PROSZE O POMOC - hacked by

wojtekd · 30 Kwiecień 2007 15:57

Mam nadzieję ze pomozecie - Problem chyba Wam znany - hacked by godzilla i niemoznosc otwierania partycji dwuklikiem. prosze o w miare najczytelniejsze ibnstrukcje coz mam robic. tu log z hijack - mam nadzieje ze dobrze go wygenerowalem.

Logfile of HijackThis v1.99.1 Scan saved at 17:27:40, on 2007-04-30 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\devldr32.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\wojtek d\Ustawienia lokalne\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe C:\Program Files\WinRAR\WinRAR.exe C:\Program Files\Winamp\Winamp.exe G:\programy=Kodeki=\XviD_Install.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\WOJTEK~1\USTAWI~1\Temp\A~NSISu_.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com?fref=149133 (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

Joan · 30 Kwiecień 2007 17:10

usun wpisy

wlącza się wyszukiwanie, kiedy chcesz otwierać dysk? jeśli tak, to otwórz notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive] @=“Dysk” “EditFlags”=dword:000001d2 “BrowserFlags”=dword:00000008 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\DefaultIcon] @=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,73,\ 68,65,6c,6c,33,32,2e,64,6c,6c,2c,38,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find] “SuppressionPolicy”=dword:00000080 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command] @=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,45,78,70,6c,6f,72,65,72,2e,65,\ 78,65,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\ddeexec] @="[FindFolder("%l", %I)]" “NoActivateHandler”="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\ddeexec\application] @=“Folders” [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\ddeexec\topic] @=“AppProperties” [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Offline Files] @="{750fdf0e-2a26-11d1-a3ea-080036587f03}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Sharing] @="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers{59099400-57FF-11CE-BD94-0020AF85B590}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers{fbeb8a05-beee-4442-804e-409d6c4515e9}] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions{fbeb8a05-beee-4442-804e-409d6c4515e9}] @="" “DriveMask”=dword:00000020 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers\Sharing] @="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{1F2E5C40-9550-11CE-99D2-00AA006E086C}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{596AB062-B4D2-4215-9F74-E9109B0A8153}] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{7988B573-EC89-11cf-9C00-00AA00A14F56}] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{fbeb8a05-beee-4442-804e-409d6c4515e9}] @="" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\Drive] @=“Dysk” “EditFlags”=hex:d2,01,00,00 [HKEY_CLASSES_ROOT\Drive\DefaultIcon] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\ 65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,38,00,00,00 [HKEY_CLASSES_ROOT\Drive\shell] @=“none” [HKEY_CLASSES_ROOT\Drive\shell\find] “SuppressionPolicy”=dword:00000080 [HKEY_CLASSES_ROOT\Drive\shell\find\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,\ 65,00,00,00 [HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec] @="[FindFolder("%l", %I)]" “NoActivateHandler”="" [HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec\application] @=“Folders” [HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec\topic] @=“AppProperties”

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa

wojtekd · 30 Kwiecień 2007 19:10

PO usunięciu wpisów rzeczywioscie zniknęła ta choilerna godzilla - nadal jednak nie moge otwierac dysków dwuklikiem. Pokazuje sie windowsowski komunikat: "Nie można znaleźć pliku skryoptu “E:]MS32DLL.dll.vbs”

Obecny log wygląda następująco :

Logfile of HijackThis v1.99.1 Scan saved at 21:08:14, on 2007-04-30 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\wojtek d\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

matio · 30 Kwiecień 2007 19:53

Tu i tu masz opisany podobny problem

adam9870 · 30 Kwiecień 2007 20:23

Log czysty, ale ze względu na:

użyj ComboFix. Uruchom go => naciśnij klawisz Y => czekaj cierpliwie i powinien być log w formie pliku .txt o nazwie combofix na partycji C, którego proszę tu pokazać.

Monczkin · 1 Maj 2007 13:04

Nazwij temat konkretnie.