Problem z trojanami

fiolka89 · 5 Wrzesień 2007 18:42

HijackThisa

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:06:33, on 05.09.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\ups.exe C:\WINDOWS\explorer.exe C:\Programme\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\vsnpstd2.exe C:\Programme\QuickTime\qttask.exe C:\Programme\BearShare\BearShare.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\Programme\MSN Messenger\MsnMsgr.Exe C:\Programme\Messenger\msmsgs.exe C:\Programme\TaskSwitchXP\TaskSwitchXP.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\MessengerDiscovery\MessengerDiscovery Live.exe C:\Programme\Wireless\IEEE802.11g WLAN USB Adapter\DrFVnet.exe C:\WINDOWS\system32\taskmgr.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Java\jre1.6.0_01\bin\jucheck.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programme\Share_Accelerator_MM\tbShar.dll F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {066A2CDC-319E-4460-BA45-C24562CD51AA} - C:\WINDOWS\system32\nnnoooo.dll O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll O2 - BHO: (no name) - {272525BB-E6C6-46CA-B6B9-3E1FDB4D75F3} - (no file) O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programme\Share_Accelerator_MM\tbShar.dll O2 - BHO: (no name) - {686611EE-3595-4CD3-986D-03BE9E5A47A9} - C:\WINDOWS\system32\vtsqn.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {91846CE6-23D5-419F-BDC6-8CB7E47639CC} - (no file) O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\tepkfgtp.dll O2 - BHO: (no name) - {9773D61D-0529-4734-A882-F899F0E8798E} - (no file) O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programme\Share_Accelerator_MM\tbShar.dll O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Programme\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sNPSTD2] C:\WINDOWS\vsnpstd2.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Programme\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [bearShare] “C:\Programme\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [avgnt] “C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe” /min O4 - HKLM…\Run: [ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe O4 - HKLM…\Run: [AAWTray] C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKCU…\Run: [MsnMsgr] “C:\Programme\MSN Messenger\MsnMsgr.Exe” /background O4 - HKCU…\Run: [MSMSGS] “C:\Programme\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [TaskSwitchXP] C:\Programme\TaskSwitchXP\TaskSwitchXP.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programme\Gadu-Gadu\gg.exe” /tray O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘LOKALER DIENST’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘NETZWERKDIENST’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Wireless Compact USB Adapter Utility.lnk = C:\Programme\Wireless\IEEE802.11g WLAN USB Adapter\DrFVnet.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/a-U … E_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me … b56907.cab O20 - Winlogon Notify: jkklj - C:\WINDOWS\ O20 - Winlogon Notify: nnnoooo - C:\WINDOWS\SYSTEM32\nnnoooo.dll O20 - Winlogon Notify: pmkhf - C:\WINDOWS\ O20 - Winlogon Notify: vtsqn - C:\WINDOWS\system32\vtsqn.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe – End of file - 7743 bytes

SilentRunnersa

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “MsnMsgr” = ““C:\Programme\MSN Messenger\MsnMsgr.Exe” /background” [MS] “MSMSGS” = ““C:\Programme\Messenger\msmsgs.exe” /background” [MS] “TaskSwitchXP” = “C:\Programme\TaskSwitchXP\TaskSwitchXP.exe” [“Alexander Avdonin”] “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““C:\Programme\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SunJavaUpdateSched” = ““C:\Programme\Java\jre1.6.0_01\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “SNPSTD2” = “C:\WINDOWS\vsnpstd2.exe” [empty string] “QuickTime Task” = ““C:\Programme\QuickTime\qttask.exe” -atboottime” [“Apple Inc.”] “BearShare” = ““C:\Programme\BearShare\BearShare.exe” /pause” [“Free Peers, Inc.”] “avgnt” = ““C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe” /min” [“Avira GmbH”] “Ulead AutoDetector v2” = “C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe” [“Ulead Systems, Inc.”] “AAWTray” = “C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar Helper” \InProcServer32(Default) = “C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] {066A2CDC-319E-4460-BA45-C24562CD51AA}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nnnoooo.dll” [null data] {100EB1FD-D03E-47FD-81F3-EE91287F9465}(Default) = “ShoppingReport” -> {HKLM…CLSID} = “ShoppingReport” \InProcServer32(Default) = “C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll” [“ShopperReports”] {4596013b-6c31-408b-a266-deae5c086dc2}(Default) = (no title provided) -> {HKLM…CLSID} = “Share_Accelerator_MM toolbar” \InProcServer32(Default) = “C:\Programme\Share_Accelerator_MM\tbShar.dll” [“Conduit Ltd.”] {686611EE-3595-4CD3-986D-03BE9E5A47A9}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\vtsqn.dll” [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Programme\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] {9030D464-4C02-4ABF-8ECC-5164760863C6}(Default) = (no title provided) -> {HKLM…CLSID} = “Windows Live Sign-in Helper” \InProcServer32(Default) = “C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll” [MS] {938A8A03-A938-4019-B764-03FF8D167D79}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\tepkfgtp.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “CPL-Erweiterung für Anzeigeverschiebung” -> {HKLM…CLSID} = “CPL-Erweiterung für Anzeigeverschiebung” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Erweiterung für HyperTerminal-Icons” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}” = “Messenger Sharing Folders” -> {HKLM…CLSID} = “Meine freigegebenen Ordner” \InProcServer32(Default) = “C:\Programme\MSN Messenger\fsshext.8.1.0178.00.dll” [MS] “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” = “Shell Extension for Malware scanning” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Programme\AntiVir PersonalEdition Classic\shlext.dll” [“Avira GmbH”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programme\WinRAR\rarext.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{066A2CDC-319E-4460-BA45-C24562CD51AA}” = “*b” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nnnoooo.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“lsdelete” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> nnnoooo\DLLName = “nnnoooo.dll” [null data] <> vtsqn\DLLName = “C:\WINDOWS\system32\vtsqn.dll” [null data] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Programme\AntiVir PersonalEdition Classic\shlext.dll” [“Avira GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programme\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programme\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning(Default) = “{45AC2688-0253-4ED8-97DE-B5370FA7D48A}” -> {HKLM…CLSID} = “Shell Extension for Malware scanning” \InProcServer32(Default) = “C:\Programme\AntiVir PersonalEdition Classic\shlext.dll” [“Avira GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programme\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Dokumente und Einstellungen\Izabela\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\ssstars.scr” [MS] Startup items in “Izabela” & “All Users” startup folders: --------------------------------------------------------- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart “Wireless Compact USB Adapter Utility” -> shortcut to: “C:\Programme\Wireless\IEEE802.11g WLAN USB Adapter\DrFVnet.exe” [“Wireless”] Enabled Scheduled Tasks: ------------------------ “AppleSoftwareUpdate” -> launches: “C:\Programme\Apple Software Update\SoftwareUpdate.exe -Task” [“Apple Computer, Inc.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “C:\Programme\Bonjour\mdnsNSP.dll” [“Apple Computer, Inc.”] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” -> {HKLM…CLSID} = “Yahoo! Toolbar mit Pop-Up-Blocker” \InProcServer32(Default) = “C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] “{4596013B-6C31-408B-A266-DEAE5C086DC2}” -> {HKLM…CLSID} = “Share_Accelerator_MM toolbar” \InProcServer32(Default) = “C:\Programme\Share_Accelerator_MM\tbShar.dll” [“Conduit Ltd.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar mit Pop-Up-Blocker” \InProcServer32(Default) = “C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] “{4596013B-6C31-408B-A266-DEAE5C086DC2}” = “Share Accelerator MM Toolbar” -> {HKLM…CLSID} = “Share_Accelerator_MM toolbar” \InProcServer32(Default) = “C:\Programme\Share_Accelerator_MM\tbShar.dll” [“Conduit Ltd.”] Explorer Bars HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\ {A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}(Default) = (no title provided) -> {HKLM…CLSID} = “ShopperReports” \InProcServer32(Default) = “C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll” [“ShopperReports”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Konsole” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Programme\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Programme\Java\jre1.6.0_01\bin\npjpi160_01.dll” [“Sun Microsystems, Inc.”] {C5428486-50A0-4A02-9D20-520B59A9F9B2}\ “ButtonText” = “ShopperReports - Compare product prices” “CLSIDExtension” = “{C9CCBB35-D123-4a31-AFFC-9B2933132116}” -> {HKLM…CLSID} = “IEButton” \InProcServer32(Default) = “C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll” [“ShopperReports”] {C5428486-50A0-4A02-9D20-520B59A9F9B3}\ “ButtonText” = “ShopperReports - Compare travel rates” “CLSIDExtension” = “{A16AD1E9-F69A-45af-9462-B1C286708842}” -> {HKLM…CLSID} = “IEButtonA” \InProcServer32(Default) = “C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll” [“ShopperReports”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Programme\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = “*b” (unwritable string) -> {HKLM…CLSID} = “Yahoo! Toolbar mit Pop-Up-Blocker” \InProcServer32(Default) = “C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] <> “{4596013b-6c31-408b-a266-deae5c086dc2}” = (no title provided) -> {HKLM…CLSID} = “Share_Accelerator_MM toolbar” \InProcServer32(Default) = “C:\Programme\Share_Accelerator_MM\tbShar.dll” [“Conduit Ltd.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, “C:\Programme\Bonjour\mDNSResponder.exe” [“Apple Computer, Inc.”] Ad-Aware 2007 Service, aawservice, ““C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe”” [“Lavasoft AB”] AntiVir PersonalEdition Classic Guard, AntiVirService, ““C:\Programme\AntiVir PersonalEdition Classic\avguard.exe”” [“Avira GmbH”] AntiVir PersonalEdition Classic Scheduler, AntiVirScheduler, ““C:\Programme\AntiVir PersonalEdition Classic\sched.exe”” [“Avira GmbH”] ---------- (launch time: 2007-09-05 19:13:02) <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 89 seconds. ---------- (total run time: 319 seconds)

Gutek · 5 Wrzesień 2007 18:46

Najpierw automaty:

Użyj w trybie awaryjnym VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Daj log z ComboFix

A oto opis jak się znaleźć w trybie awaryjnym:

pr0odlogow · 5 Wrzesień 2007 18:53

Gutek2222 i ty mówisz że sie znasz?

Żadnego vundo dunto nie ma

Nie słuchaj gutka piz*****

Patrz:

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {066A2CDC-319E-4460-BA45-C24562CD51AA} - C:\WINDOWS\system32\nnnoooo.dll O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Programme\ShoppingReport\Bin\2.0.21\ShoppingReport.dll O2 - BHO: (no name) - {272525BB-E6C6-46CA-B6B9-3E1FDB4D75F3} - (no file) O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programme\Share_Accelerator_MM\tbShar.dll O2 - BHO: (no name) - {686611EE-3595-4CD3-986D-03BE9E5A47A9} - C:\WINDOWS\system32\vtsqn.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {91846CE6-23D5-419F-BDC6-8CB7E47639CC} - (no file) O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\tepkfgtp.dll O2 - BHO: (no name) - {9773D61D-0529-4734-A882-F899F0E8798E} - (no file)

FIX

Proszę nie sugerować się tym postem

Pozdrawiam Gutek2222

Gutek · 5 Wrzesień 2007 18:57

pr0odlogow - do widzenia :evil:

Dla potomnych np.: z Silent i HJT

2.- Virus Scan Alert. (C:\WINDOWS\system32\vtsqn.dll Vundo, fail remove)

Ban nie za obrazę tylko głupoty

jeszcze chwila i poleciałby cały system