWebSv.exe G:\programy\hp\Digital Imaging\Bin\hpqSTE08.exe G:\programy\hp\Digital Imaging\Product Assistant\bin\hprblog.exe c:\program files\common files\installshield\updateservice\isuspm.exe C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Jacek\Pulpit\dla pauliny\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - G:\programy\FLASHGET\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - G:\programy\FLASHGET\fgiebar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM…\Run: [soltek] C:\WINDOWS\system32\autorun.exe O4 - HKLM…\Run: [avast!] G:\programy\AVAST\ashDisp.exe O4 - HKLM…\Run: [HP Software Update] “G:\programy\hp\HP Software Update\HPWuSchd2.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” O4 - HKLM…\Run: [CnxDslTaskBar] “C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852” O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [DAEMON Tools] “G:\programy\daemon\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [NvMediaCenter] “RUNDLL32.EXE” C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM…\Run: [iSUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start O4 - HKLM…\Run: [CorelDRAW Graphics Suite 11b] G:\programy\Cores suite\Languages\PL\Programs\Registration.exe /title=“CorelDRAW Graphics Suite 12” /date=010507 serial=DR12WRS-8796594-FHE lang=PL O4 - HKLM…\Run: [CamMonitor] G:\programy\hp\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM…\Run: [share-to-Web Namespace Daemon] G:\programy\hp\HP Share-to-Web\hpgs2wnd.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [bitComet] “G:\programy\BitComet\BitComet.exe” O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\programy\hp\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - G:\programy\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - G:\programy\FlashGet\jc_all.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\programy\FLASHGET\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\programy\FLASHGET\flashget.exe O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://megapanel.gem.pl/WebInstaller.dll O17 - HKLM\System\CCS\Services\Tcpip…{0BAEA3B3-2815-407F-B598-E95E1AD0977D}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - G:\programy\AVAST\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - G:\programy\AVAST\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - G:\programy\AVAST\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - G:\programy\AVAST\ashWebSv.exe" /service (file missing) O23 - Service: BlueSoleil Hid Service - Unknown owner - G:\programy\bluesolei\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
I jeszcze mam pytanie: jak moge sprawdzić, jakim programem czy nie mam na kompie przypadkiem jakiegos keyloggera.
adam9870
(adam9870)
28 Grudzień 2006 16:17
#2
Log czysty.
Kosmetycznie ciachnij:
Pozamykaj porty robakom. W tym celu użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.
Fusher123
(Fusher Jacek)
28 Grudzień 2006 16:18
#3
ok dzieki! A co tam jeszcze co do tego keyloggera ? Czym to sprawdzić i ewentualnie usunac ??
adam9870
(adam9870)
28 Grudzień 2006 16:25
#4
Obecnie programy antywirusowe są na takim poziomie, że nie trzeba instalować osobnych programów przeznaczonych do usuwania trojanów, keylogerów etc. ponieważ programy AV w większości sobie z tym radzą.
Z tego co wiem np. AVG Anti-Spyware umożliwia wykrywanie keylogerów.
Fusher123
(Fusher Jacek)
28 Grudzień 2006 16:32
#5
dobra rozumiem. i ostatnie pytanie : vchociaz gdzies to widziałem to nie moge znaleźć: Jak usunać
“O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)”
Program KillBox jakoś nie chce tego zrobić bo wyskakuje mi błąd
“PendingFileRenameOperations Registry Data has been Removed by ExternalProcess!”
Złączono Posta : 28.12.2006 (Czw) 17:33
dobra rozumiem. i ostatnie pytanie : vchociaz gdzies to widziałem to nie moge znaleźć: Jak usunać
“O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)”
Program KillBox jakoś nie chce tego zrobić bo wyskakuje mi błąd
“PendingFileRenameOperations Registry Data has been Removed by ExternalProcess!”
Bieniol
(Bbieniol)
28 Grudzień 2006 16:34
#6
Odpalasz Hijacka -> Do a system scan only i zaznaczasz wpis i klikasz na dole Fix Checked
Fusher123
(Fusher Jacek)
28 Grudzień 2006 16:36
#7
oo dziekuje za wszystkie inf :d i zycze szczęśliwego nowego roku
Złączono Posta : 28.12.2006 (Czw) 18:41
no tak przeskanowałem komputer programem AVG Anti-Spyware wyskoczyło 166 zainfekowanych obiektów a teraz jak to usunac tzn jak usunac te adware, 3 trojany i 1 backdoor. Koło każdego pisze “Ignore once” ale nie ma delete albo cos w tym stylu …
adam9870
(adam9870)
28 Grudzień 2006 19:15
#8
Wklej raport ze skanowania AVG.
Fusher123
(Fusher Jacek)
28 Grudzień 2006 19:23
#9
już mi sie udało wiekszosc skasowac ale po restarcie z powrotem wyskoczyło mi że mam 8 zarażonych obiektów (w tabeli SCAN są wyswietlone: Backdoor.Sturf, Trojan.Delf.bcg, Trojan.Agent.ye, oraz jakieś Adwaer save now) jak to skasowac jak już niby było delete a znowu sie pojawiło :|, log zaraz wkleje jak tylko sie skanowanie skonczy.
Złączono Posta : 28.12.2006 (Czw) 20:30
Złączono Posta : 28.12.2006 (Czw) 20:32
Jak ten syf usunac ??
Bieniol
(Bbieniol)
28 Grudzień 2006 21:50
#10
Wyłącz na chwilkę przywracanie systemu:
Panel sterowania -> System -> Przywracanie systemu
Tam zaznacz opcję Turn off System Restore lub Turn off System Restore on all drives (Wyłącz przywracanie na wszystkich dyskach). Zatwierdzasz wszystkie zmiany.
Fusher123
(Fusher Jacek)
29 Grudzień 2006 21:57
#11
A tak dla pewnosci ściągnałem jeszcze SilentRunner’a wiec wklejam logi (ponoc SR jest dokładniejszy niż HijackThis)
“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “BitComet” = ““G:\programy\BitComet\BitComet.exe”” [“www.BitComet.com ”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Soltek” = “C:\WINDOWS\system32\autorun.exe” [null data] “avast!” = “G:\programy\AVAST\ashDisp.exe” [null data] “HP Software Update” = ““G:\programy\hp\HP Software Update\HPWuSchd2.exe”” [“Hewlett-Packard Co.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “CnxDslTaskBar” = "“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852"” [“Conexant Systems, Inc.”] “WOOWATCH” = “C:\PROGRA~1\NEOSTR~1\Watch.exe” [“France Télécom R&D”] “WOOTASKBARICON” = “C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [“France Télécom R&D”] “NvCplDaemon” = “RUNDLL32.EXE NvQTwk,NvCplDaemon initialize” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “DAEMON Tools” = ““G:\programy\daemon\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] “NvMediaCenter” = ““RUNDLL32.EXE” C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] “ISUSPM Startup” = “C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup” [“InstallShield Software Corporation”] “ISUSScheduler” = ““C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start” [“InstallShield Software Corporation”] “CorelDRAW Graphics Suite 11b” = “G:\programy\Cores suite\Languages\PL\Programs\Registration.exe /title=“CorelDRAW Graphics Suite 12” /date=010507 serial=DR12WRS-8796594-FHE lang=PL” [“Corel Corporation”] “CamMonitor” = “G:\programy\hp\Digital Imaging\Unload\hpqcmon.exe” [empty string] “Share-to-Web Namespace Daemon” = “G:\programy\hp\HP Share-to-Web\hpgs2wnd.exe” [“Hewlett-Packard”] “!AVG Anti-Spyware” = ““G:\programy\AV\AVG Anti-Spyware 7.5\avgas.exe” /minimized” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = (no title provided) -> {HKLM…CLSID} = “IeCatch5 Class” \InProcServer32(Default) = “G:\programy\FLASHGET\jccatch.dll” [“FlashGet”] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}(Default) = (no title provided) -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” [“MegaUpload”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “G:\programy\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “G:\programy\AVAST\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “G:\programy\winrar\rarext.dll” [null data] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Eksplorator pulpitów” -> {HKLM…CLSID} = “Eksplorator pulpitów” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] “{A4DF5659-0801-4A60-9607-1C48695EFDA9}” = “Folder przesyłania Share-to-Web” -> {HKLM…CLSID} = “Folder przesyłania Share-to-Web” \InProcServer32(Default) = “G:\programy\hp\HP Share-to-Web\HPGS2WNS.DLL” [“Hewlett-Packard”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “G:\programy\AV\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “G:\programy\AVAST\ashShell.dll” [“ALWIL Software”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “G:\programy\AV\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “G:\programy\winrar\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “G:\programy\AV\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “G:\programy\winrar\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “G:\programy\AVAST\ashShell.dll” [“ALWIL Software”] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “G:\programy\winrar\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Jacek\Dane aplikacji\Mozilla\Firefox\Desktop Background.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\sstext3d.scr” [MS] Startup items in “Jacek” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “BlueSoleil” -> shortcut to: “G:\programy\bluesolei\BlueSoleil.exe” [“IVT Corporation”] “HP Digital Imaging Monitor” -> shortcut to: “G:\programy\hp\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” [“MegaUpload”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{E0E899AB-F487-11D5-8D29-0050BA6940E3}” = “FlashGet Bar” -> {HKLM…CLSID} = “FlashGet Bar” \InProcServer32(Default) = “G:\programy\FLASHGET\fgiebar.dll” [“Amaze Soft”] “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” = (no title provided) -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” [“MegaUpload”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ “ButtonText” = “FlashGet” “MenuText” = “&FlashGet” “Exec” = “G:\programy\FLASHGET\flashget.exe” [“FlashGet.com ”] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““G:\programy\AVAST\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““G:\programy\AVAST\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““G:\programy\AVAST\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““G:\programy\AVAST\ashWebSv.exe” /service” [“ALWIL Software”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “G:\programy\AV\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] BlueSoleil Hid Service, BlueSoleil Hid Service, “G:\programy\bluesolei\BTNtService.exe” [null data] NVIDIA Driver Helper Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] hpzlnt12\Driver = “hpzlnt12.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 136 seconds, including 20 seconds for message boxes)
adam9870
(adam9870)
29 Grudzień 2006 21:59
#12
Czysto.
Czy udało Ci się już usunąć szkodniki z folderu System Volume Information ?? Jeśli nie to wyłącz przywracanie systemu >>> przeskanuj na nowo AVG i powinien je usunąć.
Fusher123
(Fusher Jacek)
29 Grudzień 2006 22:02
#13
udalo sie dziś rano znów skanowałem komuter i jest czyściutki dziekuje za wszelką pomoc
Gutek
(Gutek)
29 Grudzień 2006 23:06
#14
Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ
Pozdrawiam Gutek2222
Fusher123
(Fusher Jacek)
30 Grudzień 2006 11:05
#15
Tytuł temaytu zmieniony. Nastepnym razem już dobrze napisze tytuł tematu.