Problem z reklamami + log

False · 18 Czerwiec 2007 19:44

Mam problem z reklamami. Brat coś dzisiaj ściągnął i wyskakują samoczynnie reklamy i przy zegarze widnieją nowe ikonki z wyświetlającymi się chmurkami

Logfile of HijackThis v1.99.1 Scan saved at 21:41:23, on 2007-06-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Video ActiveX Access\iesmn.exe C:\Program Files\Video ActiveX Access\imsmain.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Video ActiveX Access\imsmn.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Video ActiveX Access\iesmin.exe D:\Sony\Picture Package Menu\SonyTray.exe D:\Sony\Picture Package Applications\Residence.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe D:\Konnekt\konnekt.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe D:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {CDE8EAB9-CEF3-4885-B12F-26960A25C800} - C:\Program Files\Video ActiveX Access\iesplg.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Video ActiveX Access\iesbpl.dll (file missing) O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - Global Startup: Picture Package Menu.lnk = D:\Sony\Picture Package Menu\SonyTray.exe O4 - Global Startup: Picture Package VCD Maker.lnk = D:\Sony\Picture Package Applications\Residence.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVKProxy - Unknown owner - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe (file missing) O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\G DATA\AntiVirus 2007\AVK\AVKService.exe (file missing) O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\G DATA\AntiVirus 2007\AVK\AVKWCtl.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

qrczak13 · 18 Czerwiec 2007 20:43

Zastosuj SimtFraudFix, opcja 2 w trybie awaryjnym.

Po wykonaniu w/w daj log z ComboFix + zawartość pliku c:\rapport.txt

False · 18 Czerwiec 2007 21:45

SimtFraudFix pomógł Wrzucam log z ComboFix i plik rapport.txt:

ComboFix 07-06-13.7 - C:\Documents and Settings\Majk\Pulpit\ComboFix.exe “Majk” - 2007-06-18 23:40:04 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-18 to 2007-06-18 ))))))))))))))))))))))))))))))) 2007-06-18 23:39 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-18 23:34 540 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-18 23:33 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-06-18 23:33 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-06-18 23:33 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-06-18 12:27 2007-06-18 11:35 2007-06-17 18:32 2007-06-13 20:44 2007-05-30 10:02 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-05-30 07:40 2007-05-21 23:59 2007-05-21 23:58 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-18 15:44:48 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\foobar2000 2007-06-10 20:42:51 2,764 ----a-w C:\WINDOWS\mozver.dat 2007-06-10 10:48:16 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\Skype 2007-06-09 06:02:06 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\uTorrent 2007-06-06 18:46:54 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\OpenOffice.ux.pl2 2007-05-30 05:40:24 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-30 20:25:53 -------- d-----w C:\Program Files\Trymedia 2007-04-29 18:17:50 967 ----a-w C:\WINDOWS\ScUnin.pif 2007-04-29 18:17:50 94,208 ----a-w C:\WINDOWS\ScUnin.exe 2007-04-29 18:17:50 26,094 ----a-w C:\WINDOWS\scunin.dat 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-22 17:11:59 -------- d-----w C:\Program Files\Sony Corporation 2007-04-22 17:11:47 -------- d-----w C:\Program Files\Common Files\muvee Technologies 2007-04-20 07:15:41 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2007-04-20 07:15:41 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2007-04-20 07:15:41 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-03-26 16:22:39 4 ----a-w C:\WINDOWS\system32\proc-1605931354.bin 2007-03-26 13:13:25 509,644 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-26 13:13:25 100,892 ----a-w C:\WINDOWS\system32\perfc015.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 04:23] {CDE8EAB9-CEF3-4885-B12F-26960A25C800}=C:\Program Files\Video ActiveX Access\iesplg.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2006-01-12 16:40] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [2006-12-15 04:23] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-11-16 20:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”=“D:\Programy!\Optymalizacja\SuperAntiSpyrware\SASSEH.DLL” [2006-12-20 13:55] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“D:\Programy!\Optymalizacja\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Picture Package VCD Maker.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Picture Package VCD Maker.lnk backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Majk^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.1.lnk] path=C:\Documents and Settings\Majk\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.1.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.1.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] “D:\Programy!\Optymalizacja\AVG Anti-Spyware 7.5\avgas.exe” /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVKTray] “C:\Program Files\G DATA\AntiVirus 2007\AVKTray\AVKTray.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “D:\DAEMON Tools\daemon.exe” -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] D:\FlashGet\Flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “D:\Gadu-Gadu\gg.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] “d:\tibia\steam\steam.exe” -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] D:\Programy!\Optymalizacja\SuperAntiSpyrware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] D:\Winamp\winampa.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\Setupx.exe

rapport:

SmitFraudFix v2.195 Scan done at 23:34:06,42, 2007-06-18 Run from C:\Documents and Settings\Majk\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] “{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}”=“farrandly” [HKEY_CLASSES_ROOT\CLSID{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}\InProcServer32] @=“C:\WINDOWS\system32\tczij.dll” [HKEY_LOCAL_MACHINE\Software\Classes\CLSID{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}\InProcServer32] @=“C:\WINDOWS\system32\tczij.dll” »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\tczij.dll - Hoax.Win32.Renos.gen.o C:\WINDOWS\system32\tczij.dll - Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\ALLUSE~1\MENUST~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\MENUST~1\Security Troubleshooting.url Deleted C:\DOCUME~1\Majk\Ulubione\Online Security Test.url Deleted C:\Program Files\Video ActiveX Access\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS1\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS2\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS3\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End Złączono Posta: 18.06.2007 (Pon) 23:46 SimtFraudFix pomógł Wrzucam log z ComboFix i plik rapport.txt: ComboFix 07-06-13.7 - C:\Documents and Settings\Majk\Pulpit\ComboFix.exe “Majk” - 2007-06-18 23:40:04 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-18 to 2007-06-18 ))))))))))))))))))))))))))))))) 2007-06-18 23:39 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-18 23:34 540 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-18 23:33 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-06-18 23:33 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-06-18 23:33 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-06-18 12:27 2007-06-18 11:35 2007-06-17 18:32 2007-06-13 20:44 2007-05-30 10:02 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-05-30 07:40 2007-05-21 23:59 2007-05-21 23:58 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-18 15:44:48 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\foobar2000 2007-06-10 20:42:51 2,764 ----a-w C:\WINDOWS\mozver.dat 2007-06-10 10:48:16 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\Skype 2007-06-09 06:02:06 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\uTorrent 2007-06-06 18:46:54 -------- d-----w C:\DOCUME~1\Majk\DANEAP~1\OpenOffice.ux.pl2 2007-05-30 05:40:24 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-30 20:25:53 -------- d-----w C:\Program Files\Trymedia 2007-04-29 18:17:50 967 ----a-w C:\WINDOWS\ScUnin.pif 2007-04-29 18:17:50 94,208 ----a-w C:\WINDOWS\ScUnin.exe 2007-04-29 18:17:50 26,094 ----a-w C:\WINDOWS\scunin.dat 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-22 17:11:59 -------- d-----w C:\Program Files\Sony Corporation 2007-04-22 17:11:47 -------- d-----w C:\Program Files\Common Files\muvee Technologies 2007-04-20 07:15:41 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2007-04-20 07:15:41 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2007-04-20 07:15:41 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-03-26 16:22:39 4 ----a-w C:\WINDOWS\system32\proc-1605931354.bin 2007-03-26 13:13:25 509,644 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-26 13:13:25 100,892 ----a-w C:\WINDOWS\system32\perfc015.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 04:23] {CDE8EAB9-CEF3-4885-B12F-26960A25C800}=C:\Program Files\Video ActiveX Access\iesplg.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2006-01-12 16:40] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [2006-12-15 04:23] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-11-16 20:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”=“D:\Programy!\Optymalizacja\SuperAntiSpyrware\SASSEH.DLL” [2006-12-20 13:55] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“D:\Programy!\Optymalizacja\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Picture Package VCD Maker.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Picture Package VCD Maker.lnk backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Majk^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.1.lnk] path=C:\Documents and Settings\Majk\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.1.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.1.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] “D:\Programy!\Optymalizacja\AVG Anti-Spyware 7.5\avgas.exe” /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVKTray] “C:\Program Files\G DATA\AntiVirus 2007\AVKTray\AVKTray.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “D:\DAEMON Tools\daemon.exe” -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] D:\FlashGet\Flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “D:\Gadu-Gadu\gg.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] “d:\tibia\steam\steam.exe” -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] D:\Programy!\Optymalizacja\SuperAntiSpyrware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] D:\Winamp\winampa.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\Setupx.exe rapport: SmitFraudFix v2.195 Scan done at 23:34:06,42, 2007-06-18 Run from C:\Documents and Settings\Majk\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] “{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}”=“farrandly” [HKEY_CLASSES_ROOT\CLSID{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}\InProcServer32] @=“C:\WINDOWS\system32\tczij.dll” [HKEY_LOCAL_MACHINE\Software\Classes\CLSID{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}\InProcServer32] @=“C:\WINDOWS\system32\tczij.dll” »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\tczij.dll - Hoax.Win32.Renos.gen.o C:\WINDOWS\system32\tczij.dll - Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\ALLUSE~1\MENUST~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\MENUST~1\Security Troubleshooting.url Deleted C:\DOCUME~1\Majk\Ulubione\Online Security Test.url Deleted C:\Program Files\Video ActiveX Access\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS1\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS2\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS3\Services\Tcpip…{EBB6B7C7-537C-4BB0-A4AF-7FBF76E934DF}: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=195.177.196.123 195.177.196.125 195.177.196.3 195.177.196.1 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End

qrczak13 · 18 Czerwiec 2007 21:58

Do notatnika wklej:

Plik > zapisz jako > zmień rozszerzenie z .txt na wszystkie pliki > zapisz pod nazwą Fix.reg np na

pulpicie > dwuklik na Fix.reg > potwierdzasz > restart.

Log z combo ucięty. Wklej cały.