prawdopodobnie zasyfiony komp (podejrzane procesy)

**Posty:** 4 · przez **pudel88** 17 Sty 2008, 19:57

Witam, ostatnio złapałem chyba jakiegoś wira, dwa razy musiałem robić format dzień po dniu, bo się nawet komp nie chciał odpalać. Jednak wydaję mi się, że mimo wszystko mogę nadal mieć zasyfiony dysk. Niektóre aplikacje mi się nie odpalają i pare podejrzanych procesów się pojawiło. Dlatego też prosiłbym o sprawdzenie logów i o ewentualną pomoc.
Hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:22:47, on 2008-01-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:Program FilesPC Tools Firewall PlusFWService.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe C:Program FilesAlwil SoftwareAvast4ashServ.exe C:WINDOWSExplorer.EXE C:Program FilesPC Tools Firewall PlusFirewallGUI.exe C:PROGRA~1ALWILS~1Avast4ashDisp.exe C:WINDOWSSystem32RUNDLL32.EXE C:WINDOWSSystem32RunDll32.exe C:PROGRA~1NEOSTR~1CnxMon.exe C:PROGRA~1NEOSTR~1TaskbarIcon.exe C:WINDOWSSystem32mmdmm.exe C:WINDOWSSystem32ctfmon.exe C:Program FilesGadu-Gadugg.exe C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe C:WINDOWSsystem32spoolsv.exe C:WINDOWSsystem32dllcachemravsc32.exe C:WINDOWSSystem32nvsvc32.exe C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe C:Program FilesAlwil SoftwareAvast4ashWebSv.exe C:Program FilesNeostrada TPNeostradaTP.exe C:Program FilesNeostrada TPComComp.exe C:Program FilesNeostrada TPWatch.exe C:Program Filesfoobar2000foobar2000.exe C:Program FilesMozilla Firefoxfirefox.exe D:programikilogihijackthisHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl/ R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:PROGRA~1NEOSTR~1SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O4 - HKLM..Run: [00PCTFW] "C:Program FilesPC Tools Firewall PlusFirewallGUI.exe" -s O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup O4 - HKLM..Run: [nwiz] nwiz.exe /install O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit O4 - HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe O4 - HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe O4 - HKLM..Run: [WOOTASKBARICON] C:PROGRA~1NEOSTR~1TaskbarIcon.exe O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe" O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe O4 - HKLM..Run: [mmsass] mmdmm.exe O4 - HKLM..RunServices: [mmsass] mmdmm.exe O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe O4 - HKCU..Run: [Gadu-Gadu] "C:Program FilesGadu-Gadugg.exe" /tray O4 - Global Startup: DSLMON.lnk = C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm O17 - HKLMSystemCCSServicesTcpip..{96842835-B30A-4012-9C31-752544F5EF13}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe" /service (file missing) O23 - Service: Distributed Allocated Memory Unit - Unknown owner - C:WINDOWSsystem32dllcachemravsc32.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32nvsvc32.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:Program FilesPC Tools Firewall PlusFWService.exe

Silent runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 55, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCUSoftwareMicrosoftWindowsCurrentVersionRun {++} "CTFMON.EXE" = "C:WINDOWSSystem32ctfmon.exe" [MS] "Gadu-Gadu" = ""C:Program FilesGadu-Gadugg.exe" /tray" ["Gadu-Gadu S.A."] HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun {++} "00PCTFW" = ""C:Program FilesPC Tools Firewall PlusFirewallGUI.exe" -s" ["PC Tools"] "avast!" = "C:PROGRA~1ALWILS~1Avast4ashDisp.exe" ["ALWIL Software"] "NvCplDaemon" = "RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit" [MS] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "WooCnxMon" = "C:PROGRA~1NEOSTR~1CnxMon.exe" [empty string] "WOOWATCH" = "C:PROGRA~1NEOSTR~1Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:PROGRA~1NEOSTR~1TaskbarIcon.exe" ["France Télécom R&D"] "Adobe Reader Speed Launcher" = ""C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"" ["Adobe Systems Incorporated"] "NeroFilterCheck" = "C:WINDOWSsystem32NeroCheck.exe" ["Ahead Software Gmbh"] "mmsass" = "mmdmm.exe" [null data] HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" InProcServer32(Default) = "C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLMSOFTWAREMicrosoftWindowsCurrentVersionShell ExtensionsApproved "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" InProcServer32(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" InProcServer32(Default) = "C:WINDOWSSystem32hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" InProcServer32(Default) = "C:Program FilesAlwil SoftwareAvast4ashShell.dll" ["ALWIL Software"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" InProcServer32(Default) = "C:WINDOWSSystem32nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" InProcServer32(Default) = "C:WINDOWSSystem32nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" InProcServer32(Default) = "C:WINDOWSSystem32nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) InProcServer32(Default) = "C:WINDOWSSystem32nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" InProcServer32(Default) = "C:WINDOWSSystem32nvshell.dll" ["NVIDIA Corporation"] HKLMSOFTWAREClassesFoldershellexColumnHandlers {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" InProcServer32(Default) = "C:Program FilesCommon FilesAdobeAcrobatActiveXPDFShell.dll" ["Adobe Systems, Inc."] HKLMSOFTWAREClasses*shellexContextMenuHandlers avast(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" InProcServer32(Default) = "C:Program FilesAlwil SoftwareAvast4ashShell.dll" ["ALWIL Software"] WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data] HKLMSOFTWAREClassesDirectoryshellexContextMenuHandlers WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data] HKLMSOFTWAREClassesFoldershellexContextMenuHandlers avast(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" InProcServer32(Default) = "C:Program FilesAlwil SoftwareAvast4ashShell.dll" ["ALWIL Software"] WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" InProcServer32(Default) = "C:Program FilesWinRARrarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCUSoftwareMicrosoftInternet ExplorerDesktopGeneral "Wallpaper" = "C:WINDOWSwebwallpaperIdylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCUControl PanelDesktop "Wallpaper" = "C:WINDOWSwebwallpaperIdylla.bmp" Enabled Screen Saver: --------------------- HKCUControl PanelDesktop "SCRNSAVE.EXE" = "C:WINDOWSSystem32logon.scr" [MS] Startup items in "Szymek" & "All Users" startup folders: -------------------------------------------------------- C:Documents and SettingsAll UsersMenu StartProgramyAutostart "DSLMON" -> shortcut to: "C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe /W" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLMSYSTEMCurrentControlSetServicesWinsock2ParametersNameSpace_Catalog5Catalog_Entries {++} 000000000001LibraryPath = "%SystemRoot%System32mswsock.dll" [MS] 000000000002LibraryPath = "%SystemRoot%System32winrnr.dll" [MS] 000000000003LibraryPath = "%SystemRoot%System32mswsock.dll" [MS] Transport Service Providers HKLMSYSTEMCurrentControlSetServicesWinsock2ParametersProtocol_Catalog9Catalog_Entries {++} 0000000000##PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%system32mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%system32rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLMSOFTWAREMicrosoftInternet ExplorerExplorer Bars HKLMSOFTWAREClassesCLSID{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}(Default) = "Volet Wanadoo" Implemented Categories{00021494-0000-0000-C000-000000000046} [horizontal bar] InProcServer32(Default) = "C:PROGRA~1NEOSTR~1audienceaudience.dll" [empty string] HKLMSOFTWAREClassesCLSID{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}(Default) = "ToolBand Class" Implemented Categories{00021494-0000-0000-C000-000000000046} [horizontal bar] InProcServer32(Default) = "C:PROGRA~1NEOSTR~1audienceaudience.dll" [empty string] HKLMSOFTWAREClassesCLSID{5BF498C0-931E-4A4F-B33F-456D07137EAA}(Default) = "Volet Wanadoo" Implemented Categories{00021494-0000-0000-C000-000000000046} [horizontal bar] InProcServer32(Default) = "C:PROGRA~1NEOSTR~1audienceaudience.dll" [empty string] Miscellaneous IE Hijack Points ------------------------------ HKCUSoftwareMicrosoftInternet ExplorerURLSearchHooks <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" InProcServer32(Default) = "C:PROGRA~1NEOSTR~1SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:Program FilesAlwil SoftwareAvast4ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:Program FilesAlwil SoftwareAvast4ashWebSv.exe" /service" ["ALWIL Software"] Distributed Allocated Memory Unit, Distributed Allocated Memory Unit, ""C:WINDOWSsystem32dllcachemravsc32.exe"" [null data] NVIDIA Display Driver Service, NVSvc, "C:WINDOWSSystem32nvsvc32.exe" ["NVIDIA Corporation"] PC Tools Firewall Plus, PCToolsFirewallPlus, "C:Program FilesPC Tools Firewall PlusFWService.exe" ["PC Tools"] ---------- (launch time: 2008-01-17 16:23:29) <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 97 seconds, including 18 seconds for message boxes)

**Posty:** 65 · przez **Avenger** 17 Sty 2008, 20:15

O4 - HKLM..Run: [mmsass] mmdmm.exe
O4 - HKLM..RunServices: [mmsass] mmdmm.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O23 - Service: Distributed Allocated Memory Unit - Unknown owner - C:WINDOWSsystem32dllcachemravsc32.exe

Skasuj pogrubione pliki ręcznie z dysku w trybie awaryjnymi wyłączonym przywracaniem systemu, wpisy skasuj w hijacku

Otwórz notatnik i wklej w nim to

sc stop Distributed Allocated Memory Unit
sc del Distributed Allocated Memory Unit

plik>zapisz jako...>zmień rozszerzenie na: wszystkie pliki>zapisz jako FIX.BAT odpal plik fix.bat w trybie awaryjnym i wyłączonym przywracaniem systemu

Pobierz program SDFix

* Dwuklik na SDFix.exe następnie program wypakuje się na dysk systemowy (standardowo C:\SDFix)
* Zrestartuj komputer i wejdź do trybu awaryjnego (klawisz F8 przed bootem Windowsa)
* Wejdź do folderu z SDFix kliknij dwa razy na plik RunThis.bat
* Wciśnij Y nastąpi proces usuwania.
* Kiedy usuwanie się ukończy wciśnij dowolny klawisz (Any Key). Nastąpi restart komputera.
* Po restarcie SDFix uruchomi się ponownie, żeby dokończyć proces usuwania kiedy pojawi się w oknie programu Finished, wciśnij dowolny klawisz do zakończenia scryptu i załadowania ikon na pulpicie.
* Pokaż Report.txt znajdujący się w folderze SDFix.

Po zabiegach dajesz nowe logi z hijacka, Combofixoraz raport z SDFix

**Posty:** 4 · przez **pudel88** 17 Sty 2008, 21:17

Hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:05:30, on 2008-01-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\WINDOWS\System32\RunDll32.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\programiki\logi\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe

Combofix

Kod: Zaznacz wszystko: ComboFix 08-01-17.5 - Szymek 2008-01-17 20:12:30.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.289 [GMT 1:00] Running from: D:\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2007-12-17 to 2008-01-17 ))))))))))))))))))))))))))))))) . 2008-01-17 20:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-17 19:59 . 2008-01-17 19:59 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-01-17 19:49 . 2008-01-15 18:35 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-01-17 16:15 . 2008-01-17 20:09 <DIR> d-------- C:\Documents and Settings\Szymek\Dane aplikacji\foobar2000 2008-01-17 16:09 . 2008-01-17 16:09 80,120 --a------ C:\WINDOWS\system32\msv.exe 2008-01-16 21:39 . 2008-01-16 21:39 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-16 21:39 . 2008-01-16 21:39 <DIR> d-------- C:\Program Files\Ahead 2008-01-16 21:39 . 2004-07-20 17:24 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-01-16 21:39 . 2004-07-20 17:24 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-01-16 21:39 . 2004-07-20 17:24 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-01-16 21:39 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-01-16 21:39 . 2004-07-20 17:24 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-01-16 21:39 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-01-16 21:39 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-01-16 21:39 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll 2008-01-16 19:59 . 2008-01-16 19:59 <DIR> d-------- C:\WEOL'08 2.0 2008-01-16 19:40 . 2008-01-16 19:40 <DIR> d-------- C:\Documents and Settings\Szymek\Dane aplikacji\fltk.org 2008-01-15 21:39 . 2008-01-15 21:39 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-01-15 21:14 . 2008-01-15 21:14 1,158 --a------ C:\WINDOWS\mozver.dat 2008-01-15 20:01 . 2008-01-15 20:01 7,168 --a------ C:\WINDOWS\system32\msnmsgsls.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-17 19:10 --------- d-----w C:\Program Files\Neostrada TP 2008-01-16 20:13 --------- d-----w C:\Program Files\GraphCalc 2008-01-15 18:40 --------- d-----w C:\Documents and Settings\Szymek\Dane aplikacji\Gadu-Gadu 2008-01-15 18:31 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-15 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-15 18:31 --------- d-----w C:\Program Files\SAGEM 2008-01-15 18:31 --------- d-----w C:\Program Files\Java Web Start 2008-01-15 18:31 --------- d-----w C:\Program Files\Java 2008-01-15 17:54 --------- d-----w C:\Program Files\PC Tools Firewall Plus 2008-01-15 17:54 --------- d-----w C:\Documents and Settings\Szymek\Dane aplikacji\PCToolsFirewallPlus 2008-01-15 17:51 --------- d-----w C:\Program Files\Intel 2008-01-15 17:51 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-15 17:51 --------- d-----w C:\Program Files\C-Media 3D Audio 2008-01-15 17:48 --------- d-----w C:\Program Files\Alwil Software 2008-01-15 17:47 --------- d-----w C:\Program Files\Gadu-Gadu 2008-01-15 17:46 --------- d-----w C:\Program Files\SubEdit-Player 2008-01-15 17:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-01-15 17:46 --------- d-----w C:\Program Files\foobar2000 2008-01-15 17:39 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-15 17:37 --------- d-----w C:\Program Files\Usługi online 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29 13312] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-04-28 08:13 2610744] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-10-04 17:14 8491008] "nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-10-04 17:14 81920] "Cmaudio"="cmicnfg.cpl" [] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29 13312] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-01-15 19:31:34] *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-17 20:13:12 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-17 20:13:43

SDFix

Kod: Zaznacz wszystko: SDFix: Version 1.127 Run by Szymek on 2008-01-17 at 20:00 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Name: Distributed Allocated Memory Unit Path: "C:\WINDOWS\system32\dllcache\mravsc32.exe" Distributed Allocated Memory Unit - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system32\dllcache\mravsc32.exe - Deleted C:\WINDOWS\system32\i - Deleted C:\WINDOWS\system32\mmdmm.exe - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-17 20:02:22 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Finished!

**Posty:** 18165 · przez **wojtas** 17 Sty 2008, 21:39

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\msv.exe
C:\WINDOWS\system32\msnmsgsls.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 4 · przez **pudel88** 17 Sty 2008, 22:39

hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:36:47, on 2008-01-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe D:\programiki\logi\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{96842835-B30A-4012-9C31-752544F5EF13}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe

combo

Kod: Zaznacz wszystko: ComboFix 08-01-17.5 - Szymek 2008-01-17 21:32:30.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.252 [GMT 1:00] Running from: D:\programiki\logi\ComboFix.exe Command switches used :: D:\programiki\logi\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE C:\WINDOWS\system32\msnmsgsls.exe C:\WINDOWS\system32\msv.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\msnmsgsls.exe C:\WINDOWS\system32\msv.exe . ((((((((((((((((((((((((( Files Created from 2007-12-17 to 2008-01-17 ))))))))))))))))))))))))))))))) . 2008-01-17 20:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-17 19:59 . 2008-01-17 19:59 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-17 19:49 . 2008-01-17 20:13 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-01-17 19:49 . 2008-01-15 18:35 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-01-17 19:49 . 2008-01-15 18:23 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-01-17 16:15 . 2008-01-17 20:09 <DIR> d-------- C:\Documents and Settings\Szymek\Dane aplikacji\foobar2000 2008-01-16 21:39 . 2008-01-16 21:39 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-16 21:39 . 2008-01-16 21:39 <DIR> d-------- C:\Program Files\Ahead 2008-01-16 21:39 . 2004-07-20 17:24 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-01-16 21:39 . 2004-07-20 17:24 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-01-16 21:39 . 2004-07-20 17:24 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-01-16 21:39 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-01-16 21:39 . 2004-07-20 17:24 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-01-16 21:39 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-01-16 21:39 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-01-16 21:39 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll 2008-01-16 19:40 . 2008-01-16 19:40 <DIR> d-------- C:\Documents and Settings\Szymek\Dane aplikacji\fltk.org 2008-01-15 21:39 . 2008-01-15 21:39 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-01-15 21:14 . 2008-01-15 21:14 1,158 --a------ C:\WINDOWS\mozver.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-17 20:07 --------- d-----w C:\Program Files\SubEdit-Player 2008-01-17 19:14 --------- d-----w C:\Program Files\Neostrada TP 2008-01-16 20:13 --------- d-----w C:\Program Files\GraphCalc 2008-01-15 18:40 --------- d-----w C:\Documents and Settings\Szymek\Dane aplikacji\Gadu-Gadu 2008-01-15 18:31 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-15 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-15 18:31 --------- d-----w C:\Program Files\SAGEM 2008-01-15 18:31 --------- d-----w C:\Program Files\Java Web Start 2008-01-15 18:31 --------- d-----w C:\Program Files\Java 2008-01-15 17:54 --------- d-----w C:\Program Files\PC Tools Firewall Plus 2008-01-15 17:54 --------- d-----w C:\Documents and Settings\Szymek\Dane aplikacji\PCToolsFirewallPlus 2008-01-15 17:51 --------- d-----w C:\Program Files\Intel 2008-01-15 17:51 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-15 17:51 --------- d-----w C:\Program Files\C-Media 3D Audio 2008-01-15 17:48 --------- d-----w C:\Program Files\Alwil Software 2008-01-15 17:47 --------- d-----w C:\Program Files\Gadu-Gadu 2008-01-15 17:46 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-01-15 17:46 --------- d-----w C:\Program Files\foobar2000 2008-01-15 17:39 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-15 17:37 --------- d-----w C:\Program Files\Usługi online 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((( snapshot@2008-01-17_20.13.16,08 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-17 19:12:24 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-17 20:32:27 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-01-17 19:12:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-17 20:32:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat - 2008-01-17 19:12:24 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-17 20:32:27 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT - 2008-01-17 19:12:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-17 20:32:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat - 2008-01-17 19:12:24 1,024,000 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-17 20:32:27 1,060,864 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT - 2008-01-17 19:12:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2008-01-17 20:32:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2001-10-26 16:29:32 435,200 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPF900AL.DLL + 2001-10-26 16:29:32 1,853,952 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPFIMG50.DLL + 2001-10-26 16:29:32 87,040 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPFUD50.DLL + 2001-10-26 16:29:32 33,792 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\HPFUI50.DLL + 2001-10-26 16:29:46 251,904 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\UNIDRV.DLL + 2001-10-26 16:29:46 197,120 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\UNIDRVUI.DLL + 2001-10-26 16:26:56 620,032 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\UNIRES.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29 13312] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-04-28 08:13 2610744] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-10-04 17:14 8491008] "nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-10-04 17:14 81920] "Cmaudio"="cmicnfg.cpl" [] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29 13312] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-01-15 19:31:34] *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-17 21:33:18 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-17 21:33:43 ComboFix-quarantined-files.txt 2008-01-17 20:33:35 ComboFix2.txt 2008-01-17 19:13:44

**Posty:** 18165 · przez **wojtas** 17 Sty 2008, 22:40

czysto

**Posty:** 4 · przez **pudel88** 18 Sty 2008, 00:45

Dzięki wielkie za pomoc, teraz wszystko powinno śmigać

**Posty:** 3854 · przez **Dzi@dek** 18 Sty 2008, 01:16

pudel88 napisał(a):teraz wszystko powinno

Teraz musi, chyba, że ...sprzęt.

prawdopodobnie zasyfiony komp (podejrzane procesy)

Prawdopodobnie zasyfiony komp (podejrzane procesy)

Kto jest na forum