[log]popupy, komp zamula

**Posty:** 5 · przez **Piotreek1987** 18 Lis 2008, 21:19

Witam
Mam problemy z kompem jak w temacie. Kiedy używam firefoksa co jakiś czas wyskakuje mi nowa karta z jakims virus remover 2008 a jak moja matka używa internet explorer to w ogóle sie cuda dzieją cały pulpit zasypuja nowe okna przeglądarki i nic nie idzie zrobić bo jak wyłącze iexplorer w menagerze zadań to cały pulpit mi znika po za tym samo włączenie kompa trwa wieki a na starcie teoretycznie włacza mi sie tylko kaspersky antyvirus, gg, i tray od karty dzwiękowej trwa to około 10 minut
oto log z hijacka

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:39:43, on 2008-11-18 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Common Files\NMSAccessU.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Paulina\Pulpit\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell= O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp.photoprintit.de/microsite/1661/defaults/activex/IPSUploader.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Common Files\NMSAccessU.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe -- End of file - 4899 bytes

a to jest log z combofixa

Kod: Zaznacz wszystko: ComboFix 08-11-17.04 - Paulina 2008-11-18 19:55:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.65 [GMT 1:00] Uruchomiony z: c:\documents and settings\Paulina\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\bceggrss.ini c:\windows\system32\byXOigfF.dll c:\windows\system32\byXRjklk.dll c:\windows\system32\efcBtrOf.dll c:\windows\system32\efcCsspm.dll c:\windows\system32\fOrtBcfe.ini c:\windows\system32\fOrtBcfe.ini2 c:\windows\system32\geoqchbp.dll c:\windows\system32\oifxub.dll c:\windows\system32\pbhcqoeg.ini c:\windows\system32\rfbmwinf.dll c:\windows\system32\vtUnmmnk.dll c:\windows\system32\yretltov.ini H:\d.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-18 do 2008-11-18 ))))))))))))))))))))))))))))))) . 2008-11-16 14:01 . 2008-11-16 14:01 2,206 --a------ c:\windows\system32\%LocalXml% 2008-11-16 13:33 . 2008-11-18 20:01 104,448 --a------ c:\windows\system32\wibikuup.dll 2008-11-16 13:32 . 2008-11-16 13:32 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-11-16 13:32 . 2008-11-16 13:32 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-11-16 13:29 . 2008-11-16 13:29 <DIR> d-------- c:\program files\Kaspersky Lab 2008-11-16 13:29 . 2008-11-18 17:53 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-11-16 13:29 . 2008-11-18 20:09 3,032,096 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-11-16 13:29 . 2008-11-18 20:09 458,784 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-11-16 13:29 . 2008-11-18 20:09 28,960 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-11-16 13:29 . 2008-11-18 20:09 3,696 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-11-12 09:15 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 09:15 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-11 15:39 . 2008-11-11 15:43 <DIR> d-------- c:\documents and settings\Paulina\Dane aplikacji\U3 2008-10-30 18:00 . 2001-10-26 16:57 12,160 --a------ c:\windows\system32\drivers\mouhid.sys 2008-10-30 18:00 . 2001-10-26 16:57 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys 2008-10-24 18:01 . 2008-10-24 18:01 <DIR> d-------- c:\program files\Windows Media Connect 2 2008-10-24 17:59 . 2008-10-24 17:59 <DIR> d-------- c:\windows\system32\LogFiles 2008-10-24 17:59 . 2008-11-09 13:07 <DIR> d-------- c:\windows\system32\drivers\UMDF 2008-10-24 13:32 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-20 21:29 . 2008-10-20 21:29 218,376 --a------ c:\windows\system32\klogon.dll 2008-10-20 21:27 . 2008-10-20 21:27 25,601 --a------ c:\windows\system32\drivers\klopp.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-17 18:57 --------- d-----w c:\program files\FlashGet 2008-11-16 15:28 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\Azureus 2008-11-16 12:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-11-06 16:17 --------- d-----w c:\program files\Azureus 2008-11-04 13:30 --------- d-----w c:\program files\Winamp 2008-11-01 19:00 --------- d-----w c:\program files\Gadu-Gadu 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-13 20:20 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\Skype 2008-10-13 14:12 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\skypePM 2008-10-11 10:28 5,632 ----a-w c:\windows\system32\drivers\StarOpen.sys 2008-09-28 06:40 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\MSN6 2008-02-14 12:37 1,136 ----a-w c:\documents and settings\Paulina\Dane aplikacji\filterclsid.dat 2007-01-25 01:52 65,536 ----a-w c:\program files\Common Files\NMSAccessU.exe 2008-04-16 07:27 56 --sh--r c:\windows\system32\ACF9856464.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}] 2007-10-11 14:45 402872 --a------ c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-10-20 206088] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-12-08 08:49 21504 c:\program files\Gadu-Gadu\StrongGG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 18:21 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] --a------ 2006-11-10 11:35 90112 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2004-12-20 19:41 33792 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Azureus\\Azureus.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 xmasbus;xmasbus;c:\windows\system32\DRIVERS\xmasbus.sys [2008-03-22 140800] R0 xmasscsi;xmasscsi;c:\windows\system32\Drivers\xmasscsi.sys [2008-03-22 5504] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592] S3 axvbusx;axvbusx;c:\windows\system32\DRIVERS\axvbusx.sys [] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2007-10-12 58320] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2007-10-12 8304] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2007-10-12 94000] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1ae0d65e-e128-11dc-96a2-001a4d9aae05}] \Shell\AutoRun\command - I:\EXPLORER.EXE \Shell\explore\Command - I:\EXPLORER.EXE \Shell\open\Command - I:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4dc5fe7d-afdd-11dd-ba3f-001a4d9aae05}] \Shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a29c5e0e-b2cd-11dc-9602-001a4d9aae05}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{728F8122-BBAF-47A7-ACE6-39BB7FCF437F} - c:\windows\system32\efcCsspm.dll BHO-{B2E813D1-6861-4346-A56F-CBCC674BE6B5} - c:\windows\system32\efcBtrOf.dll BHO-{d786d5bd-a528-482b-b7a3-0abd9b410334} - c:\windows\system32\oifxub.dll HKCU-Run-wsctf.exe - wsctf.exe HKLM-Run-88f3300c - c:\windows\system32\geoqchbp.dll ShellExecuteHooks-{728F8122-BBAF-47A7-ACE6-39BB7FCF437F} - c:\windows\system32\efcCsspm.dll MSConfigStartUp-ArcSoft Connection Service - c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Paulina\Dane aplikacji\Mozilla\Firefox\Profiles\q9rbybct.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-18 20:10:34 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Common Files\NMSAccessU.exe c:\windows\system32\PSIService.exe . ************************************************************************** . Czas ukończenia: 2008-11-18 20:16:17 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-18 19:16:05 Przed: 787 091 456 bajtów wolnych Po: 3,522,641,920 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS [operating systems] e:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect 181 --- E O F --- 2008-11-13 08:36:41

**Posty:** 18165 · przez **wojtas** 18 Lis 2008, 21:42

skasuj w hijacku:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
F2 - REG:system.ini: Shell=
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe

Otworz notatnik i wklej w nim to:

File::
C:\d.com
D:\d.com
E:\d.com
F:\d.com
G:\d.com
c:\windows\system32\wibikuup.dll

Folder::
C:\Program Files\BearShare Applications\BearShare MediaBar

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1ae0d65e-e128-11dc-96a2-001a4d9aae05}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a29c5e0e-b2cd-11dc-9602-001a4d9aae05}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 5 · przez **Piotreek1987** 18 Lis 2008, 21:45

ok już sie robi

Dodano Dzisiaj, 21:04:
nowy log

Kod: Zaznacz wszystko: ComboFix 08-11-17.04 - Paulina 2008-11-18 20:51:50.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.80 [GMT 1:00] Uruchomiony z: c:\documents and settings\Paulina\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Paulina\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: C:\d.com c:\windows\system32\wibikuup.dll D:\d.com E:\d.com F:\d.com G:\d.com . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\BearShare Applications\BearShare MediaBar c:\program files\BearShare Applications\BearShare MediaBar\basis.xml c:\program files\BearShare Applications\BearShare MediaBar\bearshare.bmp c:\program files\BearShare Applications\BearShare MediaBar\bearshare_icons.bmp c:\program files\BearShare Applications\BearShare MediaBar\bearshare_logo.bmp c:\program files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll c:\program files\BearShare Applications\BearShare MediaBar\button_arrow.bmp c:\program files\BearShare Applications\BearShare MediaBar\google_images.bmp c:\program files\BearShare Applications\BearShare MediaBar\google_maps.bmp c:\program files\BearShare Applications\BearShare MediaBar\google_news.bmp c:\program files\BearShare Applications\BearShare MediaBar\google_videos.bmp c:\program files\BearShare Applications\BearShare MediaBar\historyCombo.html c:\program files\BearShare Applications\BearShare MediaBar\resizer.bmp c:\program files\BearShare Applications\BearShare MediaBar\search.bmp c:\program files\BearShare Applications\BearShare MediaBar\search.html c:\program files\BearShare Applications\BearShare MediaBar\search.js c:\program files\BearShare Applications\BearShare MediaBar\showSettings.js c:\program files\BearShare Applications\BearShare MediaBar\storesearchcriteria.js c:\program files\BearShare Applications\BearShare MediaBar\Uninstall.exe c:\program files\BearShare Applications\BearShare MediaBar\Updater.exe c:\program files\BearShare Applications\BearShare MediaBar\version.txt c:\program files\BearShare Applications\BearShare MediaBar\web.bmp c:\windows\system32\wibikuup.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-18 do 2008-11-18 ))))))))))))))))))))))))))))))) . 2008-11-16 14:01 . 2008-11-16 14:01 2,206 --a------ c:\windows\system32\%LocalXml% 2008-11-16 13:32 . 2008-11-16 13:32 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-11-16 13:32 . 2008-11-16 13:32 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-11-16 13:29 . 2008-11-16 13:29 <DIR> d-------- c:\program files\Kaspersky Lab 2008-11-16 13:29 . 2008-11-18 17:53 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-11-16 13:29 . 2008-11-18 20:55 3,039,264 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-11-16 13:29 . 2008-11-18 20:55 458,784 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-11-16 13:29 . 2008-11-18 20:55 29,016 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-11-16 13:29 . 2008-11-18 20:55 3,696 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-11-12 09:15 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 09:15 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-11 15:39 . 2008-11-11 15:43 <DIR> d-------- c:\documents and settings\Paulina\Dane aplikacji\U3 2008-10-30 18:00 . 2001-10-26 16:57 12,160 --a------ c:\windows\system32\drivers\mouhid.sys 2008-10-30 18:00 . 2001-10-26 16:57 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys 2008-10-24 18:01 . 2008-10-24 18:01 <DIR> d-------- c:\program files\Windows Media Connect 2 2008-10-24 17:59 . 2008-10-24 17:59 <DIR> d-------- c:\windows\system32\LogFiles 2008-10-24 17:59 . 2008-11-09 13:07 <DIR> d-------- c:\windows\system32\drivers\UMDF 2008-10-24 13:32 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-20 21:29 . 2008-10-20 21:29 218,376 --a------ c:\windows\system32\klogon.dll 2008-10-20 21:27 . 2008-10-20 21:27 25,601 --a------ c:\windows\system32\drivers\klopp.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-18 19:52 --------- d-----w c:\program files\BearShare Applications 2008-11-17 18:57 --------- d-----w c:\program files\FlashGet 2008-11-16 15:28 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\Azureus 2008-11-16 12:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-11-06 16:17 --------- d-----w c:\program files\Azureus 2008-11-04 13:30 --------- d-----w c:\program files\Winamp 2008-11-01 19:00 --------- d-----w c:\program files\Gadu-Gadu 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-13 20:20 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\Skype 2008-10-13 14:12 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\skypePM 2008-10-11 10:28 5,632 ----a-w c:\windows\system32\drivers\StarOpen.sys 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-28 06:40 --------- d-----w c:\documents and settings\Paulina\Dane aplikacji\MSN6 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-29 16:24 6,580 --sha-w c:\windows\system32\KGyGaAvL.sys 2008-08-20 05:11 668,672 ----a-w c:\windows\system32\wininet.dll 2008-02-14 12:37 1,136 ----a-w c:\documents and settings\Paulina\Dane aplikacji\filterclsid.dat 2007-01-25 01:52 65,536 ----a-w c:\program files\Common Files\NMSAccessU.exe 2008-04-16 07:27 56 --sh--r c:\windows\system32\ACF9856464.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-10-20 206088] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-12-08 08:49 21504 c:\program files\Gadu-Gadu\StrongGG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 18:21 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] --a------ 2006-11-10 11:35 90112 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2004-12-20 19:41 33792 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Azureus\\Azureus.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 xmasbus;xmasbus;c:\windows\system32\DRIVERS\xmasbus.sys [2008-03-22 140800] R0 xmasscsi;xmasscsi;c:\windows\system32\Drivers\xmasscsi.sys [2008-03-22 5504] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592] S3 axvbusx;axvbusx;c:\windows\system32\DRIVERS\axvbusx.sys [] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2007-10-12 58320] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2007-10-12 8304] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2007-10-12 94000] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4dc5fe7d-afdd-11dd-ba3f-001a4d9aae05}] \Shell\AutoRun\command - H:\LaunchU3.exe -a . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-18 20:56:47 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Common Files\NMSAccessU.exe c:\windows\system32\PSIService.exe . ************************************************************************** . Czas ukończenia: 2008-11-18 21:02:45 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-18 20:02:33 ComboFix2.txt 2008-11-18 19:16:23 Przed: 3 532 189 696 bajtów wolnych Po: 3,513,774,080 bajtów wolnych 173 --- E O F --- 2008-11-13 08:36:41

**Posty:** 18165 · przez **wojtas** 18 Lis 2008, 22:21

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 5 · przez **Piotreek1987** 18 Lis 2008, 22:32

nie działa linl do tego programu:/ poszukam jeszcze przez google

Dodano Dzisiaj, 21:36:
ok mam

**Posty:** 18165 · przez **wojtas** 18 Lis 2008, 23:03

to czekamy na wszystko

**Posty:** 5 · przez **Piotreek1987** 18 Lis 2008, 23:20

NIe moge zeskanowac kasperskym online bo mam zaintalkowanego zwykłego:/

**Posty:** 921 · przez **marcin19** 19 Lis 2008, 17:00

Piotreek1987 napisał(a):bo mam

wyłącz go na czas skanowania i wyłącz WSZYSTKIE programy korzystające z internetu

**Posty:** 5 · przez **Piotreek1987** 19 Lis 2008, 22:12

samego kasperskyego wyłączyłem i nic to nie dało nadal był ten sam komunikat że mam go zainstalowanego

**Posty:** 18165 · przez **wojtas** 19 Lis 2008, 22:46

to wykonaj co mozesz..