Wirus w *.bmp

[Alienz (Dawid Rylski)]

Hm, dostałem od pewnej podejrzanej osoby screen w formacie .bmp, przeskanowalem na stronie virusscan.jotti.org gdzie skanuje się 13 antywirusami i nic nie wykryło, potem otworzyłem i był to normalny screen ekranu z pewnej gry. Czy możliwe jest, że plik ten jest zainfekowany? Przypuszczam, że może to być jakiś keylogger w celu zdobycia mojego hasła w pewnej grze… co sądzicie? formatowac dysk, czy jak? ;->

Log z hijackthis :

Logfile of HijackThis v1.99.1 Scan saved at 14:54:12, on 2007-07-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\rmctrl.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Konnekt\konnekt.exe C:\Program Files\Opera\Opera.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Documents and Settings\z\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - D:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM…\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” O4 - HKLM…\Run: [HP Component Manager] “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe” O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM…\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM…\Run: [!AVG Anti-Spyware] “D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download Link Using Mega Manager… - D:\Program Files\Megaupload\Mega Manager\mm_file.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O17 - HKLM\System\CCS\Services\Tcpip…{3F4EE2A6-875B-46C0-A89E-C38DB10B9236}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Po sprawdzeniu na hijackthis.de wynikło, że plik ALMTR.EXE jest zainfekowany, działa on w Windows/CurrentVersion/Run i w sumie nie wiem jak go skasowac i czy go kasowac, czy to nie uszkodzi systemu, czy to nie jest plik systemowy, co to w ogole jest? Kasować to?

Log z Silent Runner:

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “RemoteControl” = “C:\WINDOWS\system32\rmctrl.exe” [null data] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “SkyTel” = “SkyTel.EXE” [“Realtek Semiconductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] “SpeedTouch USB Diagnostics” = ““C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [“THOMSON Telecom Belgium”] “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] “HP Software Update” = ““C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe”” [“Hewlett-Packard”] “HP Component Manager” = ““C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”” [“Hewlett-Packard Company”] “HPDJ Taskbar Utility” = “C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe” [“HP”] “DeviceDiscovery” = “C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe” [“Hewlett-Packard”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}(Default) = (no title provided) -> {HKLM…CLSID} = “MEGAUPLOADTOOLBAR” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” [“MegaUpload”] {bf00e119-21a3-4fd1-b178-3b8537e75c92}(Default) = “Mega Manager IE Click Monitor” -> {HKLM…CLSID} = “IeMonitorBho Class” \InProcServer32(Default) = “D:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll” [“Megaupload Limited”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] “{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “Nokia Phone Browser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “D:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“GRISOFT s.r.o.”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“GRISOFT s.r.o.”] NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“GRISOFT s.r.o.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “LinkResolveIgnoreLinkInfo” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoResolveSearch” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\z\Dane aplikacji\Opera\Opera\profile\skin\tapetazronaldinhogltpl9zq.bmp” Startup items in “z” & “All Users” startup folders: --------------------------------------------------- C:\Documents and Settings\z\Menu Start\Programy\Autostart “Adobe Gamma” -> shortcut to: “C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe” [“Adobe Systems, Inc.”] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “Adobe Reader Synchronizer” -> shortcut to: “D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe” [null data] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” -> {HKLM…CLSID} = “MEGAUPLOADTOOLBAR” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” [“MegaUpload”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” = (no title provided) -> {HKLM…CLSID} = “MEGAUPLOADTOOLBAR” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” [“MegaUpload”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\ Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe” [“GRISOFT s.r.o.”] NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Sunbelt Kerio Personal Firewall 4, KPF4, ““C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe”” [“Sunbelt Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzlnt09\Driver = “hpzlnt09.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 41 seconds, including 10 seconds for message boxes)

Skanowałem też komputer AVG Anty-Spyware, wykasowałem kilka wirusów, ale chciałbym się pozbyć tego (prawdopodobnie) keyloggera zawartego w tym pliku .bmp, to ważne, i nie wiem, robić format czy jak, co myślicie?

Hm jeśli tam znajdziecie jakiś zły plik ale nie odnoszący się do tego prawdopodobnego keyloggera, to też mówcie co usuwać, bo mam straszne lagi w grach online mając dobry net i w sumie niezle dzialjący, transfer tez jest dobry , ale to tak przy okazji.

Złączono Posta : 16.07.2007 (Pon) 15:43

@Edit, a co do tego AVG Anty-Spyware, to każdy mowi zeby przeskanowac ‘po update’. Nie bardzo wiem o co chodzi ,sciagnalem AVG z dobreprogramy i tym przeskanowalem system…

[LostWorld]

W logu okej.[HJT]

O8 - Extra context menu item: Download Link Using Mega Manager… - D:\Program Files\Megaupload\Mega Manager\mm_file.htm

O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - D:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

Odinstaluj pasek Megaupload => Toolbar o wątpliwej reputacji.

Zbędniki w Autostracie

Pokaż raport z tego AVG

#Ad-Aware 2007

#SpyBot

#Spyware Terminator

Zrób skan wyżej wymienionymi programami.

Złączono Posta : 16.07.2007 (Pon) 19:29

Skanowałem też komputer AVG Anty-Spyware, wykasowałem kilka wirusów, ale chciałbym się pozbyć tego (prawdopodobnie) keyloggera zawartego w tym pliku .bmp, to ważne, i nie wiem, robić format czy jak, co myślicie?

Po co zaraz format , możesz jeszcze przeskanować skanerem on-line

Ewido

Oczywiście ten podejrzany plik natychmiast wywalasz.

[Alienz (Dawid Rylski)]

A co z ALMTR.EXE, już w kilku logach mówili, że to trzeba usunąć, jak mam to usunąć, to nie jest jakiś plik systemowy? Hijackthis.de stwierdził, że to może być wirus.

Pasek megaupload toolbar mam tylko do ściągania plików z megauploada i działa tylko na IE (którego używam też tylko do ściągania z megauploada), na Operze już tego nie mam, ale oki, usunę.

[LostWorld]

A co z ALMTR.EXE, już w kilku logach mówili, że to trzeba usunąć, jak mam to usunąć, to nie jest jakiś plik systemowy? Hijackthis.de stwierdził, że to może być wirus. Pasek megaupload toolbar mam tylko do ściągania plików z megauploada i działa tylko na IE (którego używam też tylko do ściągania z megauploada), na Operze już tego nie mam, ale oki, usunę.

Toolbar radził bym odinstalować ze wszystkich przeglądarek , a wpis ALMTR możesz zafixować [(zaznaczyc i kliknac na Fix checked)].

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

Opis RegCleaner - http://www.agavk.p9.pl/strony/progra_regcleaner.php

Zrobiłeś skan wyżej wymienionymi programami?

Co z raportem?

Do tego dajesz nowy log z HJT , niestety na Silent się nie znam ;(

[Alienz (Dawid Rylski)]

Hm nie bardzo wiem jak moge zafixować ALMTR, bo ja go znajduję jedynie w start -> msconfig -> uruchamianie

Logi i skany zaraz dorzucę.

Złączono Posta : 16.07.2007 (Pon) 23:44

Ad-Aware SE Build 1.06r1 Logfile Created on:16 lipca 2007 23:37:00 Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R181 16.07.2007 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):21 total references Tracking Cookie(TAC index:3):9 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 2007-07-16 23:37:00 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : C:\Documents and Settings\z\recent Description : list of recently opened documents MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\internet explorer Description : last download directory used in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\mediaplayer\preferences Description : last playlist index loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\mediaplayer\preferences Description : last playlist loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\search assistant\acmru Description : list of recent search terms used with the search assistant MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows\currentversion\applets\paint\recent file list Description : list of files recently opened using microsoft paint MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows\currentversion\applets\wordpad\recent file list Description : list of recent files opened using wordpad MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-21-776561741-790525478-839522115-1003\software\winrar\dialogedithistory\extrpath Description : winrar “extract-to” history Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 552 ThreadCreationTime : 2007-07-16 17:50:35 BasePriority : Normal #:2 [csrss.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 848 ThreadCreationTime : 2007-07-16 17:50:43 BasePriority : Normal #:3 [winlogon.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 872 ThreadCreationTime : 2007-07-16 17:50:44 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 916 ThreadCreationTime : 2007-07-16 17:50:45 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Usługi i aplikacja Kontroler InternalName : services.exe LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 928 ThreadCreationTime : 2007-07-16 17:50:45 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1100 ThreadCreationTime : 2007-07-16 17:50:45 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1144 ThreadCreationTime : 2007-07-16 17:50:46 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1176 ThreadCreationTime : 2007-07-16 17:50:46 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1308 ThreadCreationTime : 2007-07-16 17:50:46 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1408 ThreadCreationTime : 2007-07-16 17:50:46 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1612 ThreadCreationTime : 2007-07-16 17:50:47 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:12 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1848 ThreadCreationTime : 2007-07-16 17:50:48 BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Eksplorator Windows InternalName : explorer LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : EXPLORER.EXE #:13 [rmctrl.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1940 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal #:14 [rthdcpl.exe] FilePath : C:\WINDOWS\ ProcessID : 1956 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 2.0.6.6 ProductVersion : 2.0.6.6 ProductName : Realtek HD Audio Sound Effect Manager CompanyName : Realtek Semiconductor Corp. FileDescription : Realtek HD Audio Control Panel LegalCopyright : Copyright © 2004 Realtek Semiconductor Corp. OriginalFilename : RTHDCPL.EXE #:15 [rundll32.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2000 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Uruchamia plik DLL jako aplikację InternalName : rundll LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : RUNDLL.EXE #:16 [dragdiag.exe] FilePath : C:\Program Files\Thomson\SpeedTouch USB\ ProcessID : 2008 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 301.0.0.12 ProductVersion : 301.0.0.12 ProductName : SpeedTouch USB CompanyName : THOMSON Telecom Belgium FileDescription : SpeedTouch Statistics LegalCopyright : Copyright© THOMSON Telecom Belgium 1999-2004 LegalTrademarks : SpeedTouch #:17 [nod32kui.exe] FilePath : C:\Program Files\Eset\ ProcessID : 2016 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 2, 70, 23 ProductVersion : 2, 70, 23 ProductName : NOD32 Antivirus System CompanyName : Eset FileDescription : NOD32 Control Center GUI InternalName : NOD32 Control Center GUI LegalCopyright : Copyright © 1992-2005 Eset LegalTrademarks : NOD, NOD32, AMON, ESET are registered trademarks of Eset OriginalFilename : nod32kui.exe #:18 [hpwuschd.exe] FilePath : C:\Program Files\Hewlett-Packard\HP Software Update\ ProcessID : 2024 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 1, 0, 0, 2 ProductVersion : 1, 0, 0, 2 ProductName : Hewlett-Packard hpwuSchd CompanyName : Hewlett-Packard FileDescription : hpwuSchd InternalName : hpwuSchd LegalCopyright : Copyright © 2003 OriginalFilename : hpwuSchd.exe #:19 [hpcmpmgr.exe] FilePath : C:\Program Files\HP\hpcoretech\ ProcessID : 2036 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 2.1.1 ProductVersion : 2.1.1 ProductName : hp coretech (COmponent REuse TECHnology) CompanyName : Hewlett-Packard Company FileDescription : HP Framework Component Manager Service InternalName : HPComponentManagerService module LegalCopyright : Copyright © Hewlett-Packard. 2002-2003 OriginalFilename : HPCmpMgr.exe #:20 [hpotdd01.exe] FilePath : C:\Program Files\Hewlett-Packard\Digital Imaging\bin\ ProcessID : 180 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 1, 0, 0, 1 ProductVersion : 1, 0, 0, 1 ProductName : Hewlett-Packard hpotdd01 CompanyName : Hewlett-Packard FileDescription : hpotdd01 InternalName : hpotdd01 LegalCopyright : Copyright © 2002 OriginalFilename : hpotdd01.exe #:21 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 220 ThreadCreationTime : 2007-07-16 17:50:49 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:22 [guard.exe] FilePath : D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\ ProcessID : 292 ThreadCreationTime : 2007-07-16 17:50:55 BasePriority : Normal FileVersion : 7, 5, 1, 22 ProductVersion : 7, 5, 1, 22 ProductName : AVG Anti-Spyware CompanyName : GRISOFT s.r.o. FileDescription : AVG Anti-Spyware guard InternalName : AVG Anti-Spyware guard LegalCopyright : Copyright © 2007 GRISOFT s.r.o. OriginalFilename : guard.exe #:23 [nod32krn.exe] FilePath : C:\Program Files\Eset\ ProcessID : 440 ThreadCreationTime : 2007-07-16 17:50:56 BasePriority : Normal FileVersion : 2, 70, 23 ProductVersion : 2, 70, 23 ProductName : NOD32 Antivirus System CompanyName : Eset FileDescription : NOD32 Kernel Service InternalName : NOD32 Kernel LegalCopyright : Copyright © 1992-2005 Eset LegalTrademarks : NOD, NOD32, AMON, ESET are registered trademarks of Eset OriginalFilename : nod32krn.exe #:24 [nvsvc32.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 472 ThreadCreationTime : 2007-07-16 17:50:56 BasePriority : Normal FileVersion : 6.14.10.9371 ProductVersion : 6.14.10.9371 ProductName : NVIDIA Driver Helper Service, Version 93.71 CompanyName : NVIDIA Corporation FileDescription : NVIDIA Driver Helper Service, Version 93.71 InternalName : NVSVC LegalCopyright : © NVIDIA Corporation. All rights reserved. OriginalFilename : nvsvc32.exe #:25 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 828 ThreadCreationTime : 2007-07-16 17:50:59 BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:26 [wscntfy.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2180 ThreadCreationTime : 2007-07-16 17:51:02 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Security Center Notification App InternalName : wscntfy.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wscntfy.exe #:27 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2432 ThreadCreationTime : 2007-07-16 17:51:03 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:28 [netsoccer.exe] FilePath : D:\Netsoccer\ ProcessID : 2988 ThreadCreationTime : 2007-07-16 21:15:40 BasePriority : Normal #:29 [konnekt.exe] FilePath : C:\Program Files\Konnekt\ ProcessID : 2276 ThreadCreationTime : 2007-07-16 21:15:41 BasePriority : Normal FileVersion : 0.6.22.137 ProductVersion : 0.6 ProductName : Konnekt CompanyName : Stamina FileDescription : Konnekt - Core InternalName : Konnekt LegalCopyright : Copyright ©2002,2003,2004,2005 Stamina #:30 [opera.exe] FilePath : C:\Program Files\Opera\ ProcessID : 3152 ThreadCreationTime : 2007-07-16 21:16:13 BasePriority : Normal FileVersion : 8679 ProductVersion : 9.10 ProductName : Opera Internet Browser CompanyName : Opera Software FileDescription : Opera Internet Browser InternalName : Opera LegalCopyright : Copyright © Opera Software 1995-2006 OriginalFilename : Opera.exe #:31 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 1248 ThreadCreationTime : 2007-07-16 21:36:26 BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 21 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 21 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 21 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : z@partypoker[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:3 Value : Cookie:z@partypoker.com/ Expires : 2017-07-03 12:50:12 LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@adbrite[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:24 Value : Cookie:z@adbrite.com/ Expires : 2008-07-05 12:52:30 LastSync : Hits:24 UseCount : 0 Hits : 24 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@ad.adtoma[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:6 Value : Cookie:z@ad.adtoma.com/ Expires : 2038-01-19 05:14:08 LastSync : Hits:6 UseCount : 0 Hits : 6 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@please[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:1 Value : Cookie:z@ad2.eurobb.net/please/ Expires : 2008-06-10 17:42:30 LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@hit.gemius[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:5 Value : Cookie:z@hit.gemius.pl/ Expires : 2013-01-05 22:59:50 LastSync : Hits:5 UseCount : 0 Hits : 5 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@overture[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:9 Value : Cookie:z@overture.com/ Expires : 2017-07-03 16:43:40 LastSync : Hits:9 UseCount : 0 Hits : 9 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@4.adbrite[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:4 Value : Cookie:z@4.adbrite.com/ Expires : 2007-07-07 12:48:52 LastSync : Hits:4 UseCount : 0 Hits : 4 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@partygaming.122.2o7[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:1 Value : Cookie:z@partygaming.122.2o7.net/ Expires : 2012-07-04 12:50:28 LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking Cookie Object Recognized! Type : IECache Entry Data : z@please[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:2 Value : Cookie:z@ad2.pl.mediainter.net/please/ Expires : 2008-06-08 16:59:54 LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 9 Objects found so far: 30 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 30 Deep scanning and examining files (D:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for D:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 30 Scanning Hosts file… Hosts file location:“C:\WINDOWS\system32\drivers\etc\hosts”. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New critical objects:0 Objects found so far: 30 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 30 23:43:07 Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:06:06.860 Objects scanned:155509 Objects identified:9 Objects ignored:0 New critical objects:9

Log skanu z Ad-Aware 2007, reszte będę wrzucał po kolei, być może dziś, być może jutro.

[LostWorld]

Hm nie bardzo wiem jak moge zafixować ALMTR, bo ja go znajduję jedynie w start -> msconfig -> uruchamianie

Nie.

Włączasz HJT => Zaznaczasz ptaszkiem wpis

O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE

=> Naciskasz Fix Checked

[Alienz (Dawid Rylski)]

Chciałeś raport z AVG, gdzie mogę go znaleźć?

[Bardock (Bardock9)]

W programie AVG Anty-Spyware ? :mrgreen:

[Alienz (Dawid Rylski)]

Ze spyware terminatora, nic nie wykryło, ale wrzucę:

“NOD32krn” = C:\PROGRAM FILES\ESET\NOD32KRN.EXE [Eset] “nv” = C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [NVIDIA Corporation] “NVSvc” = C:\WINDOWS\system32\nvsvc32.exe [NVIDIA Corporation] “PCAMPR5” = C:\WINDOWS\system32\PCAMPR5.SYS [] “PCANDIS5” = C:\WINDOWS\SYSTEM32\PCANDIS5.SYS [Printing Communications Assoc., Inc. (PCAUSA)] “Ptilink” = C:\WINDOWS\system32\DRIVERS\ptilink.sys [Parallel Technologies, Inc.] “PxHelp20” = C:\WINDOWS\System32\Drivers\PxHelp20.sys [sonic Solutions] “Secdrv” = C:\WINDOWS\system32\DRIVERS\secdrv.sys [Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.] “ServiceLayer” = C:\PROGRAM FILES\PC CONNECTIVITY SOLUTION\SERVICELAYER.EXE [Nokia.] “sptd” = C:\WINDOWS\System32\Drivers\sptd.sys [] Protocol Filters Scan Class Install Handler = {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} (C:\WINDOWS\system32\urlmon.dll) [Microsoft Corporation] Hosts Scan LOCALHOST mapping = 1 IE Scan IERESET.INF missing Signature="$CHICAGO$" IERESET.INF missing AdvancedINF=2.5,“You need a new version of advpack.dll” IERESET.INF missing AddReg=RestoreHomePage.reg IERESET.INF missing HKCU,“Software\Microsoft\Internet Explorer\Main”,“Start Page”,0,%START_PAGE_URL% IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main”,“Default_Page_URL”,0,%START_PAGE_URL% IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main”,“Default_Search_URL”,0,%SEARCH_PAGE_URL% IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main”,“Search Page”,0,%SEARCH_PAGE_URL% IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“1”,0,“www.%s.com” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“2”,0,“www.%s.org” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“3”,0,“www.%s.net” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“4”,0,“www.%s.edu” IERESET.INF missing HKCU,“Software\Microsoft\Internet Explorer\Main”,“Search Page”,0,%SEARCH_PAGE_URL% IERESET.INF missing HKCU,“Software\Microsoft\Internet Explorer\SearchUrl”,“Provider”,0,"" IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Search”,“SearchAssistant”,0,“http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Search”,“CustomizeSearch”,0,“http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm” IERESET.INF missing HKLM,“Software\Microsoft\Windows\CurrentVersion\Internet Settings\SafeSites”,%SAFESITE_VALUE%,0,“http://ie.search.msn.com/*” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“5” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“6” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“7” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“8” IERESET.INF missing HKLM,“Software\Microsoft\Internet Explorer\Main\UrlTemplate”,“9” IERESET.INF missing HKCU,“Software\Microsoft\Internet Explorer\Main”,“AutoSearch” IERESET.INF missing SEARCH_PAGE_URL=“http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch” IERESET.INF missing AddReg=RestoreBrowserSettings.reg IERESET.INF missing DelReg=DeleteTemplates.reg or DelReg=DeleteTemplates.reg, DeleteAutosearch.reg IERESET.INF missing START_PAGE_URL=“http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome” or START_PAGE_URL=“http://www.msn.com” IERESET.INF missing SAFESITE_VALUE=“http://home.microsoft.com/” or SAFESITE_VALUE=“ie.search.msn.com” IERESET.INF missing MS_START_PAGE_URL=“http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome” or MS_START_PAGE_URL=“http://www.msn.com” URLSearchHook = {08C06D61-F1F3-4799-86F8-BE1A89362C85} (C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL) [] HIJACK WARNING! WinSock2 Scan Protocol Entry 000000000001 = C:\WINDOWS\system32\imon.dll [Eset] Protocol Entry 000000000002 = C:\WINDOWS\system32\imon.dll [Eset] Protocol Entry 000000000003 = C:\WINDOWS\system32\imon.dll [Eset] Protocol Entry 000000000004 = C:\WINDOWS\system32\imon.dll [Eset] Protocol Entry 000000000005 = C:\WINDOWS\system32\imon.dll [Eset] Protocol Entry 000000000011 = C:\WINDOWS\system32\imon.dll [Eset]

Złączono Posta : 17.07.2007 (Wto) 0:49

W programie AVG Anty-Spyware ? :mrgreen:

Heh, no ale skoro zeskanowałem system i nie zapisałem loga, bo nie wiedzialem ze bedzie potrzebny, to jesli teraz skanuję to tych wirusow juz nie bedzie, wiec dalej log potrzebny?

Złączono Posta : 17.07.2007 (Wto) 1:01

I krótki raport z internetowego skanera online Ewido:

__________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.Webtrends Path: C:\Documents and Settings\z\Cookies\z@m.webtrends[1].txt Risk: Medium Name: TrackingCookie.Netflame Path: C:\Documents and Settings\z\Cookies\z@ssl-hints.netflame[2].txt Risk: Medium

Resztę postaram się zrobić jutro, idę spać

[Gutek]

Już wystarczy tych skanów jest czysto, masz jakis jeszcze problem?

[Alienz (Dawid Rylski)]

Już wystarczy tych skanów jest czysto, masz jakis jeszcze problem?

Hmm, no w sumie nie wiem, czy usunąłem tego keyloggera i czy nie narażam się na stratę konta w tej grze. Pobocznego problemu, czyli lagów w grach online też nie uszykowałem, ale to jest pewnie wina sprzętu/neta, chodź to i to było już sprawdzane…

Aha, i po wrzuceniu loga z hijackthisa po wszystkich skanach na hijackthis.de pokazało, że jeszcze 2 rzeczy do naprawy:

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O17 - HKLM\System\CCS\Services\Tcpip…{3F4EE2A6-875B-46C0-A89E-C38DB10B9236}: NameServer = 213.241.79.37 83.238.255.76

[Gutek]

Aha, i po wrzuceniu loga z hijackthisa po wszystkich skanach na hijackthis.de

to lepiej nie wrzucaj swoje DNS-y chcesz usunąc

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

kosmetycznie po Real Player możesz usunąć HJT

[Alienz (Dawid Rylski)]

Hm, tak jakby dalej nie jestem pewny, czy usunąłem tego keyloggera (jeśli to był keylogger i go miałem)? Jaka mam pewnosc?

[Gutek]

Nie masz co się bać, jest OK