wirus?

Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 16:32

d-Aware SE Build 1.05
Logfile Created on:21 października 2004 16:28:05
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R13 16.10.2004
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):10 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects

04-10-21 16:28:05 - Scan started. (Smart mode)

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [KERNEL32.DLL]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4293877831
Threads : 4
Priority : High
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : System operacyjny Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Składnik jądra Win32
InternalName : KERNEL32
LegalCopyright : Copyright (C) Microsoft Corp. 1991-1999
OriginalFilename : KERNEL32.DLL

#:2 [MSGSRV32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294923479
Threads : 1
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : System operacyjny Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : 32-bitowy Serwer wiadomości VxD systemu Windows
InternalName : MSGSRV32
LegalCopyright : Copyright (C) Microsoft Corp. 1992-1998
OriginalFilename : MSGSRV32.EXE

#:3 [MPREXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294943591
Threads : 2
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998
OriginalFilename : MPREXE.EXE

#:4 [MSTASK.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294954375
Threads : 2
Priority : Normal
FileVersion : 4.71.1972.1
ProductVersion : 4.71.1972.1
ProductName : Microsoft® Windows® - Harmonogram zadań
CompanyName : Microsoft Corporation
FileDescription : Aparat Harmonogramu zadań
InternalName : TaskScheduler
LegalCopyright : Copyright (C) Microsoft Corp. 2000
OriginalFilename : mstask.exe

#:5 [VSMON.EXE]
FilePath : C:\WINDOWS\SYSTEM\ZONELABS\
ProcessID : 4294956563
Threads : 16
Priority : Normal
FileVersion : 4.5.594.000
ProductVersion : 4.5.594.000
ProductName : TrueVector Service
CompanyName : Zone Labs Inc.
FileDescription : TrueVector Service
InternalName : vsmon
LegalCopyright : Copyright © 1998-2003, Zone Labs Inc.
OriginalFilename : vsmon.exe

#:6 [NPROTECT.EXE]
FilePath : C:\PROGRAM FILES\NORTON UTILITIES\
ProcessID : 4294936287
Threads : 3
Priority : Normal
FileVersion : 15.03.0.36
ProductVersion : 15.03.0.36
ProductName : Norton Utilities
CompanyName : Symantec Corporation
FileDescription : Norton Protection Status
InternalName : NPROTECT
LegalCopyright : Copyright (C) 2002 Symantec Corporation
LegalTrademarks : Norton Utilities
OriginalFilename : NPROTECT.EXE

#:7 [mmtask.tsk]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294935323
Threads : 1
Priority : Normal
FileVersion : 4.03.1998
ProductVersion : 4.03.1998
ProductName : Microsoft Windows
CompanyName : Microsoft Corporation
FileDescription : Multimedia background task support module
InternalName : mmtask.tsk
LegalCopyright : Copyright © Microsoft Corp. 1991-1998
OriginalFilename : mmtask.tsk

#:8 [EXPLORER.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4294878779
Threads : 4
Priority : Normal
FileVersion : 4.72.3110.1
ProductVersion : 4.72.3110.1
ProductName : System operacyjny Microsoft(R) Windows NT(R)
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1997
OriginalFilename : EXPLORER.EXE

#:9 [TASKMON.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4294798675
Threads : 1
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : Task Monitor
InternalName : TaskMon
LegalCopyright : Copyright (C) Microsoft Corp. 1998
OriginalFilename : TASKMON.EXE

#:10 [SYSTRAY.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294798763
Threads : 2
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : System operacyjny Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Aplikacja zasobnika systemowego
InternalName : SYSTRAY
LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998
OriginalFilename : SYSTRAY.EXE

#:11 [ZLCLIENT.EXE]
FilePath : C:\PROGRAM FILES\ZONE LABS\ZONEALARM\
ProcessID : 4294814603
Threads

netsec Re: wirus? 21.10.04, 16:45

Wklej log z HiJackThis.

Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 17:26

ale zes mi powiedzial....:) mozesz troszke jasniej?? :)
- kalinowski11 Re: wirus? 21.10.04, 17:31
  
  Ściągnij poniższy program . HijackThis
  pokaże co "siedzi" w Twoim kompie .
  
  209.133.47.12/~merijn/files/HijackThis.exe
  www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
  
  1.Ściągnij , uruchom .
  2.Scan .
  3.Save Log .
  4.Zapisany log "skopiuj na myszkę" , wklej do posta i wyślij
  na forum . Może jakaś "dobra dusza" się nad Tobą zlituje ;)
  5.W wypadku gdy chcemy coś skasować , otwieramy Hijacka jeszcze
  raz , klikamy Scan , zaznaczamy co chcemy skasować i klikamy
  Fix checked . Z OPCJI KASOWANIA KORZYSTAMY PO KONSULTACJI NA FORUM .
  - Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 17:58
    
    dziekuje za pomoc, oto to cos:
    
    Logfile of HijackThis v1.98.2
    Scan saved at 17:56:17, on 04-10-21
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    
    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\GADU-GADU\GG.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\PULPIT\HIJACKTHIS.EXE
    
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.wp.pl/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
    Settings,AutoConfigURL = www.aster.pl/aster.pac
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
    Settings,ProxyServer = w3cache.aster.pl:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
    Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\Run: [New.net Startup] rundll32
    C:\WINDOWS\NEWDOT~1.DLL,NewDotNetStartup
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -
    service
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton
    Utilities\NPROTECT.EXE
    O4 - HKCU\..\Run: [Gadu-Gadu] "C:\PROGRAM FILES\GADU-GADU\GG.EXE" /tray
    O4 - HKCU\..\Run: [Komunikator] C:\PROGRAM FILES\TLEN.PL\TLEN.EXE
    O4 - Startup: Norton System Doctor.lnk = C:\Program Files\Norton
    Utilities\SYSDOC32.EXE
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O16 - DPF: {5F874A6F-8B34-433D-BA4B-47AC91C0567F} (MailCfg Control) -
    poczta.wp.pl/autoryzacja/mailcfg2.ocx
    
    to co, zlituje sie jakas dobra dusza??
    - netsec Re: wirus? 21.10.04, 18:55
      
      Na początek odinstaluj w Dodaj/Usuń programy New.Net po tym wklej nowy log z
      HiJackThis.
      - Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 19:37
        
        odinstalowalam, oto nowy log...
        
        Logfile of HijackThis v1.98.2
        Scan saved at 19:36:46, on 04-10-21
        Platform: Windows 98 SE (Win9x 4.10.2222A)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
        
        Running processes:
        C:\WINDOWS\SYSTEM\KERNEL32.DLL
        C:\WINDOWS\SYSTEM\MSGSRV32.EXE
        C:\WINDOWS\SYSTEM\MPREXE.EXE
        C:\WINDOWS\SYSTEM\MSTASK.EXE
        C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
        C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
        C:\WINDOWS\SYSTEM\mmtask.tsk
        C:\WINDOWS\EXPLORER.EXE
        C:\WINDOWS\TASKMON.EXE
        C:\WINDOWS\SYSTEM\SYSTRAY.EXE
        C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
        C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
        C:\WINDOWS\SYSTEM\WMIEXE.EXE
        C:\WINDOWS\SYSTEM\DDHELP.EXE
        C:\PROGRAM FILES\GADU-GADU\GG.EXE
        C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
        C:\WINDOWS\SYSTEM\RNAAPP.EXE
        C:\WINDOWS\SYSTEM\TAPISRV.EXE
        C:\WINDOWS\PULPIT\HIJACKTHIS.EXE
        
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.wp.pl/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
        www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
        www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
        www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
        Settings,AutoConfigURL = www.aster.pl/aster.pac
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
        Settings,ProxyServer = w3cache.aster.pl:8080
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
        C:\WINDOWS\SYSTEM\MSDXM.OCX
        O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
        O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
        O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
        O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
        powrprof.dll,LoadCurrentPwrScheme
        O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
        O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe
        O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
        Files\Real\Update_OB\evntsvc.exe -osboot
        O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
        O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
        powrprof.dll,LoadCurrentPwrScheme
        O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
        O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -
        service
        O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton
        Utilities\NPROTECT.EXE
        O4 - HKCU\..\Run: [Gadu-Gadu] "C:\PROGRAM FILES\GADU-GADU\GG.EXE" /tray
        O4 - HKCU\..\Run: [Komunikator] C:\PROGRAM FILES\TLEN.PL\TLEN.EXE
        O4 - Startup: Norton System Doctor.lnk = C:\Program Files\Norton
        Utilities\SYSDOC32.EXE
        O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
        skaner.mks.com.pl/SkanerOnline.cab
        O16 - DPF: {5F874A6F-8B34-433D-BA4B-47AC91C0567F} (MailCfg Control) -
        poczta.wp.pl/autoryzacja/mailcfg2.ocx

Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 19:51

aha i jeszcze jeden mam problem, nie dotyczacy wirosow(chyba), ale skoro
jestescie tacy mili, ze mi pomagacie, to moze w tym tez mi pomozecie:)
chodzi o to, ze mialam formatowanie niedawno. po formacie okazalo sie, ze nie
moge zrobic "nowego folderu"!! nie mam takiej opcji, klikam myszka prawym
przyciskiem i nie pojawia sie "nowy" ani skrot, ani folder... jak temu
zaradzic??

netsec Re: wirus? 21.10.04, 21:10

Jak teraz otwiera się strona wp ?
- Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 21:28
  
  otwiera sie tak :(
  
  www.wp.pl/.?_err=1&ticket=52640273989248365DKb0wm3DT8FqJzfWJKVjnrZi2JGFFm2%
  2BFNHfzKEjAOQOCylen9eM2rG%2BiiNznoeedC1yHl9UVQFqVhmTZ58XteyF7Qn8blqJqAS8R4Kvp4%
  3D
  - netsec Re: wirus? 21.10.04, 22:00
    
    u mnie otwiera się identyczny link po wejściu na wp, ale strona jest ok :)
    Widocznie ten typ tak ma -:)
    - Gość: karolina Re: wirus? IP: *.aster.pl / *.aster.pl 21.10.04, 22:09
      
      dziekuje za pomoc i pozdrawiam:)

Najnowsze z forum Wirusy, trojany, spyware

Zaloguj się