megaupload nabrudził w firefoxie

**Posty:** 1294 · przez RufuS* 22 Wrz 2007, 15:50

Witam!
Tak sobie pomyslalem ze instalne MegauploadToolbar bo byc moze cos sie zmienilo i bede mogl sobie z MU sciagnac... Okazało się to głupotą sciana

Kij tam z IE. Ale ku mojemu zaskoczeniu toolbar plus jakies inne badziwie wdarło się do firefoxa.
Jak sie tego pozbyc ?:

No i jeszcze tak profilaktycznie prosiłbym o przejrzenie loga.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:41:56, on 2007-09-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Lavasoft Ad-Aware 2007\aawservice.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\RufuS\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.stk.net.pl:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\DOWNLOADS\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\DOWNLOADS\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\DOWNLOADS\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\DOWNLOADS\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1.0\adialhk.dll,wbsys.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 6614 bytes

**Posty:** 8694 · przez **Red** 22 Wrz 2007, 16:00

W logu masz ok,kosmetycznie możesz usunąć:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Dodatkowo możesz zastosować:

smitraudfix: z opcji 2

http://wiruskill.pl/forum/viewtopic.php?t=58

oraz

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 1294 · przez RufuS* 22 Wrz 2007, 17:56

Ale cos jest kurcze nie tak

Oto co sie dzieje jak chce ten link otworzyc

http://wiruskill.pl/forum/viewtopic.php?t=58

Jakos ikonki na pasku "Start" mi sie dziwne zrobiły :| Na pulpicie sam pojawia się skrót do IE...
Co wiecej!!! W ET dostałem bana !!! :wow:

Log z combofixa:

ComboFix 07-09-21.2 - "RufuS" 2007-09-22 17:39:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1471 [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-08-22 to 2007-09-22 )))))))))))))))))))))))))))))))
.

2007-09-22 15:45 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-21 20:13 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-21 20:13 <DIR> d-------- C:\DOCUME~1\RufuS\DANEAP~1\Real
2007-09-21 20:13 <DIR> d-------- C:\DOCUME~1\RufuS\DANEAP~1\Media Player Classic
2007-09-21 20:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real
2007-09-21 16:53 <DIR> d-------- C:\WINDOWS\system32\oodag
2007-09-21 16:39 <DIR> d-------- C:\Program Files\OO Software
2007-09-21 15:32 36,864 --a------ C:\WINDOWS\system32\wbsys.dll
2007-09-21 15:32 20,480 --a------ C:\WINDOWS\system32\wbload.dll
2007-09-21 15:32 <DIR> d-------- C:\Program Files\WindowBlinds
2007-09-21 15:29 <DIR> d-------- C:\Program Files\IconPackager
2007-09-21 15:29 <DIR> d-------- C:\Program Files\Common Files\Stardock
2007-09-21 15:09 <DIR> d-------- C:\Program Files\AIMP2
2007-09-15 08:33 <DIR> d-------- C:\Program Files\TVAnts
2007-09-15 08:24 <DIR> d-------- C:\Program Files\SopCast
2007-09-15 08:24 <DIR> d-------- C:\DOCUME~1\RufuS\DANEAP~1\SopCast
2007-09-13 19:56 <DIR> d-------- C:\Program Files\Realtek
2007-09-13 19:55 520,192 --a------ C:\WINDOWS\RtlExUpd.dll
2007-09-13 18:28 <DIR> d-------- C:\Program Files\AIMP Classic
2007-09-09 21:29 <DIR> d-------- C:\DOCUME~1\RufuS\DANEAP~1\Google
2007-09-09 12:46 <DIR> d-------- C:\DOCUME~1\RufuS\DANEAP~1\Aston
2007-09-08 17:44 327,168 --a------ C:\WINDOWS\IsUn0415.exe
2007-09-08 16:37 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-09-08 16:36 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2007-09-08 16:36 5,402,624 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-09-08 16:36 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-09-08 16:36 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2007-09-08 16:36 24,064 --a------ C:\WINDOWS\system32\ativcoxx.dll
2007-09-08 16:36 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-09-08 16:36 114,688 --a------ C:\WINDOWS\system32\Oemdspif.dll
2007-09-08 16:36 <DIR> d-------- C:\Program Files\XG WarCat 7.4
2007-09-08 16:32 <DIR> d-------- C:\Program Files\Driver Cleaner
2007-09-07 16:51 <DIR> d-------- C:\DOCUME~1\RufuS\DANEAP~1\RouterControl
2007-09-06 20:37 <DIR> d-------- C:\Program Files\MagicISO
2007-09-06 18:13 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-09-06 18:13 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-06 18:13 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-09-06 18:13 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-09-06 16:57 83,968 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2007-09-06 16:57 <DIR> d-------- C:\WINDOWS\OPTIONS
2007-09-06 16:27 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2007-09-06 16:24 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-09-06 16:24 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-09-06 16:24 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-09-06 16:24 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2007-09-06 16:24 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys
2007-09-06 16:23 <DIR> d-------- C:\Program Files\Neostrada TP
2007-09-02 14:32 <DIR> d-------- C:\Program Files\JPEGCrops

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-22 17:48 44914720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-22 17:39 1449760 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-09-22 17:28 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab
2007-09-22 17:27 609224 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-09-22 17:27 138908 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-09-22 17:13 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\uTorrent
2007-09-22 15:34 --------- d-------- C:\Program Files\FlashGet
2007-09-22 14:27 --------- d-------- C:\Program Files\English Translator XT
2007-09-21 22:56 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-21 20:15 --------- d-------- C:\Program Files\NAPI-PROJEKT
2007-09-21 15:41 --------- d-------- C:\Program Files\Kaspersky Internet Security 7.0
2007-09-20 20:18 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\Skype
2007-09-20 07:09 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-19 20:17 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\OpenOffice.ux.pl2
2007-09-15 13:03 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\teamspeak2
2007-09-12 17:13 --------- d-------- C:\Program Files\Konnekt
2007-09-08 16:37 --------- d-------- C:\Program Files\ATI Technologies
2007-09-07 21:58 82061 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-09-07 21:58 81549 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-09-07 07:47 --------- d-------- C:\Program Files\ALLPlayer
2007-09-05 17:31 4611072 --a------ C:\WINDOWS\system32\drivers\RtkHDAud.sys
2007-09-03 15:52 16841216 --a------ C:\WINDOWS\RTHDCPL.exe
2007-08-08 09:23 --------- d-------- C:\Program Files\Rocznik Ekspert 2002-2007
2007-08-03 13:22 1826816 --a------ C:\WINDOWS\SkyTel.exe
2007-07-26 18:06 1191936 --a------ C:\WINDOWS\RtlUpd.exe
2007-07-24 09:07 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\Sports Interactive
2007-07-24 07:55 --------- d-------- C:\Program Files\Winamp
2007-07-23 17:09 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\Opera
2007-07-22 18:26 --------- d-------- C:\DOCUME~1\RufuS\DANEAP~1\ATI
2007-07-22 12:14 --------- d-------- C:\Program Files\Easy Hi-Q Recorder
2007-07-21 14:49 315392 --a------ C:\WINDOWS\HideWin.exe
2007-07-19 13:09 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-06-28 16:44 2165760 --a------ C:\WINDOWS\MicCal.exe
2007-06-28 12:51 206088 --a------ C:\WINDOWS\system32\klogon.dll
2007-06-27 03:44 8232960 --a------ C:\WINDOWS\system32\atioglx2.dll
2007-06-27 03:14 176128 --a------ C:\WINDOWS\system32\atiok3x2.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 14:46 C:\WINDOWS\KHALMNPR.Exe]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 17:34]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [2006-09-28 21:21]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 14:36]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 16:23]
"AVP"="C:\Program Files\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-03 15:52 C:\WINDOWS\RTHDCPL.exe]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08]

C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-05 16:19:48]

C:\DOCUME~1\RufuS\MENUST~1\Programy\AUTOST~1\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\WINDOW~4\wbsrv.dll 2005-12-06 21:16 176128 C:\PROGRA~1\WINDOW~4\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\KASPER~1.0\adialhk.dll,wbsys.dll

R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys
R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40cd27b7-2b0b-11dc-9158-806d6172696f}]
AutoRun\command- E:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eab007e8-2b20-11dc-87eb-806d6172696f}]
AutoRun\command- E:\instaluj.exe /VERYSILENT

*Newly Created Service* - CATCHME
*Newly Created Service* - PNKBSTRK
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-22 17:48:02
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-22 17:48:56
.
--- E O F ---

**Posty:** 8694 · przez **Red** 22 Wrz 2007, 18:11

RufusFCB,wiruskill chwilowo nie działa,strona w remoncie,sorki

tu masz link

http://siri.urz.free.fr/Fix/SmitfraudFix.zip

**Posty:** 1294 · przez RufuS* 22 Wrz 2007, 18:17

No ok, przeczyscilem wszystko, reboota zrobilem no ale dalej cos nie tak

SmitFraudFix v2.227

Scan done at 18:11:56,45, 2007-09-22
Run from C:\Documents and Settings\RufuS\Pulpit\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
127.0.0.1 gladiatus.pl
127.0.0.1 www.gladiatus.pl
127.255.255.255 serial.alcohol-soft.com
127.255.255.255 www.alcohol-soft.com
127.255.255.255 images.alcohol-soft.com

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 88.156.96.2
DNS Server Search Order: 88.156.96.3

Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 217.8.168.244
DNS Server Search Order: 157.25.5.18
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{83D77132-3CD5-4D90-8274-375727448F06}: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FB3FA1F1-1165-4026-84CE-332B62C9E680}: DhcpNameServer=88.156.96.2 88.156.96.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{83D77132-3CD5-4D90-8274-375727448F06}: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FB3FA1F1-1165-4026-84CE-332B62C9E680}: DhcpNameServer=88.156.96.2 88.156.96.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{83D77132-3CD5-4D90-8274-375727448F06}: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{FB3FA1F1-1165-4026-84CE-332B62C9E680}: DhcpNameServer=88.156.96.2 88.156.96.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 8694 · przez **Red** 22 Wrz 2007, 18:22

Znasz te dns`y:

HKLM\SYSTEM\CCS\Services\Tcpip\..\{FB3FA1F1-1165-4026-84CE-332B62C9E680}: DhcpNameServer=88.156.96.2 88.156.96.3

Bo chyba te są tylko twoje:

HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=217.8.168.244 157.25.5.18 192.168.1.1

**Posty:** 1294 · przez RufuS* 22 Wrz 2007, 20:14

Kurcze... nie wiem. Te drugie raczej są moje na bank...
A te pierwsze.. hmm ja mam Multimo byc moze to moje ip :roll:

**Posty:** 3854 · przez **Dzi@dek** 22 Wrz 2007, 20:47

Red napisał(a):88.156.96.2 88.156.96.3

To sa Twoje DNS-y

Kod: Zaznacz wszystko: stk.vectranet.pl

Kod: Zaznacz wszystko: 217.8.168.244 157.25.5.18

GTS Poland

**Posty:** 18165 · przez **wojtas** 22 Wrz 2007, 21:58

poczytaj i wykonaj:

http://forum.programosy.pl/sposob-na-problemy-z-firefoxem-vt79402.html

**Posty:** 1294 · przez RufuS* 22 Wrz 2007, 22:56

Dzieki wojtas19162 za linka. Luknąłem do swojego profilu i znalazłem ten shit

Juz wszystko w porzadku

megaupload nabrudził w firefoxie

megaupload nabrudził w firefoxie

Kto jest na forum