hacked by godzilla

[Lukesh]

Odintaluj tego Nortona, bo to porazka - zamulacz i tyle. Jeden z antywirusow ktore polecilem jest w pelni darmowy - drugi mozesz 'kupic' i tez bedzie fajnie.

[Holek^]

@up
Odinstalowalem ;]


SKAN Z HIJACK

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:44, on 2008-03-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\drivers\services.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Mati\Moje dokumenty\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Skrót do strony właściwości High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [msm] C:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3672427D-9EF0-499A-B3FB-74CBC350CD93}: NameServer = 10.10.11.1,80.50.50.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5362 bytes

Skan po usunieciu godzilli....

System mam juz czysty?

[wojtas]

O4 - HKLM\..\Run: [msm] C:\WINDOWS\system32\drivers\services.exe

skasuj i daj loga z combofixa

[Holek^]

@Lukesh

zrobilem skana twoim friewalem co mi poradziles i mi wykrylo takie cos i jak to usunac tu masz screna




@up
zaraz dam loga

[Lukesh]

Przeskanuj combofixem: http://www.programosy.pl/program,combofix.html
Powinien z tego wyleczyc... Jednak nic groznego - drobna infekcja przenoszona (prawdopodobnie) z pendrivow.

[Holek^]

Log z combifix

ComboFix 08-03-01 - Mati 2008-03-04 21:26:18.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.133 [GMT 1:00]
Running from: C:\Documents and Settings\Mati\Moje dokumenty\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\services.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
.

2008-03-04 18:27 . 2008-03-04 18:27 <DIR> d-------- C:\Program Files\COMODO
2008-03-04 18:27 . 2008-03-04 18:27 <DIR> d-------- C:\Documents and Settings\Mati\Dane aplikacji\Comodo
2008-03-04 18:27 . 2008-03-04 21:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo
2008-03-04 18:27 . 2008-03-04 18:27 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
2008-03-04 18:27 . 2008-03-04 18:27 84,856 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-03-04 18:27 . 2008-03-04 18:27 23,800 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-03-04 16:17 . 2008-03-04 18:13 <DIR> d-------- C:\Program Files\Symantec
2008-03-04 16:17 . 2008-03-04 18:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-03-04 16:16 . 2008-03-04 18:15 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-02 21:47 . 2008-03-02 21:47 <DIR> d-------- C:\Program Files\PITy2007
2008-03-02 19:34 . 2008-03-02 20:24 <DIR> d-------- C:\Program Files\Tibia Auto
2008-03-02 19:32 . 2008-03-02 19:32 <DIR> d-------- C:\Python24
2008-03-01 00:20 . 2008-03-01 00:20 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-01 00:13 . 2008-03-01 00:38 <DIR> d-------- C:\SDFix
2008-02-27 17:04 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-02-27 17:04 . 2008-02-27 17:04 421 --a------ C:\WINDOWS\ODBC.INI
2008-02-27 17:03 . 2008-02-27 17:04 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-27 17:03 . 2008-02-27 17:03 <DIR> d-------- C:\Program Files\Microsoft Works
2008-02-27 17:01 . 2008-02-27 17:01 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-27 12:04 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-02-27 12:02 . 2008-02-27 12:02 <DIR> d-------- C:\Documents and Settings\Mati\Dane aplikacji\Gadu-Gadu
2008-02-27 10:53 . 2008-02-27 10:54 <DIR> d-------- C:\Documents and Settings\Mati\Dane aplikacji\Ventrilo
2008-02-27 00:07 . 2008-03-02 13:13 <DIR> d-------- C:\Documents and Settings\Mati\Dane aplikacji\Tibia
2008-02-27 00:05 . 2008-02-27 00:05 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-27 00:02 . 2008-02-27 00:02 <DIR> d-------- C:\WINDOWS\system32\pl-pl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-04 20:09 --------- d-----w C:\Documents and Settings\Mati\Dane aplikacji\Skype
2008-03-04 17:02 --------- d-----w C:\Documents and Settings\Mati\Dane aplikacji\skypePM
2008-03-04 13:46 295,936 ----a-w C:\WINDOWS\inf\isprnt.exe
2008-02-27 08:44 --------- d-----w C:\Program Files\Google
2008-02-26 22:59 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-26 22:58 --------- d-----w C:\Program Files\Skype
2008-02-26 22:58 --------- d-----w C:\Program Files\Common Files\Skype
2008-02-26 22:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-02-26 22:57 --------- d-----w C:\Program Files\Gadu-Gadu
2008-02-26 22:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-26 22:43 --------- d-----w C:\Program Files\Synaptics
2008-02-26 22:42 --------- d-----w C:\Program Files\Realtek
2008-02-26 22:42 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-26 22:41 --------- d-----w C:\Program Files\Intel
2008-02-26 22:38 --------- d-----w C:\Program Files\Ahead
2008-02-26 22:37 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-26 22:36 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-26 22:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-02-26 22:34 --------- d-----w C:\Program Files\InterVideo
2008-02-26 22:25 9,388 ----a-w C:\WINDOWS\system32\drivers\iaStor.PNF
2008-02-26 22:25 7,280 ----a-w C:\WINDOWS\system32\drivers\viamraid.PNF
2008-02-26 22:25 63,240 ----a-w C:\WINDOWS\system32\drivers\Si3112r.PNF
2008-02-26 22:25 6,984 ----a-w C:\WINDOWS\system32\drivers\SiSRaid.PNF
2008-02-26 22:25 20,152 ----a-w C:\WINDOWS\system32\drivers\INFCACHE.1
2008-02-26 22:25 12,432 ----a-w C:\WINDOWS\system32\drivers\adpu320.PNF
2008-02-26 22:25 12,204 ----a-w C:\WINDOWS\system32\drivers\nvraid.PNF
2008-02-26 22:25 10,828 ----a-w C:\WINDOWS\system32\drivers\iaAHCI.PNF
2008-02-26 21:39 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-26 21:38 --------- d-----w C:\Program Files\Java
2008-02-26 21:37 --------- d-----w C:\Program Files\Common Files\Java
2008-02-26 21:32 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-06 18:24 21898024]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-28 10:34 68856]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skrót do strony właściwości High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03 36975]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-07-19 11:09 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-07-19 11:06 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-07-19 11:10 114688]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 10:24 86016 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 15:32 2807808 C:\WINDOWS\alcwzrd.exe]
"SMSERIAL"="sm56hlpr.exe" [2005-08-12 11:09 552960 C:\WINDOWS\sm56hlpr.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-04-15 08:48 708697]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-03-04 18:27 1502976]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Mati\\Pulpit\\TibiCAM\\TibiCAM.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-03-04 18:27]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-03-04 18:27]

*Newly Created Service* - CMDAGENT
*Newly Created Service* - CMDGUARD
*Newly Created Service* - CMDHLP
*Newly Created Service* - INSPECT
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-04 21:27:55
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-03-04 21:28:29
ComboFix-quarantined-files.txt 2008-03-04 20:28:19
ComboFix2.txt 2008-02-29 23:36:49

Heh dzieki wam wszystkim za pomoc i za cierpliwosc ;] bardzo pomagacie i wszystkim to przekaze ze zawsze na ludziach z programosy.pl mozna polegac!!!

Ps ;p
Juz nie bede mial godziilli?

ps2
mam tego antyvira co mi dales; ] tego bezplatnego

[wojtas]

skasuj folder C:\QooBox

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach) po chwili włacz i oproznij kosz systemowy i bedzie ok

[Holek^]

@up
Skasowalem!

2 PROBLEM!!!

Mam tego firewala i on jest kurde cenzura!!!!



Ja cenzura! co chwila mi wyskakuje to okno co nie wlaczei wciskam kazda opcje po 10000 razy i tak to sie wystwietla JAK TO kurde ZROBIC ZEBY TAK NIE WYSKAKIWALO CO SEKDUNE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


Sry ponioslo mnie

Ktos mi pomoze jak to zrobic? zeby nie wyskakiwalo co chwile?

Autor postu otrzymał pochwałę

[wojtas]

Wiek: 15

wez sie uspokuj i pisz z kulturą

EOT