proszę o sprawdzenie loga

**Posty:** 908 · przez **SaTeJa** 24 Maj 2007, 20:44

Witam, co około 5 min sam uruchamia mi się IE tak jak Pop-up.
Gdy pisałem tą wiadomość wyskoczyło IE z takim adresem :

Kod: Zaznacz wszystko: http://url.cpvfeed.com/cpv.jsp?p=110830&ip=84.205.216.106&url=http%3A%2F%2Fforum.programosy.pl%2Ftutaj-vp579589.html%23579589&selectedKeyword=ron&selectedListingId=6430616

Poniżej log :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:30:35, on 2007-05-24 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\JetAudio\JetAudio.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\svchost.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} - C:\Program Files\CleanMyPC Popup Blocker\CleanBHO.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitComet\BitComet.exe" O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" 1 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe O4 - HKCU\..\Run: [Steam] "D:\Program Files\Steam\Steam.exe" -silent O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: Download All by FlashGet - D:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 21:13

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

skasuj wymienione wpisy:

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

sciagnij killbox`a:

http://www.wiruskill.pl/forum/viewtopic.php?t=58

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :

C:\WINDOWS\svchost.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem log z hijacka silenta oraz z combofixa:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

wrzuc na rapida lub cos innego

bo sie nie zmieszcza

**Posty:** 908 · przez **SaTeJa** 25 Maj 2007, 17:28

HIJACK :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:08:10, on 2007-05-25 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\WINDOWS\svchost.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} - C:\Program Files\CleanMyPC Popup Blocker\CleanBHO.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitComet\BitComet.exe" O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" 1 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe O4 - HKCU\..\Run: [Steam] "D:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe" /startup O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: Download All by FlashGet - D:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe

COMBOFIX :

Kod: Zaznacz wszystko: ComboFix 07-05.25.3V - Running from: "C:\Documents and Settings\CHWDP\Pulpit\skanowanie usuwanie syfu - PROGRAMOSY PACK\" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) "C:\WINDOWS\svchost.exe" "C:\WINDOWS\system32\drivers\core.sys" ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CORE -------\core ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-25 )))))))))))))))))))))))))))))))))) 2007-05-25 16:43 <DIR> d-------- C:\Program Files\YouTube Video Downloader 2007-05-24 22:45 <DIR> d-------- C:\Program Files\Riva 2007-05-24 22:45 <DIR> d-------- C:\Program Files\Common Files\SWF Studio 2007-05-24 22:05 682 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-24 22:05 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-05-24 22:05 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-05-24 22:05 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-05-24 21:53 <DIR> d-------- C:\Program Files\CleanMyPC 2007-05-24 19:50 <DIR> d-------- C:\Program Files\CleanMyPC Popup Blocker 2007-05-24 19:09 <DIR> d-------- C:\Program Files\TechSmith 2007-05-24 19:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\TechSmith 2007-05-24 19:08 85,960 --a------ C:\WINDOWS\system32\build_dol.exe 2007-05-24 19:08 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-05-24 17:06 <DIR> d-------- C:\Program Files\RapidLeecher 2007-05-23 14:38 <DIR> d-------- C:\Program Files\Biznes filmowy 2007-05-22 18:44 <DIR> d-------- C:\Program Files\Living Dolphins 3D Screensaver 2007-05-22 15:35 <DIR> d-------- C:\Program Files\AV Vcs 4.0 DIAMOND 2007-05-21 23:40 <DIR> d-------- C:\Tlen_pliki 2007-05-21 17:59 154,624 --a------ C:\WINDOWS\system32\cd_clint.dll 2007-05-21 17:59 <DIR> d-------- C:\WINDOWS\system32\AdCache 2007-05-18 23:10 3,984 --a------ C:\WINDOWS\desctemp.dat 2007-05-18 22:44 57,344 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-05-18 22:44 135,040 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-05-18 22:44 <DIR> d-------- C:\Program Files\IVT Corporation 2007-05-17 16:46 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2007-05-17 00:05 <DIR> d-------- C:\Program Files\Smart Projects 2007-05-13 19:12 <DIR> d-------- C:\Program Files\Lavalys 2007-05-13 14:58 65,536 --a------ C:\WINDOWS\system32\a1.dll 2007-05-13 14:58 556,544 --a------ C:\WINDOWS\system32\wscma2u.exe 2007-05-13 14:58 278,528 --a------ C:\WINDOWS\system32\ammpp.dll 2007-05-13 14:58 229,888 --a------ C:\WINDOWS\system32\atomid.exe 2007-05-13 14:58 <DIR> d-------- C:\WINDOWS\system32\embedded 2007-05-13 14:58 <DIR> d-------- C:\Program Files\AnMing 2007-05-12 15:58 <DIR> d-------- C:\Program Files\Blaze Media Pro 2007-05-12 15:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-05-12 15:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\{CFAB4006-0AE0-414D-866A-DCB2C46553CF} 2007-05-12 14:54 1,445,888 --a------ C:\WINDOWS\system32\Living_Dolphins_3D_Screensaver.scr 2007-05-11 09:56 99,840 --a------ C:\WINDOWS\system32\irftp.exe 2007-05-11 09:56 78,848 --a------ C:\WINDOWS\system32\irmon.dll 2007-05-11 09:56 7,680 --a------ C:\WINDOWS\system32\wshirda.dll 2007-05-11 09:56 55,296 --a------ C:\WINDOWS\system32\drivers\irda.sys 2007-05-11 09:56 26,624 --a------ C:\WINDOWS\system32\drivers\irstusb.sys 2007-05-11 09:56 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2007-05-10 15:44 <DIR> d-------- C:\Program Files\Real Alternative 2007-05-10 15:44 <DIR> d-------- C:\Program Files\Media Player Classic 2007-05-10 15:44 <DIR> d-------- C:\DOCUME~1\CHWDP\DANEAP~1\Real 2007-05-10 15:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-05-09 21:15 <DIR> C:\bearshare1 2007-05-09 21:15 <DIR> C:\bearshare 2007-05-07 01:40 <DIR> d-------- C:\Program Files\BitSpirit 2007-05-03 17:24 <DIR> d-------- C:\DOCUME~1\CHWDP\DANEAP~1\Camfrog 2007-05-03 17:23 <DIR> d-------- C:\Program Files\Camfrog 2007-05-03 13:20 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2007-05-03 13:20 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-05-03 13:20 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-05-03 13:20 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-05-03 13:20 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-05-03 13:20 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2007-05-03 13:20 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-05-03 13:20 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-05-03 13:20 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-05-01 14:08 <DIR> d-------- C:\Program Files\FunPhotor 2007-04-28 22:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems 2007-04-28 22:00 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-04-26 14:52 101,888 --------- C:\WINDOWS\system32\VB6STKIT.DLL 2007-04-26 14:52 <DIR> d-------- C:\Program Files\Northworks Solutions Ltd 2007-04-25 16:16 <DIR> d-------- C:\Program Files\MIKSOFT 2007-04-25 16:14 995,944 --a------ C:\WINDOWS\system32\wmvdmoe2.dll 2007-04-25 16:14 919,040 --a------ C:\WINDOWS\system32\wmnetmgr.dll 2007-04-25 16:14 898,664 --a------ C:\WINDOWS\system32\wmspdmoe.dll 2007-04-25 16:14 82,432 --a------ C:\WINDOWS\system32\drmstor.dll 2007-04-25 16:14 81,408 --a------ C:\WINDOWS\system32\logagent.exe 2007-04-25 16:14 807,528 --a------ C:\WINDOWS\system32\wmvdmod.dll 2007-04-25 16:14 752,232 --a------ C:\WINDOWS\system32\wmsdmod.dll 2007-04-25 16:14 679,936 --a------ C:\WINDOWS\system32\drmv2clt.dll 2007-04-25 16:14 675,944 --a------ C:\WINDOWS\system32\wmadmoe.dll 2007-04-25 16:14 6,656 --a------ C:\WINDOWS\system32\laprxy.dll 2007-04-25 16:14 486,504 --a------ C:\WINDOWS\system32\wmspdmod.dll 2007-04-25 16:14 410,216 --a------ C:\WINDOWS\system32\wmadmod.dll 2007-04-25 16:14 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-04-25 16:14 316,008 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-04-25 16:14 301,160 --a------ C:\WINDOWS\system32\drmclien.dll 2007-04-25 16:14 261,224 --a------ C:\WINDOWS\system32\msnetobj.dll 2007-04-25 16:14 248,424 --a------ C:\WINDOWS\system32\mpg4dmod.dll 2007-04-25 16:14 232,960 --a------ C:\WINDOWS\system32\blackbox.dll 2007-04-25 16:14 221,184 --a------ C:\WINDOWS\system32\qasf.dll 2007-04-25 16:14 217,600 --a------ C:\WINDOWS\system32\wmasf.dll 2007-04-25 16:14 143,360 --a------ C:\WINDOWS\system32\wmidx.dll 2007-04-25 16:14 1,108,584 --a------ C:\WINDOWS\system32\wmsdmoe2.dll 2007-04-25 16:14 <DIR> d-------- C:\Program Files\AudioCommander (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-22 19:09:14 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\Skype 2007-04-21 21:54:42 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\Media Player Classic 2007-04-21 18:48:42 -------- d-----w C:\Program Files\DAEMON Tools 2007-04-21 18:44:18 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-21 16:43:39 -------- d-----w C:\Program Files\Messenger 2007-04-21 15:32:52 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\Ashampoo 2007-04-21 15:32:11 -------- d-----w C:\Program Files\Ashampoo 2007-04-21 15:22:10 -------- d--h--w C:\Program Files\WindowsUpdate 2007-04-21 15:15:29 -------- d-----w C:\Program Files\Usb to Serial Driver 1.12.28 2007-04-21 15:15:28 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-04-21 15:15:14 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-21 12:52:54 57,426 ----a-w C:\WINDOWS\system32\btfunc.dll 2007-04-21 12:39:23 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\Opera 2007-04-21 11:19:50 3,445 ----a-w C:\WINDOWS\mozver.dat 2007-04-21 10:27:11 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\COWON 2007-04-20 20:30:33 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-20 20:30:31 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-20 20:20:51 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\Talkback 2007-04-20 20:20:37 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-20 20:16:11 -------- d-----w C:\Program Files\RegCleaner 2007-04-20 20:15:49 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-04-20 20:07:08 487,424 ----a-w C:\WINDOWS\Radeon Omega Drivers v3.8.291 Uninstall.exe 2007-04-20 20:07:07 -------- d-----w C:\Program Files\Radeon Omega Drivers 2007-04-20 20:05:26 -------- d-----w C:\Program Files\Skype 2007-04-20 20:05:26 -------- d-----w C:\Program Files\Common Files\Skype 2007-04-20 20:04:13 -------- d-----w C:\Program Files\SubEdit-Player 2007-04-20 20:02:45 -------- d-----w C:\DOCUME~1\CHWDP\DANEAP~1\Tlen.pl 2007-04-20 20:02:16 -------- d-----w C:\Program Files\Tlen.pl 2007-04-20 19:49:54 -------- d-----w C:\Program Files\C-Media 3D Audio 2007-04-20 19:48:29 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-20 19:48:29 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-20 19:38:02 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-20 19:37:42 0 --sha-r C:\MSDOS.SYS 2007-04-20 19:37:42 0 --sha-r C:\IO.SYS 2007-04-20 19:37:42 0 ----a-w C:\CONFIG.SYS 2007-04-20 19:37:42 0 ----a-w C:\AUTOEXEC.BAT 2007-04-20 19:36:34 -------- d-----w C:\Program Files\Usługi online 2007-04-20 19:36:07 -------- d-----w C:\Program Files\Movie Maker 2007-04-20 19:35:30 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-20 19:34:59 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-20 19:34:24 -------- d-----w C:\Program Files\Windows NT 2007-04-20 19:34:24 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-03-05 04:01:18 39,184 ----a-w C:\WINDOWS\system32\drivers\btcusb.sys 2007-03-05 04:00:56 15,632 ----a-w C:\WINDOWS\system32\btinstall.dll 2007-03-05 04:00:04 27,792 ----a-w C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys 2007-03-05 03:59:04 18,320 ----a-w C:\WINDOWS\system32\drivers\btnetdrv.sys 2007-03-05 03:57:14 19,472 ----a-w C:\WINDOWS\system32\drivers\VHIDMini.sys 2007-03-05 03:56:18 35,600 ----a-w C:\WINDOWS\system32\drivers\BTHidMgr.sys 2007-03-05 03:55:12 20,880 ----a-w C:\WINDOWS\system32\drivers\vbtenum.sys 2007-03-05 03:53:18 44,304 ----a-w C:\WINDOWS\system32\drivers\VcommMgr.sys 2007-03-05 03:52:18 34,448 ----a-w C:\WINDOWS\system32\drivers\VComm.sys 2007-03-05 03:51:24 34,576 ----a-w C:\WINDOWS\system32\drivers\blueletaudio.sys 2007-02-08 15:49:44 668,672 ----a-w C:\WINDOWS\system32\AdjMmsEng.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {00C6482D-C502-44C8-8409-FCE54AD9C208}=C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll [2007-02-16 18:41] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {7A9BC6B1-7F27-47c6-A66D-13582E81E537}=C:\Program Files\CleanMyPC Popup Blocker\CleanBHO.dll [2004-12-10 10:48] {A5366673-E8CA-11D3-9CD9-0090271D075B}=D:\PROGRA~1\FlashGet\jccatch.dll [2002-01-16 19:12] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 C:\WINDOWS\system32\atiptaxx.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "RegistryMechanic"="" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="D:\Programy\Gadu-Gadu\gg.exe" [2006-11-14 11:12] "BitComet"="D:\Program Files\BitComet\BitComet.exe" [2006-02-13 19:02] "Camfrog"="C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" [2003-09-29 08:22] "Steam"="D:\Program Files\Steam\Steam.exe" [2007-05-12 17:27] "Registry Cleaner Scheduler"="C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe" [2007-05-21 19:44] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ClearRecentDocsOnExit"=1 (0x1) *Newly Created Service* -SHAREDACCESS ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20070524-221427-858 O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) ????????????????????????????????????????????4??????????????????????????????????????????????????????????????????????????????????????????????????????????†???????????????????????????????????????†?????????????????????????????????????????????????????????????????????????:?? backup-20070524-221427-693 O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) ????????????????????????????????????????????4??????????????????????????????????????????????????????????????????????????????????????????????????????????†???????????????????????????????????????†?????????????????????????????????????????????????????????????????????????:?? ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-25 17:05:01 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-25 17:06:16 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-05-25 17:05 --- E O F ---

**Posty:** 18165 · przez **wojtas** 25 Maj 2007, 17:57

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

C:\WINDOWS\system32\build_dol.exe
C:\WINDOWS\system32\tmp.reg

usun pliki

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum