Problem z instalacja HijackThis

siloos · 28 Wrzesień 2007 13:36

czesc zlapalem jakiegos wirusa i chcialem wstawic logi na forum ale podczas uruchamiania programu HijackThis wyskakuje mi takie okienko:

http://www.imagehosting.com/show.php/11 … d.bmp.html

Wirus powoduje przekirowanie z linkow na strony np erotyczne. Uruchamiam google wpisuje haslo wikipedia i jak chce wejsc na link ktory google mi wyswietla przelancza mnie na zupelnie inna strone z reklamami. Zainstalowalem firefoxa ale to nic nie pomoglo. Dodatkowo kolo zegarka pojawila mi sie dziwna ikonka telefonu “Motorola SM56 Modem Helper” w dodaj usun programy odszukalem ten program ale nie moge go usunac gdyz za kazdym razem on wraca na nowo. Prosze o pomoc i z gory dziekuje

arekmalek · 28 Wrzesień 2007 13:52

daj log z combofix (temat przyklejony)

lub wyprobuj wczesniejsza wersje hijacka

jessica · 28 Wrzesień 2007 13:54

Nie masz tego Modemu Motoroli?

Ściągnij inną wersję Hijacka -->http://www.searchengines.pl/phpbb203/pliki/picasso/virus/tools/hijackthis.com

Bo “w ciemno” nie da się nic doradzić.

jessi

siloos · 28 Wrzesień 2007 14:10

co do medemu to nie wiem bo to nie moj komputer tylko znajomego.

zadna wersja hijacka nie dziala ciagle wyskakuje ten blad.

combofix zawiesil caly komp. Czego jeszcze moge sprobowac ?

arekmalek · 28 Wrzesień 2007 14:11

spróbuj Sdfix i DSS.

DSS - http://cybertrash.pl/images/tata/ComboS … oScan.html

SdFix - http://cybertrash.pl/images/tata/SDFix.html

siloos · 28 Wrzesień 2007 14:26

log z dss

Deckard’s System Scanner v20070905.67 Run by Jack&Debbie on 2007-09-28 15:13:35 Computer is in Normal Mode. -------------------------------------------------------------------------------- – System Restore -------------------------------------------------------------- Successfully created a Deckard’s System Scanner Restore Point. – Last 5 Restore Point(s) – 48: 2007-09-28 14:13:46 UTC - RP322 - Deckard’s System Scanner Restore Point 47: 2007-09-27 13:52:48 UTC - RP321 - System Checkpoint 46: 2007-09-26 11:53:53 UTC - RP320 - Removed iTunes 45: 2007-09-26 11:43:36 UTC - RP319 - Removed Virtual Earth 3D (Beta) 44: 2007-09-26 11:31:47 UTC - RP318 - Removed EPSON Web-To-Page – First Restore Point – 1: 2007-08-21 12:42:43 UTC - RP275 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 495 MiB (512 MiB recommended). – HijackThis (run as Jack&Debbie.exe) ----------------------------------------- Unable to find log (file not found); running clone. – HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-09-28 15:19:33 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16512) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\explorer.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\soundman.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\vsnpstd3.exe C:\Program Files\QuickTime\QTTask.exe C:\WINDOWS\sm56hlpr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\camtool\VideoMonitor\CamTool.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Media Center Diagnostic Kit\Tests\Bin\ehMonitor.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\ehome\ehmsas.exe C:\WINDOWS\system32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jack&Debbie\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/en-gb/srchasst/srchasst.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/8SE/1?http://toolbar.m … sgrInstall R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll O4 - HKEY_LOCAL_MACHINE…\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKEY_LOCAL_MACHINE…\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKEY_LOCAL_MACHINE…\Run: [soundMan] SOUNDMAN.EXE O4 - HKEY_LOCAL_MACHINE…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKEY_LOCAL_MACHINE…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKEY_LOCAL_MACHINE…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKEY_LOCAL_MACHINE…\Run: [avgnt] “C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min O4 - HKEY_LOCAL_MACHINE…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” O4 - HKEY_LOCAL_MACHINE…\Run: [ZoneAlarm Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKEY_LOCAL_MACHINE…\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKEY_LOCAL_MACHINE…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKEY_LOCAL_MACHINE…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKEY_LOCAL_MACHINE…\Run: [MsgCenterExe] “C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe” -osboot O4 - HKEY_LOCAL_MACHINE…\Run: [sMSERIAL] sm56hlpr.exe O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: camtool.lnk = C:\Program Files\camtool\VideoMonitor\CamTool.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by117fd.bay117.hotmail.msn.com/r … nPUpld.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/fl … rashim.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/s … wflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip…{5489D44E-89F9-45F8-A6C3-C2554F4BF712}: NameServer = 85.255.115.26,85.255.112.218 O17 - HKLM\SYSTEM\CCS\Services\Tcpip…{5DC95C4D-D22B-45F2-A002-2F880380D36C}: NameServer = 85.255.115.26,85.255.112.218 O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.26 85.255.112.218 O17 - HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.26 85.255.112.218 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.26 85.255.112.218 O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\system32\ O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - “C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe” – File Associations ----------------------------------------------------------- All associations okay. – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 prohlp02 (StarForce Protection Helper Driver v2) - c:\windows\system32\drivers\prohlp02.sys R0 prosync1 (StarForce Protection Synchronization Driver v1) - c:\windows\system32\drivers\prosync1.sys R0 sfhlp01 (StarForce Protection Helper Driver) - c:\windows\system32\drivers\sfhlp01.sys R1 avgio - c:\program files\antivir personaledition classic\avgio.sys R1 prodrv06 (StarForce Protection Environment Driver v6) - c:\windows\system32\drivers\prodrv06.sys R1 StarOpen - c:\windows\system32\drivers\staropen.sys R3 avgntflt - c:\program files\antivir personaledition classic\avgntflt.sys R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys S3 o1394bul - c:\docume~1\jack&d~1\locals~1\temp\o1394bul.sys (file missing) – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - c:\program files\antivir personaledition classic\sched.exe – Device Manager: Disabled ---------------------------------------------------- No disabled devices found. – Files created between 2007-08-28 and 2007-09-28 ----------------------------- 2007-09-28 14:25:26 0 d-------- C:\Program Files\Trend Micro 2007-09-26 12:48:16 0 d-------- C:\WINDOWS\pss 2007-09-26 12:38:46 0 d-------- C:\Documents and Settings\Jack&Debbie\Application Data\URSoft 2007-09-26 12:38:43 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-26 12:38:40 0 d-------- C:\Program Files\Your Uninstaller 2006 2007-09-26 12:19:50 1156 --a------ C:\WINDOWS\mozver.dat 2007-09-26 12:18:05 0 --a------ C:\WINDOWS\nsreg.dat 2007-09-26 12:17:52 0 d-------- C:\Documents and Settings\Jack&Debbie\Application Data\Mozilla 2007-09-21 14:09:12 0 d-------- C:\Program Files\MarBit 2007-09-21 14:08:22 0 d-------- C:\Program Files\Real Alternative 2007-09-21 14:08:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Real 2007-09-20 13:02:54 0 d-------- C:\Program Files\BitComet 2007-09-18 15:57:21 0 d-------- C:\Program Files\Kalendarz XP 2007-09-18 13:23:16 0 d-------- C:\Program Files\INTERIAPL 2007-09-05 13:44:08 0 d-------- C:\Program Files\Dream Aquarium – Find3M Report --------------------------------------------------------------- 2007-09-28 15:03:18 0 d-------- C:\Documents and Settings\Jack&Debbie\Application Data\Skype 2007-09-26 13:02:59 0 d-------- C:\Program Files\Google 2007-09-26 12:54:56 0 d-------- C:\Program Files\Yahoo! 2007-09-26 12:51:44 0 d-------- C:\Program Files\SatelliteTVforPC 2007-09-26 12:44:26 0 d-------- C:\Program Files\Common Files 2007-09-26 12:40:35 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-09-26 12:40:35 0 d-------- C:\Program Files\CyberLink 2007-09-26 12:35:19 0 d-------- C:\Program Files\EPSON 2007-09-26 12:25:10 0 d-------- C:\Program Files\Winamp 2007-09-25 21:51:49 44062 --a------ C:\Documents and Settings\Jack&Debbie\Application Data\wklnhst.dat 2007-09-21 14:07:57 0 d-------- C:\Program Files\Common Files\Real 2007-09-21 14:07:34 0 d-------- C:\Documents and Settings\Jack&Debbie\Application Data\Real 2007-08-28 10:10:16 0 d-------- C:\Program Files\Lx_cats 2007-08-27 19:29:46 0 d-------- C:\Program Files\DVDDecrypter 2007-08-27 18:50:38 0 d-------- C:\Documents and Settings\Jack&Debbie\Application Data\Ahead 2007-08-27 17:44:11 0 d-------- C:\Program Files\Ahead 2007-08-27 17:40:34 0 d-------- C:\Program Files\Common Files\Ahead 2007-08-11 11:42:26 0 d-------- C:\Program Files\Java – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ehTray”=“C:\WINDOWS\ehome\ehtray.exe” [2005-08-06 05:56] “Recguard”=“C:\WINDOWS\SMINST\RECGUARD.EXE” [2002-09-13 21:42] “SoundMan”=“SOUNDMAN.EXE” [2006-03-01 23:22 C:\WINDOWS\soundman.exe] “igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” [2005-09-20 17:35] “igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” [2005-09-20 17:32] “igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” [2005-09-20 17:36] “avgnt”=“C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” [2006-03-29 13:54] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [2007-07-12 04:00] “ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-03-09 00:02] “snpstd3”=“C:\WINDOWS\vsnpstd3.exe” [2005-01-14 11:00] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “MsgCenterExe”=“C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe” [] “SMSERIAL”=“sm56hlpr.exe” [2005-06-06 10:40 C:\WINDOWS\sm56hlpr.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-10 20:00] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-10-13 18:20] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 15:36] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ camtool.lnk - C:\Program Files\camtool\VideoMonitor\CamTool.exe [2007-04-16 21:16:30] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “InstallVisualStyle”=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles “InstallTheme”=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] “System”=“kdcdl.exe” – End of Deckard’s System Scanner: finished at 2007-09-28 15:20:34 ------------

Deckard’s System Scanner v20070905.67 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- – System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel® Pentium® D CPU 2.80GHz CPU 1: Intel® Pentium® D CPU 2.80GHz Percentage of Memory in Use: 70% Physical Memory (total/avail): 494.48 MiB / 147.92 MiB Pagefile Memory (total/avail): 1154.24 MiB / 745.49 MiB Virtual Memory (total/avail): 2047.88 MiB / 1946.17 MiB C: is Fixed (NTFS) - 143.67 GiB total, 117.96 GiB free. D: is CDROM (No Media) E: is Removable (No Media) F: is Removable (No Media) G: is Removable (No Media) H: is Removable (No Media) \.\PHYSICALDRIVE0 - WDC WD1600BB-00RDA0 - 149.05 GiB - 2 partitions \PARTITION0 - Unknown - 5.38 GiB \PARTITION1 (bootable) - Installable File System - 143.67 GiB - C: \.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device \.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device \.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device \.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device – Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. FirstRunDisabled is set. FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.) AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Outdated [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" “C:\Program Files\MSN Messenger\msnmsgr.exe”=“C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1” “C:\Program Files\MSN Messenger\livecall.exe”=“C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)” [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" “C:\Program Files\Media Center Diagnostic Kit\MCDiag.exe”=“C:\Program Files\Media Center Diagnostic Kit\MCDiag.exe:*:Enabled:Media Center Diagnostic Tool” “C:\Program Files\Media Center Diagnostic Kit\MCEHostRemote.exe”=“C:\Program Files\Media Center Diagnostic Kit\MCEHostRemote.exe:*:Enabled:Media Center Scripting Host” “C:\Program Files\Messenger\msmsgs.exe”=“C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger” “C:\Program Files\MSN Messenger\msnmsgr.exe”=“C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1” “C:\Program Files\MSN Messenger\livecall.exe”=“C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)” “C:\Program Files\Skype\Phone\Skype.exe”=“C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype” – Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Jack&Debbie\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=YOUR-FA15F1C2F7 ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Jack&Debbie LOGONSERVER=\YOUR-FA15F1C2F7 NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;“C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier”;C:\Program Files\Samsung\Samsung PC Studio 3;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 7, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0407 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\JACK&D~1\LOCALS~1\Temp TMP=C:\DOCUME~1\JACK&D~1\LOCALS~1\Temp tvdumpflags=8 USERDOMAIN=YOUR-FA15F1C2F7 USERNAME=Jack&Debbie USERPROFILE=C:\Documents and Settings\Jack&Debbie windir=C:\WINDOWS – User Profiles --------------------------------------------------------------- Jack&Debbie (admin) Administrator (admin) Guest (guest) – Add/Remove Programs --------------------------------------------------------- – Application Event Log ------------------------------------------------------- Event Record #/Type380 / Warning Event Submitted/Written: 09/28/2007 03:03:21 PM Event ID/Source: 4113 / H+BEDV AntiVir Event Description: AntiVir has detected ‘TR/Drop.L.hx.20.E.1’ into the file C:\Documents and Settings\Jack&Debbie\Desktop\ComboFix.exe Event Record #/Type379 / Warning Event Submitted/Written: 09/28/2007 03:02:50 PM Event ID/Source: 4113 / H+BEDV AntiVir Event Description: AntiVir has detected ‘TR/Drop.L.hx.20.E.1’ into the file C:\Documents and Settings\Jack&Debbie\Desktop\ComboFix.exe Event Record #/Type377 / Warning Event Submitted/Written: 09/28/2007 03:02:29 PM Event ID/Source: 4113 / H+BEDV AntiVir Event Description: AntiVir has detected ‘TR/Drop.L.hx.20.E.1’ into the file C:\Documents and Settings\Jack&Debbie\Desktop\ComboFix.exe Event Record #/Type375 / Warning Event Submitted/Written: 09/28/2007 02:58:03 PM Event ID/Source: 4113 / H+BEDV AntiVir Event Description: AntiVir has detected ‘TR/Drop.L.hx.20.E.1’ into the file C:\Documents and Settings\Jack&Debbie\Desktop\ComboFix.exe Event Record #/Type374 / Warning Event Submitted/Written: 09/28/2007 02:57:48 PM Event ID/Source: 4113 / H+BEDV AntiVir Event Description: AntiVir has detected ‘TR/Drop.L.hx.20.E.1’ into the file C:\Documents and Settings\Jack&Debbie\Desktop\ComboFix.exe – Security Event Log ---------------------------------------------------------- No Errors/Warnings found. – System Event Log ------------------------------------------------------------ Event Record #/Type25207 / Error Event Submitted/Written: 09/28/2007 03:02:44 PM Event ID/Source: 7000 / Service Control Manager Event Description: The Genesis Crossbar service failed to start due to the following error: %%1058 Event Record #/Type25206 / Error Event Submitted/Written: 09/28/2007 03:02:44 PM Event ID/Source: 7000 / Service Control Manager Event Description: The Genesis InfraRed service failed to start due to the following error: %%1058 Event Record #/Type25205 / Error Event Submitted/Written: 09/28/2007 03:02:44 PM Event ID/Source: 7000 / Service Control Manager Event Description: The Genesis BDA Transport Capture service failed to start due to the following error: %%1058 Event Record #/Type25204 / Error Event Submitted/Written: 09/28/2007 03:02:44 PM Event ID/Source: 7000 / Service Control Manager Event Description: The Genesis Video Capture service failed to start due to the following error: %%1058 Event Record #/Type25195 / Warning Event Submitted/Written: 09/28/2007 00:52:07 PM Event ID/Source: 4226 / Tcpip Event Description: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. – End of Deckard’s System Scanner: finished at 2007-09-28 15:20:34 ------------

jessica · 28 Wrzesień 2007 15:16

Masz ukraińską infekcję czyli Rootkit “Windows Security Center”.

Użyj -->FixWareout

Po jego użyciu może zajść potrzeba ustawiania od nowa DNS Twojego dostawcy internetowego.

–>Jak przywrócić prawidłowe DNS.

Potem, jeśli HijackThis będzie już działał, to sfiksuj te w/w wpisy:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

I napisz, jak sytuacja.

jessi