LOG z hijackthis (komp mi świruje :[ )

[Gość: LC]

Logfile of HijackThis v1.99.1
Scan saved at 18:25:53, on 2006-02-11
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\QmFydA\command.exe
C:\windows\dcmhelp.exe
C:\windows\System32\nvsvc32.exe
C:\windows\win32ssr.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\windows\System32\rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\windows\System32\sachostc.exe
C:\windows\System32\sachosts.exe
C:\windows\explorer.exe
C:\Program Files\Avant Browser\avant.exe
E:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: run=C:\WINDOWS\inet20004\winlogon.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O2 - BHO: MFCOptimizeClass Object - {C25FA7CE-23EA-4271-A66D-06C4D5C22F78} -
C:\windows\System32\awtqr.dll
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} -
C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06
\bin\jusched.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32
\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Printer] C:\windows\System32\auditchk.exe
O4 - HKLM\..\Run: [Memory manager] C:\windows\System32\himem32.exe
O4 - HKLM\..\Run: [winupdates] C:\Program
Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd7.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\windows\System32\spoolsvc.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban6.exe
O4 - HKLM\..\Run: [WinDLL (v4mon.dll)] rundll32.exe C:\windows\System32
\v4mon.dll,start
O4 - HKLM\..\Run: [ihost.exe] C:\taskmgrs.exe
O4 - HKLM\..\Run: [WindowsUpdateNT] C:\windows\System\svwhost.exe /s
O4 - HKLM\..\Run: [SystemLoader] C:\windows\sysldr32.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20004\winlogon.exe
O4 - HKLM\..\Run: [spoolsvv] C:\windows\System32\spoolsvv.exe
O4 - HKLM\..\Run: [HostSrv] C:\windows\sachostx.exe
O4 - HKLM\..\Run: [intell321.exe] C:\windows\System32\intell321.exe
O4 - HKLM\..\Run: [WinDLL (xvd32.dll)] rundll32.exe C:\windows\System32
\xvd32.dll,start
O4 - HKLM\..\RunServices: [Windows USB Hub Manager] Monitor.exe
O4 - HKLM\..\RunServices: [Printer] C:\windows\System32\auditchk.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Windows USB Hub Manager] Monitor.exe
O4 - HKCU\..\Run: [Printer] C:\windows\System32\auditchk.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [WindowsUpdateNT] C:\windows\System\svwhost.exe
O4 - HKCU\..\Run: [aupd] C:\windows\System32\symsvcsa.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20004\winlogon.exe
O4 - HKCU\..\Run: [imor] C:\windows\stub_113_4_0_4_0.exe
O8 - Extra context menu item: &Google Search - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera -
C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program
Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Download with GetRight - C:\Program
Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program
Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... -
C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - C:\Program Files\Avant
Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - C:\Program Files\Avant
Browser\Search.htm
O8 - Extra context menu item: Translate into English - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{AEC4C2F3-57BE-4770-B253-
6AADE6168C19}: NameServer = 217.30.129.149,217.30.137.200
O20 - Winlogon Notify: awtqr - C:\windows\System32\awtqr.dll
O20 - Winlogon Notify: MS-DOS Emulation - C:\windows\system32\guard.tmp (file
missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common
Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program
Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file
missing)
O23 - Service: Command Service (cmdService) - Unknown owner -
C:\windows\QmFydA\command.exe
O23 - Service: DcomHelper Service (DcomHelper) - Unknown owner -
C:\windows\dcmhelp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
\IDriverT.exe
O23 - Service: Windows Logon Process Service (MSWinLogonProcService) -
Unknown owner - C:\WINDOWS\winlogon.exe" -service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\windows\System32\nvsvc32.exe
O23 - Service: Performance True Type Fonts (PerfFont) - Unknown owner -
C:\windows\System32\perfont.exe
O23 - Service: Win32Sr - Unknown owner - C:\windows\win32ssr.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program
Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service
(file missing)

[kolobos]

Ten log to jeden wielki syf! Masz piracki windows i uzywasz IE, gratuluje...

Zamknij porty w wwdc:
www.firewallleaktester.com/tools/wwdc.exe
Zmien przegladarke na Opere lub Firefox i nie uzywaj IE.

W menadzerze zadan zakoncz:
C:\windows\System32\sachostc.exe
C:\windows\System32\sachosts.exe
Oba pliki usun.

W hijackthis usun:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
F3 - REG:win.ini: run=C:\WINDOWS\inet20004\winlogon.exe <- usun caly katalog
inet20004
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O2 - BHO: MFCOptimizeClass Object - {C25FA7CE-23EA-4271-A66D-06C4D5C22F78} -
C:\windows\System32\awtqr.dll <- usun plik
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} -
C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll <- odinstaluj.
O4 - HKLM\..\Run: [Printer] C:\windows\System32\auditchk.exe <- usun plik
O4 - HKLM\..\Run: [Memory manager] C:\windows\System32\himem32.exe <- i ten
O4 - HKLM\..\Run: [winupdates] C:\Program
Files\winupdates\winupdates.exe /auto <- katalog winupdates
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd7.exe <- i ten
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\windows\System32\spoolsvc.exe <- i
ten
O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames.exe <- ten
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban6.exe <- ten
O4 - HKLM\..\Run: [WinDLL (v4mon.dll)] rundll32.exe C:\windows\System32
\v4mon.dll,start <- usun v4mon.dll
O4 - HKLM\..\Run: [ihost.exe] C:\taskmgrs.exe <- ten
O4 - HKLM\..\Run: [WindowsUpdateNT] C:\windows\System\svwhost.exe /s <- ten
O4 - HKLM\..\Run: [SystemLoader] C:\windows\sysldr32.exe <- ten
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20004\winlogon.exe
O4 - HKLM\..\Run: [spoolsvv] C:\windows\System32\spoolsvv.exe <- ten
O4 - HKLM\..\Run: [HostSrv] C:\windows\sachostx.exe <- ten
O4 - HKLM\..\Run: [intell321.exe] C:\windows\System32\intell321.exe <- ten
O4 - HKLM\..\Run: [WinDLL (xvd32.dll)] rundll32.exe C:\windows\System32
\xvd32.dll,start <- xvd32.dll
O4 - HKLM\..\RunServices: [Windows USB Hub Manager] Monitor.exe <- i ten
O4 - HKLM\..\RunServices: [Printer] C:\windows\System32\auditchk.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00001.exe" <- ten
O4 - HKCU\..\Run: [Windows USB Hub Manager] Monitor.exe
O4 - HKCU\..\Run: [Printer] C:\windows\System32\auditchk.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe <- ten
O4 - HKCU\..\Run: [WindowsUpdateNT] C:\windows\System\svwhost.exe <- ten
O4 - HKCU\..\Run: [aupd] C:\windows\System32\symsvcsa.exe <- ten
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20004\winlogon.exe <- usun caly
katalog inet20004
O4 - HKCU\..\Run: [imor] C:\windows\stub_113_4_0_4_0.exe <- ten
O20 - Winlogon Notify: awtqr - C:\windows\System32\awtqr.dll <- ten
O20 - Winlogon Notify: MS-DOS Emulation - C:\windows\system32\guard.tmp (file
missing)

Nastepnie usun uslugi:
Start->Uruchom->cmd i tam wpisz:
sc stop cmdService
sc delete cmdService
sc stop DcomHelper
sc delete DcomHelper
sc stop MSWinLogonProcService
sc delete MSWinLogonProcService
sc stop PerfFont
sc delete PerfFont
sc stop Win32Sr
sc delete Win32Sr

O23 - Service: Command Service (cmdService) - Unknown owner -
C:\windows\QmFydA\command.exe <- usun ukryty katalog Qm...
O23 - Service: DcomHelper Service (DcomHelper) - Unknown owner -
C:\windows\dcmhelp.exe <- usun plik
O23 - Service: Windows Logon Process Service (MSWinLogonProcService) -
Unknown owner - C:\WINDOWS\winlogon.exe" -service (file missing)
O23 - Service: Performance True Type Fonts (PerfFont) - Unknown owner -
C:\windows\System32\perfont.exe <- usun plik
O23 - Service: Win32Sr - Unknown owner - C:\windows\win32ssr.exe <- usun plik.

Na koniec skan:
ftp://download.hirekmedia.hu/ssfsetup1_0.exe <- zrob update przed skanowaniem,
po przeskanowaniu odinstaluj.
download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
przeskanowaniu odinstaluj.

Po wszystkim wklej nowy log.