Prosze o sprawdzenie loga - wirusy

pawcio151 · 27 Lipiec 2006 09:10

Daje tutaj loga mojej kolezanki ktora ma napewno duzo wirusow i koputer jej przezto szaleje.

Logfile of HijackThis v1.99.1 Scan saved at 21:32:53, on 2006-07-26 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\kofbcti.exe C:\dfndred_7.exe C:\kybrded_7.exe C:\windows\system32\taskmgn.exe C:\WINDOWS\System32\testtestt.exe C:\Program Files\Messenger\msmsgs.exe C:\Gadu-Gadu\gg.exe C:\winstall.exe C:\Windows\xpupdate.exe C:\DOCUME~1\malyka\USTAWI~1\Temp\17.tmp5120.exe C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup C:\Documents and Settings\malyka\Ustawienia lokalne\Temp\Katalog tymczasowy 2 dla hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - Default URLSearchHook is missing O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [˙_zskJZU^QMKMBWC] C:\WINDOWS\System32_zskdmwinVKYH\CWBMKMQ^UZJ.exe O4 - HKLM…\Run: [sysTray] C:\Program Files\kofbcti.exe O4 - HKLM…\Run: [defender] C:\dfndred_7.exe O4 - HKLM…\Run: [keyboard] C:\kybrded_7.exe O4 - HKLM…\Run: [Windows Task Manager] c:\windows\system32\taskmgn.exe O4 - HKLM…\Run: [system] C:\WINDOWS\System32\testtestt.exe O4 - HKLM…\RunServices: [systemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKLM…\RunServices: [systemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “C:\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [pro] c:\lcaic.exe O4 - HKCU…\Run: [˙_zskJZU^QMKMBWC] C:\WINDOWS\System32_zskdmwinVKYH\CWBMKMQ^UZJ.exe O4 - HKCU…\Run: [Windows update loader] C:\Windows\xpupdate.exe O4 - Global Startup: WlanUtility.lnk = C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip…{FD931121-A7FA-40A0-A9D1-521227C207C4}: NameServer = 192.168.7.1,194.204.159.1 O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Dokumenty\Settings\artm_new.dll O20 - Winlogon Notify: winf44 - C:\WINDOWS\SYSTEM32\winf44.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: MSI_WLAN_Service - Unknown owner - C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe

“Silent Runners.vbs”, revision 46, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “Gadu-Gadu” = ““C:\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z oo”] “Windows installer” = “C:\winstall.exe” [null data] “pro” = “c:\lcaic.exe” [null data] “˙_zskJZU^QMKMBWC” = “C:\WINDOWS\System32_zskdmwinVKYH\CWBMKMQ^UZJ.exe” [file not found] “Windows update loader” = “C:\Windows\xpupdate.exe” [null data] “taskdir” = “C:\WINDOWS\System32\taskdir.exe” [null data] “Winsvr” = “C:\DOCUME~1\malyka\USTAWI~1\Temp\17.tmp5120.exe” [null data] “WinMedia” = “C:\DOCUME~1\malyka\USTAWI~1\Temp\17.tmp3072.exe " [null data] “(Default)” = “”” = (data in unrecognized format!)" [file not found] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “˙_zskJZU^QMKMBWC” = “C:\WINDOWS\System32_zskdmwinVKYH\CWBMKMQ^UZJ.exe” [file not found] “SysTray” = “C:\Program Files\kofbcti.exe” [MS] “defender” = “C:\dfndred_7.exe” ["::::::::::::::::::::::::::::::::::::::::::::"] “keyboard” = “C:\kybrded_7.exe” [“re8wru ehu hrweurhuweur 37wr3”] “Windows Task Manager” = “c:\windows\system32\taskmgn.exe” [null data] “System” = “C:\WINDOWS\System32\testtestt.exe” [null data] “(Default)” = “”" = (data in unrecognized format!)" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ INFECTION WARNING! “{2C1CD3D7-86AC-4068-93BC-A02304BB2236}” = “DCOM Server 2236” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\2236_27.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “hksrv.dll” = “{81430EF1-8905-4112-835A-B66216C68FAA}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “hksrv.dll” [MS] “DCOM Server 2236” = “{2C1CD3D7-86AC-4068-93BC-A02304BB2236}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\2236_27.dll” [null data] “hOoBVS” = “{6869AAFF-C2C3-0055-626E-432E7DCAD851}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\xkjphv.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! artm_newreg\DLLName = “C:\Documents and Settings\All Users\Dokumenty\Settings\artm_new.dll” [null data] INFECTION WARNING! winf44\DLLName = “winf44.dll” [** WMI GetObject error **] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\malyka\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Startup items in “malyka” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “WlanUtility” -> shortcut to: “C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer “No” at the first message box. ---------- (total run time: 291 seconds, including 18 seconds for message boxes)

Myszak · 27 Lipiec 2006 09:58

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R3 - Default URLSearchHook is missing O4 - HKLM…\Run: [˙_zskJZU^QMKMBWC] C:\WINDOWS\System32_zskdmwinVKYH\CWBMKMQ^UZJ.exe O4 - HKLM…\Run: [defender] C:\dfndred_7.exe O4 - HKLM…\Run: [keyboard] C:\kybrded_7.exe O4 - HKLM…\Run: [Windows Task Manager] c:\windows\system32\taskmgn.exe O4 - HKLM…\Run: [system] C:\WINDOWS\System32\testtestt.exe O4 - HKLM…\RunServices: [systemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKLM…\RunServices: [systemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [pro] c:\lcaic.exe O4 - HKCU…\Run: [˙_zskJZU^QMKMBWC] C:\WINDOWS\System32_zskdmwinVKYH\CWBMKMQ^UZJ.exe O4 - HKCU…\Run: [Windows update loader] C:\Windows\xpupdate.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Dokumenty\Settings\artm_new.dll O20 - Winlogon Notify: winf44 - C:\WINDOWS\SYSTEM32\winf44.dll

Startujesz do trybu awaryjnego i wyłączasz przywracanie systemu.
Pliki/foldery na czerwono ręcznie z dysku.
Wpisy skasuj Hijackiem.

Ściągnij Gmera --> uruchom --> przejdź do zakładki rootkit --> wybierz szukaj --> czekaż cierpliwie aż program zakończy prace --> klikasz kopiuj --> wklej do posta.

Użyj SmitFraudFix – tu masz opis.

Plik C:\Documents and Settings\All Users\Dokumenty\Settings\artm_new.dll może się nie chcieć usunąć. Wtedy :

Użyj programu Killbox

–> Uruchamiasz zaznaczasz Delete on reboot, w polu full path of file wklej ścieżkę :

C:\Documents and Settings\All Users\Dokumenty\Settings\artm_new.dll

Klikasz X i reset kompa.

Daj nowe logi Hijack + Gmer i raport ze SmitFraudFix.

Silentem zajmiemy się potem.

InfinityToJa · 27 Lipiec 2006 11:06

to również potraktować killboxem

Do skasowania również:

C:\DOCUME~1\malyka\USTAWI~1 \Temp \17.tmp5120.exe

O4 - HKLM…\Run: [sysTray] C:\Program Files\ kofbcti.exe

pawcio151 · 27 Lipiec 2006 11:32

najpierw zajme sie logami Hijack. Jest taki problem ze ona daleko mieszka wiec mam nadzieje ze hijack duzo juz jej pomoze.

Dzieki Myszak i InfinityToJa