Moj pulpit jest czerwony zarazony SPYWARE !

[skibol]

hehe dzięki boys teraz z tymi linkami powinienem sobie poradzić niewiem dokładnie o ce be z tymi plusikami (ale regulamin czytałem ) więc najchętniej dał bym je wszystkim

[Tom@szek]

Jak już przeskanujesz to zapodaj ponownie loga z hijack.

[PIOTR2020]

Tu jest link ze ''szczepionkami'' na to.
http://forum.mks.com.pl/forum/viewthread.php?tid=12021

[wojtas55]

witam
też miałem czerwony pulpit
Prosze o pomoc co mam usunać, cos usuinełem ale jeszcze cos muli




Logfile of HijackThis v1.99.1
Scan saved at 07:52, on 2008-06-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\PC Tools AntiVirus\PCTAV.exe
D:\Program Files\Gadu-Gadu\gg.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Documents and Settings\woj\Dane aplikacji\UpdateStar\UpdateStar.exe
D:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\msscntr32.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Outlook Express\msimn.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\woj\Pulpit\virus\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PCTAVApp] "D:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UpdateStar] D:\Documents and Settings\woj\Dane aplikacji\UpdateStar\UpdateStar.exe -A
O4 - Global Startup: Wireless PCI_CardBus utility V1.01.exe.lnk = ?
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PokerTime Poker - {7220F1C9-B7E0-47a6-A0BD-D5B3940BCC79} - D:\Microgaming\Poker\pokertimeMPP\MPPoker.exe
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: d:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\common files\pc tools\lsp\pctlsp.dll
O15 - Trusted Zone: http://mks.com.pl
O15 - Trusted Zone: http://*.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Microsoft Security Center Extension (msscenter) - Unknown owner - D:\WINDOWS\system32\msscntr32.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - D:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe

Pozdrowienia

[size=9:][ [i:][b:][color=#B50158:]Dodano:[/b:] Dzisiaj o 8:23[/i:] ][/size:] [/color:]
właśnie mozna sobie kawe zrobic i wypic jak się odpala

zrobie combo fixa i zobacze

[size=9:][ [i:][b:][color=#B50158:]Dodano:[/b:] Dzisiaj o 8:36[/i:] ][/size:] [/color:]
ComboFix 08-06-03.4 - woj 2008-06-05 8:24:18.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.228 [GMT 2:00]
Running from: D:\Documents and Settings\woj\Pulpit\virus\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\WINDOWS\s32.txt
.
---- Previous Run -------
.
D:\WINDOWS\Downloaded Program Files\setup.inf
D:\WINDOWS\g32.txt
D:\WINDOWS\gs32.txt
D:\WINDOWS\homepage.html
D:\WINDOWS\index.html
D:\WINDOWS\promo1.html
D:\WINDOWS\promo2.html
D:\WINDOWS\promo3.html
D:\WINDOWS\promo4.html
D:\WINDOWS\promo5.html
D:\WINDOWS\promo6.html
D:\WINDOWS\promogif1.gif
D:\WINDOWS\promogif2.gif
D:\WINDOWS\promogif3.gif
D:\WINDOWS\s32.txt
D:\WINDOWS\system32\adult.txt
D:\WINDOWS\system32\aspimgr.exe
D:\WINDOWS\system32\finance.txt
D:\WINDOWS\system32\lt.res
D:\WINDOWS\system32\other.txt
D:\WINDOWS\system32\pharma.txt
D:\WINDOWS\system32\sft.res
D:\WINDOWS\system32\sn.txt
D:\WINDOWS\system32\sockins32.dll
D:\WINDOWS\ws386.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASPIMGR
-------\Legacy_NWSAPAGENT
-------\Service_aspimgr
-------\Service_NwSapAgent


((((((((((((((((((((((((( Files Created from 2008-05-05 to 2008-06-05 )))))))))))))))))))))))))))))))
.

2008-06-04 22:57 . 2008-06-04 22:57 <DIR> d-------- D:\WINDOWS\system32\xircom
2008-06-04 22:57 . 2008-06-04 22:57 <DIR> d-------- D:\Program Files\microsoft frontpage
2008-06-04 22:47 . 2008-06-04 22:47 <DIR> d-------- D:\Program Files\Common Files\PC Tools
2008-06-04 21:56 . 2008-06-04 21:56 <DIR> d-------- D:\Documents and Settings\woj\Dane aplikacji\PC Tools
2008-06-04 21:50 . 2008-06-05 08:11 <DIR> d-------- D:\Program Files\PC Tools AntiVirus
2008-06-04 21:50 . 2007-12-06 15:51 28,568 --a------ D:\WINDOWS\system32\drivers\AVHook.sys
2008-06-04 21:50 . 2007-12-06 15:51 21,912 --a------ D:\WINDOWS\system32\drivers\AVRec.sys
2008-06-04 21:50 . 2008-02-12 10:44 21,904 --a------ D:\WINDOWS\system32\drivers\AVFilter.sys
2008-06-04 21:43 . 2008-06-04 21:43 <DIR> d-------- D:\Program Files\Lavasoft
2008-06-04 14:08 . 2008-06-04 14:08 36,864 --a------ D:\WINDOWS\system32\msscntr32.exe
2008-06-01 19:35 . 2008-06-01 19:35 <DIR> d-------- D:\Poker
2008-06-01 19:11 . 2008-06-04 23:27 <DIR> d-------- D:\WINDOWS\system32\FlashAX
2008-06-01 19:09 . 2008-06-01 19:32 <DIR> d-------- D:\Documents and Settings\woj\Dane aplikacji\Microgaming
2008-06-01 19:08 . 2008-06-01 19:08 <DIR> d-------- D:\Microgaming
2008-06-01 18:37 . 2008-06-01 19:21 <DIR> d-------- D:\Program Files\Holdem Bot
2008-06-01 17:56 . 2008-06-01 17:56 43,044 --ah----- D:\WINDOWS\system32\mlfcache.dat
2008-05-29 21:53 . 2008-05-29 21:53 <DIR> d-------- D:\Program Files\Safari
2008-05-29 21:53 . 2008-05-29 21:53 <DIR> d-------- D:\Documents and Settings\woj\Dane aplikacji\Apple Computer
2008-05-27 07:41 . 2008-06-04 23:23 <DIR> d-------- D:\Program Files\Hold'em Hawk
2008-05-05 22:31 . 2008-05-05 22:31 <DIR> d-------- D:\Documents and Settings\woj\Dane aplikacji\ArcSoft
2008-05-05 22:16 . 2005-02-23 14:58 11,776 --a------ D:\WINDOWS\system32\drivers\afc.sys
2008-05-05 22:15 . 2008-05-05 22:15 <DIR> d-------- D:\Program Files\Common Files\ArcSoft
2008-05-05 22:15 . 2006-01-24 10:20 1,645,320 -ra------ D:\WINDOWS\system32\GdiPlus.dll
2008-05-05 22:15 . 2007-04-19 09:39 400,128 --a------ D:\WINDOWS\system32\MSLUP60.dll
2008-05-05 22:15 . 2007-04-19 09:39 256,768 --a------ D:\WINDOWS\system32\MSLURT.dll
2008-05-05 22:15 . 2005-04-27 16:36 245,408 --a------ D:\WINDOWS\system32\unicows.dll
2008-05-05 22:06 . 2008-05-05 22:06 <DIR> d-------- D:\Documents and Settings\woj\Dane aplikacji\CASIO

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 06:18 --------- d-----w D:\Documents and Settings\woj\Dane aplikacji\Cream Software
2008-06-05 06:17 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-06-04 21:23 --------- d-----w D:\Program Files\RescuePRO
2008-06-04 21:17 --------- d-----w D:\Program Files\SkanerOnline
2008-05-26 18:43 --------- d-----w D:\Program Files\Nokia
2008-05-26 18:41 --------- d-----w D:\Program Files\WinISD
2008-05-26 18:40 --------- d-----w D:\Program Files\Google
2008-05-26 18:39 --------- d-----w D:\Program Files\pic
2008-05-26 18:39 --------- d-----w D:\Program Files\CHIP System Check Tool
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2005-11-11 14:47 7311360]
"PCTAVApp"="D:\Program Files\PC Tools AntiVirus\PCTAV.exe" [2008-03-05 09:37 1238928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=D:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"NvCplDaemon"=RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
"NeroFilterCheck"=D:\WINDOWS\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\totalcmd\\TOTALCMD.EXE"=

R2 msscenter;Microsoft Security Center Extension;D:\WINDOWS\system32\msscntr32.exe [2008-06-04 14:08]
S3 udfpt;udfpt;D:\WINDOWS\system32\drivers\udfpt.sys []
S3 usbscan;Sterownik skanera USB;D:\WINDOWS\system32\DRIVERS\usbscan.sys [2006-09-13 19:19]
S3 USBSTOR;Sterownik magazynu masowego USB;D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-09-13 18:19]
S3 W8335PCI;802.11g/b Driver ;D:\WINDOWS\system32\DRIVERS\Mrvw123.sys [2005-12-29 14:07]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-05 08:26:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-05 8:31:09
ComboFix-quarantined-files.txt 2008-06-05 06:30:17

Pre-Run: 1,483,485,184 bajtów wolnych
Post-Run: 1,486,188,544 bajtów wolnych

134 --- E O F --- 2008-03-11 21:19:40

[Precel]

wojtas55 napisz osobny temat w bezpieczeństwie
i obejmij go pozniej tagami code
eot