Prosze o sprawdzenie loga -Trojan.Startpage.Xs

maninna · 17 Marzec 2006 16:20

Logfile of HijackThis v1.99.1 Scan saved at 17:03:32, on 2006-03-17 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINME\SYSTEM\KERNEL32.DLL C:\WINME\SYSTEM\MSGSRV32.EXE C:\WINME\SYSTEM\mmtask.tsk C:\WINME\SYSTEM\MPREXE.EXE C:\WINME\SYSTEM\MSTASK.EXE C:\WINME\SYSTEM\ATI2EVXX.EXE C:\WINME\SYSTEM\KB891711\KB891711.EXE C:\WINME\EXPLORER.EXE C:\WINME\TASKMON.EXE C:\WINME\SYSTEM\SYSTRAY.EXE C:\WINME\SYSTEM\IRMON.EXE C:\WINME\SYSTEM\ATIPTAXX.EXE C:\WINME\SYSTEM\ATI2CWXX.EXE C:\PROGRAM FILES\APOINT\APOINT.EXE C:\WINME\PCTVOICE.EXE C:\WINME\SYSTEM\ESB.EXE C:\PROGRAM FILES\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE C:\PROGRAM FILES\JETICO\JETICO PERSONAL FIREWALL\FWSRV.EXE C:\WINME\SYSTEM\INTERNAT.EXE C:\WINME\SYSTEM\ICSMGR.EXE C:\WINME\SYSTEM\RESTORE\STMGR.EXE D:\NKBMONITOR.EXE C:\WINME\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\APOINT\APWHEEL.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINME\SYSTEM\DDHELP.EXE C:\WINME\WUAUCLT.EXE C:\WINME\SYSTEM\PSTORES.EXE C:\WINME\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.org R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.org O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTWARE\QUICKF~1\PLUGINS\IEHELP.DLL O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINME\SYSTEM\MSDXM.OCX O4 - HKLM…\Run: [scanRegistry] C:\WINME\scanregw.exe /autorun O4 - HKLM…\Run: [TaskMonitor] C:\WINME\taskmon.exe O4 - HKLM…\Run: [PCHealth] C:\WINME\PCHealth\Support\PCHSchd.exe -s O4 - HKLM…\Run: [systemTray] SysTray.Exe O4 - HKLM…\Run: [irMon] irmon.exe O4 - HKLM…\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM…\Run: [AtiPTA] Atiptaxx.exe O4 - HKLM…\Run: [Ati2cwxx] Ati2cwxx.exe O4 - HKLM…\Run: [AlpsPoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM…\Run: [CountrySelection] pctptt.exe O4 - HKLM…\Run: [PCTVOICE] pctvoice.exe O4 - HKLM…\Run: [ESB] C:\WINME\SYSTEM\ESB.exe O4 - HKLM…\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun O4 - HKLM…\Run: [JeticoPFStartup] “C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe” O4 - HKLM…\Run: [internat.exe] internat.exe O4 - HKLM…\Run: [iCSMGR] ICSMGR.EXE O4 - HKLM…\Run: [QuickTime Task] “C:\WINME\SYSTEM\QTTASK.EXE” -atboottime O4 - HKLM…\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM…\RunServices: [schedulingAgent] mstask.exe O4 - HKLM…\RunServices: [*StateMgr] C:\WINME\System\Restore\StateMgr.exe O4 - HKLM…\RunServices: [ATIPOLAB] ati2evxx.exe O4 - HKLM…\RunServices: [KB891711] C:\WINME\SYSTEM\KB891711\KB891711.EXE O4 - Startup: Microsoft Office.lnk = D:\Office\OSA9.EXE O4 - Startup: NkbMonitor.exe.lnk = D:\NkbMonitor.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINME\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINME\web\related.htm O13 - DefaultPrefix: http://web.all-find.org/best.php?url= O13 - WWW Prefix: http://web.all-find.org/best.php?url= O13 - Home Prefix: http://web.all-find.org/best.php?url= O13 - Mosaic Prefix: http://web.all-find.org/best.php?url= O15 - Trusted Zone: http://www.mks.com.pl O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar … /cabsa.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar … vSniff.cab O18 - Protocol: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\WINME\SYSTEM\TEXTWAREILLUMINATORBASEPROTOCOL.DLL O21 - SSODL: DDE Module - {DABB23E9-AC0D-3740-E3E5-4B37C80837E5} - C:\WINME\SYSTEM\wirl.dll

Złączono Posta : 17.03.2006 (Pią) 17:32

“Silent Runners.vbs”, revision 44, http://www.silentrunners.org/ Operating System: Windows Me (Millennium Edition) Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “ScanRegistry” = “C:\WINME\scanregw.exe /autorun” [MS] “TaskMonitor” = “C:\WINME\taskmon.exe” [MS] “PCHealth” = “C:\WINME\PCHealth\Support\PCHSchd.exe -s” [MS] “SystemTray” = “SysTray.Exe” [MS] “IrMon” = “irmon.exe” [MS] “LoadPowerProfile” = “Rundll32.exe powrprof.dll,LoadCurrentPwrScheme” [MS] “AtiPTA” = “Atiptaxx.exe” [“ATI Technologies, Inc.”] “Ati2cwxx” = “Ati2cwxx.exe” [“ATI Technologies Inc.”] “AlpsPoint” = “C:\Program Files\Apoint\Apoint.exe” [“Alps Electric Co., Ltd.”] “CountrySelection” = “pctptt.exe” [“PCtel, Inc.”] “PCTVOICE” = “pctvoice.exe” [“PCtel, Inc.”] “ESB” = “C:\WINME\SYSTEM\ESB.exe” [empty string] “Camera Detector” = “C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun” [“ACD Systems, Ltd.”] “JeticoPFStartup” = ““C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe”” [“Jetico, Inc.”] “internat.exe” = “internat.exe” [MS] “ICSMGR” = “ICSMGR.EXE” [MS] “QuickTime Task” = ““C:\WINME\SYSTEM\QTTASK.EXE” -atboottime” [“Apple Computer, Inc.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++} “LoadPowerProfile” = “Rundll32.exe powrprof.dll,LoadCurrentPwrScheme” [MS] “SchedulingAgent” = “mstask.exe” [MS] “*StateMgr” = “C:\WINME\System\Restore\StateMgr.exe” [MS] “ATIPOLAB” = “ati2evxx.exe” [“ATI Technologies Inc.”] “KB891711” = “C:\WINME\SYSTEM\KB891711\KB891711.EXE” [MS] HKLM\Software\Microsoft\Active Setup\Installed Components\ PerUser_CVT_Inis(Default) = “Windows Setup - FAT32 Converter” \StubPath = “rundll.exe C:\WINME\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINME\INF\applets1.inf” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX” ["("] {C08DF07A-3E49-4E25-9AB0-D3882835F153}(Default) = (no title provided) -> {HKLM…CLSID} = “QUICKfind BHO Object” \InProcServer32(Default) = “C:\PROGRA~1\TEXTWARE\QUICKF~1\PLUGINS\IEHELP.DLL” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice Property Sheet Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRAM FILES\OPENOFFICE.ORG1.1.0\PROGRAM\SHLXTHDL.DLL” [“Sun Microsystems, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\PROGRAM FILES\WINRAR\rarext.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “DDE Module” = “{DABB23E9-AC0D-3740-E3E5-4B37C80837E5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINME\SYSTEM\wirl.dll” [null data] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\PROGRAM FILES\WINRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\PROGRAM FILES\WINRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\PROGRAM FILES\WINRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINME\ACD Wallpaper.bmp” Startup items in “Startup” & “All Users…Startup” folders: ----------------------------------------------------------- C:\WINME\Start Menu\Programs\StartUp “Microsoft Office” -> shortcut to: “D:\Office\OSA9.EXE -b -l” [MS] “NkbMonitor.exe” -> shortcut to: “D:\NkbMonitor.exe” [“Nikon Corporation”] Enabled Scheduled Tasks: ------------------------ “Tune-up Application Start” -> launches: “walign” [MS] “PCHealth Scheduler for Data Collection” -> launches: “C:\WINME\PCHEALTH\SUPPORT\PCHSCHD.EXE -c” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “C:\WINME\SYSTEM\rnr20.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range: C:\WINME\SYSTEM\mswsosp.dll [MS], 1 C:\WINME\system32\wspirda.dll [MS], 2 C:\WINME\SYSTEM\msafd.dll [MS], 3 - 5 C:\WINME\SYSTEM\rsvpsp.dll [MS], 6 - 7 Internet Explorer Address Prefixes: ----------------------------------- Prefix for bare domain (“domain-name-here.com”) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Default Prefix\ HIJACK WARNING! (Default) = “http://web.all-find.org/best.php?url=” Prefix for specific service (i.e., “www”) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\ HIJACK WARNING! “home” = “http://web.all-find.org/best.php?url=” HIJACK WARNING! “mosaic” = “http://web.all-find.org/best.php?url=” HIJACK WARNING! “www” = “http://web.all-find.org/best.php?url=” Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data) The Internet Explorer version cannot be found! C:\WINME\INF\IERESET.INF (used to “Reset Web Settings”) The contents of IERESET.INF cannot be reliably checked! Added lines (compared with English-language version): [strings]: START_PAGE_URL=“http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome” [strings]: MS_START_PAGE_URL=“http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome” Missing lines (compared with English-language version): [strings]: 2 lines ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 14 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 10 seconds. ---------- (total run time: 44 seconds)

InfinityToJa · 17 Marzec 2006 17:16

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.org R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.org O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINME\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINME\web\related.htm O13 - DefaultPrefix: http://web.all-find.org/best.php?url= O13 - WWW Prefix: http://web.all-find.org/best.php?url= O13 - Home Prefix: http://web.all-find.org/best.php?url= O13 - Mosaic Prefix: http://web.all-find.org/best.php?url= O21 - SSODL: DDE Module - {DABB23E9-AC0D-3740-E3E5-4B37C80837E5} - C:\WINME\SYSTEM\wirl.dll

Usuwasz wpisy i pogrubione pliki w trybie awaryjnym z wyłączonym przywracaniem systemu.

Przeskanuj http://www.ewido.net

maninna · 17 Marzec 2006 17:45

dzieki.

a jak wylaczyc przywracanie systemu i co to jest tryb awaryjny?

InfinityToJa · 17 Marzec 2006 17:56

prawy przycisk myszy na mój komputer>>>właściwości>>>zakładka przywracanie systemu>>>zaptaszkuj wyłącz przywracanie systemu

w tryb awaryjny możesz wejść podczas startu przyciskająć [F8] lub [F4]

maninna · 17 Marzec 2006 17:57

i jak probuje przeskanowac na ewido to pojawia mi sie komunikat “runtime error”.

co to znaczy?

Złączono Posta : 17.03.2006 (Pią) 20:02

zaznaczylam “disable system restore”. to to jest “wylaczenie przywracania systemu”?

Gutek · 18 Marzec 2006 00:16

przecież on ma ME :x

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.org R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.org R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.org R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.org O13 - DefaultPrefix: http://web.all-find.org/best.php?url= O13 - WWW Prefix: http://web.all-find.org/best.php?url= O13 - Home Prefix: http://web.all-find.org/best.php?url= O13 - Mosaic Prefix: http://web.all-find.org/best.php?url= O21 - SSODL: DDE Module - {DABB23E9-AC0D-3740-E3E5-4B37C80837E5} - (no file)

w trybie awaryjnym uusń wpisy hijackiem i przeskanuj kompa scanerami online Scanery do wyboru