logo elektroda
logo elektroda
X
logo elektroda
Szukanie Zaawansowane
logo elektroda
REKLAMA
REKLAMA
Adblock/uBlockOrigin/AdGuard mogą powodować znikanie niektórych postów z powodu nowej reguły.

Analiza loga HijackThis v1.99.1 na Windows XP SP1 - podejrzenie infekcji?

donkaroluss 07 Sie 2006 18:05 1291 4
REKLAMA
Zgłoś naruszenie prawa
| Nowy temat
  • #1 2889961
    donkaroluss
    Poziom 12  
    Posty: 107
    Pomógł: 5
    Ocena: 6
    Logfile of HijackThis v1.99.1
    Scan saved at 16:53:07, on 07.08.2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Programme\Keyboard Driver\Keyboard Driver\ikeymain.exe
    C:\Programme\Keyboard Driver\mouse_2k.exe
    C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\vsnpstd.exe
    C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
    C:\Programme\Macrogaming\SweetIM\SweetIM.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Programme\AntiVir PersonalEdition Classic\sched.exe
    C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
    d:\programe\neu\RTETPISv.exe
    C:\WINDOWS\System32\svchost.exe
    D:\programe\Skype\Phone\Skype.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Programme\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ish.de/
    R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programme\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\programe\Adobe\ActiveX\AcroIEHelper.dll
    O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
    O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programme\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [Keyboard driver ] C:\Programme\Keyboard Driver\Keyboard Driver\ikeymain.exe
    O4 - HKLM\..\Run: [SANSUNMouse ] C:\Programme\Keyboard Driver\mouse_2k.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [dmvzd.exe] C:\WINDOWS\System32\dmvzd.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SweetIM] C:\Programme\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKCU\..\Run: [RTEGPRS] "C:\Programme\Gemeinsame Dateien\RTE\RTEGPRS.exe" tray
    O4 - Global Startup: Adobe Reader - Schnellstart.lnk = D:\programe\Adobe\Reader\reader_sl.exe
    O4 - Global Startup: MSWin.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programe\ICQ\ICQLite\ICQLite.exe
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programe\ICQ\ICQLite\ICQLite.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://peterzander.spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,912,0
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CCS\Services\Tcpip\..\{83D86335-5C58-486F-AD62-DD7731A35444}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EF92F0F0-2E68-463A-A3DD-B57098B94F12}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.29 85.255.112.109
    O17 - HKLM\System\CS1\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.29 85.255.112.109
    O17 - HKLM\System\CS2\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.29 85.255.112.109
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - AppInit_DLLs: index.dat
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
    O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: RTE : TAPI (RTETAPIService) - RTE Software - d:\programe\neu\RTETPISv.exe

    Log nie jest moj. System zostal przeskanowany programami: ewido, ssfsetup1_0, xclean_micro. Te dwa pierwsze zostaly juz zdeinstalowane.
    Co do wwdc to wyglada to tak:
    Analiza loga HijackThis v1.99.1 na Windows XP SP1 - podejrzenie infekcji?
  • REKLAMA
  • #2 2890800
    Kolobos
    Spec od komputerów  
    Posty: 85182
    Pomógł: 17174
    Ocena: 10461
    SweetIM mozna odinstalowac i usunac jego wpisy.

    Do kasacji w hjt:
    O4 - HKLM\..\Run: [dmvzd.exe] C:\WINDOWS\System32\dmvzd.exe <- plik usun z dysku.
    O4 - Global Startup: MSWin.exe
    O20 - AppInit_DLLs: index.dat
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    Czy te dnsy sa poprawne:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109

    Jezeli tak to zostaw, a jezeli nie to wszystkie te wpisy do kasacji.

    Warto tez uzyc:
    http://downloads.subratam.org/Fixwareout.exe
    i wkleic log z usuwania na forum.
  • REKLAMA
  • #3 2893961
    donkaroluss
    Poziom 12  
    Posty: 107
    Pomógł: 5
    Ocena: 6
    Log po korekcie:

    Logfile of HijackThis v1.99.1
    Scan saved at 16:29:33, on 08.08.2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    D:\programe\Nero\InCD\InCDsrv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Programme\Keyboard Driver\Keyboard Driver\ikeymain.exe
    C:\Programme\Keyboard Driver\mouse_2k.exe
    C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\vsnpstd.exe
    C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\programe\Nero\InCD\InCD.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Programme\AntiVir PersonalEdition Classic\sched.exe
    C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wuauclt.exe
    D:\programe\Nero\Nero StartSmart\NeroStartSmart.exe
    D:\programe\Nero\NeroVision\NeroVision.exe
    D:\programe\Emule\eMule0.47a\emule.exe
    D:\programe\Skype\Phone\Skype.exe
    C:\Programme\MSN Messenger\msnmsgr.exe
    C:\Programme\Hijackthis\HijackThis.exe

    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\programe\Adobe\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [Keyboard driver ] C:\Programme\Keyboard Driver\Keyboard Driver\ikeymain.exe
    O4 - HKLM\..\Run: [SANSUNMouse ] C:\Programme\Keyboard Driver\mouse_2k.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
    O4 - HKLM\..\Run: [InCD] D:\programe\Nero\InCD\InCD.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [RTEGPRS] "C:\Programme\Gemeinsame Dateien\RTE\RTEGPRS.exe" tray
    O4 - Global Startup: Adobe Reader - Schnellstart.lnk = D:\programe\Adobe\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programe\ICQ\ICQLite\ICQLite.exe
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programe\ICQ\ICQLite\ICQLite.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://peterzander.spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,912,0
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CCS\Services\Tcpip\..\{83D86335-5C58-486F-AD62-DD7731A35444}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EF92F0F0-2E68-463A-A3DD-B57098B94F12}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.29 85.255.112.109
    O17 - HKLM\System\CS1\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.29 85.255.112.109
    O17 - HKLM\System\CS2\Services\Tcpip\..\{2A469F79-A95C-422E-81F1-D1ABA5BD6F4B}: NameServer = 85.255.114.29,85.255.112.109
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.29 85.255.112.109
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\programe\Nero\InCD\InCDsrv.exe
    O23 - Service: RTE : TAPI (RTETAPIService) - Unknown owner - d:\programe\neu\RTETPISv.exe (file missing)

    DNSy sa poprwane.
  • REKLAMA
  • Pomocny post
    #4 2894134
    Kolobos
    Spec od komputerów  
    Posty: 85182
    Pomógł: 17174
    Ocena: 10461
    Jezeli zrobiles to co napisalem i wpisow w nowym logu nie ma, to nie ma potrzeby wklejania go na forum.
  • #5 2894522
    donkaroluss
    Poziom 12  
    Posty: 107
    Pomógł: 5
    Ocena: 6
    Cytat:
    Jezeli zrobiles to co napisalem i wpisow w nowym logu nie ma, to nie ma potrzeby wklejania go na forum.

    Przyjalem do wiadomosci. ;)
    Wielkie dzieki Kolobos
| Nowy temat
Zgłoś naruszenie prawa
REKLAMA