prosze o sprawdzenie loga

[servitor]

Co chwila wyskakuja okienka z reklamami ktore sa uciazliwe. Internet explorer jest caly czas w procesach, po wylaczeniu sam wlacza sie ponownie i zajmuje prawie 100mb ramu

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 17:02:00, on 30.07.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\VistaMizer\madotate\madotate.exe
C:\Programme\VisualTaskTips\VisualTaskTips.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Dennis Gluszak\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\WINDOWS\VistaMizer\styler\TB\StylerTB.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [thoosje's sidebar] C:\Programme\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Madotate.lnk = C:\WINDOWS\VistaMizer\madotate\madotate.exe
O4 - Startup: VisualTaskTips.lnk = C:\Programme\VisualTaskTips\VisualTaskTips.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1163424474748
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared files\RichVideo.exe



[wojtas]

W dodaj/usuń odinstaluj MessengerPlus! 3

daj loga z combofixa

[servitor]

Kod: Zaznacz wszystko

ComboFix 07-07-30.2 - "Dennis Gluszak" 2007-07-31 12:23:00.1 [GMT 2:00] - NTFS
Microsoft Windows XP Home Edition  5.1.2600.2.1252.49.1031.18.True
* Created a new restore point


(((((((((((((((((((((((((   Files Created from 2007-06-28 to 2007-07-31  )))))))))))))))))))))))))))))))


2007-07-31 12:22   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-07-31 11:59   <DIR>   d--------   C:\Programme\Steam
2007-07-30 22:26   <DIR>   d--------   C:\WINDOWS\LastGood
2007-07-30 17:45   <DIR>   d--------   C:\Programme\BearShare
2007-07-30 17:39   <DIR>   d--------   C:\Programme\BearShare Applications
2007-07-30 17:00   <DIR>   d--------   C:\!KillBox
2007-07-30 16:48   <DIR>   d--------   C:\WINDOWS\pss
2007-07-30 14:41   108,144   --a------   C:\WINDOWS\system32\CmdLineExt.dll
2007-07-30 14:41   <DIR>   dr-h-----   C:\DOKUME~1\DENNIS~1\ANWEND~1\SecuROM
2007-07-30 14:24   <DIR>   d--------   C:\Programme\Atari
2007-07-30 13:09   <DIR>   d--------   C:\Programme\Rockstar Games
2007-07-30 12:47   <DIR>   d--------   C:\DOKUME~1\DENNIS~1\ANWEND~1\stamina
2007-07-30 12:46   <DIR>   d--------   C:\Programme\Konnekt
2007-06-13 13:17   <DIR>   d--------   C:\DOKUME~1\DENNIS~1\ANWEND~1\ICQ Toolbar
2007-06-12 19:19   <DIR>   d--------   C:\Programme\ICQToolbar
2007-06-12 19:19   <DIR>   d--------   C:\DOKUME~1\DENNIS~1\ANWEND~1\ICQ
2007-06-12 19:16   <DIR>   d--------   C:\Programme\ICQ6
2007-06-10 16:56   <DIR>   d--------   C:\Programme\Windows Live Safety Center


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-31 12:28   ---------   d--------   C:\Programme\MSN Messenger
2007-07-30 14:23   ---------   d--------   C:\Programme\Gemeinsame Dateien\InstallShield
2007-07-30 13:09   ---------   d--h-----   C:\Programme\InstallShield Installation Information
2007-07-27 18:08   ---------   d--------   C:\DOKUME~1\DENNIS~1\ANWEND~1\dvdcss
2007-07-07 15:46   ---------   d--------   C:\Programme\Microsoft LifeCam
2007-07-03 18:08   ---------   d--------   C:\Programme\EA GAMES
2007-06-12 22:02   49372   --a------   C:\WINDOWS\system32\perfc007.dat
2007-06-12 22:02   320424   --a------   C:\WINDOWS\system32\perfh007.dat
2007-06-03 13:26   ---------   d--------   C:\DOKUME~1\DENNIS~1\ANWEND~1\Ahead
2007-05-16 17:11   683520   --a------   C:\WINDOWS\system32\inetcomm.dll


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2006-03-29 12:53]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [2007-01-19 13:55]
"thoosje's sidebar"="C:\Programme\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe" [2007-02-12 13:42]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 18:24]
"Steam"="C:\Programme\Steam\Steam.exe" [2007-07-31 11:59]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"MessengerPlusUninstall"=C:\WINDOWS\system32\cmd.exe /C "C:\DOKUME~1\DENNIS~1\LOKALE~1\Temp\MsgPlusUninst.bat"
"MessengerPlusLiveUninstall"="C:\DOKUME~1\DENNIS~1\LOKALE~1\Temp\MsgPlusUninstall.exe" /Cleanup

C:\Dokumente und Einstellungen\Dennis Gluszak\Startmen\Programme\Autostart\
Madotate.lnk - C:\WINDOWS\VistaMizer\madotate\madotate.exe [2004-09-30 02:30:18]
VisualTaskTips.lnk - C:\Programme\VisualTaskTips\VisualTaskTips.exe [2006-07-31 13:33:50]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flag meet about type]
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mags Wave Flag Meet\copytitle.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\transsixth]
C:\DOKUME~1\DENNIS~1\ANWEND~1\SOAPDA~1\Extrarealshim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
C:\WINDOWS\vVX3000.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"swg"=C:\Programme\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
"MessengerPlus3"="C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" /background
"Skype"="C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" /background
"transsixth"=C:\DOKUME~1\DENNIS~1\ANWEND~1\SOAPDA~1\Extrarealshim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SoundMan"=SOUNDMAN.EXE
"DAEMON Tools"="C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
"InCD"=C:\Programme\Ahead\InCD\InCD.exe
"LanguageShortcut"=C:\Programme\CyberLink\PowerDVD\Language\Language.exe
"LifeCam"="C:\Programme\Microsoft LifeCam\LifeExp.exe"
"MessengerPlus3"="C:\Programme\MessengerPlus! 3\MsgPlus.exe"
"SunJavaUpdateSched"=C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"Picasa Media Detector"=C:\Programme\Picasa2\PicasaMediaDetector.exe
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"VX3000"=C:\WINDOWS\vVX3000.exe
"Microsoft Works Update Detection"=C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"WorksFUD"=C:\Programme\Microsoft Works\wkfud.exe
"Microsoft Works Portfolio"=C:\Programme\Microsoft Works\WksSb.exe /AllUsers
"flag meet about type"=C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mags Wave Flag Meet\Pile Trans.exe
"Ulead AutoDetector v2"=C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe

R0 a347bus;a347bus;C:\WINDOWS\system32\DRIVERS\a347bus.sys
R0 a347scsi;a347scsi;C:\WINDOWS\system32\Drivers\a347scsi.sys
R1 avgio;avgio;\??\C:\Programme\AntiVir PersonalEdition Classic\avgio.sys
R2 ElbyCDIO;ElbyCDIO Driver;C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
R2 MSCamSvc;MSCamSvc;"C:\Programme\Microsoft LifeCam\MSCamS32.exe"
R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 AnyDVD;AnyDVD;C:\WINDOWS\system32\Drivers\AnyDVD.sys
R3 avgntflt;avgntflt;\??\C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys
R3 dtscsi;dtscsi;C:\WINDOWS\system32\Drivers\dtscsi.sys
R3 VX3000;VX-3000;C:\WINDOWS\system32\DRIVERS\VX3000.sys
S3 ovt519;%USB\vid_054c&pid_0154.DeviceDesc%;C:\WINDOWS\system32\Drivers\ov519vid.sys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab9ea067-74bc-11db-9b0d-0020edb596f3}]
AutoRun\command- G:\Autorun.exe


Contents of the 'Scheduled Tasks' folder
2007-07-20 15:18:22 C:\WINDOWS\Tasks\1-Klick-Wartung.job - C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 12:32:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000137

scanning hidden files ...

**************************************************************************

Completion time: 2007-07-31 12:34:04

   --- E O F ---


[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


skasuj folder:

C:\Programme\BearShare Applications

wklej do notatnika:

REGEDIT 4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"MessengerPlusUninstall"=-
"MessengerPlusLiveUninstall"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"transsixth"=-
"MessengerPlus3"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"MessengerPlus3"=-
"flag meet about type"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flag meet about type]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\transsixth]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Autor postu otrzymał pochwałę