sprawdzenie loga

**Posty:** 55 · przez **prt** 14 Sie 2007, 11:55

Często wchodzę na pewna stronę nigdy nic nie było ale od pewnego czasu co jakiś czas przeglądając ją pojawia się okienko firefox.exe wysyłaj nie wysyłaj raportu o błędach , to czasami zdarza się też na innych stronach. Jest to o tyle wykurzające że kiedy ściągam jakiś plik i to wyskoczy to koniec pobierania ;(.

Drugim problemem jest duża liczba uruchomionych procesów, czy tak jest zawsze ? Tu chodzi mi raczej o powtarzanie się niektórych procesów.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:42:26, on 2007-08-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 89.149.200.219 l2authd.lineage2.com O1 - Hosts: 89.149.200.219 l2testauthd.lineage2.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

**Posty:** 18165 · przez **wojtas** 14 Sie 2007, 12:26

skasuj wpis oraz pogrubiony wywal do kosza:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

przeinstaluj firefoxa oraz daj loga z combofixa

**Posty:** 55 · przez **prt** 14 Sie 2007, 13:56

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Lidia" 2007-08-14 13:46:07.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.273 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-07-14 to 2007-08-14 ))))))))))))))))))))))))))))))) 2007-08-14 13:45 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-13 21:44 <DIR> dr-h----- C:\DOCUME~1\Lidia\DANEAP~1\SecuROM 2007-08-13 21:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Test Drive Unlimited 2007-08-13 20:52 <DIR> d-------- C:\Program Files\7-Zip 2007-08-06 18:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Apple Computer 2007-08-04 13:20 <DIR> d-------- C:\DOCUME~1\Lidia\DANEAP~1\fltk.org 2007-08-01 15:48 <DIR> d-------- C:\DOCUME~1\Lidia\DANEAP~1\CyberLink 2007-08-01 15:37 <DIR> d-------- C:\Program Files\CyberLink 2007-08-01 15:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\CyberLink 2007-07-30 13:22 <DIR> d-------- C:\Program Files\Matroska Pack 2007-07-29 19:27 <DIR> d-------- C:\Program Files\MarBit 2007-07-26 00:09 <DIR> d---s---- C:\DOCUME~1\Lidia\UserData 2007-07-24 15:52 <DIR> d-------- C:\DOCUME~1\Lidia\DANEAP~1\Media Player Classic 2007-07-24 15:37 774,144 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-07-24 15:37 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-07-24 15:37 <DIR> d-------- C:\Program Files\XviD 2007-07-24 15:24 <DIR> d-------- C:\Program Files\AviSynth 2.5 2007-07-24 14:37 9,804 --a------ C:\WINDOWS\system\vdremote.dll 2007-07-24 14:37 7,244 --a------ C:\WINDOWS\system\vdsvrlnk.dll 2007-07-23 12:42 <DIR> d-------- C:\Program Files\Real Alternative 2007-07-23 12:42 <DIR> d-------- C:\Program Files\Media Player Classic 2007-07-23 12:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-21 13:55 <DIR> d-------- C:\DOCUME~1\Lidia\DANEAP~1\Sports Interactive 2007-07-19 00:15 665,424 --a------ C:\WINDOWS\system32\wmv8dmoe.dll 2007-07-19 00:15 572,752 --a------ C:\WINDOWS\system32\wmvdmoe.dll 2007-07-19 00:15 438,608 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2007-07-19 00:15 1,683,792 --a------ C:\WINDOWS\system32\wmvcore2.dll 2007-07-18 20:51 <DIR> d-------- C:\Temp 2007-07-16 00:07 <DIR> d-------- C:\DOCUME~1\Lidia\DANEAP~1\Skype 2007-07-16 00:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-13 21:44 107888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-08-04 14:09 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-01 15:37 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-29 14:02 88 -r-hs---- C:\WINDOWS\system32\D644FB63F0.sys 2007-07-29 14:02 3350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-28 00:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-28 00:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-28 00:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 23:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 23:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-26 10:47 --------- d-------- C:\Program Files\Winamp 2007-07-23 12:42 --------- d-------- C:\Program Files\Common Files\Real 2007-07-23 12:42 --------- d-------- C:\DOCUME~1\Lidia\DANEAP~1\Real 2007-07-12 20:21 --------- d-------- C:\Program Files\Real 2007-07-07 22:26 --------- d-------- C:\DOCUME~1\Lidia\DANEAP~1\gtk-2.0 2007-06-28 21:13 --------- d-------- C:\DOCUME~1\Lidia\DANEAP~1\teamspeak2 2007-06-27 18:56 --------- d-------- C:\Program Files\VID_0E8F&PID_0003 2007-05-16 17:19 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 17:19 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 17:19 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-16 17:18 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 17:18 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 17:18 683520 --a------ C:\WINDOWS\system32\inetcomm.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41] "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 16:48 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-26 09:45] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 19:19] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29] S3 idrmkl;idrmkl;\??\C:\DOCUME~1\Lidia\USTAWI~1\Temp\idrmkl.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-14 13:47:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-14 13:48:13 --- E O F ---

Pierwszy raz robie combofixem , więc nie wiem czy dobrze

**Posty:** 18165 · przez **wojtas** 14 Sie 2007, 16:49

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

idrmkl

Files to delete:

C:\DOCUME~1\Lidia\USTAWI~1\Temp\idrmkl.sys

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

potem nowe logi

sprawdzenie loga

sprawdzenie loga

Kto jest na forum