log do spr.

Przeghlądam strony w Operze i pojawia mi sie okno jak bym chciał pobrać jakis program, a tego programu nie pobierałem ( Avasy informujemnie ze strona jakaś tam ma wira ale ja na tej stronie nigdy nie byłem ) wieć podaje log z Silent Runners i HijackThis. Prosze o pomoc.



Logfile of HijackThis v1.99.1
Scan saved at 14:51:59, on 2006–04–01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Spybot – Search & Destroy\TeaTimer.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\Program Files\ewido anti–malware\ewidoctrl.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Gadu–Gadu\gg.exe
E:\Program Files\Alwil Software\Avast4\ashDisp.exe
D:\WINDOWS\system32\taskmgr.exe
E:\Program Files\Spybot – Search & Destroy\SpybotSD.exe
E:\Program Files\Opera\Opera.exe
D:\Documents and Settings\bbbb\Pulpit\TORRENT\HijackThis.exe

R1 – HKLM\Software\Microsoft\Internet Explorer,SearchAssistant = about:blank
R0 – HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 – HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 – HKCU\..\Run: [Gadu–Gadu] "F:\Program Files\Gadu–Gadu\gg.exe" /tray
O4 – HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot – Search & Destroy\TeaTimer.exe
O4 – HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\MSMSGS.EXE" /background
O4 – Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O17 – HKLM\System\CCS\Services\Tcpip\..\{5F6AE2BF–D96E–4A81–85CC–08F83FE34199}: NameServer = 194.204.159.1,194.204.152.34
O23 – Service: avast! iAVS4 Control Service (aswUpdSv) – Unknown owner – E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 – Service: Ati HotKey Poller – ATI Technologies Inc. – D:\WINDOWS\System32\Ati2evxx.exe
O23 – Service: ATI Smart – Unknown owner – D:\WINDOWS\system32\ati2sgag.exe
O23 – Service: avast! Antivirus – Unknown owner – E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 – Service: avast! Mail Scanner – Unknown owner – E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 – Service: avast! Web Scanner – Unknown owner – E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 – Service: ewido security suite control – ewido networks – F:\Program Files\ewido anti–malware\ewidoctrl.exe
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non–default values, except where indicated by "{++}"


Startup items buried in registry:
–––––––––––––––––––––––––––––––––

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu–Gadu" = ""F:\Program Files\Gadu–Gadu\gg.exe" /tray" ["sms–express.com"]
"SpybotSD TeaTimer" = "E:\Program Files\Spybot – Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]
"MSMSGS" = ""D:\Program Files\Messenger\MSMSGS.EXE" /background" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{53707962–6F74–2D53–2644–206D7942484F}\(Default) = (no title provided)
–> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714–76d4–11d1–8b24–00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
–> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560–9AA2–1069–930E–00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
–> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{63542C48–9552–494A–84F7–73AA6A7C99C1}" = "OpenOffice Property Sheet Handler"
–> {CLSID}\InProcServer32\(Default) = "F:\Program Files\OpenOffice.org1.1.4\program\shlxthdl.dll" ["Sun Microsystems, Inc."]
"{0006F045–0000–0000–C000–000000000046}" = "Microsoft Outlook Custom Icon Handler"
–> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{B41DB860–8EE4–11D2–9906–E49FADC173CA}" = "WinRAR shell extension"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
"{21569614–B795–46b1–85F4–E737A8DC09AD}" = "Shell Search Band"
–> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\browseui.dll" [MS]
"{472083B0–C522–11CF–8763–00608CC02F24}" = "avast"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{9EF34FF2–3396–4527–9D27–04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"
–> {CLSID}\InProcServer32\(Default) = "F:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]
INFECTION WARNING! "{54D9498B–CF93–414F–8984–8CE7FDE0D391}" = "ewido shell guard"
–> {CLSID}\InProcServer32\(Default) = "F:\Program Files\ewido anti–malware\shellhook.dll" ["TODO: "]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0–C522–11CF–8763–00608CC02F24}"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860–8EE4–11D2–9906–E49FADC173CA}"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860–8EE4–11D2–9906–E49FADC173CA}"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0–C522–11CF–8763–00608CC02F24}"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860–8EE4–11D2–9906–E49FADC173CA}"
–> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
–––––––––––––––––––––––––––––

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "D:\Documents and Settings\bbbb\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "bbbb" & "All Users" startup folders:
––––––––––––––––––––––––––––––––––––––––––––––––––––––

D:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Microsoft Office" –> shortcut to: "D:\Program Files\Microsoft Office\Office\OSA9.EXE –b –l" [MS]


Winsock2 Service Provider DLLs:
–––––––––––––––––––––––––––––––

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 – 03, 06 – 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 – 05


Running Services (Display Name, Service Name, Path {Service DLL}):
––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

Ati HotKey Poller, Ati HotKey Poller, "D:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""E:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
ewido security suite control, ewido security suite control, "F:\Program Files\ewido anti–malware\ewidoctrl.exe" ["ewido networks"]


Print Monitors:
–––––––––––––––

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]


––––––––––
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the –all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 73 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 23 seconds.
–––––––––– (total run time: 143 seconds)

Odpowiedzi: 2

To co jest nie tak?????
Zainstalowałem Free Internet Eraser i oto wyniki.

Initalizing Free Internet Eraser...

ComputerName: ERTR–861YFC717U
Current UserName: bbbb
Windows Type: Microsoft Windows XP
Windows Version: 5.1 (Build 2600) Dodatek Service Pack 2
Windows Main Directory: D:\WINDOWS
Windows System Directory: D:\WINDOWS\system32
Windows Temporary Files Directory: D:\DOCUME~1\bbbb\USTAWI~1\Temp
Internet Explorer Cache Directory: D:\Documents and Settings\bbbb\Ustawienia lokalne\Temporary Internet Files
Internet Explorer Cookies Directory: D:\Documents and Settings\bbbb\Cookies
Internet Explorer History Directory: D:\Documents and Settings\bbbb\Ustawienia lokalne\Historia

Free Internet Eraser Ready...

Erasing Windows Recent Document List......
Windows Recent Document List Erased.

Erasing Windows Run History....
Windows Run History Erased.

Erasing Windows Find Computer History...
Windows Find Computer History Erased.

Erasing Windows Find Files/Folders History...
Windows Find Files/Folders History Erased.

Erasing Windows Open/Save History.....
Windows Open/Save History Erased.

Erasing Windows Registry Streams...
Windows Registry Streams Erased.

Erasing Windows Clipboard...
Windows Clipboard Erased.

Erasing Windows Recycle Bin.....
Windows Recycle Bin Erased.

Erasing Windows Temporary Files Directory....
Windows Temporary Files Directory Erased.

Erasing Windows Scandisk File Fragments (*.CHK)...
Windows Scandisk File Fragments (*.CHK) Erased.

Erasing Windows Paint Recent File List...
Windows Paint Recent File List Erased.

Erasing Windows Wordpad Recent File List...
Windows Wordpad Recent File List Erased.

Erasing Windows MediaPlayer Recent File List...
Windows MediaPlayer Recent File List Erased.

Erasing Internet Explorer Cache.....
Internet Explorer Cache Erased.

Erasing Internet Explorer Browser History.....
Internet Explorer Browser History Erased.

Erasing Internet Explorer Cookies...
Internet Explorer Cookies Erased.

Erasing Internet Explorer Location Bar/Visited URLs...
Internet Explorer Location Bar/Visited URLs Erased.

Erasing Internet Explorer Typed URLs....
Internet Explorer Typed URLs Erased.

Erasing Internet Explorer Downloaded Program Files Directory....
Internet Explorer Downloaded Program Files Directory Erased.

Cleaning Completed!

Cleaning Summary:
===============================================================================
Registry Keys Erased: 4 Folders Erased: 5
Registry Values Erased: 0 Files Erased: 8
===============================================================================
Released Disk Space: 56,53 KB
Under
Dodano
01.04.2006 19:26:54
Jest czysto nic nie widać :wink:
Wiewia
Dodano
01.04.2006 17:31:20
Under
Dodano:
01.04.2006 17:18:24
Komentarzy:
2
Strona 1 / 1