Simpler.exe

Mini · 21 Listopad 2006 20:05

siema, mam problem z tym czyms o nazwie simpler prosze pomozcie

Logfile of HijackThis v1.99.1 Scan saved at 20:16:56, on 2006-11-21 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\locator.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Programy\Skype\Phone\Skype.exe C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe C:\WINNT\system32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Administrator\Pulpit\Gry\hjt\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.fun.center2001.de/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 217.98.20.20:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) R3 - URLSearchHook: (no name) - {E6FF30C0-48CE-0DF4-DF28-1EEA14325131} - ExchangeMaster.dll (file missing) F2 - REG:system.ini: UserInit=userinit.exe,C:\WINNT\SERVICES.EXE O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Programy\iMesh\iMesh5\iMeshBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Programy\GetRight\xx2gr.dll O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll O2 - BHO: YA2GOOGLE - {89731480-D47D-4DC4-8A36-BAAE55E094C5} - C:\WINNT\explorer.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL O4 - HKLM…\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [razertra] C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\RunServices: [Windows ASN4 Services] bot.exe O4 - HKLM…\RunServices: [systemTools] C:\WINNT\system32\kernels8.exe O4 - HKCU…\Run: [skype] “C:\Programy\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Komunikator] C:\Programy\Tlen\tlen.exe O4 - Startup: MSWin-917368498.exe O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Download with GetRight Pro - C:\Programy\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programy\GetRight\GRbrowse.htm O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra ‘Tools’ menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {4B1A4A31-8845-11D5-9769-00B0D071D434} (Avaya ICM Client) - https://uslugi.ingnn.pl/webchat/icm/caller.cab O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_14.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/se … loader.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CCS\Services\Tcpip…{761F4E62-3280-4009-9CC9-734B7E94C110}: NameServer = 85.255.114.194, 85.255.112.129 O17 - HKLM\System\CS1\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS2\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O20 - AppInit_DLLs: pushow51.dll O20 - Winlogon Notify: rpcc - C:\WINNT\system32\rpcc.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINNT\system32\vbsys2.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IXP000.TMP\MsiExec.exe (file missing)

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows 2000 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Skype” = ““C:\Programy\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Komunikator” = “C:\Programy\Tlen\tlen.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} “wininet.dll” = “mscornet.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Resume copy” = “copyfstq.exe /startup” [null data] “Synchronization Manager” = “mobsync.exe /logon” [MS] “razertra” = “C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe” [“Razer Inc.”] “TkBellExe” = ““C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {00000000-6CB0-410C-8C3D-8FA8D2011D0A}(Default) = (no title provided) -> {HKLM…CLSID} = “DownloadRedirect Class” \InProcServer32(Default) = “C:\Programy\iMesh\iMesh5\iMeshBHO.dll” [“iMesh Ltd”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}(Default) = “****A**” (unwritable string) -> {HKLM…CLSID} = “bho2gr Class” \InProcServer32(Default) = “C:\Programy\GetRight\xx2gr.dll” [“Headlight Software, Inc.”] {5345A7A1-805A-4923-B505-86B2FEBA3FE0}(Default) = “iMeshBar BHO” -> {HKLM…CLSID} = “iMeshBar BHO” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [“iMesh”] {8036D4D7-AAD3-4793-AB49-329E437155A8}(Default) = (no title provided) -> {HKLM…CLSID} = “Mario Forever Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] {89731480-D47D-4DC4-8A36-BAAE55E094C5}(Default) = “YA2GOOGLE” -> {HKLM…CLSID} = “MExplorer Class” \InProcServer32(Default) = “C:\WINNT\explorer.dll” [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINNT\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” = “ICQ Lite Shell Extension” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Programy\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{64BC5640-700F-4E7E-8462-D3092DD74B0F}” = “VDMSound LaunchPad” -> {HKLM…CLSID} = “LaunchPadShellEx Class” \InProcServer32(Default) = “C:\Programy\VDMSound\LaunchPad.dll” [empty string] “{B7056B8E-4F99-44f8-8CBD-282390FE5428}” = “VirtualCloneDrive” -> {HKLM…CLSID} = “VirtualCloneDrive Shell Extension” \InProcServer32(Default) = “C:\Programy\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll” [“Elaborate Bytes AG”] “{A4D78B20-6E05-1069-8758-4E73FD83DEAD}” = “QCopy” -> {HKLM…CLSID} = “QCopy” \InProcServer32(Default) = “dropcpyr.dll” [null data] “{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}” = “My Logitech Pictures” -> {HKLM…CLSID} = “My Logitech Pictures” \InProcServer32(Default) = “C:\Programy\Logitech\Video\Namespc2.dll” [“Logitech Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “SystemCheck2” = “{54645654-2225-4455-44A1-9F4543D34546}” -> {HKLM…CLSID} = “System Check Application” \InProcServer32(Default) = “C:\WINNT\system32\vbsys2.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <> “AppInit_DLLs” = “pushow51.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ <> “Userinit” = “userinit.exe,C:\WINNT\SERVICES.EXE” [MS], [null data] <> “System” = " csvtg.exe" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] <> rpcc\DLLName = “C:\WINNT\system32\rpcc.dll” [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Programy\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ FineReader(Default) = “{AC0DD14A-8F29-4F88-BE1D-0F0ED1B06C9F}” -> {HKLM…CLSID} = “FineReaderExplorerContextMenuHandler” \InProcServer32(Default) = “c:\program files\abbyy finereader 7.0 professional edition\fecmenu.dll” [“ABBYY (BIT Software)”] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta(Default) = “XnView.Image” <> HKLM\Software\Classes\XnView.Image\shell\open\command(Default) = ““C:\Programy\XnView\xnview.exe” “%1"” [“XnView, http://www.xnview.com”] Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “Administrator” & “All Users” startup folders: --------------------------------------------------------------- C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart <> “MSWin-917368498.exe” [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Kaspersky Anti-Hacker” -> shortcut to: “C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe /silence” [“Kaspersky Lab”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\rnr20.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 27 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{5345A7A9-805A-4923-B505-86B2FEBA3FE0}” -> {HKLM…CLSID} = “iMeshBar” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [“iMesh”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{463DF6D5-BEC1-4D67-B217-59DB692DFC53}” -> {HKLM…CLSID} = “Mario Forever Toolbar” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{463DF6D5-BEC1-4D67-B217-59DB692DFC53}” = “Mario Forever Toolbar” -> {HKLM…CLSID} = “Mario Forever Toolbar” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] “{5345A7A9-805A-4923-B505-86B2FEBA3FE0}” = (no title provided) -> {HKLM…CLSID} = “iMeshBar” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [“iMesh”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{5345A7AE-805A-4923-B505-86B2FEBA3FE0}(Default) = “iMeshBar Quick View” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\WINNT\system32\shdocvw.dll” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ “ButtonText” = “ICQ Lite” “MenuText” = “ICQ Lite” “Exec” = “C:\Program Files\ICQLite\ICQLite.exe” [“ICQ Ltd.”] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{E6FF30C0-48CE-0DF4-DF28-1EEA14325131}” = “powerdll” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = " ExchangeMaster.dll” [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINNT\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] kavsvc, kavsvc, ““C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe”” [“Kaspersky Lab”] System zdarzeń COM+, EventSystem, “C:\WINNT\System32\svchost.exe -k netsvcs” {“C:\WINNT\System32\es.dll” [null data]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor BJC-250\Driver = “CNMLM14.DLL” [“CANON INC.”] hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 83 seconds. ---------- (total run time: 133 seconds)

Bieniol · 21 Listopad 2006 21:26

Użyj narzędzia -> SmitFraudFix (w trybie awaryjnym z opcji 2 )

Użyj narzędzia FixWareOut

Po zabiegach nowe logi + raport ze smitFraudFix + raport z FixWareOut

Złączono Posta : 22.11.2006 (Sro) 17:21

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (jeżeli jakieś znaczki są żółte, to niech takie zostaną). Po użyciu tego narzędzia wymagany jest reset sysa.

W trybie awaryjnym z wyłączonym przywracaniem systemu usuwasz (wpisy Hijackiem, pliki/foldery na czerwono ręcznie z dysku):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) R3 - URLSearchHook: (no name) - {E6FF30C0-48CE-0DF4-DF28-1EEA14325131} - ExchangeMaster.dll (file missing) F2 - REG:system.ini: UserInit=userinit.exe,C:\WINNT\SERVICES.EXE O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Programy\iMesh\iMesh5\iMeshBHO.dll O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL O2 - BHO: YA2GOOGLE - {89731480-D47D-4DC4-8A36-BAAE55E094C5} - C:\WINNT\explorer.dll O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL O4 - HKLM…\RunServices: [Windows ASN4 Services] bot.exe O4 - Startup: MSWin-917368498.exe O17 - HKLM\System\CCS\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CCS\Services\Tcpip…{761F4E62-3280-4009-9CC9-734B7E94C110}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS1\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS2\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O20 - AppInit_DLLs: pushow51.dll O20 - Winlogon Notify: rpcc - C:\WINNT\system32\rpcc.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINNT\system32\vbsys2.dll (file missing)

Uzyj narzędzia -> Rustock.b-fix

Po zabiegach nowe logi

Mini · 22 Listopad 2006 17:13

jeśli możesz to napisz do mnie na gg

Bieniol · 22 Listopad 2006 17:36

Wszystkie sprawy załatwiamy na forum. Po zabiegach które wymieniłem wyżej daj nowe logi

Mini · 22 Listopad 2006 18:06

w tym WWDC te znaczki po zmienieniu maja byc zielone czy czerwone? jak sie wylacza przywracanie systemu? I jak zmienie te znaczki , wylacze przywracanie systemu to pozniej w trybie awaryjnym te rzeczy zaznaczone na czerwono normalnei usunac ?

Bieniol · 22 Listopad 2006 18:14

Mają być zielone. Zmieniasz klikając koło znaczna na przycisk

Panel sterowania --> System --> Przywracanie systemu

Tam zaznacz opcję Turn off System Restore lub Turn off System Restore on all drives (Wyłącz przywracanie na wszystkich dyskach). Zatwierdzasz wszystkie zmiany.

Pliki na czerwono usuwasz ręcznie z dysku

Mini · 22 Listopad 2006 18:26

jak nacisne na system to wyskauje mi takie okienko z 5 zakladkami ogolne, identyfikacja sieciowa, sprzet, profile uzytkownika, zaawansowane

niezabardzo widze tu wylaczanie przywracania systemu

Bieniol · 22 Listopad 2006 18:30

Bardzo przepraszam - mój bład. Dopiero teraz zauważyłem, że masz system 2000, a on nie ma przywracania systemu. Opuszczasz ten krok

Mini · 22 Listopad 2006 19:03

Logfile of HijackThis v1.99.1 Scan saved at 20:02:01, on 2006-11-22 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\locator.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe C:\Documents and Settings\Administrator\Pulpit\Gry\programy\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 217.98.20.20:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) R3 - URLSearchHook: (no name) - {E6FF30C0-48CE-0DF4-DF28-1EEA14325131} - ExchangeMaster.dll (file missing) F2 - REG:system.ini: UserInit=userinit.exe,C:\WINNT\SERVICES.EXE O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Programy\iMesh\iMesh5\iMeshBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Programy\GetRight\xx2gr.dll O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL (file missing) O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll O2 - BHO: YA2GOOGLE - {89731480-D47D-4DC4-8A36-BAAE55E094C5} - C:\WINNT\explorer.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL (file missing) O4 - HKLM…\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [razertra] C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\RunServices: [Windows ASN4 Services] bot.exe O4 - HKCU…\Run: [skype] “C:\Programy\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Komunikator] C:\Programy\Tlen\tlen.exe O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Download with GetRight Pro - C:\Programy\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programy\GetRight\GRbrowse.htm O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra ‘Tools’ menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {4B1A4A31-8845-11D5-9769-00B0D071D434} (Avaya ICM Client) - https://uslugi.ingnn.pl/webchat/icm/caller.cab O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_14.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/se … loader.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CCS\Services\Tcpip…{761F4E62-3280-4009-9CC9-734B7E94C110}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS1\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS2\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O20 - AppInit_DLLs: pushow51.dll O20 - Winlogon Notify: rpcc - C:\WINNT\system32\rpcc.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINNT\system32\vbsys2.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IXP000.TMP\MsiExec.exe (file missing)

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows 2000 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Skype” = ““C:\Programy\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Komunikator” = “C:\Programy\Tlen\tlen.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Resume copy” = “copyfstq.exe /startup” [null data] “Synchronization Manager” = “mobsync.exe /logon” [MS] “razertra” = “C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe” [“Razer Inc.”] “TkBellExe” = ““C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {00000000-6CB0-410C-8C3D-8FA8D2011D0A}(Default) = (no title provided) -> {HKLM…CLSID} = “DownloadRedirect Class” \InProcServer32(Default) = “C:\Programy\iMesh\iMesh5\iMeshBHO.dll” [“iMesh Ltd”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}(Default) = “***” (unwritable string) -> {HKLM…CLSID} = “bho2gr Class” \InProcServer32(Default) = “C:\Programy\GetRight\xx2gr.dll” [“Headlight Software, Inc.”] {5345A7A1-805A-4923-B505-86B2FEBA3FE0}(Default) = “iMeshBar BHO” -> {HKLM…CLSID} = “iMeshBar BHO” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [file not found] {8036D4D7-AAD3-4793-AB49-329E437155A8}(Default) = (no title provided) -> {HKLM…CLSID} = “Mario Forever Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] {89731480-D47D-4DC4-8A36-BAAE55E094C5}(Default) = “YA2GOOGLE” -> {HKLM…CLSID} = “MExplorer Class” \InProcServer32(Default) = “C:\WINNT\explorer.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINNT\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” = “ICQ Lite Shell Extension” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Programy\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{64BC5640-700F-4E7E-8462-D3092DD74B0F}” = “VDMSound LaunchPad” -> {HKLM…CLSID} = “LaunchPadShellEx Class” \InProcServer32(Default) = “C:\Programy\VDMSound\LaunchPad.dll” [empty string] “{B7056B8E-4F99-44f8-8CBD-282390FE5428}” = “VirtualCloneDrive” -> {HKLM…CLSID} = “VirtualCloneDrive Shell Extension” \InProcServer32(Default) = “C:\Programy\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll” [“Elaborate Bytes AG”] “{A4D78B20-6E05-1069-8758-4E73FD83DEAD}” = “QCopy” -> {HKLM…CLSID} = “QCopy” \InProcServer32(Default) = “dropcpyr.dll” [null data] “{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}” = “My Logitech Pictures” -> {HKLM…CLSID} = “My Logitech Pictures” \InProcServer32(Default) = “C:\Programy\Logitech\Video\Namespc2.dll” [“Logitech Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “SystemCheck2” = “{54645654-2225-4455-44A1-9F4543D34546}” -> {HKLM…CLSID} = “System Check Application” \InProcServer32(Default) = “C:\WINNT\system32\vbsys2.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <> “AppInit_DLLs” = “pushow51.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ <> “Userinit” = “userinit.exe,C:\WINNT\SERVICES.EXE” [MS], [file not found] “System” = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] <> rpcc\DLLName = “C:\WINNT\system32\rpcc.dll” [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Programy\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ FineReader(Default) = “{AC0DD14A-8F29-4F88-BE1D-0F0ED1B06C9F}” -> {HKLM…CLSID} = “FineReaderExplorerContextMenuHandler” \InProcServer32(Default) = “c:\program files\abbyy finereader 7.0 professional edition\fecmenu.dll” [“ABBYY (BIT Software)”] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta(Default) = “XnView.Image” <> HKLM\Software\Classes\XnView.Image\shell\open\command(Default) = "“C:\Programy\XnView\xnview.exe” “%1"” [“XnView, http://www.xnview.com”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “CDRAutoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoBandCustomize” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Internet Explorer|Toolbars| Disable customizing browser toolbars} “NoWindowsUpdate” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove links and access to Windows Update} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “Administrator” & “All Users” startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Kaspersky Anti-Hacker” -> shortcut to: “C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe /silence” [“Kaspersky Lab”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\rnr20.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 27 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{5345A7A9-805A-4923-B505-86B2FEBA3FE0}” -> {HKLM…CLSID} = “iMeshBar” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [file not found] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{463DF6D5-BEC1-4D67-B217-59DB692DFC53}” -> {HKLM…CLSID} = “Mario Forever Toolbar” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{463DF6D5-BEC1-4D67-B217-59DB692DFC53}” = “Mario Forever Toolbar” -> {HKLM…CLSID} = “Mario Forever Toolbar” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] “{5345A7A9-805A-4923-B505-86B2FEBA3FE0}” = (no title provided) -> {HKLM…CLSID} = “iMeshBar” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [file not found] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{5345A7AE-805A-4923-B505-86B2FEBA3FE0}(Default) = “iMeshBar Quick View” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\WINNT\system32\shdocvw.dll” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ “ButtonText” = “ICQ Lite” “MenuText” = “ICQ Lite” “Exec” = “C:\Program Files\ICQLite\ICQLite.exe” [“ICQ Ltd.”] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{E6FF30C0-48CE-0DF4-DF28-1EEA14325131}” = “powerdll” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “ExchangeMaster.dll” [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINNT\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] kavsvc, kavsvc, ““C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe”” [“Kaspersky Lab”] System zdarzeń COM+, EventSystem, “C:\WINNT\System32\svchost.exe -k netsvcs” {“C:\WINNT\System32\es.dll” [null data]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor BJC-250\Driver = “CNMLM14.DLL” [“CANON INC.”] hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 70 seconds. ---------- (total run time: 105 seconds)

Joan · 22 Listopad 2006 19:29

Ściągasz narzędzie KillBox, zaznaczasz Delete on Reboot, potem klikasz All Files i wklejasz do pola Full Path of File to Delete ścieżki:

C:\WINNT\System32\rpcc.dll

C:\WINNT\SERVICES.EXE

Klikasz X i reset sysa.

Użyj narzędzia FixWareOut

W HJT odpalonym w trybie awaryjnym zaznaczasz wpisy i klikasz na dole “Fix checked” , to co na czerwono usuwasz ręcznie z dysku:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) R3 - URLSearchHook: (no name) - {E6FF30C0-48CE-0DF4-DF28-1EEA14325131} - ExchangeMaster.dll (file missing) F2 - REG:system.ini: UserInit=userinit.exe,C:\WINNT\SERVICES.EXE O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Programy\iMesh\iMesh5\iMeshBHO.dll O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL (file missing) O2 - BHO: YA2GOOGLE - {89731480-D47D-4DC4-8A36-BAAE55E094C5} - C:\WINNT\explorer.dll (file missing) O17 - HKLM\System\CCS\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CCS\Services\Tcpip…{761F4E62-3280-4009-9CC9-734B7E94C110}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS1\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS2\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O20 - AppInit_DLLs: pushow51.dll O20 - Winlogon Notify: rpcc - C:\WINNT\system32\rpcc.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINNT\system32\vbsys2.dll (file missing)

Po zabiegach nowe logi i C:\Fixwareout\report.txt oraz raport ze SmitFruadFix, którego nie wkleiłeś

Mini · 26 Listopad 2006 19:24

Ok. Dzieki juz wszystko dziala

adam9870 · 26 Listopad 2006 19:31

Skoro wszystko zrobiłeś to wklej zestaw nowych logów oraz raport z Fixwareout.

Mini · 2 Grudzień 2006 20:32

Logfile of HijackThis v1.99.1 Scan saved at 21:27:44, on 2006-12-02 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\locator.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe C:\Programy\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Windows Media Player\mplayer2.exe C:\Documents and Settings\Administrator\Pulpit\Gry\programy\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 217.98.20.20:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) R3 - URLSearchHook: (no name) - {E6FF30C0-48CE-0DF4-DF28-1EEA14325131} - ExchangeMaster.dll (file missing) F2 - REG:system.ini: UserInit=userinit.exe,C:\WINNT\SERVICES.EXE O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Programy\iMesh\iMesh5\iMeshBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Programy\GetRight\xx2gr.dll O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL (file missing) O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll O2 - BHO: YA2GOOGLE - {89731480-D47D-4DC4-8A36-BAAE55E094C5} - C:\WINNT\explorer.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL (file missing) O4 - HKLM…\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [razertra] C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\RunServices: [Windows ASN4 Services] bot.exe O4 - HKCU…\Run: [skype] “C:\Programy\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Komunikator] C:\Programy\Tlen\tlen.exe O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Download with GetRight Pro - C:\Programy\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programy\GetRight\GRbrowse.htm O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra ‘Tools’ menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {4B1A4A31-8845-11D5-9769-00B0D071D434} (Avaya ICM Client) - https://uslugi.ingnn.pl/webchat/icm/caller.cab O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_14.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/se … loader.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CCS\Services\Tcpip…{761F4E62-3280-4009-9CC9-734B7E94C110}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS1\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O17 - HKLM\System\CS2\Services\Tcpip…{31973BF1-FC5F-4DE0-BB54-B7DADDD31FD4}: NameServer = 85.255.114.194,85.255.112.129 O20 - AppInit_DLLs: pushow51.dll O20 - Winlogon Notify: rpcc - C:\WINNT\system32\rpcc.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINNT\system32\vbsys2.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IXP000.TMP\MsiExec.exe (file missing)

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows 2000 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Skype” = ““C:\Programy\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Komunikator” = “C:\Programy\Tlen\tlen.exe” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Resume copy” = “copyfstq.exe /startup” [null data] “Synchronization Manager” = “mobsync.exe /logon” [MS] “razertra” = “C:\Program Files\TerraTec Electronic GmbH\Mystify Razer\razertra.exe” [“Razer Inc.”] “TkBellExe” = ““C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {00000000-6CB0-410C-8C3D-8FA8D2011D0A}(Default) = (no title provided) -> {HKLM…CLSID} = “DownloadRedirect Class” \InProcServer32(Default) = “C:\Programy\iMesh\iMesh5\iMeshBHO.dll” [“iMesh Ltd”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Programy\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}(Default) = “****>*A**************” (unwritable string) -> {HKLM…CLSID} = “bho2gr Class” \InProcServer32(Default) = “C:\Programy\GetRight\xx2gr.dll” [“Headlight Software, Inc.”] {5345A7A1-805A-4923-B505-86B2FEBA3FE0}(Default) = “iMeshBar BHO” -> {HKLM…CLSID} = “iMeshBar BHO” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [file not found] {8036D4D7-AAD3-4793-AB49-329E437155A8}(Default) = (no title provided) -> {HKLM…CLSID} = “Mario Forever Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] {89731480-D47D-4DC4-8A36-BAAE55E094C5}(Default) = “YA2GOOGLE” -> {HKLM…CLSID} = “MExplorer Class” \InProcServer32(Default) = “C:\WINNT\explorer.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINNT\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” = “ICQ Lite Shell Extension” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Programy\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{64BC5640-700F-4E7E-8462-D3092DD74B0F}” = “VDMSound LaunchPad” -> {HKLM…CLSID} = “LaunchPadShellEx Class” \InProcServer32(Default) = “C:\Programy\VDMSound\LaunchPad.dll” [empty string] “{B7056B8E-4F99-44f8-8CBD-282390FE5428}” = “VirtualCloneDrive” -> {HKLM…CLSID} = “VirtualCloneDrive Shell Extension” \InProcServer32(Default) = “C:\Programy\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll” [“Elaborate Bytes AG”] “{A4D78B20-6E05-1069-8758-4E73FD83DEAD}” = “QCopy” -> {HKLM…CLSID} = “QCopy” \InProcServer32(Default) = “dropcpyr.dll” [null data] “{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}” = “My Logitech Pictures” -> {HKLM…CLSID} = “My Logitech Pictures” \InProcServer32(Default) = “C:\Programy\Logitech\Video\Namespc2.dll” [“Logitech Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “SystemCheck2” = “{54645654-2225-4455-44A1-9F4543D34546}” -> {HKLM…CLSID} = “System Check Application” \InProcServer32(Default) = “C:\WINNT\system32\vbsys2.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <> “AppInit_DLLs” = “pushow51.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ <> “Userinit” = “userinit.exe,C:\WINNT\SERVICES.EXE” [MS], [file not found] “System” = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] <> rpcc\DLLName = “C:\WINNT\system32\rpcc.dll” [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Programy\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ICQLiteMenu(Default) = “{73B24247-042E-4EF5-ADC2-42F62E6FD654}” -> {HKLM…CLSID} = “MCLiteShellExt Class” \InProcServer32(Default) = “C:\Program Files\ICQLite\ICQLiteShell.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ FineReader(Default) = “{AC0DD14A-8F29-4F88-BE1D-0F0ED1B06C9F}” -> {HKLM…CLSID} = “FineReaderExplorerContextMenuHandler” \InProcServer32(Default) = “c:\program files\abbyy finereader 7.0 professional edition\fecmenu.dll” [“ABBYY (BIT Software)”] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Programy\WinRAR\rarext.dll” [null data] Default executables: -------------------- HKLM\Software\Classes.hta(Default) = “XnView.Image” <> HKLM\Software\Classes\XnView.Image\shell\open\command(Default) = "“C:\Programy\XnView\xnview.exe” “%1"” [“XnView, http://www.xnview.com”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “CDRAutoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoBandCustomize” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Internet Explorer|Toolbars| Disable customizing browser toolbars} “NoWindowsUpdate” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove links and access to Windows Update} “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Favorites menu from Start Menu} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Documents menu from Start Menu} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ClearRecentDocsOnExit” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSharedDocuments” = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoRecentDocsMenu” = (REG_DWORD) hex:0x00000001 {unrecognized setting} “NoFavoritesMenu” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyDocs” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMMyPictures” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoStartMenuMyMusic” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsHistory” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRecentDocsNetHood” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSMHelp” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoRun” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\ “DisableWindowsUpdateAccess” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Update| Remove access to use all Windows Update features} HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\ “NoUpdateCheck” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “Administrator” & “All Users” startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Kaspersky Anti-Hacker” -> shortcut to: “C:\Programy\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe /silence” [“Kaspersky Lab”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\rnr20.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 27 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{5345A7A9-805A-4923-B505-86B2FEBA3FE0}” -> {HKLM…CLSID} = “iMeshBar” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [file not found] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{463DF6D5-BEC1-4D67-B217-59DB692DFC53}” -> {HKLM…CLSID} = “Mario Forever Toolbar” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{463DF6D5-BEC1-4D67-B217-59DB692DFC53}” = “Mario Forever Toolbar” -> {HKLM…CLSID} = “Mario Forever Toolbar” \InProcServer32(Default) = “C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll” [null data] “{5345A7A9-805A-4923-B505-86B2FEBA3FE0}” = (no title provided) -> {HKLM…CLSID} = “iMeshBar” \InProcServer32(Default) = “C:\Program Files\iMeshBar\bar\4.bin\IMESHBAR.DLL” [file not found] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{5345A7AE-805A-4923-B505-86B2FEBA3FE0}(Default) = “iMeshBar Quick View” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\WINNT\system32\shdocvw.dll” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ “ButtonText” = “ICQ Lite” “MenuText” = “ICQ Lite” “Exec” = “C:\Program Files\ICQLite\ICQLite.exe” [“ICQ Ltd.”] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{E6FF30C0-48CE-0DF4-DF28-1EEA14325131}” = “powerdll” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “ExchangeMaster.dll” [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINNT\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] kavsvc, kavsvc, ““C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe”” [“Kaspersky Lab”] System zdarzeń COM+, EventSystem, “C:\WINNT\System32\svchost.exe -k netsvcs” {“C:\WINNT\System32\es.dll” [null data]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor BJC-250\Driver = “CNMLM14.DLL” [“CANON INC.”] hpzsnt10\Driver = “hpzsnt10.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 46 seconds, including 7 seconds for message boxes)

Bieniol · 3 Grudzień 2006 08:03

Nic z tego, co napisała Joan nie jest zrobione. Wykonaj to jeszcze raz (dokładnie) i wróć tutaj z logami