Nie działają mi przeglądarki i GG. (log)


(Mmierski) #1


(Bbieniol) #2

Usuń Hijackiem te wpisy:

Wyczyść folder TEMP (w trybie awaryjnym), czyli Start --> uruchom --> cmd i wpisujesz:

Po zabiegach nowy log z Hijacka + log z Silent Runners


(Mmierski) #3


(Bbieniol) #4

Czysto :slight_smile:

Gdzie log z Silenta?


(Mmierski) #5

Miałep problemy z ściąganiem tego Silenta. Sorki!! Ale wielkie dzięki za pomoc. Sprobuje to dzisiaj ściągnąć jeszcze raz.

Złączono Posta : 09.11.2006 (Czw) 16:11

Nie moge ściągnąć Silenta. Jak klikne na link to wyskakuje mi okno w którym jest tekst o Silencie:

'Silent Runners.vbs -- find out what starts up with Windows!

'(compatible with Windows 95/98/Millennium/NT 4.0/2000 Pro/XP Home & Pro/Vista RC1)

'

'DO NOT REMOVE THIS HEADER!

'

'Copyright Andrew ARONOFF 11 October 2006, http://www.silentrunners.org/

'This script is provided without any warranty, either express or implied

'It may not be copied or distributed without permission

'

'** YOU RUN THIS SCRIPT AT YOUR OWN RISK! ** (END OF HEADER)

Option Explicit

Dim strRevNo : strRevNo = "49"

Public flagTest : flagTest = False 'True if in testing mode

'flagTest = True 'Uncomment to put in testing mode

Public arSecTest : arSecTest = Array() 'array of section numbers to test

Public intSection : intSection = 0 'section counter

'This script is divided into 28 sections.

'malware launch points:

' registry keys (1-12, 15)

' INI/INF-files (16-18)

' folders (19)

' enabled scheduled tasks (20)

' Winsock2 service provider DLLs (21)

' IE toolbars, explorer bars, extensions (22)

' started services (26)

' keyboard driver filters (27)

' printer monitors (28)

'hijack points:

' System/Group Policies (14)

' prefixes for IE URLs (23)

' misc IE points (24)

' HOSTS file (25)

'Output is suppressed if deemed normal unless the -all parameter is used

'Section XVIII is skipped unless the -supp/-all parameters are used or

'the first message box is answered "No" and the next message box "Yes"

' 1. HKCU/HKLM... Run/RunOnce/RunOnce\Setup/RunOnceEx

' HKLM... RunServices/RunServicesOnce

' HKCU/HKLM... Policies\Explorer\Run

' 2. HKLM... Active Setup\Installed Components\

' HKCU... Active Setup\Installed Components\

' (StubPath <> "" And HKLM version # > HKCU version #)

' 3. HKLM... Explorer\Browser Helper Objects\

' 4. HKLM... Shell Extensions\Approved\

' 5. HKLM... Explorer\SharedTaskScheduler/ShellExecuteHooks

' 6. HKCU/HKLM... ShellServiceObjectDelayLoad\

' 7. HKCU/HKLM... Command Processor\AutoRun

' HKCU... Policies\System\Shell (W2K/WXP/WVa only)

' HKCU... Windows\load & run

' HKLM... Windows\AppInit_DLLs

' HKCU/HKLM... Winlogon\Shell

' HKLM... Winlogon\Userinit, System, Ginadll, Taskman

' HKLM... Control\SafeBoot\Option\UseAlternateShell

' HKLM... Control\SecurityProviders\SecurityProviders

' HKLM... Control\Session Manager\BootExecute

' HKLM... Control\Session Manager\WOW\cmdline, wowcmdline

' 8. HKLM... Winlogon\Notify\ (subkey names/DLLName values <> O/S-specific dictionary data)

' 9. HKLM... Image File Execution Options ("Debugger" subkeys)

'10. HKCU/HKLM... Policies... Startup/Shutdown, Logon/Logoff scripts (W2K/WXP/WXP)

'11. HKCU/HKLM Protocols\Filter

'12. Context menu shell extensions

'13. HKCU/HKLM executable file type (bat/cmd/com/exe/hta/pif/scr)

'14. System/Group Policies

'15. Enabled Wallpaper & Screen Saver

'16. WIN.INI (load/run <> ""), SYSTEM.INI (shell <> explorer.exe, scrnsave.exe), WINSTART.BAT

'17. AUTORUN.INF in root directory of local fixed disks

'18. DESKTOP.INI in any local fixed disk directory (section skipped by default)

'19. %WINDIR%... Startup & All Users... Startup (W98/WMe) or

' %USERNAME%... Startup & All Users... Startup folder contents

'20. Enabled Scheduled Tasks

'21. Winsock2 Service Provider DLLs

'22. Internet Explorer Toolbars, Explorer Bars, Extensions

'23. Internet Explorer URL Prefixes

'24. Misc. IE Hijack Points

'25. HOSTS file

'26. Started Services

'27. Keyboard Driver Filters

'28. Print Monitors

Dim Wshso : Set Wshso = WScript.CreateObject("WScript.Shell")

Dim WshoArgs : Set WshoArgs = WScript.Arguments

Dim intErrNum, intMB, intMB1 'Err.Number, MsgBox return value x 2

Dim strflagTest : strflagTest = ""

If flagTest Then

strflagTest = "TEST "

Wshso.Popup "Silent Runners is in testing mode.",1, _

"Testing, testing, 1-2-3...", vbOKOnly + vbExclamation

End If

'Configuration Detection Section

' FileSystemObject creation error (112)

' CScript/WScript (147)

' Dim (161)

' GetFileVersion(WinVer.exe) (VBScript 5.1) (182)

' OS version (223)

' WMI (279)

' Dim (364)

' command line arguments (440)

' supplementary search MsgBox (532)

' startup MsgBox (557)

' CreateTextFile error (583)

' output file header (625)

' WXP SP2 (629)

Co mam z tym zrobić??


(Bbieniol) #6

To nie jest log, który nas interesuje. Zapoznaj się dokładnie z tym tematem -> http://forum.dobreprogramy.pl/viewtopic.php?t=36654 i wygeneruj loga według instrukcji :slight_smile:


(Mmierski) #7

Za nic nie moge go ściągnąć (Silenta). Klikam na link i wyskakuje mi pełno tekstu a i nic więcej:(


(Bbieniol) #8

Na link klikasz prawym przycieskiem myszy -> zapisz element docelowy jako -> zapisujesz :slight_smile:

Dalej postępujesz według instrukcji :slight_smile:


(Mmierski) #9

Prosze sprawdzić link do progranu "Silent Runners". Poniewarz prowadzi on do Pliku tekstowego "notatnik".