Prosze o sprawdzenie loga i pomoc

Aleksander88 · 11 Lipiec 2006 11:18

Logfile of HijackThis v1.99.1 Scan saved at 13:17:33, on 2006-07-11 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Sygate\SPF\smc.exe E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\Explorer.EXE E:\Program Files\MKS\Bin\mksmonsv.exe E:\WINDOWS\SOUNDMAN.EXE E:\Program Files\QuickTime\qttask.exe E:\Program Files\MKS\Bin\mks_menu.exe E:\Program Files\MKS\Bin\mks_mail.exe E:\WINDOWS\System32\ctfmon.exe E:\Program Files\Gadu-Gadu\gg.exe E:\WINDOWS\System32\RUNDLL32.EXE E:\Program Files\Messenger\msmsgs.exe C:\Program Files\SpySheriff\SpySheriff.exe E:\WINDOWS\System32\nvsvc32.exe E:\WINDOWS\System32\wuauclt.exe E:\Program Files\Internet Explorer\iexplore.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\cmd.exe E:\Program Files\Internet Explorer\iexplore.exe E:\DOCUME~1\Norak\USTAWI~1\Temp\Rar$EX00.281\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wisla.krakow.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [QuickTime Task] “E:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [sysTray] C:\Program Files\cwjx.exe O4 - HKLM…\Run: [MSConfig] E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM…\Run: [smcService] E:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM…\Run: [MKS_MENU] E:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [MailScanner] E:\Program Files\MKS\Bin\mks_mail.exe O4 - HKCU…\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU…\Run: [MSMSGS] “E:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - Global Startup: Menu mks_vir.lnk = E:\Program Files\MKS\Bin\mks_menu.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} - http://mks.com.pl/skaner/SkanerOnline.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - E:\Program Files\MKS\Bin\mksmonsv.exe O23 - Service: MkS_Scan - Unknown owner - E:\Program Files\MKS\Bin\mks_scan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - E:\Program Files\Sygate\SPF\smc.exe

Mam jakieś śmieci jeszcze , troche usunąlem ale z tym sobie nie moge poradzic. Spysherif pokazuje cos takiego (screen)

Tak to zostawic kompa bratu na pare dni…

system · 11 Lipiec 2006 11:24

Użyj tego narzędzia SmitFraudFix z ocji nr 2 (clean) i wynik usuwania wklej na forum. Pownno być na dysku c:\raport.txt

po wszytkim nowe logi hijackthis i silent runners opis jest TU.

Gutek · 11 Lipiec 2006 11:26

Zmień tytuł na konkretny

w trybie awaryjnym usuń plik i folder ręcznie

Aleksander88 · 11 Lipiec 2006 12:33

Zrobione , oto wyniki

SmitFraudFix v2.69 Scan done at 14:27:41,09, 2006-07-11 Run from E:\Documents and Settings\Norak\Moje dokumenty\Wilackie multimedia + piosenki\hj\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files E:\DOCUME~1\Norak\Pulpit\SpySheriff.lnk Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End “Silent Runners.vbs”, revision 46, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “E:\WINDOWS\System32\ctfmon.exe” [MS] “Gadu-Gadu” = ““E:\Program Files\Gadu-Gadu\gg.exe” /tray” [“sms-express.com”] “NvMediaCenter” = “RUNDLL32.EXE E:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit” [MS] “MSMSGS” = ““E:\Program Files\Messenger\msmsgs.exe” /background” [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “NvCplDaemon” = “RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “QuickTime Task” = ““E:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “MSConfig” = “E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto” [MS] “SmcService” = “E:\PROGRA~1\Sygate\SPF\smc.exe -startgui” [“Sygate Technologies, Inc.”] “MKS_MENU” = “E:\Program Files\MKS\Bin\mks_menu.exe” [empty string] “MailScanner” = “E:\Program Files\MKS\Bin\mks_mail.exe” [“MKS sp. z o. o.”] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““E:\WINDOWS\System32\rundll32.exe” “E:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” - {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” - {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “E:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” - {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “E:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “E:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” - {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “E:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” - {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “E:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” - {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “E:\Program Files\MKS\Bin\MkSShell.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” - {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “E:\Program Files\MKS\Bin\MkSShell.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “E:\Program Files\WinRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “E:\WINDOWS\System32\logon.scr” [MS] Startup items in “Norak” “All Users” startup folders: ------------------------------------------------------- E:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart “Menu mks_vir” - shortcut to: “E:\Program Files\MKS\Bin\mks_menu.exe” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ MkS_Vir Monitor, MksVirMonSvc, “E:\Program Files\MKS\Bin\mksmonsv.exe” [empty string] NVIDIA Display Driver Service, NVSvc, “E:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] Sygate Personal Firewall, SmcService, “E:\Program Files\Sygate\SPF\smc.exe” [“Sygate Technologies, Inc.”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer “No” at the first message box. ---------- (total run time: 57 seconds, including 5 seconds for message boxes) Logfile of HijackThis v1.99.1 Scan saved at 14:36:11, on 2006-07-11 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Sygate\SPF\smc.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\MKS\Bin\mksmonsv.exe E:\WINDOWS\System32\nvsvc32.exe E:\WINDOWS\SOUNDMAN.EXE E:\Program Files\QuickTime\qttask.exe E:\Program Files\MKS\Bin\mks_menu.exe E:\Program Files\MKS\Bin\mks_mail.exe E:\WINDOWS\System32\ctfmon.exe E:\Program Files\Gadu-Gadu\gg.exe E:\WINDOWS\System32\RUNDLL32.EXE E:\Program Files\Internet Explorer\iexplore.exe E:\WINDOWS\System32\wuauclt.exe E:\WINDOWS\explorer.exe E:\WINDOWS\system32\NOTEPAD.EXE E:\Program Files\WinRAR\WinRAR.exe E:\DOCUME~1\Norak\USTAWI~1\Temp\Rar$EX00.062\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [QuickTime Task] “E:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [MSConfig] E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM…\Run: [smcService] E:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM…\Run: [MKS_MENU] E:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [MailScanner] E:\Program Files\MKS\Bin\mks_mail.exe O4 - HKCU…\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU…\Run: [MSMSGS] “E:\Program Files\Messenger\msmsgs.exe” /background O4 - Global Startup: Menu mks_vir.lnk = E:\Program Files\MKS\Bin\mks_menu.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} - http://mks.com.pl/skaner/SkanerOnline.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - E:\Program Files\MKS\Bin\mksmonsv.exe O23 - Service: MkS_Scan - Unknown owner - E:\Program Files\MKS\Bin\mks_scan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - E:\Program Files\Sygate\SPF\smc.exe Zmień tytuł na konkretny w trybie awaryjnym usuń plik i folder ręcznie Folder usunąłem , a tego secure32.html nie było na C już

InfinityToJa · 11 Lipiec 2006 12:36

czysto

Aleksander88 · 11 Lipiec 2006 16:28

Ok w takim razie dziękuje :mrgreen:

Pozdrawiam