win32:jeefo

**Posty:** 12 · przez **n30x** 18 Lip 2007, 13:18

Przy każdym pliku .exe pojawia się ten wirus(win32:jeefo)... dodaje logi z hijacka i silentrunnera i czekam na odpowiedzi.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:14:01, on 2007-07-18 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE E:\Programy\Avast Antyvirus\aswUpdSv.exe E:\Programy\Avast Antyvirus\ashServ.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Avast Antyvirus\ashWebSv.exe C:\WINDOWS\SOUNDMAN.EXE E:\Programy\AVASTA~1\ashDisp.exe E:\Programy\Daemon Tools\daemon.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe E:\Programy\AresLite\Ares\Ares.exe C:\Program Files\Skype\Phone\Skype.exe E:\Gadu-Gadu\gg 7.6\G-G\gg.exe E:\Programy\WinZip\WZQKPICK.EXE C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.BIN C:\Program Files\Razer\razertra.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Opera\Opera.exe E:\Programy\Hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avast!] E:\Programy\AVASTA~1\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Programy\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Windows LSASS Service] E:\Programy\Hacking\DAO\svchost.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ares] "E:\Programy\AresLite\Ares\Ares.exe" -h O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AIP] C:\WINDOWS\aip.exe O4 - HKCU\..\Run: [PestTrap] C:\Program Files\PestTrap\PestTrap.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg 7.6\G-G\gg.exe" /tray O4 - Startup: OpenOffice.ux.pl 2.1.0.lnk = C:\Program Files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe O4 - Global Startup: WinZip Quick Pick.lnk = E:\Programy\WinZip\WZQKPICK.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - (no file) O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - E:\Programy\AresLite\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Programy\Avast Antyvirus\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - E:\Programy\Avast Antyvirus\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - E:\Programy\Avast Antyvirus\ashWebSv.exe" /service (file missing) O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "ares" = ""E:\Programy\AresLite\Ares\Ares.exe" -h" ["Ares Development Group"] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "AIP" = "C:\WINDOWS\aip.exe" [file not found] "PestTrap" = "C:\Program Files\PestTrap\PestTrap.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} "isamonitor.exe" = "C:\Program Files\Perfect Codec\isamonitor.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "avast!" = "E:\Programy\AVASTA~1\ashDisp.exe" [null data] "DAEMON Tools" = ""E:\Programy\Daemon Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "razer" = "C:\Program Files\Razer\razerhid.exe" [empty string] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found] "Windows LSASS Service" = "E:\Programy\Hacking\DAO\svchost.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {85F685C3-20D9-4943-95E4-EB4224056C3F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Expressivo" \InProcServer32\(Default) = "E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll" ["IVO Software Sp. z o.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

**Posty:** 18165 · przez **wojtas** 18 Lip 2007, 13:25

silent jest uciety

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

znasz to:

O4 - HKLM\..\Run: [Windows LSASS Service] E:\Programy\Hacking\DAO\svchost.exe

potem 3 nowe logi z hijacka silenta oraz combofixa:

combofixa

**Posty:** 12 · przez **n30x** 18 Lip 2007, 13:34

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [Windows LSASS Service] E:\Programy\Hacking\DAO\svchost.exe

Tego nie ma...

Jak uzyć tego programu z opcji drugiej?
po uruchomieniu włącza mi się konsola cmd.
i utwarza się nowy folder

**Posty:** 18165 · przez **wojtas** 18 Lip 2007, 13:36

n30x napisał(a):po uruchomieniu włącza mi się konsola cmd.

wciskasz 2 i dajesz enter czekasz i potem nowe 3 logi o ktore prosilem najlepiej jakbys te 3 logi wrzucil na jakis serwer np. www.rapidshare.com

**Posty:** 8694 · przez **Red** 18 Lip 2007, 13:41

n30x napisał(a):Jak uzyć tego programu z opcji drugiej?

masz tam przeciez na screnach jak to zrobić,chyba na drugim jak się nie mylę

p.s.

Na drugi raz bardzo proszę o wklejanie pełnych logów,dokonczonych,bo zasada jest taka że tylko takie są sprawdzanie na naszym forum.

**Posty:** 12 · przez **n30x** 18 Lip 2007, 13:57

nie chodzą Mi żadne ftp z tego powodu a więc zamieszczam wszystko tutaj:

Kod: Zaznacz wszystko: SmitFraudFix v2.204 Scan done at 13:38:33,32, 2007-07-18 Run from E:\Programy\SmitFraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\svchost.exe Deleted C:\DOCUME~1\Vicked\Ulubione\Online Security Test.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 80.51.89.5 DNS Server Search Order: 80.51.89.2 HKLM\SYSTEM\CCS\Services\Tcpip\..\{E5657A1D-9E54-4E6B-8FDE-6E9AD064A404}: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CS1\Services\Tcpip\..\{E5657A1D-9E54-4E6B-8FDE-6E9AD064A404}: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CS2\Services\Tcpip\..\{E5657A1D-9E54-4E6B-8FDE-6E9AD064A404}: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CS3\Services\Tcpip\..\{E5657A1D-9E54-4E6B-8FDE-6E9AD064A404}: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.51.89.5 80.51.89.2 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=80.51.89.5 80.51.89.2 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Kod: Zaznacz wszystko: "Vicked" - 2007-07-18 13:52:07 - ComboFix 07-07-14.6 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 ))))))))))))))))))))))))))))))) 2007-07-18 13:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-18 13:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-18 13:38 1,330 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-18 13:30 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-07-18 13:30 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-07-18 13:06 <DIR> d-------- C:\DOCUME~1\Vicked\DANEAP~1\Gadu-Gadu 2007-07-18 12:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Szablony 2007-07-18 12:30 <DIR> d-------- C:\WINDOWS\San Andreas Mod Installer 2007-07-03 19:09 <DIR> d-------- C:\WUTemp 2007-07-03 08:56 <DIR> d-------- C:\filmy 2007-06-23 08:14 <DIR> d-------- C:\Program Files\mIRC (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-18 11:33:43 -------- d-----w C:\DOCUME~1\Vicked\DANEAP~1\Skype 2007-07-18 10:33:43 -------- d-----w C:\DOCUME~1\Vicked\DANEAP~1\OpenOffice.ux.pl2 2007-07-18 10:31:21 -------- d-----w C:\DOCUME~1\Vicked\DANEAP~1\Hamachi 2007-06-18 11:31:47 -------- d-----w C:\DOCUME~1\Vicked\DANEAP~1\teamspeak2 2007-06-07 10:27:42 73,532 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-07 10:27:42 495,436 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-07 09:47:58 -------- d-----w C:\Program Files\Rockstar Games 2007-06-06 17:44:18 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-06-06 16:56:00 -------- d--h--w C:\Program Files\InstallShield Installation Information 16507-02-25 13:48:25 552 ----a-w C:\WINDOWS\system32\d3d8caps.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2001-04-16 16:39 37808 --------- C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85F685C3-20D9-4943-95E4-EB4224056C3F}] 2007-01-26 14:35 102400 --a------ E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nwiz"="nwiz.exe" [2003-11-17 07:33 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2003-08-15 09:34 C:\WINDOWS\SOUNDMAN.EXE] "avast!"="E:\Programy\AVASTA~1\ashDisp.exe" [2007-01-15 19:28] "DAEMON Tools"="E:\Programy\Daemon Tools\daemon.exe" [2005-12-10 16:57] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03] "razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 18:21] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [] "Windows LSASS Service"="E:\Programy\Hacking\DAO\svchost.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14] "ares"="E:\Programy\AresLite\Ares\Ares.exe" [2007-03-15 04:15] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-05-07 10:32] "AIP"="C:\WINDOWS\aip.exe" [] "Gadu-Gadu"="E:\Gadu-Gadu\gg 7.6\G-G\gg.exe" [2007-07-09 09:39] HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-18 13:53:02 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-18 13:53:24 --- E O F ---

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:54:23, on 2007-07-18 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe E:\Programy\Avast Antyvirus\aswUpdSv.exe E:\Programy\Avast Antyvirus\ashServ.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Avast Antyvirus\ashWebSv.exe C:\WINDOWS\SOUNDMAN.EXE E:\Programy\AVASTA~1\ashDisp.exe E:\Programy\Daemon Tools\daemon.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\ctfmon.exe E:\Programy\AresLite\Ares\Ares.exe C:\Program Files\Skype\Phone\Skype.exe E:\Gadu-Gadu\gg 7.6\G-G\gg.exe E:\Programy\WinZip\WZQKPICK.EXE C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.BIN C:\Program Files\Razer\razertra.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\explorer.exe E:\Programy\Hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avast!] E:\Programy\AVASTA~1\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Programy\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Windows LSASS Service] E:\Programy\Hacking\DAO\svchost.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ares] "E:\Programy\AresLite\Ares\Ares.exe" -h O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AIP] C:\WINDOWS\aip.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg 7.6\G-G\gg.exe" /tray O4 - Startup: OpenOffice.ux.pl 2.1.0.lnk = C:\Program Files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe O4 - Global Startup: WinZip Quick Pick.lnk = E:\Programy\WinZip\WZQKPICK.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - E:\Programy\AresLite\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Programy\Avast Antyvirus\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - E:\Programy\Avast Antyvirus\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - E:\Programy\Avast Antyvirus\ashWebSv.exe" /service (file missing) O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Silenta cały czas Mi ucina...

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "ares" = ""E:\Programy\AresLite\Ares\Ares.exe" -h" ["Ares Development Group"] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "AIP" = "C:\WINDOWS\aip.exe" [file not found] "PestTrap" = "C:\Program Files\PestTrap\PestTrap.exe" [file not found] "Gadu-Gadu" = ""E:\Gadu-Gadu\gg 7.6\G-G\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} "isamonitor.exe" = "C:\Program Files\Perfect Codec\isamonitor.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "avast!" = "E:\Programy\AVASTA~1\ashDisp.exe" [null data] "DAEMON Tools" = ""E:\Programy\Daemon Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "razer" = "C:\Program Files\Razer\razerhid.exe" [empty string] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found] "Windows LSASS Service" = "E:\Programy\Hacking\DAO\svchost.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {85F685C3-20D9-4943-95E4-EB4224056C3F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Expressivo" \InProcServer32\(Default) = "E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll" ["IVO Software Sp. z o.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Programy\Avast Antyvirus\ashShell.dll" ["ALWIL Software"] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "E:\Programy\Kodeki\Kodeki\K-lite mega pack\K-Lite Codec Pack\Real\rpshell.dll" ["RealNetworks, Inc."] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.ux.pl 2.1.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Programy\Avast Antyvirus\ashShell.dll" ["ALWIL Software"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Programy\Avast Antyvirus\ashShell.dll" ["ALWIL Software"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "E:\PROGRAMY\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Documents and Settings\Vicked\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Vicked\Dane aplikacji\Opera\Opera\profile\skin\wallpaper_xp__linux_por_txiru_26.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssmypics.scr" [MS] Startup items in "Vicked" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\Vicked\Menu Start\Programy\Autostart "OpenOffice.ux.pl 2.1.0" -> shortcut to: "C:\Program Files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe" [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "WinZip Quick Pick" -> shortcut to: "E:\Programy\WinZip\WZQKPICK.EXE" ["WinZip Computing, Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{BF1CED2C-4B3F-4079-A330-864EDA5A4CFF}" -> {HKLM...CLSID} = "Protection Bar" \InProcServer32\(Default) = "C:\Program Files\Perfect Codec\iesplugin.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{85F685C3-20D9-4943-95E4-EB4224056C3F}" = "Expressivo" -> {HKLM...CLSID} = "Expressivo" \InProcServer32\(Default) = "E:\Programy\Expressive\Expressivo Demo\IH_iexplore.dll" ["IVO Software Sp. z o.o."]

**Posty:** 8694 · przez **Red** 18 Lip 2007, 13:59

Silenta cały czas Mi ucina...

,albo to wina forum (nie miesci się),albo nie czekasz na koncowy kominikat.

**Posty:** 48 · przez **Marekwronczyn** 18 Lip 2007, 14:17

Nie dziw się jeśli masz Avasta

Autor postu otrzymał pochwałę

**Posty:** 12 · przez **n30x** 18 Lip 2007, 14:19

a jakies inne pomysły jak pozbyć sie tego wirusa?
btw. komunikat z Silenta wyskakuje ale i tak nie ma go całego...

**Posty:** 8694 · przez **Red** 18 Lip 2007, 14:41

do usuniecia masz jeszcze:

O4 - HKLM\..\Run: [Windows LSASS Service] E:\Programy\Hacking\DAO\svchost.exe

otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PestTrap"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"isamonitor.exe"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows LSASS Service"=-

u góry>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
Klikasz dwa razy na powstały plik i potwierdzasz.

ps

dasz rade to uruchomic:

http://www.wirusy.antivirenkit.pl/pl/szczepionki/Jeefo.html

**Posty:** 12 · przez **n30x** 18 Lip 2007, 14:54

oto co wyskakuje z Silenta podczas robienia LOG'a

Host skryptów systemu Windows

Skrypt: E:\Programy|silentrunner\Silent Runners.vbs
Wiersz: 7889
Znak: 4
Błąd: Przepełnienie: 'hVal'
Kod: 800A0006
Źródło: Microsoft VBScript - bład czasy wykonywania

Trzeba było odrazu z tą szczepionka przeciw jeefo dziękuje

**Posty:** 8694 · przez **Red** 18 Lip 2007, 14:55

zostawmy silent runners.
Wykonaj to co napisałem.

win32:jeefo

win32:jeefo

Kto jest na forum