Pomocy - wirus ?

[umfana]

Logfile of HijackThis v1.97.7
Scan saved at 07:25:11, on 2004-08-28
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\eDonkey2000\edonkey2000.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\symlcsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\glophone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trojan Remover\tyo5.exe
C:\Program Files\Trojan Remover\tyo5.exe
C:\FixBlast.exe
C:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.wp.pl/
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program
Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [Miniphone] C:\WINDOWS\glophone.exe /w
O4 - HKLM\..\Run: [eDonkey2000] "D:\eDonkey2000\edonkey2000.exe" -t
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!
\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O9 - Extra button: Voiceglo directory (HKLM)
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) -
www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -
us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4387/mcfscan.cab

[umfana]

Wczoraj surfujac na Oprze wlazalam na jakas strone Yahoo, na ktorej zaatakowaly
mnie reklamy...niekonczaca sie ilosc badziewia.
Stronke dal mi kumpel, abym jakiejs muzy posluchala...
Skutkiem czego musialam zamknac Opere.Dzis moj komp zidiocial.Na Operze
ustawiona mam homepage Yahoo?!
Programy, foldery, pliki nie chca sie otwierac.Totalna paranoja.
Jednym skanerem online wykrywlam trojana i usunelam go, ale dalej fiksuje moj
pecet.
Pomocy!
;(

[kalinowski11]

Na Operze ... niemożliwe :) . Swoją drogą dowcipnych masz kumpli . Wklej nowy
log hijacka .

Pozdrawiam .

To zescanowania ...po usunieciu trojana...

[umfana]

Starting scan at 07:59:09:125...
Scan Memory
Memory not infected
Scan folder: 'C:\', recursive
Scan folder: 'D:\', recursive
Scan folder: 'E:\', recursive
Finished scan at 08:08:49:259
Total number of files is 46101, number of infected files is 0
Average files per second is 79, average file size is 7416460

Logfile of HijackThis v1.97.7

[umfana]

Logfile of HijackThis v1.97.7
Scan saved at 08:11:35, on 2004-08-28
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\eDonkey2000\edonkey2000.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\symlcsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\glophone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Trojan Remover\tyo5.exe
C:\Program Files\Trojan Remover\tyo5.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Downloads\HijackThis.exe

[kalinowski11]

Ściągnij najnowszą wersję hijacka i wklej cały log :)

www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

Nowy ...log :)

[umfana]

Logfile of HijackThis v1.98.2
Scan saved at 08:25:53, on 2004-08-28
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\eDonkey2000\edonkey2000.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\symlcsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\glophone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Trojan Remover\tyo5.exe
C:\Program Files\Trojan Remover\tyo5.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Sławka\Ustawienia lokalne\Temp\Katalog tymczasowy 1
dla hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.wp.pl/
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program
Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [Miniphone] C:\WINDOWS\glophone.exe /w
O4 - HKLM\..\Run: [eDonkey2000] "D:\eDonkey2000\edonkey2000.exe" -t
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -
quiet
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O9 - Extra button: Voiceglo directory - {C9B8ABB6-1CC3-4957-9CA3-053036B2EE3A} -
C:\Documents and Settings\All Users\Pulpit\Glophone.lnk
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -
us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4387/mcfscan.cab


Dzieki za pomoc !!!

[kalinowski11]

Do "wyciepania" :

> O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program
> Files\webHancer\Programs\whSurvey.exe"

www.sysinfo.org/startuplist.php?submit=&filter=webHancer+Survey+Companion&submit.x=8&submit.y=8

Ogromnie dziekuje Kalinowski !!! (*v*)

[umfana]

@-`,-`,-`,--

Nazwa trojana - Trojan.Sisn

[umfana]