natretne adware

**Posty:** 45 · przez **P310** 31 Mar 2008, 00:05

Witam. Wyskakują mi co jakiś czas (15- 30 min) reklamy z

freevideoticket.com

Pewnie mam jakieś śmieci. jednak w pierwszej kolejności chcaiłbym zablokować te stronke, a potem zająć się syfem. Dodałem w pliku host (C:\Windows\system32\drivers\etc) linijke z localhostem jednak nie pomogło (choć wcześniej pomagało) stronka wciąż wskakuje. Ktoś zna jakieś inne sposoby?

**Posty:** 7838 · przez **Lukesh** 31 Mar 2008, 00:10

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
:arrow:

na sam koniec wstaw logi z HJ: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 45 · przez **P310** 31 Mar 2008, 16:29

Lukesh napisał(a):Arrow Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

Ten temat raczej mnie nie dotyczy.

Lukesh napisał(a):Arrow Zrob skan on-line www.ewido.com

strasznie to długo leci. Będzie edit.

Arrow na sam koniec wstaw logi z HJ: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:55:00, on 2008-03-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\ALCMTR.EXE D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools\daemon.exe D:\eMule\emule.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe D:\ZASOBY~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\PC\USTAWI~1\Temp\Rar$EX00.032\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 66.154.46.228 localhost O1 - Hosts: freevideoticket.com 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Shockwave\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Snikers] C:\Program Files\Snikers\Snikers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: Analizuj za pomocą LeechGet - file://E:\LeechGet 2007\\Parser.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz używając kreatora LeechGet - file://E:\LeechGet 2007\\Wizard.html O8 - Extra context menu item: Pobierz używając LeechGet - file://E:\LeechGet 2007\\AddUrl.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FB627FA4-D383-4A37-9603-737EE0F68A3A}: NameServer = 10.1.106.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6719 bytes

[/code]

**Posty:** 7838 · przez **Lukesh** 31 Mar 2008, 16:31

Ten temat raczej mnie nie dotyczy.

Dotyczy jak najbardziej - zastosuj.

**Posty:** 8001 · przez **Okocza** 31 Mar 2008, 16:32

daj loga z hijacka na sam początek.

**Posty:** 3854 · przez **Dzi@dek** 31 Mar 2008, 17:02

O1 - Hosts: 66.154.46.228 localhost
O1 - Hosts: freevideoticket.com 127.0.0.1
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Usuń te wpisy w HJ i Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 45 · przez **P310** 31 Mar 2008, 17:07

Kod: Zaznacz wszystko: ComboFix 08-03-30.3 - PC 2008-03-31 17:08:04.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.257 [GMT 2:00] Running from: C:\Documents and Settings\PC\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\hosts . ((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))) . 2008-03-31 16:31 . 2008-03-31 10:34 <DIR> d-------- C:\SDFix 2008-03-31 16:24 . 2008-03-31 16:24 <DIR> d---s---- C:\Documents and Settings\PC\UserData 2008-03-30 19:38 . 2008-03-30 19:38 <DIR> d-------- C:\Program Files\Common Files\BOONTY Shared 2008-03-30 18:37 . 2008-03-30 18:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\BOONTY 2008-03-30 18:32 . 2008-03-30 19:45 <DIR> d-------- C:\Program Files\RegCleaner 2008-03-30 18:22 . 2008-03-30 18:36 <DIR> d-------- C:\Program Files\BoontyGames 2008-03-30 18:22 . 2008-03-30 18:22 <DIR> d-------- C:\Program Files\Boonty 2008-03-30 15:07 . 2008-03-30 15:07 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\dvdcss 2008-03-30 14:07 . 2008-03-30 14:07 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\HP 2008-03-30 14:06 . 2008-03-30 14:06 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\Image Zone Express 2008-03-29 15:01 . 2008-03-29 15:01 <DIR> d-------- C:\Converted Audio Files 2008-03-29 15:00 . 2008-03-29 15:00 <DIR> d-------- C:\Program Files\Acoustica MP3 To Wave Converter PLUS 2008-03-28 23:50 . 2008-03-28 23:50 <DIR> d-------- C:\Archivos de programa 2008-03-25 21:10 . 2007-12-18 12:00 318,639,159 --a------ C:\HOTEL ZŁA-Fritt vilt-[2006](LEKTOR PL)DVDRip.RMVB[wielkiekino.za.pl].rmvb 2008-03-23 19:24 . 2008-03-23 19:24 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-03-23 13:22 . 2008-03-23 13:23 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\Tibia 2008-03-23 00:33 . 2008-03-23 00:33 <DIR> d-------- C:\Program Files\Damian Pasternak 2008-03-22 20:25 . 2008-03-22 20:25 <DIR> d-------- C:\Program Files\Dziobas Rar Player 2008-03-22 20:13 . 2008-03-23 19:23 <DIR> d-------- C:\Program Files\Common Files\Real 2008-03-22 20:13 . 2008-03-22 20:13 <DIR> d-------- C:\Program Files\aod 2008-03-22 20:13 . 2008-03-22 20:13 <DIR> d-------- C:\My Music 2008-03-22 20:10 . 2008-03-22 20:10 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\Media Player Classic 2008-03-22 20:09 . 2008-03-24 13:26 <DIR> d-------- C:\Program Files\Real Alternative 2008-03-21 01:01 . 2008-03-21 01:01 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\vlc 2008-03-21 01:00 . 2008-03-21 01:00 <DIR> d-------- C:\Program Files\VideoLAN 2008-03-21 00:54 . 2008-03-21 00:54 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\CyberLink 2008-03-21 00:54 . 2008-03-21 00:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-03-21 00:53 . 2008-03-21 00:54 <DIR> d-------- C:\Program Files\CyberLink 2008-03-20 18:39 . 2008-03-20 18:39 <DIR> d-------- C:\Program Files\RAR Password Cracker 2008-03-19 20:49 . 2008-03-19 20:49 <DIR> d-------- C:\Program Files\FLVPlayer 2008-03-18 19:54 . 2008-03-18 19:54 <DIR> d-------- C:\Documents and Settings\PC\WINDOWS 2008-03-13 21:28 . 2008-03-13 21:28 <DIR> d-------- C:\Documents and Settings\PC\.thumbnails 2008-03-13 21:28 . 2008-03-13 21:35 <DIR> d-------- C:\Documents and Settings\PC\.gimp-2.4 2008-03-11 21:33 . 2008-03-11 21:33 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\Gadu-Gadu 2008-03-11 17:12 . 2008-03-14 17:38 <DIR> d-------- C:\Documents and Settings\PC\Gadu-Gadu 2008-03-11 16:56 . 2008-03-11 16:56 <DIR> d-------- C:\Documents and Settings\PC\Dane aplikacji\PC Suite 2008-03-11 16:55 . 2007-08-08 14:37 <DIR> d--h----- C:\Documents and Settings\PC\Ustawienia lokalne 2008-03-11 16:55 . 2008-03-11 16:55 <DIR> dr------- C:\Documents and Settings\PC\Ulubione 2008-03-11 16:55 . 2007-08-08 13:00 <DIR> d--h----- C:\Documents and Settings\PC\Szablony 2008-03-11 16:55 . 2008-03-31 17:05 <DIR> d-------- C:\Documents and Settings\PC\Pulpit 2008-03-11 16:55 . 2008-03-31 16:55 <DIR> dr------- C:\Documents and Settings\PC\Moje dokumenty 2008-03-11 16:55 . 2007-08-08 14:37 <DIR> dr------- C:\Documents and Settings\PC\Menu Start 2008-03-11 16:55 . 2008-03-30 15:07 <DIR> dr-h----- C:\Documents and Settings\PC\Dane aplikacji 2008-03-11 16:51 . 2007-08-08 14:37 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-03-11 16:51 . 2007-08-08 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-03-11 16:51 . 2007-08-08 13:00 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-03-11 16:51 . 2007-08-08 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-03-11 16:51 . 2007-08-08 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-03-11 16:51 . 2007-08-08 14:37 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-03-11 16:51 . 2007-08-08 14:37 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-03-10 21:42 . 2008-03-10 21:42 <DIR> d-------- C:\Program Files\Grupa IMAGE 2008-03-09 23:31 . 2008-03-09 23:32 17 --a------ C:\k.bat 2008-03-09 23:28 . 2008-03-09 23:28 <DIR> d-------- C:\Program Files\Hugodane 2008-03-09 23:28 . 2008-03-09 23:30 <DIR> d-------- C:\Program Files\Hugo 2008-03-09 13:04 . 2008-03-09 13:04 0 --a------ C:\WINDOWS\Route.INI 2008-03-07 23:50 . 2008-03-07 23:50 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-03-07 23:34 . 2008-03-07 23:42 <DIR> d-------- C:\Program Files\PhotoFiltre 2008-03-06 21:32 . 2008-03-06 21:36 <DIR> d-------- C:\Program Files\Kazaa Lite Rewolucja 2008-03-06 21:32 . 2008-03-06 21:32 <DIR> d-------- C:\My Shared Folder 2008-03-06 21:32 . 2008-03-06 21:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kazaa Lite 2008-03-04 17:37 . 2008-03-05 14:52 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-03-04 17:37 . 2008-03-04 17:37 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-03-04 17:37 . 2008-03-05 14:52 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-04 16:48 . 2008-03-04 16:48 <DIR> d-------- C:\Program Files\WarRock 2008-03-04 16:48 . 2008-03-21 00:53 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-03-03 18:27 . 2008-03-03 18:27 609 --a------ C:\WINDOWS\7THLEVEL.INI 2008-02-25 15:21 . 2008-02-25 15:21 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-02-22 20:52 . 2008-02-22 20:52 <DIR> d-------- C:\Program Files\Common Files\INCA Shared 2008-02-16 19:32 . 2008-02-16 19:32 <DIR> d-------- C:\Program Files\Neoact 2008-02-16 19:32 . 2006-08-17 03:46 139,264 --a------ C:\WINDOWS\NeoUninstall.exe 2008-02-16 19:32 . 2008-02-16 19:32 26 --a------ C:\WINDOWS\neosetup.INI 2008-02-16 17:49 . 2008-02-16 18:06 <DIR> d-------- C:\Program Files\I Have No Tomatoes 2008-02-16 16:46 . 2008-02-16 16:46 <DIR> d-------- C:\Program Files\Q-Typing 2008-02-14 17:03 . 2008-03-08 17:19 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-02-13 18:01 . 2008-03-08 23:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-02-09 16:46 . 2008-02-09 16:49 <DIR> d-------- C:\Hairy_Harry 2008-02-08 20:52 . 2008-02-08 21:43 <DIR> d-------- C:\RecWar 2008-02-08 20:40 . 2008-02-08 20:40 <DIR> d-------- C:\blobby 2008-02-08 20:18 . 2008-02-08 20:18 <DIR> d-------- C:\Program Files\Pocket Tanks 2008-02-08 20:16 . 2008-02-08 20:16 <DIR> d-------- C:\Program Files\Common Files\DirectX 2008-02-08 19:18 . 2008-02-08 19:20 269 --a------ C:\WINDOWS\bbbconfig.dat 2008-02-07 22:28 . 2008-02-07 22:28 31 --a------ C:\WINDOWS\GunzLauncher.INI 2008-02-07 21:55 . 2008-02-07 21:55 <DIR> d-------- C:\Program Files\MAIET 2008-02-06 22:25 . 2008-02-10 17:35 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-02-05 21:26 . 2008-02-05 21:26 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-02-05 21:21 . 2008-02-05 21:50 112,652 --a------ C:\WINDOWS\hpoins07.dat 2008-02-05 21:21 . 2005-05-24 10:22 21,124 --------- C:\WINDOWS\hpomdl07.dat 2008-02-05 21:13 . 2008-02-05 21:26 113,461 --------- C:\WINDOWS\hpoins07.dat.temp 2008-02-05 21:13 . 2005-05-24 10:22 21,124 --------- C:\WINDOWS\hpomdl07.dat.temp 2008-02-02 14:50 . 2008-02-02 14:50 <DIR> d-------- C:\Program Files\Java 2008-02-01 20:04 . 2008-02-01 20:04 <DIR> dr-h----- C:\MSOCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-21 12:38 --------- d-----w C:\Program Files\Tasker 3.14 2008-03-18 18:23 --------- d-----w C:\Program Files\FORMUL.IPS 2008-03-17 18:05 --------- d-----w C:\Program Files\IPSPI 2008-02-21 13:48 17,480 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2008-01-31 18:35 --------- d-----w C:\Program Files\Bitch Soccer 2008-01-31 18:25 --------- d-----w C:\Program Files\lol 2008-01-28 18:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Zylom 2008-01-10 12:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2008-01-10 12:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-12-30 09:48 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-12-19 14:16 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 14:06 167368] "eMuleAutoStart"="D:\eMule\emule.exe" [2007-05-13 16:57 5308416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-08 12:57 7110656] "nwiz"="nwiz.exe" [2005-07-08 12:57 1519616 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-08 12:57 86016] "RTHDCPL"="RTHDCPL.EXE" [2005-04-26 08:16 14370816 C:\WINDOWS\RTHDCPL.EXE] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ] "PCSuiteTrayApplication"="D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10 271360] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152] "QuickTime Task"="D:\Shockwave\QTTask.exe" [2007-06-29 07:24 286720] "Snikers"="C:\Program Files\Snikers\Snikers.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "avast!"="D:\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] "Nokia.PCSync"="D:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 11:17 1241088] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\eMule\\emule.exe"= "E:\\Kal Of Djuti xD Tu\\CoD2MP_s.exe"= "C:\\Program Files\\Xfire\\Xfire.exe"= "D:\\Apache\\xampp\\apache\\bin\\apache.exe"= "D:\\Apache\\xampp\\mysql\\bin\\mysqld.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "D:\\BitTorrent\\bittorrent.exe"= "E:\\Metin2\\metin2.bin"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"= "C:\\blobby\\volley.exe"= "D:\\Zasoby Dysku\\GameSpy Arcade\\Aphex.exe"= "D:\\Ares\\Ares.exe"= "D:\\Zasoby Dysku\\Gry\\minigry\\Soldat\\Soldat.exe"= S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" [2008-03-30 19:38] S3 tap0801;TAP-Win32 Adapter V8;C:\WINDOWS\system32\DRIVERS\tap0801.sys [2006-10-01 14:37] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b687dc7d-b17e-11dc-8cb7-0015f27f4d34}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-31 17:09:07 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-31 17:09:32 ComboFix-quarantined-files.txt 2008-03-31 15:09:23 Pre-Run: 512,978,944 bajtów wolnych Post-Run: 503,570,432 bajtów wolnych . 2008-02-14 15:24:12 --- E O F ---

A tego skanu online nie będzie przykro mi, miałem prawie całość ale combofix mi wyłączył

pozdro.

[ Dodano: Dzisiaj o 16:10 ]
Usunąłem wszystkie oprócz jednego

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

To mój sterownik od karty dzwiękowej bodajże. Pozdro.

[ Dodano: Dzisiaj o 16:11 ]
drugi log z hijacka

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:16:09, on 2008-03-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\ALCMTR.EXE D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools\daemon.exe D:\eMule\emule.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe D:\ZASOBY~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe E:\Uratowane 2\Program Fajls\WinRAR\WinRAR.exe C:\DOCUME~1\PC\USTAWI~1\Temp\Rar$EX00.593\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Shockwave\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Snikers] C:\Program Files\Snikers\Snikers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: Analizuj za pomocą LeechGet - file://E:\LeechGet 2007\\Parser.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz używając kreatora LeechGet - file://E:\LeechGet 2007\\Wizard.html O8 - Extra context menu item: Pobierz używając LeechGet - file://E:\LeechGet 2007\\AddUrl.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FB627FA4-D383-4A37-9603-737EE0F68A3A}: NameServer = 10.1.106.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6830 bytes

**Posty:** 3854 · przez **Dzi@dek** 31 Mar 2008, 17:29

C:\k.bat

Znasz to

Otwórz notatnik i wklej:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b687dc7d-b17e-11dc-8cb7-0015f27f4d34}]

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.
Reszta OK.

**Posty:** 45 · przez **P310** 31 Mar 2008, 22:55

Dzi@dek napisał(a):Cytat:
C:\k.bat

Znasz to Question

Tak to narzędzie do emulacji tylko nie wiem jakim cudem uzyskało taką nazwę...

Dzi@dek napisał(a):Plik Arrow Zapisz jako... Arrow CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
Potwierdz zrestartuje sie komputer.

Zrobiłem jak kazałeś i

nie wiem, może kodowanie zmienić?

**Posty:** 18165 · przez **wojtas** 31 Mar 2008, 22:57

daj nowy log z hj oraz combofixa

**Posty:** 45 · przez **P310** 09 Kwi 2008, 19:25

Czy móże ktoś powiedzieć jak zablokować stronę? Potem wkleje wam loga z czego będziecie żywnie chcieć, tylkko musze jaknajprędzej zablokować tę stronę. Na moim komputerze... taka reklama. Jak to wygląda. Błagam o pomoc. Pozdro.

[ Dodano: Dzisiaj o 18:26 ]
PS. Jeśli to coś pomoże to dodam że adware wyskakuje po pewnym czasie, nogdy kiedy siedze i coś robie, zawsze kiedy pozostawie kompa na pare (parenaście) minut.

**Posty:** 18165 · przez **wojtas** 09 Kwi 2008, 20:16

może to CI pomoze:

http://forum.programosy.pl/firefox-noscript-brak-reklam-vt92775.html

i daj logi z combo i hijacka

natretne adware

natretne adware

Kto jest na forum