Norton znalazl konia trojanskie ale nie potrafi ich usunac

**Posty:** 321 · przez **Dhogar** 25 Paź 2008, 22:12

Jak w temacie
Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:09:39, on 2008-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/default R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" -autorun O4 - HKLM\..\Policies\Explorer\Run: [] O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user') O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9398 bytes

SIlent Runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "DAEMON Tools Lite" = ""C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun" ["DT Soft Ltd"] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "DAEMON Tools Pro Agent" = ""C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" -autorun" ["DT Soft Ltd."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."] "SSBkgdUpdate" = ""C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot" ["Nuance Communications, Inc."] "OpwareSE4" = ""C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"" ["Nuance Communications, Inc."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."] "ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "Symantec PIF AlertEng" = ""C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"" ["Symantec Corporation"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "Norton Internet Security 2006" -> {HKLM...CLSID} = "CNisExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

Z gory dzieki za sprawdzenie

**Posty:** 7956 · przez **Magik** 25 Paź 2008, 22:23

Dhogar napisał(a):Jak w temacie

netykieta

na co silent runners?? gdzie combofix??

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

i nastepnie

http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

czyli
Sdfix, combofix, FixIEDef, Hijackthis--->te 4 logi zaczynamy rozmawiac

**Posty:** 684 · przez **djarta** 25 Paź 2008, 22:25

Magik napisał(a):
Dhogar napisał(a):Jak w temacie

Sdfix, combofix, FixIEDef, Hijackthis--->te 4 logi zaczynamy rozmawiac

Ucięłeś Silenta, daj nam w całośći.

=============
K.

**Posty:** 321 · przez **Dhogar** 25 Paź 2008, 22:48

HIjack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:40:29, on 2008-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/default R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user') O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9313 bytes

Combofix

Kod: Zaznacz wszystko: ComboFix 08-10-18.03 - Pasiak 2008-10-25 22:33:00.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.615 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Pasiak\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-25 do 2008-10-25 ))))))))))))))))))))))))))))))) . 2008-10-25 14:42 . 2008-10-25 22:30 46,640 --a------ C:\WINDOWS\system32\msln.exe 2008-10-22 03:26 . 2008-10-22 14:26 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-21 19:59 . 2008-10-21 19:59 <DIR> d--h----- C:\WINDOWS\PIF 2008-10-19 20:16 . 2008-10-19 20:16 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-19 20:15 . 2008-10-25 22:35 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-19 20:15 . 2008-09-09 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-19 20:15 . 2008-09-09 20:23 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-19 20:15 . 2008-09-09 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-19 20:15 . 2008-09-09 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-19 20:15 . 2008-09-09 22:19 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-19 20:15 . 2008-09-09 22:19 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-19 20:15 . 2008-10-19 20:15 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-19 20:13 . 2008-10-19 20:22 <DIR> d-------- C:\SDFix 2008-10-19 19:32 . 2008-10-19 19:35 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-10-19 19:32 . 2008-10-19 19:35 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-10-19 19:22 . 2008-10-19 19:22 <DIR> d-------- C:\Documents and Settings\Pasiak\Dane aplikacji\Symantec 2008-10-19 19:15 . 2008-10-19 19:15 10,344 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys 2008-10-19 19:14 . 2008-10-19 20:03 <DIR> d-------- C:\Program Files\Norton Internet Security 2008-10-19 19:13 . 2008-10-19 19:35 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-19 19:13 . 2008-10-19 19:35 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-16 15:48 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-10-16 15:48 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-10-16 01:16 . 2008-08-14 15:46 2,181,632 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-16 01:16 . 2008-08-14 15:46 2,137,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-16 01:16 . 2008-08-14 15:46 2,059,008 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-16 01:16 . 2008-08-14 15:46 2,017,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-15 15:10 . 2008-10-15 15:22 <DIR> d-------- C:\Program Files\DAEMON Tools Pro 2008-10-15 15:10 . 2008-10-15 15:18 <DIR> d-------- C:\Documents and Settings\Pasiak\Dane aplikacji\DAEMON Tools Pro 2008-10-15 15:10 . 2008-10-15 15:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2008-10-15 15:04 . 2008-10-15 15:04 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-10-15 15:03 . 2008-10-15 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-09 22:54 . 2008-10-09 22:54 <DIR> d-------- C:\Program Files\AV2MP3 2008-10-09 22:54 . 2005-08-09 05:00 77,824 --a------ C:\WINDOWS\system32\mpfilecom.ax 2008-10-09 22:34 . 2008-10-09 22:46 <DIR> d-------- C:\Program Files\GoldWave 2008-10-09 21:49 . 2008-10-09 21:49 <DIR> d-------- C:\Program Files\Audacity 2008-10-07 17:36 . 2007-04-09 14:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll 2008-10-07 17:36 . 2008-10-07 17:36 421 --a------ C:\WINDOWS\ODBC.INI 2008-10-07 17:34 . 2008-10-07 17:35 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-10-07 17:34 . 2008-10-07 17:34 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-10-05 23:39 . 2008-10-05 23:39 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-10-05 23:39 . 2008-10-05 23:39 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-10-05 23:38 . 2008-10-05 23:38 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-10-05 23:38 . 2008-10-19 20:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-05 23:38 . 2008-10-25 22:28 4,069,408 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-05 23:38 . 2008-10-25 22:36 232,992 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-05 23:38 . 2008-10-25 22:28 54,332 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-05 23:38 . 2008-10-25 22:28 28,484 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-05 23:37 . 2008-10-05 23:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-10-04 09:38 . 2008-10-04 09:38 <DIR> d-------- C:\Program Files\uTorrent 2008-10-04 09:37 . 2008-10-05 23:44 <DIR> d-------- C:\Documents and Settings\Pasiak\Dane aplikacji\uTorrent 2008-10-04 08:26 . 2008-10-04 08:26 <DIR> d-------- C:\Documents and Settings\Pasiak\Dane aplikacji\Leadertech 2008-10-03 03:00 . 2008-10-03 03:00 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-01 21:59 . 2008-10-01 21:59 5,269 --a------ C:\WINDOWS\FontData.fdb 2008-10-01 21:52 . 2008-10-01 21:52 <DIR> d-------- C:\Documents and Settings\Pasiak\Dane aplikacji\Corel 2008-10-01 21:52 . 2008-10-01 22:08 2,516 --ahs---- C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys 2008-10-01 21:52 . 2008-10-01 21:54 88 -r-hs---- C:\Documents and Settings\All Users\Dane aplikacji\A3B0F8B778.sys 2008-10-01 21:44 . 2008-10-01 21:44 <DIR> d-------- C:\Program Files\Common Files\Protexis 2008-10-01 21:44 . 2008-10-01 21:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Corel 2008-10-01 21:42 . 2008-10-01 21:42 <DIR> d-------- C:\Program Files\Common Files\Corel 2008-09-30 16:24 . 2008-09-30 16:24 <DIR> d-------- C:\Program Files\FDRLab 2008-09-30 14:22 . 2008-09-30 14:22 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Made in Indonesia 2008-09-30 14:15 . 2008-09-30 14:15 <DIR> d-------- C:\Program Files\Lavasoft 2008-09-30 14:15 . 2008-09-30 14:15 <DIR> d-------- C:\Documents and Settings\Pasiak\Dane aplikacji\Lavasoft 2008-09-30 14:03 . 2008-09-30 14:19 <DIR> d-------- C:\Spyware Cleaner 2008 2008-09-27 19:57 . 2008-09-27 22:26 <DIR> d-------- C:\Program Files\Total Video Converter 2008-09-27 16:36 . 2008-09-27 16:36 124,688 --a------ C:\WINDOWS\system32\mswinsck.ocx 2008-09-27 16:36 . 2008-09-27 16:36 111,104 --a------ C:\WINDOWS\system32\uha.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-25 11:09 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\foobar2000 2008-10-22 20:07 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-10-22 16:19 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-21 20:48 --------- d-----w C:\Program Files\FlashGet 2008-10-19 17:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-10-19 17:35 --------- d-----w C:\Program Files\Symantec 2008-09-23 19:24 --------- d-----w C:\Program Files\Trend Micro 2008-09-20 12:42 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\Canon 2008-09-19 01:00 --------- d-----w C:\Program Files\MSXML 4.0 2008-09-18 17:24 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-17 17:21 --------- d-----w C:\Program Files\Common Files\Nero 2008-09-17 17:19 --------- d-----w C:\Program Files\Common Files\Ahead 2008-09-17 17:19 --------- d-----w C:\Program Files\Ahead 2008-09-17 16:55 --------- d-----w C:\Program Files\Canon 2008-09-17 16:52 --------- d-----w C:\Program Files\ScanSoft 2008-09-17 16:52 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared 2008-09-17 16:52 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-17 16:52 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\ScanSoft 2008-09-17 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft 2008-09-17 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-09-17 16:50 --------- d--h--w C:\Documents and Settings\All Users\Dane aplikacji\CanonBJ 2008-09-17 16:49 --------- d--h--w C:\Program Files\CanonBJ 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-13 08:33 --------- d-----w C:\Program Files\foobar2000 2008-09-12 20:55 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-09-12 20:55 --------- d-----w C:\Program Files\ALLPlayer 2008-09-12 20:52 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-12 15:40 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\ImgBurn 2008-09-12 14:12 --------- d-----w C:\Program Files\ImgBurn 2008-09-12 04:43 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\DMCache 2008-09-11 21:36 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE 2008-09-11 18:50 --------- d-----w C:\Program Files\Sun 2008-09-11 18:50 --------- d-----w C:\Program Files\Java 2008-09-11 18:48 --------- d-----w C:\Program Files\Common Files\Java 2008-09-11 17:42 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\Gadu-Gadu 2008-09-11 06:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-11 06:11 --------- d-----w C:\Program Files\SAGEM 2008-09-09 18:42 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\SPORE 2008-09-09 18:36 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-09-09 18:33 --------- d-----w C:\Program Files\Realtek 2008-09-09 18:32 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-09-09 18:32 --------- d-----w C:\Documents and Settings\Pasiak\Dane aplikacji\DAEMON Tools 2008-09-09 18:26 --------- d-----w C:\Program Files\microsoft frontpage 2008-09-09 18:25 --------- d-----w C:\Program Files\Usługi online 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-20 05:38 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-19_20.36.37.09 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-03 22:44:08 332,288 -c--a-w C:\WINDOWS\system32\dllcache\netapi32.dll + 2008-10-15 17:00:47 332,800 -c--a-w C:\WINDOWS\system32\dllcache\netapi32.dll - 2004-08-03 22:44:08 332,288 ----a-w C:\WINDOWS\system32\netapi32.dll + 2008-10-15 17:00:47 332,800 ----a-w C:\WINDOWS\system32\netapi32.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2008-10-09 200136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 52840] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048] "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-08-23 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"= "C:\\WINDOWS\\system32\\java.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Documents and Settings\\Pasiak\\Pulpit\\utorrent.exe"= R2 PSI_SVC_2;Protexis Licensing V2;C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592] S3 Asushwio;Asushwio;C:\WINDOWS\system32\drivers\Asushwio.sys [2004-04-27 5824] S3 EraserUtilDrvI7;EraserUtilDrvI7;C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys [ ] *Newly Created Service* - COMHOST . Zawartość folderu 'Zaplanowane zadania' 2008-10-24 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Pasiak.job - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2007-05-23 12:13] . - - - - USUNIĘTO PUSTE WPISY - - - - HKU-Default-RunOnce-<NO NAME> - (no file) . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Pasiak\Dane aplikacji\Mozilla\Firefox\Profiles\i7ny4rzc.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official . . ------- Skojarzenia plików ------- . inifile=%SystemRoot%\System32\NOTEPAD.EXE %1" . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-25 22:35:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-25 22:37:20 ComboFix-quarantined-files.txt 2008-10-25 20:37:13 ComboFix2.txt 2008-10-19 18:37:32 Przed: 513 634 304 bajtów wolnych Po: 689,967,104 bajtów wolnych 212 --- E O F --- 2008-10-24 01:00:26

FixIedef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6705 * * * ******************************************************************************** Created at 22:27:39 on Saturday, October 25, 2008 Time Zone : Logged On User : Pasiak Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 Processor 3500+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 440.64 MB Total Physical Memory: 1023 MB Free Physical Memory : 476 MB Total Page File : 1023 MB Free Page File : 2040 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1966 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Dodano 25.10.2008 21:48:53:

Kod: Zaznacz wszystko: FixIedef [code]******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6705 * * * ******************************************************************************** Created at 22:27:39 on Saturday, October 25, 2008 Time Zone : Logged On User : Pasiak Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 Processor 3500+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 440.64 MB Total Physical Memory: 1023 MB Free Physical Memory : 476 MB Total Page File : 1023 MB Free Page File : 2040 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1966 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!![/code]

**Posty:** 7956 · przez **Magik** 25 Paź 2008, 23:10

2x wkleiles log z fixiedef'a zamiast sdfixa ale ok :wink:

w HJT na fix:

Kod: Zaznacz wszystko: O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\msln.exe

Zapisz plik jako CFScript.txt najlepiej aby ikonka tego pliku znajdowała się obok ikonki ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na ikonkę ComboFix.exe powinno rozpocząć się usuwanie po tym daj log na forum.

przeskanuj na virustotal.com

Kod: Zaznacz wszystko: C:\Documents and Settings\All Users\Dane aplikacji\A3B0F8B778.sys C:\WINDOWS\_MSRSTRT.EXE

przeskanuj kompa kaspersky online

http://www.kaspersky.com/virusscanner

i nie poodba mi sie iz w logach widnieje Kaspersky i Norton-->uzywasz 2 av??