a wiec najpierw wkleje loga
Logfile of HijackThis v1.99.1
Scan saved at 10:35:25, on 2006-02-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\games\bot\Tibia.exe
C:\WINDOWS\system32\cidaemon.exe
D:\instalki\internet\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {2F343C20-52AA-11D8-AE8E-BD0D54BF2261} (ArabicTextBox2.8) - http://www.summitsoft.co.uk/AEditX.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www3.ca.com/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
teraz pokaze wynik skanowania w pestscan :
Trojan "SpywareStrike" found in:
key "hkey_classes_root \interface\{0f345791-d507-4f1c-9e44-8beec61d6148}"
key "hkey_classes_root \interface\{15462503-7597-4662-9c63-31c42112d4e9}"
key "hkey_classes_root \interface\{17412fea-fb37-4fc0-b689-dcf84fc7fb0a}"
key "hkey_classes_root \interface\{4dc8dca1-191d-4bd9-bcfe-44df358ae036}"
key "hkey_classes_root \interface\{5b395871-7173-4b84-986a-a7112f1bdb45}"
key "hkey_classes_root \interface\{72daa86e-db4a-42b0-b82a-41a6de2b315e}"
key "hkey_classes_root \interface\{732eb0fc-c608-40b1-b524-b092e3915316}"
key "hkey_classes_root \interface\{8504b09f-e628-4af9-8f8f-f2f73e4b46ab}"
key "hkey_classes_root \interface\{8d6083dc-ad33-44db-a8f1-b3b520af9891}"
key "hkey_classes_root \interface\{900fe140-70c1-4043-b32d-c89412399fb6}"
key "hkey_classes_root \interface\{95a5de55-9979-4507-a521-2e1f8bcc61ab}"
key "hkey_classes_root \interface\{a1c155d5-80a0-4bf2-ac7a-53b027c47879}"
key "hkey_classes_root \interface\{b5775c39-bfef-4fa2-a194-550807a95146}"
key "hkey_classes_root \interface\{ca8beb64-4a47-411b-87a1-488643df9521}"
key "hkey_classes_root \interface\{d0ab917d-1645-4eeb-b9bb-b33103845ed9}"
key "hkey_classes_root \interface\{e809d2ae-7550-4540-bd5c-4e214ee86661}"
key "hkey_classes_root \typelib\{ed9f5c8f-c607-4928-9d6c-47484e9a0fee}"
i jeszcze cos
Key Logger "Advanced KEYLOGGER" found in:
key "hkey_local_machine \software\licenses" value "{k7c0db872a3f777c0}"
key "hkey_local_machine \software\licenses" value "{r7c0db872a3f777c0}"
wczesniej wyskakiwala mi chmurka “YOUR COMPUTER IS INFECTED” ale usunalem program spyware strike recznie i znikla , ale czuje ze mam keylogery w kompie ;////
pomocy , i powiedzcie krok po kroku jak sie pozbyc tego scierwa:)
ps chcialem dodac ze czasami mi sie komp zwiesza tak po prostu
ps 2 czasami zamienia sie rozdzielczosc i bity tak jakby w trybie awaryjnym i cos pisze ze sterownik akrty grficznej jest jakis zly czy cos