problem z trojanem

[antiwir]

Logfile of HijackThis v1.99.1
Scan saved at 21:46:05, on 2005-08-03
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\d?xplore.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\Winamp.exe
C:\Documents and Settings\Misiu\Pulpit\hijachthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
81.222.131.49/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\DOCUME~1\Misiu\USTAWI~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
81.222.131.49/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
81.222.131.49/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {39908A2B-03CB-42DE-B114-758D88475BCA} -
C:\WINDOWS\System32\eila.dll (file missing)
O2 - BHO: (no name) - {86DCA6E9-4905-46AD-5181-6753050E11C5} -
C:\WINDOWS\System32\qnry.dll (file missing)
O2 - BHO: (no name) - {B672CF74-3DF1-0C05-E86F-0B8BB89F4FF8} -
C:\WINDOWS\System32\yihhvrd.dll
O2 - BHO: (no name) - {F05F8974-10B7-4A43-C529-4DA6FED962BE} -
C:\WINDOWS\System32\yihhvrd.dll
O2 - BHO: (no name) - {F35FFF74-10C1-4F31-C55E-3AA68AAB62CB} -
C:\WINDOWS\System32\yihhvrd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools
Service\AdTools.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Epyo] C:\WINDOWS\System32\d?xplore.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program
Files\Nikon\PictureProject\NkbMonitor.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112300480639
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} -
www.180searchassistant.com/180saax.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
skaner.mks.com.pl/SkanerOnline.cab
O20 - Winlogon Notify: drct16 - drct16.dll (file missing)
O20 - Winlogon Notify: ntfs32 - ntfs32.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32
\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

[Gość: Kolobos]

Zakoncz proces:
C:\WINDOWS\System32\d?xplore.exe
I usun plik.

Skan i usuwanie wszystkiego tym:
download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.
Zamknij porty tym:
www.firewallleaktester.com/tools/wwdc.exe
Uzyj:
www.trojaner-info.de/files/SpSeHjfix112.exe
W hijackthis usun:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
81.222.131.49/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\DOCUME~1\Misiu\USTAWI~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
81.222.131.49/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
81.222.131.49/index.php
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no
file) <- to usuwasz w rejestrze, jak nie wiesz jak to zobacz pare ostatnich
postow bo przed chwila o tym pisalem
O2 - BHO: (no name) - {39908A2B-03CB-42DE-B114-758D88475BCA} -
C:\WINDOWS\System32\eila.dll (file missing)
O2 - BHO: (no name) - {86DCA6E9-4905-46AD-5181-6753050E11C5} -
C:\WINDOWS\System32\qnry.dll (file missing)
O2 - BHO: (no name) - {B672CF74-3DF1-0C05-E86F-0B8BB89F4FF8} -
C:\WINDOWS\System32\yihhvrd.dll <- kasujesz plik z dysku
O2 - BHO: (no name) - {F05F8974-10B7-4A43-C529-4DA6FED962BE} -
C:\WINDOWS\System32\yihhvrd.dll
O2 - BHO: (no name) - {F35FFF74-10C1-4F31-C55E-3AA68AAB62CB} -
C:\WINDOWS\System32\yihhvrd.dll
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools
Service\AdTools.exe <- kasujesz katalog
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe <- usuwasz plik
O4 - HKCU\..\Run: [Epyo] C:\WINDOWS\System32\d?xplore.exe
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} -
www.180searchassistant.com/180saax.cab

To usuwales tak jak masz w opisie?
O20 - Winlogon Notify: drct16 - drct16.dll (file missing)
O20 - Winlogon Notify: ntfs32 - ntfs32.dll (file missing)
Pewnie nie wiec zobacz:
www.searchengines.pl/phpbb203/index.php?showtopic=12510&st=30&p=109496&#entry132561