Pomocy

Dla specjalistów Bezpieczeństwo
#1

Nie wiem co jest, ale przy wył. komputera pojawil sie komunikat ze jest pare osob zalogowanych na tym komputerze i wyłączenie go spowoduje utratę danych… a przy właczaniu kompytera pojawia sie komunikat ze antywirus jest wyłaczony ( a zaraz pozniej sam sie włacza i wszystko gra). Nie mam pojęcia o co moze tu chodzic? Z góry dziękuje

#2

usuwanie, użyj FxIstbar.exe.

EWIDO dokonaj scanowania po zrobieniu update - http://www.ewido.net/en/

możesz dac screena

#3

Gutek, jakiego screena?

Dzięki za sprawdzenie loga. Ewido znalazl sporo robactwa tylko nie da się tego usunąć…

#4

Zrób scren gdy pokaze Ci się ten komunikat informujący, że jest “pare osob zalogowanych na tym komputerze i wyłączenie go spowoduje utratę danych…”.

Scren robi się naciskając klawisz PrintScren (ten klawisz jest nad strzałkami). Klawisz ten nacisnij jak pokaze Ci się ten komunikat potem wejdź do jakieś programu graficznego np. Painta i kliknij CTRL+V wtedy wklei się obrazek i potem Plik>>Zapisz jako>>Zapisz to na dysku.

Potem wejdź na http://www.fotosik.pl i zamiesc tam obrazek. Pokaże Ci się strona z linkiem do obrazka. Ten link zamieść w tresci posta na forum.

#5

niestety juz tego komunikatu nie bylo, a przed chwila sam sie komputer wylaczyl (tak jakby ktos to za mnie zrobil). Czyli nie wiem, to jakis haker? co mam zrobic? POMÓŻCIE

#6

daj log z silenta

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable. Po użyciu tego narzędzia wymagany jest reset sysa.

#7

zainstalowałam Kerio. Teraz robię loga na Silencie, tylko jak mialo sie to wykonywac, to wyskakiwalo okienko ze srypt jest niebezpieczny, wiec zezwolilam na jednorazowe uruchomienie skryptu całego. Zaraz będzie log

Złączono Posta : 04.03.2006 (Sob) 22:44

“Silent Runners.vbs”, revision 43, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

“Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“ccApp” = ““C:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“AcctMgr” = “C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup” [“Symantec Corporation”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [“Symantec Corporation”]

“RemoteControl” = ““C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”]

“NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”]

“MMTray” = ““C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe”” [“Musicmatch, Inc.”]

“mmtask” = ““C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe”” [“Musicmatch Inc.”]

“TkBellExe” = ““realsched.exe” -osboot” [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = “Yahoo! Toolbar Helper” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

{AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = “Google Toolbar Helper” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”]

{BDF3E430-B101-42AD-A544-FADC6B084872}(Default) = “CNavExtBho Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll” [“Symantec Corporation”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania”

-> {CLSID}\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”]

“{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS]

“{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Media Player Classic\rpshell.dll” [“RealNetworks, Inc.”]

“{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS]

“{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS]

“{73B24247-042E-4EF5-ADC2-42F62E6FD654}” = “ICQ Lite Shell Extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ICQ-PL\ICQLiteShell.dll” [empty string]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

“{21569614-B795-46b1-85F4-E737A8DC09AD}” = “Shell Search Band”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS]

“{E0D79304-84BE-11CE-9641-444553540000}” = “WinZip”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

“{E0D79305-84BE-11CE-9641-444553540000}” = “WinZip”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

“{E0D79306-84BE-11CE-9641-444553540000}” = “WinZip”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

“{E0D79307-84BE-11CE-9641-444553540000}” = “WinZip”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

“{C1728FC8-0162-4827-85B0-8420B5B20263}” = “All Converter”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\1stbenison\All Converter\CMExt.dll” [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! “{54D9498B-CF93-414F-8984-8CE7FDE0D391}” = “ewido shell guard”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\shellhook.dll” ["TODO: "]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”]

ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ICQ-PL\ICQLiteShell.dll” [empty string]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido anti-malware\context.dll” [“ewido networks”]

ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ICQ-PL\ICQLiteShell.dll” [empty string]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\WINZIP\WZSHLSTB.DLL” [“WinZip Computing LP”]

Active Desktop and Wallpaper:

Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\

“Wallpaper” = “C:\Documents and Settings\USER\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:

HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS]

Startup items in “USER” & “All Users” startup folders:

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart

“hp psc 1000 series” -> shortcut to: “C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe” [“Hewlett-Packard Co.”]

“hpoddt01.exe” -> shortcut to: “C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe” [“Hewlett-Packard”]

Enabled Scheduled Tasks:

“FRU Task #Hewlett-Packard#hp psc 1200 series#1117808980” -> launches: "C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe -I “#Hewlett-Packard#hp psc 1200 series#1117808980"” [empty string]

“Funkcja One Button Checkup pakietu Norton SystemWorks” -> launches: “C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE” [“Symantec Corporation”]

“Norton AntiVirus - Skanuj komputer - USER” -> launches: “C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.EXE /task:“C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”]

“Norton AntiVirus - Skanuj komputer” -> launches: “C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /task:“C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”]

“Symantec Drmc” -> launches: “C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe /CUSTOM /SCHEDULE” [null data]

“Symantec NetDetect” -> launches: “C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE” [“Symantec Corporation”]

Winsock2 Service Provider DLLs:

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll” [“Symantec Corporation”]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”]

“{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}” = “&SearchBar” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL” [file not found]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “Yahoo! Toolbar” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll” [“Symantec Corporation”]

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”]

“{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “Yahoo! Toolbar” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”]

Explorer Bars

Dormant Explorer Bars in “View, Explorer Bar” menu

HKLM\Software\Classes\CLSID{0494D0DE-F8E0-41AD-92A3-14154ECE70AC}\ = “SearchBar Quick View”

Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32(Default) = “C:\WINDOWS\system32\shdocvw.dll” [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):

ewido security suite control, ewido security suite control, “C:\Program Files\ewido anti-malware\ewidoctrl.exe” [“ewido networks”]

ewido security suite guard, ewido security suite guard, “C:\Program Files\ewido anti-malware\ewidoguard.exe” [“ewido networks”]

Norton Unerase Protection, NProtectService, “C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE” [“Symantec Corporation”]

SAVScan, SAVScan, ““C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe”” [“Symantec Corporation”]

SecuROM User Access Service (V7), UserAccess7, “C:\WINDOWS\system32\UAService7.exe” [“Sony DADC Austria AG.”]

Speed Disk service, Speed Disk service, “C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE” [“Symantec Corporation”]

Symantec Event Manager, ccEvtMgr, ““C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”]

Symantec Settings Manager, ccSetMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”]

SymWMI Service, SymWSC, ““C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe”” [“Symantec Corporation”]

Usługa Auto Protect programu Norton AntiVirus, navapsvc, ““C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe”” [“Symantec Corporation”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS]

Print Monitors:

HKLM\System\CurrentControlSet\Control\Print\Monitors\

hpzsnt07\Driver = “hpzsnt07.dll” [“HP”]

Monitor 2 języka BJ\Driver = “CNBJMON2.DLL” [MS]

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • The search for DESKTOP.INI DLL launch points on all local fixed drives

took 152 seconds.

  • The search for all Registry CLSIDs containing dormant Explorer Bars

took 45 seconds.

---------- (total run time: 326 seconds)

Złączono Posta : 04.03.2006 (Sob) 23:04

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable. Po użyciu tego narzędzia wymagany jest reset sysa.