Sprawdzenie logow OTL oraz dalsze kroki

[matti94 0]

Witam.

Chcialbym prosic o pomoc w przeskanowaniu komputera w poszukiwaniu wszelkiego rodzaju zlosliwego oprogramowania i wirusow typu keylogger, podejrzewam ze komputer moze byc zarazony takowym wirusem. Nie chcialbym zeby ktos mogl przechwycic moje pliki i hasla takze prosze o pomoc co moge zrobic..

Pierwsze co zrobilem skan programem "HiJackThis"

 

Oto log z tego programu:

Cytat:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:42:06, on 2014-01-09

Platform: Unknown Windows (WinNT 6.01.3505 SP1)

MSIE: Internet Explorer v11.0 (11.00.9600.16428)

Boot mode: Normal

 

Running processes:

C:\Users\Mateusz\AppData\Local\GG\Application\gghub.exe

D:\Program Files (x86)\Kies\KiesAirMessage.exe

D:\Program Files (x86)\Kies\Kies.exe

C:\Users\Mateusz\AppData\Local\GG\Application\ggapp.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Users\Mateusz\AppData\Roaming\BitTorrent\BitTorrent.exe

C:\Program Files (x86)\Unified Remote\RemoteServer.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

D:\Program Files (x86)\Kies\KiesTrayAgent.exe

C:\Program Files (x86)\USB Disk Win98 Driver\Res.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Users\Mateusz\AppData\Local\GG\Application\ggdrive\ggdrive.exe

C:\Users\Mateusz\AppData\Local\GG\Application\xulrunner\gghub.exe

F:\Moje\tibia\HiJackThis\HijackThis.exe

C:\Windows\SysWOW64\DllHost.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

O2 - BHO: sAvEariNet - {523D6D65-2985-D4ED-DE40-541DB8998D5D} - C:\ProgramData\sAvEariNet\m8goLH.dll (file missing)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: saverneT - {D8FADA24-B513-D9BC-87F9-573D1ABD0455} - C:\ProgramData\saverneT\PG8GU9aW60.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O2 - BHO: AliBar BHO - {E4E012DC-1925-48E9-8010-2D195574642A} - C:\Users\Mateusz\AppData\Roaming\B1Toolbar\B1Toolbar32.dll (file missing)

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\Run: [KiesTrayAgent] D:\Program Files (x86)\Kies\KiesTrayAgent.exe

O4 - HKLM\..\Run: [uSB Storage Toolbox] C:\Program Files (x86)\USB Disk Win98 Driver\Res.EXE

O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [KiesPDLR] D:\Program Files (x86)\Kies\External\FirmwareUpdate\KiesPDLR.exe

O4 - HKCU\..\Run: [steam] "D:\Program Files (x86)\Steam\steam.exe" -silent

O4 - HKCU\..\Run: [GG] "C:\Users\Mateusz\AppData\Local\GG\Application\gghub.exe"

O4 - HKCU\..\Run: [KiesAirMessage] D:\Program Files (x86)\Kies\KiesAirMessage.exe -startup

O4 - HKCU\..\Run: [KiesPreload] D:\Program Files (x86)\Kies\Kies.exe /preload

O4 - HKCU\..\Run: [] D:\Program Files (x86)\Kies\External\FirmwareUpdate\KiesPDLR.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

O4 - HKCU\..\Run: [bitTorrent] "C:\Users\Mateusz\AppData\Roaming\BitTorrent\BitTorrent.exe" /MINIMIZED

O4 - HKCU\..\Run: [unified Remote v2] C:\Program Files (x86)\Unified Remote\RemoteServer.exe

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Mateusz\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files (x86)\MP3 Player Utilities 4.00\AMVConverter\grab.html

O8 - Extra context menu item: AMV convert tool grab multimedia file - C:\Program Files (x86)\MP3 Player Utilities 5.02\AMVConverter\grab.html

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files (x86)\MP3 Player Utilities 4.00\MediaManager\grab.html

O8 - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O13 - Gopher Prefix:

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - AppInit_DLLs: c:\progra~3\webgen~1\webgen~1.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\httpd.exe

O23 - Service: Apache2.4 - Apache Software Foundation - C:\xampp\apache\bin\httpd.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Usługa Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Usługa Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: vToolbarUpdater13.2.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

 

--

End of file - 12606 bytes

 

 

Oraz skan OTL:

http://wklej.org/id/1230916/

 

Prosze o pomoc w dalszych krokach

[filutka78 11]

O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\WEBGEN~1\WEBGEN~2.DLL) - C:\ProgramData\WebGeniuos\WebGeniuos_x64.dll ()

O20 - AppInit_DLLs: (c:\progra~3\webgen~1\webgen~1.dll) - c:\ProgramData\WebGeniuos\WebGeniuos.dll ()

Znasz to?

[matti94 0]

Nie nic mi to nie mowi ;/

[filutka78 11]

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL

[2014-01-09 21:25:23 | 000,000,000 | ---D | C] -- C:\Users\Mateusz\AppData\Local\cache

[2014-01-09 21:25:22 | 000,000,000 | ---D | C] -- C:\Users\Mateusz\AppData\Roaming\newnext.me

[2014-01-09 21:25:22 | 000,000,000 | ---D | C] -- C:\Users\Mateusz\AppData\Local\genienext

[2013-08-01 18:30:17 | 000,000,000 | -HSD | C] -- C:\found.000

[2013-12-21 23:10:09 | 000,000,000 | ---D | C] -- C:\ProgramData\saverneT

[2013-12-21 23:09:53 | 000,000,000 | ---D | C] -- C:\ProgramData\jfcbbaicaobppnfmckdmkahbbnkodigc

[2013-12-21 23:09:23 | 000,000,000 | ---D | C] -- C:\ProgramData\36426904124f2e9d

O2 - BHO: (Improved search toolbar) - {E4E012DC-1925-48E9-8010-2D195574642A} - C:\Users\Mateusz\AppData\Roaming\B1Toolbar\B1Toolbar32.dll File not found

O2 - BHO: (saverneT) - {D8FADA24-B513-D9BC-87F9-573D1ABD0455} - C:\ProgramData\saverneT\PG8GU9aW60.dll ()

O2 - BHO: (sAvEariNet) - {523D6D65-2985-D4ED-DE40-541DB8998D5D} - C:\ProgramData\sAvEariNet\m8goLH.dll File not found

O2:64bit: - BHO: (saverneT) - {D8FADA24-B513-D9BC-87F9-573D1ABD0455} - C:\ProgramData\saverneT\PG8GU9aW60.x64.dll ()

O2:64bit: - BHO: (sAvEariNet) - {523D6D65-2985-D4ED-DE40-541DB8998D5D} - C:\ProgramData\sAvEariNet\m8goLH.x64.dll File not found

FF - prefs.js..extensions.enabledAddons: {EEE6C361-6118-11DC-9C72-001320C79847}:1.6.0.3

MOD - [2013-12-27 21:33:03 | 004,168,192 | ---- | M] () -- c:\ProgramData\WebGeniuos\WebGeniuos.dll

O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\WEBGEN~1\WEBGEN~2.DLL) - C:\ProgramData\WebGeniuos\WebGeniuos_x64.dll ()

O20 - AppInit_DLLs: (c:\progra~3\webgen~1\webgen~1.dll) - c:\ProgramData\WebGeniuos\WebGeniuos.dll ()

[2013-12-27 21:33:03 | 000,000,000 | ---D | C] -- C:\ProgramData\WebGeniuos

 

:Services

26dc2c7a

 

:Reg

[-HKEY_USERS\S-1-5-21-641074376-3244462334-1615048272-1000\Software\Microsoft\Internet Explorer\SearchScopes\{7B4FEAF7-304F-4D8D-8FFD-6BABCCFDFD6E}]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"=-

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"=-

[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"=-

[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"=-

[HKEY_USERS\S-1-5-21-641074376-3244462334-1615048272-1000\Software\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E4E012DC-1925-48E9-8010-2D195574642A}]

 

:Commands

[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.

Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.

 

(nie śpiesz się - ja już idę spać)

 

F.

[matti94 0]

Raport:

http://wklej.org/id/1230981/

 

Nowy log OTL:

http://wklej.org/id/1230992/

[filutka78 11]

Do Notatnika wklej:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScopeBefore"=-

[HKEY_USERS\S-1-5-21-641074376-3244462334-1615048272-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScopeBefore"=-

Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>

plik uruchom (dwuklik i OK).

 

Kończymy:

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL)

W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.

 

F.

[matti94 0]

okej Wszystko zrobione tak jak napisales. Dziekuje Ci bardzo za pomoc