wkurzający problem

[igoman]

Oryginalnie napisane przez UrielSceptum

Użyłeś pewnie jakiegoś ciemnego bota ;/ Nie widzę innego rozwiązania niż format

no to musze jakoś przekonać rodziców, albo grać na 2 kompie

[igoman]

ten proces wydawał mi sie podejrzany więc go zakończyłem:
i...błędy się przestały pokazywać

co wy na to??

[Lord_Piterek]

no widac ze to ten keylogger. Rob formata, byle szybko i zmieniaj passy !!!

[igoman]

Oryginalnie napisane przez Lord_Piterek

no widac ze to ten keylogger. Rob formata, byle szybko i zmieniaj passy !!!

ale jak zakonczylem ten proces to on dalej dziala czy nie?

[Donas]

@up
Odpowiedz sam sobie na pytanie. Skoro zakończyłeś, to jak może działać, omg?

Dawaj logi z hijackthis to coś poradzimy.

[igoman]

sie robi:
Logfile of HijackThis v1.99.1
Scan saved at 21:41:11, on 2007-07-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss*****
C:\WINDOWS\system32\winlogon*****
C:\WINDOWS\system32\services*****
C:\WINDOWS\system32\lsass*****
C:\WINDOWS\system32\Ati2evxx*****
C:\WINDOWS\system32\svchost*****
C:\Program Files\Windows Defender\MsMpEng*****
C:\WINDOWS\System32\svchost*****
d:\Program Files\Alwil Software\Avast4\aswUpdSv*****
d:\Program Files\Alwil Software\Avast4\ashServ*****
C:\WINDOWS\system32\spoolsv*****
C:\WINDOWS\system32\Ati2evxx*****
C:\WINDOWS\Explorer*****
C:\WINDOWS\system32\CTsvcCDA*****
C:\WINDOWS\System32\snmp*****
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx*****
C:\Program Files\Logitech\iTouch\iTouch*****
C:\Program Files\Java\jre1.6.0_01\bin\jusched*****
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray*****
C:\Program Files\Logitech\MouseWare\system\em_exec*****
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp*****
D:\Program Files\Winamp\winampa*****
d:\Program Files\Alwil Software\Avast4\ashMaiSv*****
C:\RECYCLER\Services\services*****
d:\Program Files\Alwil Software\Avast4\ashWebSv*****
C:\WINDOWS\system32\ctfmon*****
D:\Program Files\CursorXP\CursorXP*****
C:\Program Files\DAEMON Tools\daemon*****
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum*****
D:\Program Files\Launchy\Launchy*****
C:\Program Files\OpenOffice.ux.pl 2.0.4\program\soffice*****
C:\Program Files\OpenOffice.ux.pl 2.0.4\program\soffice.BIN
D:\Program Files\Gadu-Gadu\gg*****
C:\Program Files\Windows Defender\MSASCui*****
C:\Program Files\Mozilla Firefox\firefox*****
C:\Program Files\WinRAR\WinRAR*****
C:\DOCUME~1\Igor\USTAWI~1\Temp\Rar$EX04.579\Hijack This*****

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx*****
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch*****
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX*****
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched*****"
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray*****"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck*****
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui*****" -hide
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp*****
O4 - HKLM\..\Run: [WinampAgent] d:\Program Files\Winamp\winampa*****
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM*****" -scheduler
O4 - HKLM\..\Run: [Services] C:\RECYCLER\Services\services*****
O4 - HKLM\..\Run: [] C:\Windows\system32\*****
O4 - HKCU\..\Run: [ctfmon*****] C:\WINDOWS\system32\ctfmon*****
O4 - HKCU\..\Run: [CursorXP] d:\Program Files\CursorXP\CursorXP*****
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon*****" -lang 1033
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd*****
O4 - Startup: OpenOffice.ux.pl 2.0.4.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.4\program\quickstart*****
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum*****
O4 - Global Startup: Launchy.lnk = D:\Program Files\Launchy\Launchy*****
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL*****/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs*****
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs*****
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_71.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_30.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1096080685390
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_30.cab
O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/pl/mahjong_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - d:\Program Files\Spik\url_wpmsg.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv*****
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx*****
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag*****
O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ*****
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv*****" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv*****" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr***** (file missing)
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc***** (file missing)
O23 - Service: Symantec Proxy Service (ccPxySvc) - Unknown owner - C:\Program Files\Norton Internet Security\ccPxySvc***** (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA*****
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Unknown owner - C:\Program Files\Norton Internet Security\NISUM***** (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc***** (file missing)

[Uther92]

Co to ? O.O
O4 - HKLM\..\Run: [Services] C:\RECYCLER\Services\services*****
O4 - HKLM\..\Run: [] C:\Windows\system32\*****

Daj też log z combofix:
http://www.unicorn.ksiezyc.pl/WWW/in.../combofix.html

[Szekelebongo]

Uther92:

Do punktu 1.

Services***** is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. This process also deals with the automatic starting of services during the computers boot-up and the stopping of services during shut-down. This program is important for the stable and secure running of your computer and should not be terminated.


Do punktu 2.

Trojanisches Pferd/IRC/BackDoor.SdBot.HLV

Naprawa według forum.idg.pl

Otwórz nowy plik w Notatniku i wklej poniższy tekst:

regsvr32 oleaut32.dll
regsvr32 jscript.dll
regsvr32 vbscript.dll
regsvr32 msxml.dll
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 cryptdlg.dll

Zapisz go jako go tu jako plik: c:\fixbits.bat

otwórz okno wiersza polecenia (START - uruchom... cmd ) i wpisz polecenie pod migającym kursorem, potem Enter.

Mam nadzieję że pomogłem, jeśli coś Cię dalej trapi to pisz

Co do wyskakujących okienek to pokazują one "klasę" tego kto tworzył program. Nigdy nie należy wierzyć że użytkownik wpisze poprawne dane

[Snib'ek]

@Up
Services. e x e to też OwnTibia. Tyle, że ona jest w C:\Windows\Services . e x e
A plik systemowy to C:\Windows\System32\Services . e x e

[Szekelebongo]

Oryginalnie napisane przez Snib'ek

@Up
Services. e x e to też OwnTibia. Tyle, że ona jest w C:\Windows\Services . e x e
A plik systemowy to C:\Windows\System32\Services . e x e

Zgadzam się w 100% - niedopatrzenie z mojej strony. Przepraszam

[igoman]

O4 - HKLM\..\Run: [Services] C:\RECYCLER\Services\services*****

ten usunalem,ale ten 2 nie.dobrze??

i co mam wpisac w tym cmd??