Prosze o sprawdzenie loga!


(Bialkin) #1

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:


HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"Gadu-Gadu" = ""F:\net\gg\Gadu-Gadu\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"]

"Komunikator" = "F:\net\tlen\tlen.exe" [null data]

"eMuleAutoStart" = "F:\net\p2p\emuł\eMule\emule.exe -AutoStart" ["http://emuleplus.info"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]

"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]

"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]

"WinampAgent" = ""F:\MUZYCZNE\winek\Winamp\Winampa.exe"" [null data]

"KAVPersonal50" = ""F:\ANTYWIRUS\Nowy folder\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"]

"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" [file not found]

"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"

-> {CLSID}\InProcServer32(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"

-> {CLSID}\InProcServer32(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

-> {CLSID}\InProcServer32(Default) = "F:\SYSTEM\winrara\rarext.dll" [null data]

"{B7E6FD81-68DE-4523-98C8-94A31E0EC160}" = (no title provided)

-> {CLSID}\InProcServer32(Default) = "C:\WINDOWS\system32\iaaksie.dll" [null data]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {CLSID}\InProcServer32(Default) = "C:\WINDOWS\Program Files\Microsoft Office\Office10\msohev.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"

-> {CLSID}\InProcServer32(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

INFECTION WARNING! SharedDlls\DLLName = "C:\WINDOWS\system32\d00mlad11d0.dll" [null data]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

Kaspersky Anti-Virus(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"

-> {CLSID}\InProcServer32(Default) = "F:\ANTYWIRUS\Nowy folder\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"]

WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {CLSID}\InProcServer32(Default) = "F:\SYSTEM\winrara\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {CLSID}\InProcServer32(Default) = "F:\SYSTEM\winrara\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

Kaspersky Anti-Virus(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"

-> {CLSID}\InProcServer32(Default) = "F:\ANTYWIRUS\Nowy folder\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"]

WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {CLSID}\InProcServer32(Default) = "F:\SYSTEM\winrara\rarext.dll" [null data]

Active Desktop and Wallpaper:


Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\cz\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp"

Enabled Screen Saver:


HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS]

Winsock2 Service Provider DLLs:


Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}):


ASP.NET State Service, aspnet_state, "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe" [MS]

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]

ATI Smart, ATI Smart, "C:\WINDOWS\system32\ati2sgag.exe" [empty string]

HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}

Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\system32\wbem\wmiapsrv.exe" [MS]

kavsvc, kavsvc, ""F:\ANTYWIRUS\Nowy folder\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"]

Usługa administracyjna Menedżera dysków logicznych, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"]

Usługa dostarczania sieci, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]}

Usługa numeru seryjnego multimediów przenośnych, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\mspmsnsv.dll" [MS]}


  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • To search all directories of local fixed drives for DESKTOP.INI

DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

use the -supp parameter or answer "No" at the first message box.

---------- (total run time: 41 seconds, including 3 seconds for message boxes)

Cytat:

Logfile of HijackThis v1.99.1 

Scan saved at 19:19:05, on 2005-11-18 

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) 

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 


Running processes: 

C:\WINDOWS\System32\smss.exe 

C:\WINDOWS\system32\winlogon.exe 

C:\WINDOWS\system32\services.exe 

C:\WINDOWS\system32\lsass.exe 

C:\WINDOWS\system32\Ati2evxx.exe 

C:\WINDOWS\system32\svchost.exe 

C:\WINDOWS\System32\svchost.exe 

C:\WINDOWS\system32\spoolsv.exe 

C:\WINDOWS\Explorer.EXE 

C:\WINDOWS\system32\rundll32.exe 

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 

C:\WINDOWS\SOUNDMAN.EXE 

C:\Program Files\D-Tools\daemon.exe 

F:\MUZYCZNE\winek\Winamp\Winampa.exe 

F:\net\tlen\tlen.exe 

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe 

C:\Program Files\Microsoft AntiSpyware\gcasServ.exe 

C:\Documents and Settings\cz\Pulpit\drweb-cureit.exe 

C:\DOCUME~1\cz\USTAWI~1\Temp\RarSFX1\drw_start.exe 

C:\DOCUME~1\cz\USTAWI~1\Temp\RarSFX1\drweb32w.exe 

C:\Program Files\Internet Explorer\iexplore.exe 

F:\MUZYCZNE\winek\Winamp\winamp.exe 

F:\net\gg\Gadu-Gadu\Gadu-Gadu\gg.exe 

C:\WINDOWS\system32\taskmgr.exe 

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 

F:\ANTYWIRUS\ANTISPY\hijackthis\HijackThis.exe 


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = blank.htm 

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" 

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 

O4 - HKLM\..\Run: [WinampAgent] "F:\MUZYCZNE\winek\Winamp\Winampa.exe" 

O4 - HKLM\..\Run: [KAVPersonal50] "F:\ANTYWIRUS\Nowy folder\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize 

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 

O4 - HKCU\..\Run: [Gadu-Gadu] "F:\net\gg\Gadu-Gadu\Gadu-Gadu\gg.exe" /tray 

O4 - HKCU\..\Run: [Komunikator] F:\net\tlen\tlen.exe 

O4 - HKCU\..\Run: [eMuleAutoStart] F:\net\p2p\emuł\eMule\emule.exe -AutoStart 

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present 

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\WINDOWS\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab 

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab 

O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\iaaksie.dll 

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe 

O23 - Service: kavsvc - Kaspersky Lab - F:\ANTYWIRUS\Nowy folder\Kaspersky Anti-Virus Personal Pro\kavsvc.exe

Złączono Posta : 18.11.2005 (Pią) 22:52

help

====================================

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE

Proponuje poczytać TEN temat i zobacz jaka jest prośba do userów wklejających loga.

Pozdrawiam kuz5


(Gutek) #2

LOG z hijacka:

co robisz, w awaryjnym opróżniasz TEMP

Najważniejsze Usuwanie VX2.BetterInternet, przeczytaj uważnie i daj log nr 1 z narzędzia L2Mfix