przez do843 25 Lut 2006, 21:58
do843 napisał(a):sciągnełam Silent Runners ale pojawia sie takie ostrzezenie .
WMI NOT Instaled!
This script requiers"WMI",Windows Menagement Instrumentation, to run, It can be downland at:http://tinyurl.com/jbxe
Pres OK to direct your browser to the download site or.... itd
mam przejść na tamtą strone?
przez Red 25 Lut 2006, 22:07
przez do843 25 Lut 2006, 22:15
"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\PROGRAM FILES\GADU-GADU\GG.EXE" /tray" ["sms-express.com"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"internat.exe" = "internat.exe" [MS]
"ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS]
"SystemTray" = "SysTray.Exe" [MS]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"Atikey" = "Atitask.exe" ["ATI Technologies, Inc."]
"AtiCwd32" = "Aticwd32.exe" ["ATI Technologies Inc."]
"StillImageMonitor" = "C:\WINDOWS\SYSTEM\STIMON.EXE" [MS]
"HP Component Manager" = ""C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"" ["Hewlett-Packard Company"]
"HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"SchedulingAgent" = "mstask.exe" [MS]
"KB891711" = "C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE" [MS]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\7-ZIP\7-ZIP.DLL" ["Igor Pavlov"]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\7-ZIP\7-ZIP.DLL" ["Igor Pavlov"]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\7-ZIP\7-ZIP.DLL" ["Igor Pavlov"]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp"
WIN.INI & SYSTEM.INI launch points:
-----------------------------------
SYSTEM.INI
[boot]
INFECTION WARNING! "shell=explorer.exe ibm00001.exe" [MS], [file not found]
"SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\Aquarium.scr" [null data]
Startup items in "Startup" & "All Users...Startup" folders:
-----------------------------------------------------------
C:\WINDOWS\Menu Start\Programy\Autostart
"HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."]
"HP Image Zone - szybkie uruchamianie" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data]
Enabled Scheduled Tasks:
------------------------
"Rozpoczęcie aplikacji dostrajania" -> launches: "walign" [MS]
"Symantec NetDetect" -> launches: "C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\NDETECT.EXE" ["Symantec Corporation"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6
Toolbars, Explorer Bars, Extensions:
------------------------------------
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL" ["Sun Microsystems, Inc."]
Miscellaneous IE Hijack Points
------------------------------
HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!
C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!
Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://home.pol.chello.pl/ssi/welcome/welcome.php?url=home
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
Missing lines (compared with English-language version):
[Strings]: 2 lines
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
usbmon.dll\Driver = "usbmon.dll" [MS]
usbmon\Driver = "usbmon.dll" [MS]
hpzs9x10\Driver = "hpzs9x10.dll" ["HP"]
Canon BJC Language Monitor\Driver = "CBJMON.DLL" ["Canon Information Systems"]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 54 seconds, including 20 seconds for message boxes)przez Red 26 Lut 2006, 17:19
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{AFFB10E3-C7A0-70AA-4013-B9B129A017DD}"=-
przez Red 27 Lut 2006, 18:41
do843 napisał(a):zy czynnosci w killboxe robie w awaryjnym czy normalnie?
przez Red 27 Lut 2006, 18:55
do843 napisał(a):zapisac w jakims konkretnym katalogu?
przez do843 27 Lut 2006, 19:38
Red napisał(a):C:\WINDOWS\SYSTEM\DTEML.DLL
C:\WINDOWS\SYSTEM\IQMUI.DLL
C:\WINDOWS\SYSTEM\BQOWSEWM.DLL
C:\WINDOWS\SYSTEM\mrvcr71.dll
C:\WINDOWS\SYSTEM\iqmui.dll
C:\WINDOWS\SYSTEM\bqowsewm.dll
przez Red 27 Lut 2006, 20:19
do843 napisał(a):pojedynczo
przez Red 27 Lut 2006, 21:15
przez do843 27 Lut 2006, 21:50
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
------- System Files in System Directory -------
Wolumin w stacji dysk˘w C: SYSTEM
Numer seryjny woluminu: 2A20-16DA
Katalog C:\WINDOWS\SYSTEM
WZW32 DLL 226 592 06.02.20 21:32 WZW32.DLL
JST DLL 226 592 06.02.20 21:32 JST.DLL
UWP10 DLL 226 592 06.02.20 21:32 uwp10.dll
GDDEF DLL 226 592 06.02.20 21:32 GDDEF.DLL
MWRDO20 DLL 226 592 06.02.20 21:32 MWRDO20.DLL
MRVCR71 DLL 226 592 06.02.20 21:32 mrvcr71.dll
MSVCRT DLL 278 528 04.09.21 0:12 MSVCRT.DLL
MSVCIRT DLL 77 824 04.09.21 0:11 MSVCIRT.DLL
MSVCP60 DLL 401 462 04.02.17 20:26 MSVCP60.DLL
MFC42 DLL 1 019 959 04.02.17 6:53 MFC42.DLL
OLEPRO32 DLL 164 112 03.06.19 12:05 OLEPRO32.DLL
OLEAUT32 DLL 626 960 03.06.19 12:05 OLEAUT32.DLL
REGSVR32 EXE 37 136 00.02.24 17:07 REGSVR32.EXE
13 plik(˘w) 3 965 533 bajt˘w
0 katalog(˘w) 290 086 912 bajt˘w wolnych
------- Hidden Files in System Directory -------
Wolumin w stacji dysk˘w C: SYSTEM
Numer seryjny woluminu: 2A20-16DA
Katalog C:\WINDOWS\SYSTEM
ATI98DEF GID 10 844 04.12.30 15:59 ati98def.GID
FOLDER HTT 13 264 04.12.30 15:44 folder.htt
DESKTOP INI 266 04.12.30 15:44 desktop.ini
MSVCRT DLL 278 528 04.09.21 0:12 MSVCRT.DLL
MSVCIRT DLL 77 824 04.09.21 0:11 MSVCIRT.DLL
MSVCP60 DLL 401 462 04.02.17 20:26 MSVCP60.DLL
MFC42 DLL 1 019 959 04.02.17 6:53 MFC42.DLL
OLEPRO32 DLL 164 112 03.06.19 12:05 OLEPRO32.DLL
OLEAUT32 DLL 626 960 03.06.19 12:05 OLEAUT32.DLL
REGSVR32 EXE 37 136 00.02.24 17:07 REGSVR32.EXE
10 plik(˘w) 2 630 355 bajt˘w
0 katalog(˘w) 290 082 816 bajt˘w wolnych
---------------- User Agent ------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{48A8F24B-6F61-7AEA-5893-D79F8E76A322}"=""
------------------ Locate.com Results ------------------
C:\WINDOWS\SYSTEM\
wzw32.dll Mon 2006-02-20 21:32:52 ..S.R 226 592 221,28 K
jst.dll Mon 2006-02-20 21:32:52 ..S.R 226 592 221,28 K
uwp10.dll Mon 2006-02-20 21:32:52 ..S.R 226 592 221,28 K
gddef.dll Mon 2006-02-20 21:32:52 ..S.R 226 592 221,28 K
mwrdo20.dll Mon 2006-02-20 21:32:52 ..S.R 226 592 221,28 K
mrvcr71.dll Mon 2006-02-20 21:32:52 ..S.R 226 592 221,28 K
6 items found: 6 files, 0 directories.
Total of file sizes: 1 359 552 bytes 1,29 M
------------ Strings.exe Qoologic Results ------------
C:\WINDOWS\hosts.bak: 127.0.0.1 www.qoologic.com
C:\WINDOWS\hosts: 127.0.0.1 www.qoologic.com
-------------- Strings.exe Aspack Results -------------
----------------- HKLM Run Key ------------------
-------------- Strings.exe Umonitor Results -------------
C:\WINDOWS\SYSTEM\ipebase11.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z
przez Red 27 Lut 2006, 22:04
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{48A8F24B-6F61-7AEA-5893-D79F8E76A322}"=-
przez Red 27 Lut 2006, 22:15
przez do843 27 Lut 2006, 22:43
Red napisał(a):REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{48A8F24B-6F61-7AEA-5893-D79F8E76A322}"=-
przez Red 27 Lut 2006, 22:46
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{48A8F24B-6F61-7AEA-5893-D79F8E76A322}"=-
przez Red 27 Lut 2006, 23:09
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 3 gości