Log mojego braciszka

Kiepas · 12 Luty 2005 16:55

Właśnie robie bratu porzadki na kopie… poniżej zapodaje loga, widze że bedzie tu troszke roboty.

Logfile of HijackThis v1.99.0 Scan saved at 17:54:27, on 12-02-2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe C:\PROGRA~1\PESTPA~1\PPControl.exe C:\PROGRA~1\PESTPA~1\CookiePatrol.exe C:\PROGRA~1\PESTPA~1\PPMemCheck.exe C:\WINDOWS\system32\iemu.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Programy\ Foto exspres 4.0\CalCheck.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\Programy\Panda Antivirus\Firewall\PavFires.exe C:\Programy\Panda Antivirus\pavsrv51.exe C:\Programy\Panda Antivirus\AVENGINE.EXE C:\WINDOWS\ieod.exe C:\Programy\Panda Antivirus\apvxdwin.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Programy\Panda Antivirus\pavProxy.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\IVA&TOLEK\Pulpit\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {2A8AF1EF-EE13-821E-7C1B-7314624F9B91} - C:\WINDOWS\d3ij.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM…\Run: [CloneCDElbyCDFL] “C:\Programy\CloneCD\ElbyCheck.exe” /L ElbyCDFL O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM…\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM…\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM…\Run: [sCANINICIO] “C:\Programy\Panda Antivirus\Inicio.exe” O4 - HKLM…\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM…\Run: [iemu.exe] C:\WINDOWS\system32\iemu.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [ETD Security Scanner] “C:\Programy\ETD Security Scanner\ETD Security Scanner.exe” /s O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - Global Startup: Microsoft Office.lnk = C:\Programy\OFFICE XP\Office10\OSA.EXE O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Programy\ Foto exspres 4.0\CalCheck.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\Programy\OFFICE~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz używając Download &Express’a - C:\Programy\Download Express\Add_Url.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.awmdabest.com (HKLM) O15 - Trusted IP range: 206.161.125.149 O15 - Trusted IP range: (HKLM) O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/I … _EN_XP.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://D:\TOMEK\Auto Cad 2000LT\AcDcToday.ocx O16 - DPF: {8B936702-C234-40D0-B69C-A2F669A33978} - http://akamai.downloadv3.com/binaries/L … _EN_XP.cab O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://D:\TOMEK\Auto Cad 2000LT\InstFred.ocx O16 - DPF: {D22AC3EF-B7D8-11D5-A281-005056BF0101} (plug Class) - http://www.gxplugin.com/loader/dll/gxbplug.dll O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://D:\TOMEK\Auto Cad 2000LT\AcPreview.ocx O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} - http://akamai.downloadv3.com/binaries/I … _EN_XP.cab O17 - HKLM\System\CCS\Services\Tcpip…{CD161A9E-9301-4B87-AA57-9B1892523C59}: NameServer = 10.0.0.1 O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe (file missing) O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Firewall Service - Unknown - C:\Programy\Panda Antivirus\Firewall\PavFires.exe O23 - Service: Panda anti-virus service - Unknown - C:\Programy\Panda Antivirus\pavsrv51.exe O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing) O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\ieod.exe

stachan · 12 Luty 2005 17:00

:roll: wg mnie do usunięcia to:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056

R3 - Default URLSearchHook is missing

O4 - HKLM…\Run: [iemu.exe] C:\WINDOWS\system32\iemu.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll O15 - Trusted Zone: *.awmdabest.com

O15 - Trusted Zone: *.awmdabest.com (HKLM)

O15 - Trusted IP range: 206.161.125.149

O15 - Trusted IP range: (HKLM)

O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/I … _EN_XP.cab

O16 - DPF: {8B936702-C234-40D0-B69C-A2F669A33978} - http://akamai.downloadv3.com/binaries/L … _EN_XP.cab

O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} - http://akamai.downloadv3.com/binaries/I … _EN_XP.cab

O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe (file missing)

O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

ponadto SP2 dla IE

Kiepas · 12 Luty 2005 17:14

chyba SP 2 dla windows XP

musg · 12 Luty 2005 17:21

rowniez dla IE.

Shark · 12 Luty 2005 17:34

Wyłącz przywracanie systemu+Tryb Awaryjny

Searchy itp.

Kiepas:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vckca.dll/sp.html#15056 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - Default URLSearchHook is missing

Podejżliwe BHO:

Trojan

O4 - HKLM…\Run: [iemu.exe] C:\WINDOWS\system32\iemu.exe

Bug

Ściągasz LSP-Fix i usuwasz z niego aklsp

Usuń Trusted:

ActiveX (trochę ich dużo):

Warunki:

1.Tryb Awaryjny + Wyłączone przywracanie systemu

2.Usuwasz wszystko Co Ci wskazałem

3.Pamiętaj o LSP-Fix

4.Z trustedami poradzi sobie program KillTrusted - Przeskanuj nim.

5.Na koniec skany programami i skanerami:

http://www.forum.dobreprogramy.com/view … hp?t=17671

6.Zainstaluj wszystkie łatki z WindowsUpdate

7.Daj jeszcze raz log HijackThis