Prosze o sprawdzenie loga

Dla specjalistów Bezpieczeństwo
#1

wydawalo mi sie ze usunalem, natomiast spybot ciagle pokazuje ze jest

#2

usuń hijackiem

Pokaż log z silenta - Silent opis: http://www.searchengines.pl/phpbb203/in … opic=15989

wyłacz rezydenta i Tea Timer przed usuwaniem w Spybot

#3

“Silent Runners.vbs”, revision 43, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“SpybotSD TeaTimer” = “C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [“Safer Networking Limited”]

“Komunikator” = “C:\Program Files\Tlen.pl\tlen.exe” [null data]

“MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS]

“eMuleAutoStart” = “D:\Program Files\eMule\emule.exe -AutoStart” [“http://www.emule-project.net”]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“{0228e555-4f9c-4e35-a3ec-b109a192b4c2}” = “C:\Program Files\Google\Gmail Notifier\gnotify.exe” [“Google Inc.”]

“VTTimer” = “VTTimer.exe” [“S3 Graphics, Inc.”]

“Symantec NetDriver Monitor” = “C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer” [“Symantec Corporation”]

“SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe” [“Sun Microsystems, Inc.”]

“SELM_Monitor3” = “C:\Program Files\GFI\SELM3\selm_mon.exe” ["GFI Software Ltd. "]

“NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”]

“GhostStartTrayApp” = “C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe” [“Symantec Corporation”]

“ccApp” = ““C:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”]

“AudioDeck” = “C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1” [“VIA Technologies, Inc.”]

“CTHelper” = “CTHELPER.EXE” [“Creative Technology Ltd”]

“UpdReg” = “C:\WINDOWS\UpdReg.EXE” [“Creative Technology Ltd.”]

“Jet Detection” = ““C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe”” [empty string]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided)

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”]

{9ECB9560-04F9-4bbc-943D-298DDF1699E1}(Default) = “Norton Internet Security”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

{A5366673-E8CA-11D3-9CD9-0090271D075B}(Default) = “IeCatch2 Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\FlashGet\jccatch.dll” [“Amaze Soft”]

{BDF3E430-B101-42AD-A544-FADC6B084872}(Default) = “NAV Helper”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

“{8D1636FD-CA49-4b4e-90E4-0A20E03A15E8}” = “jetAudio”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“JetAudio, Inc.”]

“{57C51AF9-DEF7-11D3-A801-00C04F163490}” = “Ghost Shell Extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll” [“Symantec Corporation”]

“{21569614-B795-46b1-85F4-E737A8DC09AD}” = “Shell Search Band”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS]

“{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS]

“{F16F2A47-893D-4FFC-A83A-E66C9F5AC838}” = “Audiofan Wave to MP3 Converter 1.1 Shell Extension”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\amese.dll” [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\

INFECTION WARNING! text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

Audiofan Wave to MP3 Converter(Default) = “{F16F2A47-893D-4FFC-A83A-E66C9F5AC838}”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\amese.dll” [null data]

jetAudio(Default) = “{8D1636FD-CA49-4b4e-90E4-0A20E03A15E8}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“JetAudio, Inc.”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

jetAudio(Default) = “{8D1636FD-CA49-4b4e-90E4-0A20E03A15E8}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“JetAudio, Inc.”]

Symantec.Norton.Antivirus.IEContextMenu(Default) = “{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

Active Desktop and Wallpaper:

Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\

“Wallpaper” = “C:\Documents and Settings\batman\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp”

Enabled Screen Saver:

HKCU\Control Panel\Desktop\

“SCRNSAVE.EXE” = “C:\WINDOWS\reloaded.scr” [null data]

Startup items in “batman” & “All Users” startup folders:

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart

“Adobe Gamma Loader” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”]

Enabled Scheduled Tasks:

“Norton AntiVirus - Scan my computer - batman” -> launches: “C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /task:“C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”]

“Symantec NetDetect” -> launches: “C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE” [“Symantec Corporation”]

Winsock2 Service Provider DLLs:

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{E0E899AB-F487-11D5-8D29-0050BA6940E3}” = “FlashGet Bar”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\FlashGet\fgiebar.dll” [“Amaze Soft”]

“{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}” = “Norton Internet Security”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll” [“Symantec Corporation”]

“{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}” = “Norton AntiVirus”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll” [“Symantec Corporation”]

Explorer Bars

Dormant Explorer Bars in “View, Explorer Bar” menu

HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = “&Badanie”

Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll” [“Sun Microsystems, Inc.”]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

“ButtonText” = “Badanie”

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\

“ButtonText” = “FlashGet”

“MenuText” = “&FlashGet”

“Exec” = “C:\PROGRA~1\FlashGet\flashget.exe” [“Amaze Soft”]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

“ButtonText” = “Messenger”

“MenuText” = “Windows Messenger”

“Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):

Creative Service for CDROM Access, Creative Service for CDROM Access, “C:\WINDOWS\system32\CTsvcCDA.exe” [“Creative Technology Ltd”]

GFI LANguard S.E.L.M. 3 Alerter agent service, GFI SELM 3 Alerter, ““C:\Program Files\GFI\SELM3\SELMAlrt.exe” -startservice” [" GFI Software Ltd."]

GFI LANguard S.E.L.M. 3 Archiver agent service, GFI SELM 3 Archiver, ““C:\Program Files\GFI\SELM3\SELMArch.exe” -startservice” [empty string]

GFI LANguard S.E.L.M. 3 Collector agent service, GFI SELM 3 Collector, ““C:\Program Files\GFI\SELM3\SELMColl3.exe” -startservice” [“GFI Software Ltd.”]

GhostStartService, GhostStartService, “C:\PROGRA~1\NORTON~2\NORTON~1\GHOSTS~2.EXE” [“Symantec Corporation”]

ISSvc, ISSVC, ““C:\Program Files\Norton Internet Security\ISSVC.exe”” [“Symantec Corporation”]

Message Queuing, MSMQ, “C:\WINDOWS\system32\mqsvc.exe” [MS]

Norton AntiVirus Auto-Protect Service, navapsvc, ““C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe”” [“Symantec Corporation”]

Norton Unerase Protection, NProtectService, “C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE” [“Symantec Corporation”]

Speed Disk service, Speed Disk service, “C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe” [“Symantec Corporation”]

Symantec Event Manager, ccEvtMgr, ““C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe”” [“Symantec Corporation”]

Symantec Network Drivers Service, SNDSrvc, ““C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe”” [“Symantec Corporation”]

Symantec Network Proxy, ccProxy, ““C:\Program Files\Common Files\Symantec Shared\ccProxy.exe”” [“Symantec Corporation”]

Symantec Settings Manager, ccSetMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe”” [“Symantec Corporation”]

Symantec SPBBCSvc, SPBBCSvc, ““C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe”” [“Symantec Corporation”]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS]

WMDM PMSP Service, WMDM PMSP Service, “C:\WINDOWS\system32\MsPMSPSv.exe” [MS]

Print Monitors:

HKLM\System\CurrentControlSet\Control\Print\Monitors\

Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS]

PDF995 Monitor\Driver = “pdf995mon.dll” [null data]

  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • The search for DESKTOP.INI DLL launch points on all local fixed drives

took 26 seconds.

  • The search for all Registry CLSIDs containing dormant Explorer Bars

took 21 seconds.

---------- (total run time: 87 seconds)

#4

Ale jest czysto

Jak nadal pojawiajaa sie wpisy to:

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\NDNuninstall6_98.exe

C:\WINDOWS\NDNuninstall7_14.exe

C:\WINDOWS\system32\rlvknlg.exe

C:\WINDOWS\system32\rk.bin

C:\WINDOWS\system32\rlls.dll

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

#5

Dzieki wielkie!

#6

Teraz to juz sie zamielilem

Nie zauwazyłem, pawulon_ ty i rudik77 to jedna osoba, masz dwa konta.

Prosze o szybkie wyjaśnienie na pw inaczej temat wyladuje w śmietniku :?

Update:

Sprawa wyjaśniona, pawulon_ nie podpinaj sie pod nie swoje tematy, tylko zakładaj własne (dlaczego, wyjaśniłem ci na pw)

#7

w moj komputer:\C:\ sa jakies dokumenty tekstowe o nazwie alertserv i selmalrt, po usunieciu i restarcie wracaja, co to moze byc?

#8

Hhehe - http://forum.sw-soft.com/member.php?s=d … serid=6798

-http://process.networktechs.com/selmalrt.exe.php

#9

???

#10

Zostaw :slight_smile:

#11

aha, heheh