Prosze o sprawdzenie loga

Dla specjalistów Bezpieczeństwo
#1

Witam

Parę dni byłspokój i znowu się zaczeło

Po uruchomieniu wyzuca komunikat :

System zostanie zamknięty przez

Zarzadzanie NT/system

Proces systemowy

C:\windows \system32\lsass.exe

Zostanie nieoczekiwanie zamknięty z kodem stanu 128

Komp skanowany NOD,Xcleaner,ewiro

co dalej robić ??

Logfile of HijackThis v1.99.1

Scan saved at 08:55:27, on 2006-08-21

Platform: Windows 2003 (WinNT 5.02.3790)

MSIE: Internet Explorer v6.00 (6.00.3790.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

C:\BHROOT\BIN\NT611SVC.EXE

C:\WINDOWS\system32\crypserv.exe

C:\WINDOWS\System32\dns.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\MSDEFord\Binn\MSSQL$FORDDB\Binn\sqlservr.exe

C:\Program Files\Eset\nod32krn.exe

C:\BHROOT\BIN\PORTMAP.EXE

C:\WINDOWS\system32\srvany.exe

C:\WINDOWS\system32\resetservice.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wins.exe

C:\BHROOT\BIN\DBMANG.EXE

C:\WINDOWS\system32\reset5.exe

C:\WINDOWS\system32\Dfssvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\keyhook.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\FRITZ!\FriFax32.exe

C:\Program Files\Option\GlobeTrotter Mobility Manager\GlobeTrotter Mobility Manager.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\WINDOWS\system32\sistray.exe

C:\Program Files\Option\GlobeTrotter Mobility Manager\VirtualWirelessDevice.exe

C:\Program Files\Screamer Radio\screamer.exe

C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.578\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.205

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: Shell=explorer.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2059D29F-F562-4C93-BE6E-86E5FC61EF11} - C:\WINDOWS\system32\docproq2.dll (file missing)

O2 - BHO: IE 4.x-5.x BHO in ObjectPascal - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\PROGRA~1\marbit\tools\IEHelper.dll (file missing)

O2 - BHO: WebCGMHlprObj Class - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {B6DA7E87-BC33-439A-A725-FF7E25BA44AA} - C:\WINDOWS\system32\LTDIS14n.dll (file missing)

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx

O4 - HKLM…\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe

O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE

O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [!ewido] “C:\Program Files\ewido anti-spyware 4.0\ewido.exe” /minimized

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [MarBitTools] C:\Program Files\marbit\tools\tools.exe 1

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: FRITZ!fax.lnk = C:\Program Files\FRITZ!\FriFax32.exe

O4 - Global Startup: GlobeTrotter Mobility Manager.lnk = C:\Program Files\Option\GlobeTrotter Mobility Manager\GlobeTrotter Mobility Manager.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: Download with Internet TOOLS - C:\Program Files\marbit\tools\MBdownload.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O17 - HKLM\System\CCS\Services\Tcpip…{7DEB8690-8031-49DA-8D98-D8CECB0CF918}: NameServer = 194.204.152.34,194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip…{BB925461-4A71-479B-AB2A-939F54F889E6}: NameServer = 212.2.96.51 212.2.96.52

O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll

O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

O23 - Service: bh611 - Bell& Howell - C:\BHROOT\BIN\NT611SVC.EXE

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: Bell & Howell Database Manager (dbmang) - Bell & Howell - C:\BHROOT\BIN\DBMANG.EXE

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: ONC/RPC Portmapper (portmapper) - Bell & Howell - C:\BHROOT\BIN\PORTMAP.EXE

O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe

O23 - Service: Struktura sterowników trybu użytkownika w systemie Windows (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)

#2

Najprawdopodobniej masz wirus Sasser.

Tu o wirusie Sasser i jego rodzinie.

Program usuwający Sassera:

Tutaj

#3

Złapałeś blastera…

Zobacz koniecznie http://www.searchengines.pl/phpbb203/index.php?showtopic=12532&st=0entry49445

http://www.error.xp.pl/

Po usunięciu blastera log ponownie do kontroli…

#4

Wglada na to że pomogło

Ale system chyba spowolnił Nie moge wykonac tych zaleceń z rejestrami U mnie w serwer 2003 eterprice wyglada to troche inaczej .

Oto log po usunięciu robaka

Logfile of HijackThis v1.99.1

Scan saved at 13:55:27, on 2006-08-22

Platform: Windows 2003 (WinNT 5.02.3790)

MSIE: Internet Explorer v6.00 (6.00.3790.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

C:\BHROOT\BIN\NT611SVC.EXE

C:\WINDOWS\system32\crypserv.exe

C:\WINDOWS\System32\dns.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\MSDEFord\Binn\MSSQL$FORDDB\Binn\sqlservr.exe

C:\Program Files\Eset\nod32krn.exe

C:\BHROOT\BIN\PORTMAP.EXE

C:\WINDOWS\system32\srvany.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\system32\resetservice.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wins.exe

C:\BHROOT\BIN\DBMANG.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Dfssvc.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\keyhook.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Option\GlobeTrotter Mobility Manager\GlobeTrotter Mobility Manager.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\WINDOWS\system32\sistray.exe

C:\Program Files\Option\GlobeTrotter Mobility Manager\VirtualWirelessDevice.exe

C:\Program Files\Screamer Radio\screamer.exe

C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\WINDOWS\system32\ntvdm.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.406\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: Shell=explorer.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2059D29F-F562-4C93-BE6E-86E5FC61EF11} - C:\WINDOWS\system32\docproq2.dll (file missing)

O2 - BHO: IE 4.x-5.x BHO in ObjectPascal - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\PROGRA~1\marbit\tools\IEHelper.dll (file missing)

O2 - BHO: WebCGMHlprObj Class - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {B6DA7E87-BC33-439A-A725-FF7E25BA44AA} - C:\WINDOWS\system32\LTDIS14n.dll (file missing)

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx

O4 - HKLM…\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe

O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE

O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [!ewido] “C:\Program Files\ewido anti-spyware 4.0\ewido.exe” /minimized

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [MarBitTools] C:\Program Files\marbit\tools\tools.exe 1

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: FRITZ!fax.lnk = C:\Program Files\FRITZ!\FriFax32.exe

O4 - Global Startup: GlobeTrotter Mobility Manager.lnk = C:\Program Files\Option\GlobeTrotter Mobility Manager\GlobeTrotter Mobility Manager.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: Download with Internet TOOLS - C:\Program Files\marbit\tools\MBdownload.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O17 - HKLM\System\CCS\Services\Tcpip…{7DEB8690-8031-49DA-8D98-D8CECB0CF918}: NameServer = 194.204.152.34,194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip…{BB925461-4A71-479B-AB2A-939F54F889E6}: NameServer = 212.2.96.51 212.2.96.52

O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll

O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

O23 - Service: bh611 - Bell& Howell - C:\BHROOT\BIN\NT611SVC.EXE

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: Bell & Howell Database Manager (dbmang) - Bell & Howell - C:\BHROOT\BIN\DBMANG.EXE

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: ONC/RPC Portmapper (portmapper) - Bell & Howell - C:\BHROOT\BIN\PORTMAP.EXE

O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe

O23 - Service: Struktura sterowników trybu użytkownika w systemie Windows (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)

Napewno mam bład w inernet eplorerze , ale nie moge go przeinstalować (ponowna instalacja nic nie daje ) To jest tematem innego postu

Narazie dziekuje za pomoc wszystkim i prosze o ponowne sprawdzenie loga

Pozdrawiam wszystkich

#5

Z tego co wiem do cracka na aktywację windy ? czy Twój system aby napewno jest legalny :twisted: ?

Skasuj :

#6

mam to skasować ?

O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll

#7

odpowiedz na pytanie Myszaka to Ci powiemy czy skasowac :mrgreen: