System alert :/

Szczepi · 7 Lipiec 2007 19:08

log z hjt:

Logfile of HijackThis v1.99.1 Scan saved at 21:07:52, on 2007-07-07 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\brss01a.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Programy\Winamp\winampa.exe C:\Programy\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\explorer.exe C:\Programy\Opera\Opera.exe E:\Instalki\hijackthis\HijackThis.exe O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Video ActiveX Access\iesbpl.dll O4 - HKLM…\Run: [WinampAgent] C:\Programy\Winamp\winampa.exe O4 - HKLM…\Run: [ZoneAlarm Client] “C:\Programy\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O17 - HKLM\System\CCS\Services\Tcpip…{9D89F113-5619-405F-8AB0-CD402A659EB8}: NameServer = 85.255.114.66,85.255.112.130 O17 - HKLM\System\CCS\Services\Tcpip…{A50D9470-4411-4F37-B29A-8CFFCF04F2F2}: NameServer = 85.255.114.66,85.255.112.130 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.66 85.255.112.130 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.66 85.255.112.130 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.66 85.255.112.130 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Pojawia mi sie chmurka System Alert oraz wyskoczył mi błąd ze wystapił poważny błąd w systemie :? Prosze o pomoc.

anon94597501 · 7 Lipiec 2007 19:20

Usuń:

MSIE: Internet Explorer v6.00 (6.00.2600.0000)


O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Video ActiveX Access\iesbpl.dll


O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.66 85.255.112.130


O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.66 85.255.112.130


 	O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.66 85.255.112.130

Podaj ponownie log z Hijack,

Opis ComboFix - przeczytaj pierwszy post mówiący o ComboFix, i zapodaj z niego log.

BTW.

Ściągnij te programy:

Spybot - Search & Destroy 1.5 - usuwanie na przyszlość spyware(szpiegów)

Odkurzacz 10 - oczyszczanie dysku

jv16 PowerTools 2007 - oczyszczanie rejestru

Szczepi · 7 Lipiec 2007 19:31

HJT

Logfile of HijackThis v1.99.1 Scan saved at 21:25:32, on 2007-07-07 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\brss01a.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Programy\Winamp\winampa.exe C:\Programy\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\explorer.exe C:\Programy\Opera\Opera.exe C:\Programy\Xfire\Xfire.exe C:\Programy\Teamspeak2_RC2\TeamSpeak.exe E:\Instalki\comboscan.exe E:\Instalki\hijackthis\HijackThis.exe O4 - HKLM…\Run: [WinampAgent] C:\Programy\Winamp\winampa.exe O4 - HKLM…\Run: [ZoneAlarm Client] “C:\Programy\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O17 - HKLM\System\CCS\Services\Tcpip…{9D89F113-5619-405F-8AB0-CD402A659EB8}: NameServer = 85.255.114.66,85.255.112.130 O17 - HKLM\System\CCS\Services\Tcpip…{A50D9470-4411-4F37-B29A-8CFFCF04F2F2}: NameServer = 85.255.114.66,85.255.112.130 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Combofix(po użyciu narzędzia chmurka system alert zniknęła):

“Szczepan” - 2007-07-07 21:28:13 - ComboFix 07-07-07.3 ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALLUSE~1\DANEAP~1.\TEMP C:\Program Files\video activex access C:\Program Files\video activex access\iesbpl.dll C:\Program Files\video activex access\iesbunst.exe C:\Program Files\video activex access\iesmin.exe C:\Program Files\video activex access\iesmn.exe C:\Program Files\video activex access\iesunst.exe C:\Program Files\video activex access\imsmain.exe C:\Program Files\video activex access\imsmn.exe C:\Program Files\video activex access\imsunst.exe C:\Program Files\video activex access\ot.ico C:\Program Files\video activex access\ts.ico C:\Program Files\video activex access\uninst.exe C:\WINDOWS\system32\xnvaogd.dll ((((((((((((((((((((((((( Files Created from 2007-06-07 to 2007-07-07 ))))))))))))))))))))))))))))))) 2007-07-05 18:29 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-07-05 18:29 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-07-05 18:29 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-07-05 18:29 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-07-05 18:29 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-07-05 18:29 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-07-05 18:29 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-07-05 18:29 2007-07-05 18:29 2007-07-05 18:26 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-07-05 18:26 249,856 --------- C:\WINDOWS\Setup1.exe 2007-07-03 16:02 2007-06-26 20:44 2007-06-19 18:42 22,584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-06-19 18:09 99,904 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-06-19 18:09 63,040 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-06-19 18:09 2007-06-14 14:28 182,880 --a------ C:\WINDOWS\system32\iuengine.dll 2007-06-14 14:28 2007-06-13 10:08 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-07 19:20:48 -------- d-----w C:\DOCUME~1\Szczepan\DANEAP~1\Xfire 2007-07-07 19:19:36 -------- d-----w C:\DOCUME~1\Szczepan\DANEAP~1\teamspeak2 2007-07-07 19:03:56 610 ----a-w C:\WINDOWS\system32\tmp.reg 2007-06-22 21:17:38 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-06-16 22:11:58 51,200 ----a-w C:\WINDOWS\nircmd.exe 2007-06-06 22:08:42 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-06-06 21:45:58 -------- d-----w C:\Program Files\Activision 2007-05-13 16:01:35 -------- d-----r C:\DOCUME~1\Szczepan\DANEAP~1\Brother 2007-05-13 16:01:12 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-13 16:00:29 50 ----a-w C:\WINDOWS\system32\bridf05a.dat 2007-05-13 15:42:27 -------- d-----w C:\DOCUME~1\Szczepan\DANEAP~1\ScanSoft 2007-05-13 15:35:49 -------- d-----w C:\Program Files\Common Files\ScanSoft Shared 2007-05-13 15:35:40 -------- d-----w C:\Program Files\ScanSoft 2007-05-12 12:52:39 62,592 ----a-w C:\WINDOWS\system32\drivers\moufiltr.sys 2007-05-11 19:28:37 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-27 18:46:38 4,212 —h–w C:\WINDOWS\system32\zllictbl.dat 2007-04-27 18:18:11 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-27 18:18:11 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-27 17:44:29 0 --sha-r C:\MSDOS.SYS 2007-04-27 17:44:29 0 --sha-r C:\IO.SYS 2007-04-27 17:44:29 0 ----a-w C:\CONFIG.SYS 2007-04-27 17:44:29 0 ----a-w C:\AUTOEXEC.BAT 2007-04-27 17:40:54 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WinampAgent”=“C:\Programy\Winamp\winampa.exe” [2006-10-25 07:37] “ZoneAlarm Client”=“C:\Programy\Zone Labs\ZoneAlarm\zlclient.exe” [2007-03-09 00:02] “PaperPort PTD”=“C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe” [2005-03-17 14:25] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] “{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}”=“C:\WINDOWS\System32\xnvaogd.dll” [] HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-07 21:28:48 Windows 5.1.2600 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-07 21:29:34 C:\ComboFix-quarantined-files.txt … 2007-07-07 21:29 — E O F —

Hmm mam firewall’a, więc miałem nadzieje, że narzędzia podane przez Ciebie nie są konieczne

Fighter · 7 Lipiec 2007 19:43

ATF Cleaner

Bardzo użyteczny programik do czyszczenia tempów i nie tylko

http://cybertrash.pl/images/tata/ATF/ATF.html

AVG AntiSpyware 7.5

http://www.ewido.net/en/download/

Update i skan

bodek32 · 7 Lipiec 2007 19:58

Start>uruchom>cmd i wpisz komendy

sc stop BrSplService

sc delete BrSplService

Skasuj pogrubiony plik

A wpis skasuj w hijacku

Co do tego

Skasuj wpisy w hijacku i zastosuj Fixwareout

I pokaż nowe logi + C:\fixwareout\report.txt

Gutek · 8 Lipiec 2007 10:48

Fighter daruj sobie sprawdzanie logów :evil:

bodek32 - nie wypisuj bzdur

wpis jet Ok nie usuwaj :x

Daj log z Combofix

Użyj SmitFraudFix wybierz opcji nr 2 , oczywiście w trybie awaryjnym i po tym nowy log z Combofix

Użyj FixWareOut - http://downloads.subratam.org/Fixwareout.exe