Problem z trojanem

pioter4583 · 1 Sierpień 2008 17:22

mam dwa tysiace wirusow na minute proboje usonac anti wirus awast prz kazdym usonieciu dodaje nastepne wirusy wysylam log

Logfile of HijackThis v1.99.1

Scan saved at 19.18.53, on 01/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

C:\Programmi\Alwil Software\Avast4\ashServ.exe

C:\Programmi\HPQ\IAM\bin\asghost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Programmi\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe

C:\Programmi\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE

C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Programmi\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SMINST\Scheduler.exe

C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\WINDOWS\System32\svchost.exe

C:\Programmi\File comuni\LightScribe\LSSrvc.exe

C:\Programmi\Logitech\Video\LogiTray.exe

C:\Programmi\Canon\MyPrinter\BJMyPrt.exe

C:\Programmi\Winamp\winampa.exe

C:\Programmi\iTunes\iTunesHelper.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\SPYWAREfighter\spftray.exe

C:\WINDOWS\system32\lphcgqvj0e329.exe

C:\Programmi\rhclqvj0e329\rhclqvj0e329.exe

C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Programmi\Logitech\Video\FxSvr2.exe

C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

C:\Programmi\Skype\Phone\Skype.exe

C:\Programmi\Winamp Remote\bin\OrbTray.exe

C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

C:\Programmi\Windows Media Player\WMPNSCFG.exe

C:\documents and settings\alicetuttoincluso\impostazioni locali\dati applicazioni\mokok.exe

C:\Programmi\iPod\bin\iPodService.exe

C:\Programmi\SPYWAREfighter\spfprc.exe

C:\Programmi\Skype\Plugin Manager\skypePM.exe

C:\Programmi\Java\jre1.6.0_05\bin\jucheck.exe

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Documents and Settings\alicetuttoincluso\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.msn.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.c0m.it?pg=SP

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1 … BuJUK3qW4L

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.virgilio.it/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programmi\Winamp Toolbar\winamptb.dll

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programmi\Winamp Toolbar\winamptb.dll

O2 - BHO: XBTP06568 - {311F9DE8-6126-4EEE-B15F-65CBB3B4F9F6} - C:\Programmi\AOL Security Toolbar\tbu403\AOL_security_toolbar.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll

O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll

O3 - Toolbar: AOL Security Toolbar - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - C:\Programmi\AOL Security Toolbar\tbu403\AOL_security_toolbar.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programmi\Winamp Toolbar\winamptb.dll

O4 - HKLM…\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM…\Run: [soundMAXPnP] C:\Programmi\Analog Devices\Core\smax4pnp.exe

O4 - HKLM…\Run: [soundMAX] C:\Programmi\Analog Devices\SoundMAX\Smax4.exe /tray

O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe”

O4 - HKLM…\Run: [PTHOSTTR] C:\Programmi\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start

O4 - HKLM…\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM…\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM…\Run: [synTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM…\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

O4 - HKLM…\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule

O4 - HKLM…\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM…\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe

O4 - HKLM…\Run: [WatchDog] C:\Programmi\InterVideo\DVD Check\DVDCheck.exe

O4 - HKLM…\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe

O4 - HKLM…\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe

O4 - HKLM…\Run: [scheduler] C:\WINDOWS\SMINST\Scheduler.exe

O4 - HKLM…\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM…\Run: [LogitechVideoRepair] C:\Programmi\Logitech\Video\ISStart.exe

O4 - HKLM…\Run: [LogitechVideoTray] C:\Programmi\Logitech\Video\LogiTray.exe

O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM…\Run: [CanonSolutionMenu] C:\Programmi\Canon\SolutionMenu\CNSLMAIN.exe /logon

O4 - HKLM…\Run: [CanonMyPrinter] C:\Programmi\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKLM…\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe

O4 - HKLM…\Run: [QuickTime Task] “C:\Programmi\QuickTime\qttask.exe” -atboottime

O4 - HKLM…\Run: [iTunesHelper] “C:\Programmi\iTunes\iTunesHelper.exe”

O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM…\Run: [RegistryMechanic] C:\Programmi\Registry Mechanic\RegMech.exe /QS

O4 - HKLM…\Run: [spywarefighterguard] C:\Programmi\SPYWAREfighter\spftray.exe

O4 - HKLM…\Run: [lphcgqvj0e329] C:\WINDOWS\system32\lphcgqvj0e329.exe

O4 - HKLM…\Run: [sMrhclqvj0e329] C:\Programmi\rhclqvj0e329\rhclqvj0e329.exe

O4 - HKLM…\Run: [spyware-Secure] C:\Programmi\Spyware-Secure\Spyware-Secure_trial.exe

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [RSS Reader] “C:\Programmi\RSS Reader\RSSReader.exe”

O4 - HKCU…\Run: [LogitechSoftwareUpdate] C:\Programmi\Logitech\Video\ManifestEngine.exe boot

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programmi\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [AliceMessenger] C:\Programmi\Alice Messenger\alicemessenger.exe

O4 - HKCU…\Run: [bitTorrent DNA] “C:\Programmi\DNA\btdna.exe”

O4 - HKCU…\Run: [bitTorrent] “C:\Programmi\BitTorrent\bittorrent.exe” --force_start_minimized

O4 - HKCU…\Run: [skype] “C:\Programmi\Skype\Phone\Skype.exe” /nosplash /minimized

O4 - HKCU…\Run: [Orb] “C:\Programmi\Winamp Remote\bin\OrbTray.exe” /background

O4 - HKCU…\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe

O4 - HKCU…\Run: [mokok] c:\documents and settings\alicetuttoincluso\impostazioni locali\dati applicazioni\mokok.exe mokok

O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dati applicazioni\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?8b3832d5309347638a5374784f92b3c6

O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?8b3832d5309347638a5374784f92b3c6

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra ‘Tools’ menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

O15 - Trusted Zone: *.archiviosex.net

O15 - Trusted Zone: *.otherchance.com

O15 - Trusted Zone: *.whatsnew.name

O17 - HKLM\System\CCS\Services\Tcpip…{B1090CC0-1559-4909-AB71-DCCED64207AE}: NameServer = 85.37.17.16 85.38.28.68

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programmi\Windows Live\Mail\mailcomm.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O20 - Winlogon Notify: OneCard - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe

O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Programmi\SPYWAREfighter\spfprc.exe

Agaton · 1 Sierpień 2008 17:37

pioter4583 ,

W związku ze zmianą, jaka obowiązuje przy wklejaniu logów w tym dziale, przeczytaj i zastosuj się do Tematu

huber2t · 2 Sierpień 2008 04:17

Wyłącz i Włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Fix w hijackthis

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.c0m.it?pg=SP R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1 … BuJUK3qW4L R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.virgilio.it/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM…\Run: [lphcgqvj0e329] C:\WINDOWS\system32\lphcgqvj0e329.exe O4 - HKLM…\Run: [sMrhclqvj0e329] C:\Programmi\rhclqvj0e329\rhclqvj0e329.exe O4 - HKLM…\Run: [spyware-Secure] C:\Programmi\Spyware-Secure\Spyware-Secure_trial.exe O4 - HKCU…\Run: [AliceMessenger] C:\Programmi\Alice Messenger\alicemessenger.exe O4 - HKCU…\Run: [mokok] c:\documents and settings\alicetuttoincluso\impostazioni locali\dati applicazioni\mokok.exe mokok O15 - Trusted Zone: *.archiviosex.net O15 - Trusted Zone: *.otherchance.com O15 - Trusted Zone: *.whatsnew.name

Pobierz ComboFix, ale nie uruchamiaj

Otwórz notatnik i wklej do niego:

File::

C:\WINDOWS\system32\lphcgqvj0e329.exe

c:\documents and settings\alicetuttoincluso\impostazioni locali\dati applicazioni\mokok.exe


Folder::

C:\Programmi\rhclqvj0e329

C:\Programmi\Spyware-Secure

Plik -> zapisz jako -> CFScript.txt.

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

Logi dajesz na http://wklejto.pl lub na http://wklej.org a w poście dajesz tylko link