|
|
#1
9-ga Wrz 2008, 10:31
| |||
| |||
 LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? Witam wszystkich, Jestem nowy w witrynie, ale bardzo wdzięczny, że jesteś tutaj. I potknięty na niego z powodu niedawnego zakażenia w mojej Mamusi laptopa (dzielimy go) i jestem pewny, jak rozwiązać ten problem. O cztery dni temu, okna IE z reklam pop-up to nagle stało z balonu na mojej Deskbar, że czyta, "Spyware wykryto! Kliknij tutaj, aby pobrać anti-spyware" I pobiegł Symantec i Spybot S & D Pełne skanowanie (nie wiesz, jak tego wirusa wypadnięcie obu tych) i nie znaleźli niczego! Potem zacząłem guglanie i pobrać Malwarebyte's Anti-Malware i że prowadził. Stwierdzono kilka rzeczy, ale nie rozwiązać problem. Ściągnąłem PrevxCSI ale nie mam wystarczająco dużo $ $ $ jeszcze kupić License (ale w razie potrzeby) i wymienia następujące: C: \ WINDOWS \ system32 \ ds fmon.dll - Malicious Software C: \ WINDOWS \ system32 \ CSRLT.exe - Malware Dropper C: \ WINDOWS \ MSBLT.exe - Malware Dropper C: \ WINDOWS \ system32 \ LSASSMGR.exe - maskowana Malware C: \ Program Files \ Mozilla Firefox \ firefoxe.exe - maskowana Malware C: \ Program Files \ Internet Explorer \ iexplor.exe - maskowana Malware C: \ WINDOWS \ system32 \ spool.exe - maskowana Malware C: \ WINDOWS \ system32 \ srtsrv32.exe - maskowana Malware C: \ WINDOWS \ system32 \ LSSMON.exe - Malware Dropper C: \ WINDOWS \ divx32.dll - Malware Dropper C: \ WINDOWS \ system32 \ msupd32.exe - Malware Dropper C: \ WINDOWS \ system32 \ upd01.exe - Malware Dropper To wygląda i brzmi jak dla mnie wiele i jestem bardzo zmartwiony.  Czy ktoś ma pomocne sugestie dla mnie? Am I będzie musiał wydać sporo pieniędzy na to naprawić?Thank you so much!  |
|
#2
9-ga Wrz 2008, 11:32
| ||||
| ||||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? Hello teddynicholas. Zapraszamy do CJ. Pobierz ComboFix przez subs jeden z poniższych linków. Bądź pewny górę zapisać je do Desktop. Link # 1 Link # 2 ** Uwaga: Ważne jest, że jest to zapisane bezpośrednio na pulpicie Zamknij wszystkie otwarte internetowych. (Firefox, Internet Explorer, itp.) przed rozpoczęciem ComboFix. Tymczasowo wyłączyć twój antywirusowe, Oraz wszelkie AntiSpyware Ochrona w czasie rzeczywistym przed wykonywania skanowania. Kliknij link aby wyświetlić listę programów bezpieczeństwa, które powinny być wyłączone i jak je wyłączyć. Dwukrotnie kliknij combofix.exe i postępuj zgodnie z instrukcjami wyświetlanymi na ekranie. Po zakończeniu ComboFix będzie produkować dziennik dla Ciebie. Opublikuj na ComboFix log w następnej odpowiedzi. Ważne: Nie mouseclick ComboFix okna, gdy jest uruchomiony. To może spowodować, że stoisko. Pamiętaj, aby ponownie uaktywnić antywirusowe i AntiSpyware ochrony gdy ComboFix jest zakończona.
__________________  Ostatnio edytowane przez evilfantasy, 9 września 2008 w 11:32. |
|
#3
16-ty Wrz 2008, 14:27
| |||
| |||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? ComboFix 08-09-15.02 - Teddy 2008-09-16 16:34:04.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.550 [GMT -4:00] Uruchamianie z: C: \ Documents and Settings \ Teddy \ Desktop \ ComboFix.exe * Utworzono nowy punkt przywracania OSTRZEŻENIE-This Machine nie ma konsoli odzyskiwania ZAINSTALOWANE! . ((((((((((((((((((((((((((((((((((((((( Inne Skreślenia ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ Documents and Settings \ LocalService \ Cookies \ system@ad.yieldmanag er [1]. Txt C: \ Documents and Settings \ Teddy \ Cookies \ teddy@ad.yieldmanager [1]. Txt C: \ WINDOWS \ Downloaded Program Files \ setup.inf C: \ WINDOWS \ system32 \ spool.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-16 do 2008-09-16 ))))))))))) )))))))))))))))))))) . 2008-09-16 16:21. 2008-09-16 16:50 <DIR> d -------- C: \ WINDOWS \ system32 \ CatRoot_bak 2008-09-16 13:23. 2008-09-16 13:23 <DIR> d -------- C: \ WINDOWS \ LastGood 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iTunes 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iPod 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dane aplikacji \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-09-13 13:12. 2008-09-13 13:16 <DIR> d -------- C: \ Program Files \ Common Files \ Apple 2008-09-08 16:10. 2008-09-08 16:10 <DIR> d -------- C: \ Program Files \ Easy SpyRemover 2008-09-08 15:45. 2008-09-06 00:59 741.376 - a ------ C: \ WINDOWS \ system32 \ LSSMON.EXE 2008-09-08 15:45. 2008-09-04 21:59 17.920 - a ------ C: \ WINDOWS \ system32 \ LSASSMGR.EXE 2008-09-07 22:34. 2008-09-02 00:16 38.528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys 2008-09-07 22:33. 2008-09-07 22:34 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ Teddy \ Dane aplikacji \ Malwarebytes 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dane aplikacji \ Malwarebytes 2008-09-07 22:33. 2008-09-02 00:16 17.200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys 2008-09-06 15:09. 2008-09-06 15:09 90.112 - a ------ C: \ WINDOWS \ system32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008-09-06 15:09 57.344 - a ------ C: \ WINDOWS \ system32 \ QuickTime.qts 2008-09-05 10:44. 2008-09-06 00:59 741.376 - a ------ C: \ WINDOWS \ system32 \ msupd32.exe 2008-09-04 21:59. 2008-09-07 12:59 741.376 - a ------ C: \ WINDOWS \ system32 \ upd01.exe 2008-09-04 21:59. 2008-09-06 00:59 741.376 - a ------ C: \ WINDOWS \ divx32.dll 2008-09-04 21:59. 2008-09-04 21:59 17.920 - a ------ C: \ WINDOWS \ system32 \ srtsrv32.exe 2008-09-04 21:59. 2008-09-16 16:24 5.903 - a ------ C: \ WINDOWS \ system32 \ mssc32.dll 2008-09-04 21:59. 2008-09-16 16:24 5.903 - a ------ C: \ WINDOWS \ system32 \ bsc32.dll 2008-09-02 13:23. 2008-09-02 13:23 <DIR> d -------- C: \ Program Files \ PrevxCSI 2008-09-02 13:23. 2008-09-16 13:32 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dane aplikacji \ PrevxCSI 2008-09-02 13:23. 2008-09-02 13:23 17.408 - a ------ C: \ WINDOWS \ system32 \ drivers \ pxark.sys 2008-09-01 01:30. 2008-09-02 13:10 <DIR> da ------ C: \ Documents and Settings \ All Users \ Dane aplikacji \ TEMP 2008-09-01 01:20. 2008-09-07 22:19 0 - a ------ C: \ WINDOWS \ system32 \ sc02.sc 2008-08-31 01:46. 2007-02-20 16:04 2.463.976 - a ------ C: \ WINDOWS \ system32 \ NPSWF32.dll 2008-08-31 01:46. 2007-02-20 16:04 190.696 - a ------ C: \ WINDOWS \ system32 \ NPSWF32_FlashUtil.exe 2008-08-30 09:59. 2008-08-30 21:34 <DIR> d -------- C: \ Program Files \ Macromedia 2008-08-30 09:59. 2008-08-30 21:27 <DIR> d -------- C: \ Program Files \ Common Files \ Macromedia 2008-08-30 01:25. 2008-09-13 13:18 <DIR> d -------- C: \ Program Files \ Bonjour 2008-08-29 14:33. 2006-09-18 17:55 109.744 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.SYS 2008-08-29 14:33. 2006-09-18 17:55 48.816 - a ------ C: \ WINDOWS \ system32 \ S32EVNT1.DLL 2008-08-29 10:18. 2008-08-29 10:18 87.336 - a ------ C: \ WINDOWS \ system32 \ dns-sd.exe 2008-08-29 09:53. 2008-08-29 09:53 61.440 - a ------ C: \ WINDOWS \ system32 \ dnssd.dll 2008-08-27 04:05. 2008-04-07 05:38 45.392-ra ------ C: \ WINDOWS \ system32 \ AdobePDF.dll 2008-08-27 04:05. 2008-04-07 05:38 22.872-ra ------ C: \ WINDOWS \ system32 \ AdobePDFUI.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 20:53 --------- d ----- w C: \ Program Files \ Symantec AntiVirus 2008-09-13 17:17 --------- d ----- w C: \ Program Files \ QuickTime 2008-09-13 17:13 --------- d ----- w C: \ Program Files \ Apple Software Update 2008-09-08 18:53 249.956 ---- aw C: \ WINDOWS \ system32 \ dsfMon.dll 2008-09-01 07:50 --------- d ----- w C: \ Documents and Settings \ All Users \ Dane aplikacji \ Spybot - Search & Destroy 2008-09-01 05:56 --------- d ----- w C: \ Program Files \ Spybot - Search & Destroy 2008-08-30 05:24 --------- d ----- w C: \ Program Files \ Common Files \ Adobe 2008-08-29 18:34 --------- d ----- w C: \ Program Files \ Common Files \ Symantec Shared 2008-08-29 18:33 --------- d ----- w C: \ Program Files \ Symantec 2008-08-29 18:32 --------- d ----- w C: \ Documents and Settings \ All Users \ Dane aplikacji \ Symantec 2008-08-27 08:22 --------- d ----- w C: \ Documents and Settings \ All Users \ Dane aplikacji \ FLEXnet 2008-08-26 00:52 --------- d ----- w C: \ Documents and Settings \ Teddy \ Dane aplikacji \ OpenOffice.org2 2008-08-13 21:33 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2008-08-12 02:46 --------- d ----- w C: \ Program Files \ Phm 2008-07-26 08:55 --------- d ----- w C: \ Program Files \ OpenOffice.org 2.4 2008-07-26 08:54 --------- d ----- w C: \ Program Files \ Java 2008-07-19 02:10 94.920 ---- aw C: \ WINDOWS \ system32 \ cdm.dll 2008-07-19 02:10 53.448 ---- aw C: \ WINDOWS \ system32 \ wuauclt.exe 2008-07-19 02:09 563.912 ---- aw C: \ WINDOWS \ system32 \ wuapi.dll 2008-07-19 02:09 325.832 ---- aw C: \ WINDOWS \ system32 \ wucltui.dll 2008-07-19 02:09 205.000 ---- aw C: \ WINDOWS \ system32 \ wuweb.dll 2008-07-19 02:09 1.811.656 ---- aw C: \ WINDOWS \ system32 \ Wuaueng.dll 2008-07-07 20:32 253.952 ---- aw C: \ WINDOWS \ system32 \ es.dll 2008-06-24 22:12 295.936 ------ w C: \ WINDOWS \ system32 \ wmpeffects.dll 2008-06-24 16:23 74.240 ---- aw C: \ WINDOWS \ system32 \ mscms.dll 2008-06-23 16:57 826.368 ---- aw C: \ WINDOWS \ system32 \ wininet.dll 2008-06-20 17:41 245.248 ---- aw C: \ WINDOWS \ system32 \ mswsock.dll 2008-04-19 16:57 32 ---- aw C: \ Documents and Settings \ All Users \ Dane aplikacji \ ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Uwaga * puste wpisy & legit domyślne wpisy nie są wyświetlane REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Run] "swg" = "C: \ Program Files \ Google \ googletoolbarnotifier \ GoogleToolbarNo tifier.exe" [2007-04-02 68856] "QuickTime Task" = "C: \ Program Files \ QuickTime \ qttask.exe" [2008-09-06 413696] "H / PC Connection Agent" = "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" [2006-11-13 1289000] "ctfmon.exe" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2004-08-04 15360] "IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe" [2008-02-28 1828136] "SpybotSD TeaTimer" = "C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe" [2008-08-18 1832272] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "RemoteControl" = "C: \ Program Files \ CyberLink \ PowerDVD \ PDVDServ.exe" [2004-05-14 32768] "RoxioEngineUtility" = "C: \ Program Files \ Common Files \ Roxio Shared \ System \ EngUtil.exe" [2003-05-01 65536] "RoxioAudioCentral" = "C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ rxmon.exe" [2003-07-15 319488] "SiS Windows KeyHook" = "C: \ WINDOWS \ system32 \ keyhook.exe" [2004-09-02 249856] "SiSUSBRG" = "C: \ WINDOWS \ SiSUSBrg.exe" [2004-09-22 106496] "Apoint" = "C: \ Program Files \ Apoint2K \ Apoint.exe" [2003-12-05 159744] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" [2008-06-10 144784] "DSFHost" = "C: \ Program Files \ Staples \ easyprint \ dsfhost.exe" [2006-01-05 2142301] "Synchronization Manager" = "C: \ WINDOWS \ system32 \ mobsync.exe" [2004-08-04 143360] "Zune Launcher" = "C: \ Program Files \ Zune \ ZuneLauncher.exe" [2007-03-14 24104] "GrooveMonitor" = "C: \ Program Files \ Microsoft Office \ Office12 \ groovemonitor.exe" [2006-10-27 31016] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" [2008-01-11 39792] "NeroFilterCheck" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe" [2008-02-28 570664] "NBKeyScan" = "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" [2008-02-18 2221352] "Adobe Acrobat Speed Launcher" = "C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ Acrobat_sl.exe" [2008-06-12 37232] "ccApp" = "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" [2006-07-19 52896] "vptray" = "C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ VPTray.exe" [2006-09-27 125168] "Layersecurity Servicemonitor" = "C: \ WINDOWS \ system32 \ LSSMON.EXE" [2008-09-06 741376] "iTunesHelper" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-10 289576] "SoundMan" = "SOUNDMAN.EXE" [2004-09-22 C: \ WINDOWS \ SOUNDMAN.EXE] "AGRSMMSG" = "AGRSMMSG.exe" [2004-09-22 C: \ WINDOWS \ AGRSMMSG.exe] "SiSPower" = "SiSPower.dll" [2004-09-22 C: \ WINDOWS \ system32 \ SiSPower.dll] C: \ Documents and Settings \ Teddy \ Menu Start \ Programy \ Autostart \ Adobe Gamma.lnk - C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe [2005-03-16 113664] OneNote 2007 Screen Clipper i Launcher.lnk - C: \ Program Files \ Microsoft Office \ Office12 \ ONENOTEM.EXE [2006-10-26 98632] C: \ Documents and Settings \ All Users \ Menu Start \ Programy \ Autostart \ Windows Desktop Search.lnk - C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe [2007-02-05 118784] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(56F9679E-7826-4C84-81F3-532071A8BCC5)" = "C: \ Program Files \ Windows Desktop Search \ MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows] "AppInit_DLLs" = acaptuser32.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ plik obrazu wykonania opcji \ firefox.exe] "Debugger" = C: \ Program Files \ Mozilla Firefox \ firefoxe.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ plik obrazu wykonania opcji \ iexplore.exe] "Debugger" = C: \ Program Files \ Internet Explorer \ iexplor.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ plik obrazu wykonania opcji \ spoolsv.exe] "Debugger" = C: \ WINDOWS \ system32 \ spool.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Security Center \ Monitoring \ SymantecAntiVirus] "DisableMonitoring" = dword: 00000001 [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ system32 \ \ Sessmgr.exe" = "C: \ Program Files \ Common Files \ \ AOL \ \ Loader \ aolload.exe" = "C: \ Program Files \ \ BitLord \ \ BitLord.exe" = "C: \ Program Files \ \ Soulseek \ \ slsk.exe" = "C: \ Program Files \ \ Mozilla Firefox \ \ firefox.exe" = "C: \ \ StubInstaller.exe" = "C: \ Program Files \ \ LimeWire \ \ LimeWire.exe" = "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" = "C: \ Program Files \ \ Messenger \ \ msmsgs.exe" = "C: \ Program Files \ AIM \ aim.exe" = "C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync RAPI Manager "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" = C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Connection Manager "C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Application "C: \ Program Files \ Microsoft Office \ \ Office12 \ Outlook.exe" = "C: \ Program Files \ Microsoft Office \ \ Office12 \ \ GROOVE.EXE" = "C: \ Program Files \ Microsoft Office \ \ Office12 \ \ ONENOTE.EXE" = "C: \ Program Files \ \ Isadora \ \ isadora.exe" = "C: \ Program Files \ \ Skype \ \ Phone \ \ Skype.exe" = "C: \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ Program Files \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "3389: TCP" = 3389: TCP: @ Xpsp2res.dll, -22009 "1500: TCP" = 1500: TCP: Bezpieczny dostęp pełnomocnika Port "26675: TCP" = 26675: TCP: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Service * Nowo utworzone Service * - CATCHME * Nowo utworzone Service * - PROCEXP90 . Zawartość programu "Zaplanowane zadania" folder . - - - - SIEROT REMOVED - - - -- HKLM-Run-CSRLT.EXE - C: \ WINDOWS \ system32 \ CSRLT.EXE . Dodatkowe Scan ------- ------- . FireFox -: Profile - C: \ Documents and Settings \ Teddy \ Dane aplikacji \ Mozilla \ Firefox \ Profiles \ 6xzfp0sa.default \ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp: / / www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q = . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - Rootkit / stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 16:51:46 Windows 5.1.2600 Service Pack 2 dla systemu plików NTFS skanowanie ukrytych procesów ... skanowanie ukrytych autostart entries ... skanowanie ukrytych plików ... skanowanie zakończone pomyślnie ukryte pliki: 0 ************************************************** ************************ . Zakończenie czas: 2008-09-16 17:15:59 ComboFix-kwarantannę-files.txt 2008-09-16 21:15:16 Pre-Run: 10478669824 bytes wolny Post-Run: 10446106624 bytes wolny 190 --- EOF --- 2008-09-11 20:07:51 |
|
#4
16-ty Wrz 2008, 14:45
| ||||
| ||||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? Uwaga: poniżej instrukcje zostały stworzone specjalnie dla tego użytkownika. Jeśli nie jesteś tego użytkownika, NIE poniższe wskazówki, jak mogą one uszkodzić twój system funkcjonowania Usuń te pliki i foldery, w następujący sposób: 1. Idź do Zacząć > Biec > Type Notepad.exe i kliknij OK , aby otworzyć Notatnik. To musieć Notatnik być, nie programu Wordpad. 2. Kopiowanie tekstu w polu poniżej kod zaznaczając cały tekst i naciskając Ctrl + C Kod: Killall: Plik: C: \ Program Files \ Easy SpyRemover C: \ WINDOWS \ system32 \ LSSMON.EXE C: \ WINDOWS \ system32 \ LSASSMGR.EXE C: \ WINDOWS \ system32 \ msupd32.exe C: \ WINDOWS \ system32 \ upd01.exe C: \ WINDOWS \ system32 \ srtsrv32.exe C: \ WINDOWS \ system32 \ mssc32.dll C: \ WINDOWS \ system32 \ bsc32.dll rejestru: [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ image Plik wykonania opcji \ iexplore.exe] "Debugger" =- [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ plik obrazu wykonania opcji \ spoolsv.exe] "Debugger" =- 4. Następnie kliknij Plik > Zapisać 5. Nazwa pliku CFScript.txt - Zapisz plik na pulpicie 6. Następnie przeciągnij CFScript (przytrzymaj lewy przycisk myszy podczas przeciągania pliku), a jej spadek (zwolnić lewy przycisk myszy) w ComboFix.exe jak widać na zrzucie ekranu poniżej. Ważne: Wykonać tę instrukcję uważnie!  ComboFix rozpocznie wykonywać, wystarczy postępować zgodnie z instrukcjami wyświetlanymi na ekranie. Po ponownym uruchomieniu komputera (w przypadku gdy zwraca się o ponowne uruchomienie komputera), nie dadzą dziennik dla Ciebie. Opublikuj że log (Combofix.txt) w następnej odpowiedzi. Uwaga: Nie mouseclick ComboFix okna, gdy jest uruchomiony. To może powodować systemu zamrażać
__________________ |
|
#5
16-ty Wrz 2008, 15:32
| |||
| |||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? ComboFix 08-09-15.02 - Teddy 2008-09-16 17:49:20.2 - NTFSx86 Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.850 [GMT -4:00] Uruchamianie z: C: \ Documents and Settings \ Teddy \ Desktop \ ComboFix.exe Polecenie używane polecenia: C: \ Documents and Settings \ Teddy \ Desktop \ CFScript.txt * Utworzono nowy punkt przywracania OSTRZEŻENIE-This Machine nie ma konsoli odzyskiwania ZAINSTALOWANE! . ((((((((((((((((((((((((((((((((((((((( Inne Skreślenia ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ WINDOWS \ system32 \ bsc32.dll C: \ WINDOWS \ system32 \ LSASSMGR.EXE C: \ WINDOWS \ system32 \ LSSMON.EXE C: \ WINDOWS \ system32 \ mssc32.dll C: \ WINDOWS \ system32 \ msupd32.exe C: \ WINDOWS \ system32 \ spool.exe C: \ WINDOWS \ system32 \ srtsrv32.exe C: \ WINDOWS \ system32 \ upd01.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-16 do 2008-09-16 ))))))))))) )))))))))))))))))))) . 2008-09-16 16:21. 2008-09-16 16:50 <DIR> d -------- C: \ WINDOWS \ system32 \ CatRoot_bak 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iTunes 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Program Files \ iPod 2008-09-13 13:19. 2008-09-13 13:19 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dane aplikacji \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-09-13 13:12. 2008-09-13 13:16 <DIR> d -------- C: \ Program Files \ Common Files \ Apple 2008-09-08 16:10. 2008-09-08 16:10 <DIR> d -------- C: \ Program Files \ Easy SpyRemover 2008-09-07 22:34. 2008-09-02 00:16 38.528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys 2008-09-07 22:33. 2008-09-07 22:34 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ Teddy \ Dane aplikacji \ Malwarebytes 2008-09-07 22:33. 2008-09-07 22:33 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dane aplikacji \ Malwarebytes 2008-09-07 22:33. 2008-09-02 00:16 17.200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys 2008-09-06 15:09. 2008-09-06 15:09 90.112 - a ------ C: \ WINDOWS \ system32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008-09-06 15:09 57.344 - a ------ C: \ WINDOWS \ system32 \ QuickTime.qts 2008-09-04 21:59. 2008-09-06 00:59 741.376 - a ------ C: \ WINDOWS \ divx32.dll 2008-09-02 13:23. 2008-09-02 13:23 <DIR> d -------- C: \ Program Files \ PrevxCSI 2008-09-02 13:23. 2008-09-16 13:32 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dane aplikacji \ PrevxCSI 2008-09-02 13:23. 2008-09-02 13:23 17.408 - a ------ C: \ WINDOWS \ system32 \ drivers \ pxark.sys 2008-09-01 01:30. 2008-09-02 13:10 <DIR> da ------ C: \ Documents and Settings \ All Users \ Dane aplikacji \ TEMP 2008-09-01 01:20. 2008-09-07 22:19 0 - a ------ C: \ WINDOWS \ system32 \ sc02.sc 2008-08-31 01:46. 2007-02-20 16:04 2.463.976 - a ------ C: \ WINDOWS \ system32 \ NPSWF32.dll 2008-08-31 01:46. 2007-02-20 16:04 190.696 - a ------ C: \ WINDOWS \ system32 \ NPSWF32_FlashUtil.exe 2008-08-30 09:59. 2008-08-30 21:34 <DIR> d -------- C: \ Program Files \ Macromedia 2008-08-30 09:59. 2008-08-30 21:27 <DIR> d -------- C: \ Program Files \ Common Files \ Macromedia 2008-08-30 01:25. 2008-09-13 13:18 <DIR> d -------- C: \ Program Files \ Bonjour 2008-08-29 14:33. 2006-09-18 17:55 109.744 - a ------ C: \ WINDOWS \ system32 \ drivers \ SYMEVENT.SYS 2008-08-29 14:33. 2006-09-18 17:55 48.816 - a ------ C: \ WINDOWS \ system32 \ S32EVNT1.DLL 2008-08-29 10:18. 2008-08-29 10:18 87.336 - a ------ C: \ WINDOWS \ system32 \ dns-sd.exe 2008-08-29 09:53. 2008-08-29 09:53 61.440 - a ------ C: \ WINDOWS \ system32 \ dnssd.dll 2008-08-27 04:05. 2008-04-07 05:38 45.392-ra ------ C: \ WINDOWS \ system32 \ AdobePDF.dll 2008-08-27 04:05. 2008-04-07 05:38 22.872-ra ------ C: \ WINDOWS \ system32 \ AdobePDFUI.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 21:33 --------- d ----- w C: \ Program Files \ Symantec AntiVirus 2008-09-13 17:17 --------- d ----- w C: \ Program Files \ QuickTime 2008-09-13 17:13 --------- d ----- w C: \ Program Files \ Apple Software Update 2008-09-01 07:50 --------- d ----- w C: \ Documents and Settings \ All Users \ Dane aplikacji \ Spybot - Search & Destroy 2008-09-01 05:56 --------- d ----- w C: \ Program Files \ Spybot - Search & Destroy 2008-08-30 05:24 --------- d ----- w C: \ Program Files \ Common Files \ Adobe 2008-08-29 18:34 --------- d ----- w C: \ Program Files \ Common Files \ Symantec Shared 2008-08-29 18:33 --------- d ----- w C: \ Program Files \ Symantec 2008-08-29 18:32 --------- d ----- w C: \ Documents and Settings \ All Users \ Dane aplikacji \ Symantec 2008-08-27 08:22 --------- d ----- w C: \ Documents and Settings \ All Users \ Dane aplikacji \ FLEXnet 2008-08-26 00:52 --------- d ----- w C: \ Documents and Settings \ Teddy \ Dane aplikacji \ OpenOffice.org2 2008-08-13 21:33 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2008-08-12 02:46 --------- d ----- w C: \ Program Files \ Phm 2008-07-26 08:55 --------- d ----- w C: \ Program Files \ OpenOffice.org 2.4 2008-07-26 08:54 --------- d ----- w C: \ Program Files \ Java 2008-04-19 16:57 32 ---- aw C: \ Documents and Settings \ All Users \ Dane aplikacji \ ezsid.dat . ((((((((((((((((((((((((((((( Snapshot@2008-09-16_17.03.48.82 )))))))))) ))))))))))))))))))))))))))))))) . - 2007-07-30 23:18:40 33.624-c - aw C: \ WINDOWS \ system32 \ dllcache \ wups.dll + 2008-07-19 02:10:20 36.552-c - aw C: \ WINDOWS \ system32 \ dllcache \ wups.dll - 2007-07-30 23:18:40 33.624 ---- aw C: \ WINDOWS \ system32 \ wups.dll + 2008-07-19 02:10:20 36.552 ---- aw C: \ WINDOWS \ system32 \ wups.dll - 2007-07-30 23:19:12 43.352 ---- aw C: \ WINDOWS \ system32 \ wups2.dll + 2008-07-19 02:10:40 45.768 ---- aw C: \ WINDOWS \ system32 \ wups2.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Uwaga * puste wpisy & legit domyślne wpisy nie są wyświetlane REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Run] "swg" = "C: \ Program Files \ Google \ googletoolbarnotifier \ GoogleToolbarNo tifier.exe" [2007-04-02 68856] "QuickTime Task" = "C: \ Program Files \ QuickTime \ qttask.exe" [2008-09-06 413696] "H / PC Connection Agent" = "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" [2006-11-13 1289000] "ctfmon.exe" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2004-08-04 15360] "IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe" [2008-02-28 1828136] "SpybotSD TeaTimer" = "C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe" [2008-08-18 1832272] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "RemoteControl" = "C: \ Program Files \ CyberLink \ PowerDVD \ PDVDServ.exe" [2004-05-14 32768] "RoxioEngineUtility" = "C: \ Program Files \ Common Files \ Roxio Shared \ System \ EngUtil.exe" [2003-05-01 65536] "RoxioAudioCentral" = "C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ rxmon.exe" [2003-07-15 319488] "SiS Windows KeyHook" = "C: \ WINDOWS \ system32 \ keyhook.exe" [2004-09-02 249856] "SiSUSBRG" = "C: \ WINDOWS \ SiSUSBrg.exe" [2004-09-22 106496] "Apoint" = "C: \ Program Files \ Apoint2K \ Apoint.exe" [2003-12-05 159744] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" [2008-06-10 144784] "DSFHost" = "C: \ Program Files \ Staples \ easyprint \ dsfhost.exe" [2006-01-05 2142301] "Synchronization Manager" = "C: \ WINDOWS \ system32 \ mobsync.exe" [2004-08-04 143360] "Zune Launcher" = "C: \ Program Files \ Zune \ ZuneLauncher.exe" [2007-03-14 24104] "GrooveMonitor" = "C: \ Program Files \ Microsoft Office \ Office12 \ groovemonitor.exe" [2006-10-27 31016] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" [2008-01-11 39792] "NeroFilterCheck" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe" [2008-02-28 570664] "NBKeyScan" = "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" [2008-02-18 2221352] "Adobe Acrobat Speed Launcher" = "C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ Acrobat_sl.exe" [2008-06-12 37232] "ccApp" = "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" [2006-07-19 52896] "vptray" = "C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ VPTray.exe" [2006-09-27 125168] "iTunesHelper" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-10 289576] "CSRLT.EXE" = "C: \ WINDOWS \ system32 \ CSRLT.EXE" [BU] "SoundMan" = "SOUNDMAN.EXE" [2004-09-22 C: \ WINDOWS \ SOUNDMAN.EXE] "AGRSMMSG" = "AGRSMMSG.exe" [2004-09-22 C: \ WINDOWS \ AGRSMMSG.exe] "SiSPower" = "SiSPower.dll" [2004-09-22 C: \ WINDOWS \ system32 \ SiSPower.dll] C: \ Documents and Settings \ Teddy \ Menu Start \ Programy \ Autostart \ Adobe Gamma.lnk - C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe [2005-03-16 113664] OneNote 2007 Screen Clipper i Launcher.lnk - C: \ Program Files \ Microsoft Office \ Office12 \ ONENOTEM.EXE [2006-10-26 98632] C: \ Documents and Settings \ All Users \ Menu Start \ Programy \ Autostart \ Windows Desktop Search.lnk - C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe [2007-02-05 118784] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entversion \ Explorer \ ShellExecuteHooks] "(56F9679E-7826-4C84-81F3-532071A8BCC5)" = "C: \ Program Files \ Windows Desktop Search \ MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows] "AppInit_DLLs" = acaptuser32.dll [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ plik obrazu wykonania opcji \ firefox.exe] "Debugger" = C: \ Program Files \ Mozilla Firefox \ firefoxe.exe [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Security Center \ Monitoring \ SymantecAntiVirus] "DisableMonitoring" = dword: 00000001 [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ system32 \ \ Sessmgr.exe" = "C: \ Program Files \ Common Files \ \ AOL \ \ Loader \ aolload.exe" = "C: \ Program Files \ \ BitLord \ \ BitLord.exe" = "C: \ Program Files \ \ Soulseek \ \ slsk.exe" = "C: \ Program Files \ \ Mozilla Firefox \ \ firefox.exe" = "C: \ \ StubInstaller.exe" = "C: \ Program Files \ \ LimeWire \ \ LimeWire.exe" = "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" = "C: \ Program Files \ \ Messenger \ \ msmsgs.exe" = "C: \ Program Files \ AIM \ aim.exe" = "C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ rapimgr.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync RAPI Manager "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" = C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Connection Manager "C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe" = C: \ Program Files \ Microsoft ActiveSync \ WCESMgr.exe: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Application "C: \ Program Files \ Microsoft Office \ \ Office12 \ Outlook.exe" = "C: \ Program Files \ Microsoft Office \ \ Office12 \ \ GROOVE.EXE" = "C: \ Program Files \ Microsoft Office \ \ Office12 \ \ ONENOTE.EXE" = "C: \ Program Files \ \ Isadora \ \ isadora.exe" = "C: \ Program Files \ \ Skype \ \ Phone \ \ Skype.exe" = "C: \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ Program Files \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "3389: TCP" = 3389: TCP: @ Xpsp2res.dll, -22009 "1500: TCP" = 1500: TCP: Bezpieczny dostęp pełnomocnika Port "26675: TCP" = 26675: TCP: 169.254.2.0/255.255.255.0: Enabled: ActiveSync Service R0 pxark; pxark; C: \ WINDOWS \ system32 \ drivers \ pxark.sys [2008-09-02 17408] R2 CSIScanner; CSIScanner; C: \ Program Files \ PrevxCSI \ prevxcsi.exe [2008-09-02 618040] R2 SafeAccessAgent; bezpieczny dostęp pełnomocnika; C: \ Program Files \ StillSecure \ bezpiecznego dostępu Agent \ SAService.exe [2006-01-27 880640] R2 Viewpoint Manager Service; Viewpoint Manager Service; C: \ Program Files \ Viewpoint \ Common \ viewpointservice.exe [2007-01-04 24652] S3 HwIOctl; HwIOctl; C: \ Documents and Settings \ Właściciel \ Pulpit \ HwIOctl.sys [] S3 Ktp3; Elantech Touchpad (KTP3); C: \ WINDOWS \ system32 \ DRIVERS \ Ktp3.sy s [2004-09-22 24704] S3 Memctl; Memctl; C: \ Documents and Settings \ Właściciel \ Pulpit \ Memctl.sys [] . Zawartość programu "Zaplanowane zadania" folder . - - - - SIEROT REMOVED - - - -- HKLM-Run-Layersecurity Servicemonitor - C: \ WINDOWS \ system32 \ LSSMON.EXE HKLM-RunOnce-MSBLT.EXE - C: \ WINDOWS \ MSBLT.EXE ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - Rootkit / stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 18:00:27 Windows 5.1.2600 Service Pack 2 dla systemu plików NTFS skanowanie ukrytych procesów ... skanowanie ukrytych autostart entries ... skanowanie ukrytych plików ... ************************************************** ************************ . ------------------------ Pozostałe uruchomione procesy ----------------------- -- . C: \ Program Files \ Common Files \ Symantec Shared \ ccsetmgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccEvtMgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCSvc.exe C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Symantec \ LiveUpdate \ AluSchedulerSvc.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Symantec AntiVirus \ DefWatch.exe C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe C: \ WINDOWS \ system32 \ IoctlSvc.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ WINDOWS \ system32 \ searchindexer.exe C: \ Program Files \ Viewpoint \ Viewpoint Manager \ ViewMgr.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ PROGRA ~ 1 \ Micros ~ 3 \ rapimgr.exe C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ playlist.exe C: \ Program Files \ Apoint2K \ ApntEx.exe C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ searchprotocolhost.exe C: \ WINDOWS \ system32 \ searchfilterhost.exe . ************************************************** ************************ . Zakończenie czas: 2008-09-16 18:24:56 - został uruchomiony ponownie maszyny ComboFix-kwarantannę-files.txt 2008-09-16 22:23:49 ComboFix2.txt 2008-09-16 21:16:14 Pre-Run: 10626510848 bytes wolny Post-Run: 10616803328 bytes wolny 205 --- EOF --- 2008-09-11 20:07:51 |
|
#6
16-ty Wrz 2008, 15:50
| ||||
| ||||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? Pobrać TrendMicro HijackThis.exe (HJT) na pulpicie.
__________________ |
|
#7
23-cia Wrz 2008, 09:24
| |||
| |||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? Logfile of Trend Micro HijackThis v2.0.2 Skanowanie zapisany na 12:21:04, na 9/23/2008 Platforma: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Uruchamianie procesów: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ WINDOWS \ System32 \ svchost.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccsetmgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccEvtMgr.exe C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCSvc.exe C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Symantec \ LiveUpdate \ ALUSchedulerSvc.exe C: \ Program Files \ PrevxCSI \ prevxcsi.exe C: \ Program Files \ Symantec AntiVirus \ DefWatch.exe C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe C: \ WINDOWS \ system32 \ IoctlSvc.exe C: \ Program Files \ StillSecure \ bezpiecznego dostępu Agent \ SAService.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Viewpoint \ Common \ viewpointservice.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ WINDOWS \ system32 \ SearchIndexer.exe C: \ WINDOWS \ explorer.exe C: \ Program Files \ PrevxCSI \ prevxcsi.exe C: \ WINDOWS \ System32 \ svchost.exe C: \ Program Files \ CyberLink \ PowerDVD \ PDVDServ.exe C: \ WINDOWS \ SOUNDMAN.EXE C: \ WINDOWS \ system32 \ keyhook.exe C: \ Program Files \ Apoint2K \ Apoint.exe C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe C: \ Program Files \ Staples \ easyprint \ dsfhost.exe C: \ Program Files \ Zune \ ZuneLauncher.exe C: \ Program Files \ Microsoft Office \ Office12 \ groovemonitor.exe C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ Apoint2K \ Apntex.exe C: \ Program Files \ Google \ googletoolbarnotifier \ GoogleToolbarNo tifier.exe C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe C: \ PROGRA ~ 1 \ Micros ~ 3 \ rapimgr.exe C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ Viewpoint \ Viewpoint Manager \ ViewMgr.exe C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ AcroTray.exe C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Wydawnictwo \ FNPLicensingService.exe C: \ WINDOWS \ system32 \ Taskmgr.exe C: \ WINDOWS \ lsass.exe C: \ WINDOWS \ system32 \ SPOOLER.EXE C: \ WINDOWS \ system32 \ wscntfy.exe C: \ WINDOWS \ system32 \ ctfmon.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe C: \ WINDOWS \ system32 \ SearchProtocolHost.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.averatec.com R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU \ Software \ Microsoft \ Internet Connection Wizard, ShellNext = http://oqaserver-a/ R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyOverride = *. lokalnych O2 - BHO: Yahoo! Toolbar Helper - (02478D38-C3F9-4EFB-9B51-7695ECA05670) - C: \ Program Files \ Yahoo! \ Companion \ Instaluje \ CPN \ yt.dll O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - (18DF081C-E8AD-4283-A596-FA578C2EBDC3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelperShim.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O2 - BHO: Groove GFS Browser Helper - (72853161-30C5-4D22-B7F9-0BBC1D38A37E) - C: \ PROGRA ~ 1 \ Micros ~ 4 \ Office12 \ GRA8E1 ~ 1.DLL O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O2 - BHO: AOL Toolbar Launcher - (7C554162-8CB7-45A4-B8F4-8EA1C75885F9) - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ aoltb.dll O2 - BHO: Viewpoint Toolbar BHO - (A7327C09-B521-4EDB-8509-7D2660C9EC98) - C: \ Program Files \ Viewpoint \ Viewpoint Toolbar \ 3.8.0 \ ViewBarBHO.dll O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - C: \ Program Files \ Google \ googletoolbar2.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - (AE7CD045-E861-484f-8273-0445EE161910) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ googletoolbarnotifier \ 3.1.807.1746 \ sw g.dll O2 - BHO: SmartSelect - (F4971EE7-DAA0-4053-9964-665D8EE6A077) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Instaluje \ CPN \ yt.dll O3 - Toolbar: & Google - (2318C2B1-4965-11D4-9B18-009027A5CD4F) - C: \ Program Files \ Google \ googletoolbar2.dll O3 - Toolbar: AOL Toolbar - (DE9C389F-3316-41A7-809B-AA305ED9D922) - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ aoltb.dll O3 - Toolbar: Viewpoint Toolbar - (F8AD5AA5-D966-4667-9DAF-2561D68B2012) - C: \ Program Files \ Common Files \ Viewpoint \ Toolbar Runtime \ 3.8.0 \ IEViewBar.dll O3 - Toolbar: Adobe PDF - (47833539-D0C5-4125-9FA8-0819E2EAAC93) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll O4 - HKLM \ .. \ Run: [RemoteControl] "C: \ Program Files \ CyberLink \ PowerDVD \ PDVDServ.exe" O4 - HKLM \ .. \ Run: [RoxioEngineUtility] "C: \ Program Files \ Common Files \ Roxio Shared \ System \ EngUtil.exe" O4 - HKLM \ .. \ Run: [RoxioAudioCentral] "C: \ Program Files \ Roxio \ Easy CD Creator 6 \ AudioCentral \ rxmon.exe" O4 - HKLM \ .. \ Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM \ .. \ Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM \ .. \ Run: [SiSPower] Rundll32.exe SiSPower.dll, ModeAgent O4 - HKLM \ .. \ Run: [SiS Windows KeyHook] C: \ WINDOWS \ system32 \ keyhook.exe O4 - HKLM \ .. \ Run: [SiSUSBRG] C: \ WINDOWS \ SiSUSBrg.exe O4 - HKLM \ .. \ Run: [Apoint] C: \ Program Files \ Apoint2K \ Apoint.exe O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" O4 - HKLM \ .. \ Run: [DSFHost] C: \ Program Files \ Staples \ easyprint \ dsfhost.exe O4 - HKLM \ .. \ Run: [Synchronization Manager]% SystemRoot% \ system32 \ mobsync.exe / logon O4 - HKLM \ .. \ Run: [Zune Launcher] "C: \ Program Files \ Zune \ ZuneLauncher.exe" O4 - HKLM \ .. \ Run: [GrooveMonitor] "C: \ Program Files \ Microsoft Office \ Office12 \ groovemonitor.exe" O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe O4 - HKLM \ .. \ Run: [NBKeyScan] "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" O4 - HKLM \ .. \ Run: [Adobe Acrobat Speed Launcher] "C: \ Program Files \ Adobe \ Acrobat 9.0 \ Acrobat \ Acrobat_sl.exe" O4 - HKLM \ .. \ Run: [ccApp] "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe" O4 - HKLM \ .. \ Run: [vptray] C: \ PROGRA ~ 1 \ SYMANT ~ 1 \ VPTray.exe O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [Layersecurity Servicemonitor] C: \ WINDOWS \ system32 \ LSSMON.EXE O4 - HKLM \ .. \ Run: [Bufor wydruku] C: \ WINDOWS \ system32 \ SPOOLER.EXE O4 - HKCU \ .. \ Run: [swg] C: \ Program Files \ Google \ googletoolbarnotifier \ GoogleToolbarNo tifier.exe O4 - HKCU \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ qttask.exe"-atboottime O4 - HKCU \ .. \ Run: [H / PC Connection Agent] "C: \ Program Files \ Microsoft ActiveSync \ wcescomm.exe" O4 - HKCU \ .. \ Run: [ctfmon.exe] C: \ WINDOWS \ system32 \ ctfmon.exe O4 - HKCU \ .. \ Run: [IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)] "C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe" Aso-616B5711-6DAE-4795-A05F -39A1E5104020 O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - HKCU \ .. \ Run: [AdobeUpdater] C: \ Program Files \ Common Files \ Adobe \ Updater \ AdobeUpdater.exe O4 - HKLM \ .. \ Policies \ Explorer \ Run: [LocalSecurityAuthoritySubsystem] C: \ WINDOWS \ lsass.exe O4 - Startup: Adobe Gamma.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Startup: OneNote 2007 Screen Clipper i Launcher.lnk = C: \ Program Files \ Microsoft Office \ Office12 \ ONENOTEM.EXE O4 - Global Startup: Windows Desktop Search.lnk = C: \ Program Files \ Windows Desktop Search \ WindowsSearch.exe O8 - Dodatkowe menu kontekstowego pozycję: & AOL Toolbar Search - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ zasoby \ en-US \ local \ search.html O8 - Dodatkowe menu kontekstowego pozycję: Dopisz Link do docelowa Istniejące PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIEAppendSelLinks.html O8 - Dodatkowe menu kontekstowego pozycję: Dołącz do istniejącego PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Dodatkowe menu kontekstowego pozycję: Konwertuj docelowe Link do Adobe PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIECaptureSelLinks.html O8 - Dodatkowe menu kontekstowego pozycję: Konwertuj do Adobe PDF - res: / / C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekście menu: E & ksportuj do programu Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ Micros ~ 4 \ Office12 \ EXCEL.EXE/3000 O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra button: Wyślij do programu OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ Micros ~ 4 \ Office12 \ ONBttnIE.dll O9 - Extra 'Tools' menuitem: S & end do programu OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ Micros ~ 4 \ Office12 \ ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - (2EAF5BB1-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ Micros ~ 3 \ INetRepl.dll O9 - Extra button: (no name) - (2EAF5BB2-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ Micros ~ 3 \ INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite ... - (2EAF5BB2-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ Micros ~ 3 \ INetRepl.dll O9 - Extra button: AOL Toolbar - (3369AF0D-62E9-4bda-8103-B4C75499B578) - C: \ Program Files \ AOL \ AOL Toolbar 2.0 \ aoltb.dll O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MIC273 ~ 1 \ Office12 \ REFIEBAR.DLL O9 - Extra button: AIM - (AC9E2541-2814-11d5-BC6D-00B0D0A1DE45) - C: \ Program Files \ AIM \ aim.exe O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O14 - IERESET.INF: START_PAGE_URL = http://www.averatec.com O16 - DPF: (0D6BB8B8-0257-420C-B9EB-CFA90DB1026C) -- http://svrnsec01.purchase.edu:88/setup.cab O16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl Class) -- http://v5.windowsupdate.microsoft.co...?1096453339343 O18 - Protocol: grooveLocalGWS - (88FED34C-F0CA-4636-A375-3CB6248B04CD) - C: \ PROGRA ~ 1 \ Micros ~ 4 \ Office12 \ GR99D3 ~ 1.DLL O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ COMMON ~ 1 \ Skype \ SKYPE4 ~ 1.DLL O20 - AppInit_DLLs: acaptuser32.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C: \ Program Files \ Common Files \ Adobe Systems Shared \ Service \ Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C: \ Program Files \ Symantec \ LiveUpdate \ ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccsetmgr.exe O23 - Service: CSIScanner - Prevx - C: \ Program Files \ PrevxCSI \ prevxcsi.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C: \ Program Files \ Symantec AntiVirus \ DefWatch.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Wydawnictwo \ FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ googleupdaterservice.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C: \ PROGRA ~ 1 \ Symantec \ LIVEUP ~ 1 \ LUCOMS ~ 1.EXE O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe O23 - Service: NMIndexingService - Nero AG - C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc - C: \ WINDOWS \ system32 \ IoctlSvc.exe O23 - Service: Bezpieczny dostęp pełnomocnika (SafeAccessAgent) - StillSecure - C: \ Program Files \ StillSecure \ bezpiecznego dostępu Agent \ SAService.exe O23 - Service: SAVRoam (SavRoam) - Symantec - C: \ Program Files \ Symantec AntiVirus \ SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ SPBBC \ SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C: \ Program Files \ Symantec AntiVirus \ Rtvscan.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ Security Center \ SymWSC.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C: \ Program Files \ Viewpoint \ Common \ viewpointservice.exe -- Koniec pliku - 14719 bajtów |
|
#8
23-cia Wrz 2008, 10:25
| ||||
| ||||
| LSASSMGR.exe (i inni) zakażonych! Wszelkie info / pomóc? Pobrać Malwarebytes' Anti-Malware (MBAM)
Dodatkowe Uwaga: Jeśli napotka MBAM plik jest trudne do usunięcia, zostanie przedstawiony Tobie z 1 z 2 monit, kliknij przycisk OK, albo niech MBAM i kontynuować proces dezynfekcji, jeżeli prośba o ponowne uruchomienie komputera, należy zrobić to natychmiast. ---------- Teraz uruchomić nową HijackThis skanowania i po dziennika wraz z MBAM zalogować.
__________________ |
 |
| Narzędzia wątku | |
| |
