[log] privacy protection , proszę o sprawdzenie loga

**Posty:** 29 · przez **AfgaN** 25 Paź 2007, 19:07

Złapałem coś napewno, przez pewien czas wyświetlało mi strone na pulpicie(privacy protection), ale jakoś to rozwiązałem. Wiem że do końca się tego nie pozbyłem chociażby po tym, że w dzienniku ashampo firewall widzę że co jakiś czas próbuje się łączyć c:\windows\explorer.exe a chyba nie powinno bo wcześniej tego nie widziałem. Byłbym wdzięczny za pomoc bo w kwestii komputerów to jestem laikiem.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:02:31, on 2007-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\USB all-in-one game controller\SK_DevUpdate.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlflm.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: (no name) - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Ashampoo FireWall] "E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: SK_DevUpdate.lnk = C:\Program Files\USB all-in-one game controller\SK_DevUpdate.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - e:\Program Files\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - e:\Program Files\Hello\PicasaCapture.dll O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O21 - SSODL: bxsbang - {E30C30C9-163F-43D3-8840-07AA95C82716} - C:\WINDOWS\bxsbang.dll O21 - SSODL: ocgrep - {DD7A06E0-0FDA-4439-A461-C68060B3A89A} - (no file) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 6432 bytes

**Posty:** 18165 · przez **wojtas** 25 Paź 2007, 21:10

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

po tym wszystkim log z combofixa oraz hijacka dajesz na forum

**Posty:** 29 · przez **AfgaN** 25 Paź 2007, 21:35

Przy próbie odpalenia windows worms door cleaner dostałem wiadomość o następującej treści " Your system seems to be infected by a virus, your SVCHOST virtual memory usage 22928Ko is beyond usual values. It is strongly advised to check your system with Antivirus up to date and AntiTrojans." Mam zrobić tak jak każe i przelecieć komputer anty wirem? Wcześniej skanowałem i nic nie wykryło(mam avasta). Gdy dam ok pojawia się okienko wwdc i wszystkie znaczki poza UPNP są na czerwono(ten jest zielony).

**Posty:** 18165 · przez **wojtas** 25 Paź 2007, 21:37

to narazie nie wykonuj wwdc tylko wykonaj reszte i wroc z logami

**Posty:** 29 · przez **AfgaN** 25 Paź 2007, 23:22

Ok więc lecim na szczecin. Combofix jakiegoś root(cośtam) zlokalizował i chyba usunął, o to log.

Kod: Zaznacz wszystko: ComboFix 07-10-25.4 - TT 2007-10-25 23:14:50.1 - [color=red][b]FAT32[/b][/color]x86 * Created a new restore point . [color=red][b] Rootkit driver huy32 is present. ... attempting disinfection [/b][/color] [color=blue] huy32 ...... driver unloaded successfully.[/color] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\TT\Menu Start\exp1orer.lnk C:\Documents and Settings\TT\Ulubione\exp1orer.lnk C:\WINDOWS\search_res.txt C:\WINDOWS\system32\huy32.sys . ((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 ))))))))))))))))))))))))))))))) . 2007-10-25 23:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-25 22:58 <DIR> d-------- C:\VundoFix Backups 2007-10-25 22:53 2,262 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-25 22:49 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-25 22:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-25 22:49 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-25 22:49 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-25 22:49 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-25 20:51 <DIR> d--hs---- C:\FOUND.076 2007-10-25 18:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-25 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-24 20:16 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-24 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-10-24 20:09 <DIR> d--hs---- C:\FOUND.075 2007-10-22 13:51 286,720 --a------ C:\WINDOWS\movctrlflm.dll 2007-10-22 13:51 286,720 --a------ C:\WINDOWS\bxsbang.dll 2007-10-22 13:51 107,520 --a------ C:\WINDOWS\kthemup.exe 2007-10-14 23:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-14 23:21 <DIR> d-------- C:\NVIDIA 2007-10-14 16:46 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-14 16:17 <DIR> d--hs---- C:\FOUND.074 2007-10-13 22:07 <DIR> d--hs---- C:\FOUND.073 2007-10-13 13:53 <DIR> d--hs---- C:\FOUND.072 2007-10-12 20:40 <DIR> d--hs---- C:\FOUND.071 2007-10-10 21:52 <DIR> d--hs---- C:\FOUND.070 2007-10-10 13:52 <DIR> d--hs---- C:\FOUND.069 2007-10-10 13:14 <DIR> dr-h----- C:\Documents and Settings\AfgaN\Dane aplikacji\SecuROM 2007-10-10 13:05 <DIR> d-------- C:\Documents and Settings\AfgaN\Stellarium 2007-10-10 12:45 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\Ventrilo 2007-10-09 20:38 <DIR> d-------- C:\Program Files\WinHarp95 2007-10-09 20:38 284,160 --a------ C:\WINDOWS\uninst.exe 2007-10-08 00:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\RFA_Backups 2007-10-07 23:51 <DIR> d-------- C:\Program Files\7-Zip 2007-10-07 23:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2007-10-04 20:26 <DIR> d--hs---- C:\FOUND.068 2007-10-03 13:23 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-09-25 19:14 <DIR> d--hs---- C:\FOUND.067 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 12:06 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-14 21:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-09-21 22:46 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-21 22:46 --------- d--h--r C:\Documents and Settings\TT\Dane aplikacji\SecuROM 2007-09-21 22:38 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\InstallShield 2007-09-14 16:19 --------- d-----w C:\Program Files\Picasa2 2007-09-13 21:40 --------- d-----w C:\Program Files\Wykresy 2007-09-08 00:00 --------- d-----w C:\Program Files\MegauploadToolbar 2007-09-08 00:00 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\MegauploadToolbar 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-03 22:15 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\vlc 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2007-07-26 02:53 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-07-26 02:53 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2006-11-18 18:56 492,896 ----a-w C:\Documents and Settings\TT\Install.exe 2006-01-31 12:48 14,976 ----a-w C:\Documents and Settings\TT\Device.dat 2006-09-15 14:00:20 61 --sh--w C:\WINDOWS\cnerolf.dat 2005-08-18 17:48:26 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2005-08-18 17:48:26 56 --sh--r C:\WINDOWS\system32\7A835BE76D.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC546B33-036A-41DA-B1CC-C1D15659520E}] 2007-10-22 11:07 286720 --a------ C:\WINDOWS\movctrlflm.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-05-12 00:34] "nwiz"="nwiz.exe" [2005-05-12 00:34 C:\WINDOWS\system32\nwiz.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "Ashampoo FireWall"="E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-05-12 00:34] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "bxsbang"= {E30C30C9-163F-43D3-8840-07AA95C82716} - C:\WINDOWS\bxsbang.dll [2007-10-22 11:07 286720] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^TT^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\TT\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRaidService] C:\WINDOWS\system32\nvraidservice.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "D:\Programy\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "d:\gry\steam\steam.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50613502-6260-11da-9cdb-000feaeed153}] AutoRun\command - G:\Autorun.exe *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-25 23:16:19 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-25 23:16:35 - machine was rebooted . --- E O F ---

A tutaj log z hijacka.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:19:59, on 2007-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\USB all-in-one game controller\SK_DevUpdate.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlflm.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: (no name) - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Ashampoo FireWall] "E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: SK_DevUpdate.lnk = C:\Program Files\USB all-in-one game controller\SK_DevUpdate.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - e:\Program Files\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - e:\Program Files\Hello\PicasaCapture.dll O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O21 - SSODL: bxsbang - {E30C30C9-163F-43D3-8840-07AA95C82716} - C:\WINDOWS\bxsbang.dll O21 - SSODL: ocgrep - {DD7A06E0-0FDA-4439-A461-C68060B3A89A} - (no file) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 6357 bytes

Pgrogramy o vundo nie znalazły go.

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 13:49

O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlflm.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - (no file)
O21 - SSODL: bxsbang - {E30C30C9-163F-43D3-8840-07AA95C82716} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {DD7A06E0-0FDA-4439-A461-C68060B3A89A} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

Uruchamiasz HijackThis => klikasz Do a system scan only => pokaże się lista wpisów => stawiasz ptaszek przy wpisach, które wymieniłem => klikasz Fix checked i potwierdzasz usunięcie.

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\movctrlflm.dll
C:\WINDOWS\bxsbang.dll
C:\WINDOWS\cnerolf.dat
C:\WINDOWS\kthemup.exe

Folder::
C:\FOUND.074
C:\FOUND.073
C:\FOUND.072
C:\FOUND.071
C:\FOUND.070
C:\FOUND.069
C:\FOUND.076
C:\FOUND.068
C:\FOUND.067
C:\FOUND.075

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

znasz to:

C:\Program Files\WinHarp95

jesli nie usuwasz pogrubiony folder do kosza

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka + log z combofixa

**Posty:** 29 · przez **AfgaN** 26 Paź 2007, 14:54

Gdy urchomiłem dzisiaj komputer privacy protection powrócił http://img508.imageshack.us/img508/5166/beztytuuvi6.jpg

Przy próbie fixowania hijack wiesza się.

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 14:56

to wykonaj reszte co mozesz i wroc z logami

**Posty:** 29 · przez **AfgaN** 26 Paź 2007, 16:14

Zrobiłem co mówiłeś przy użyciu Combofixa.

Kod: Zaznacz wszystko: ComboFix 07-10-25.4 - TT 2007-10-26 16:02:04.2 - [color=red][b]FAT32[/b][/color]x86 Running from: E:\ComboFix.exe Command switches used :: E:\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\bxsbang.dll C:\WINDOWS\cnerolf.dat C:\WINDOWS\kthemup.exe C:\WINDOWS\movctrlflm.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\FOUND.067 C:\FOUND.067\FILE0000.CHK C:\FOUND.068 C:\FOUND.068\FILE0000.CHK C:\FOUND.068\FILE0001.CHK C:\FOUND.068\FILE0002.CHK C:\FOUND.068\FILE0003.CHK C:\FOUND.068\FILE0004.CHK C:\FOUND.069 C:\FOUND.069\FILE0000.CHK C:\FOUND.069\FILE0001.CHK C:\FOUND.069\FILE0002.CHK C:\FOUND.070 C:\FOUND.070\FILE0000.CHK C:\FOUND.070\FILE0001.CHK C:\FOUND.070\FILE0002.CHK C:\FOUND.070\FILE0003.CHK C:\FOUND.070\FILE0004.CHK C:\FOUND.070\FILE0005.CHK C:\FOUND.070\FILE0006.CHK C:\FOUND.070\FILE0007.CHK C:\FOUND.070\FILE0008.CHK C:\FOUND.071 C:\FOUND.071\FILE0000.CHK C:\FOUND.071\FILE0001.CHK C:\FOUND.071\FILE0002.CHK C:\FOUND.071\FILE0003.CHK C:\FOUND.071\FILE0004.CHK C:\FOUND.071\FILE0005.CHK C:\FOUND.071\FILE0006.CHK C:\FOUND.071\FILE0007.CHK C:\FOUND.071\FILE0008.CHK C:\FOUND.071\FILE0009.CHK C:\FOUND.071\FILE0010.CHK C:\FOUND.071\FILE0011.CHK C:\FOUND.071\FILE0012.CHK C:\FOUND.071\FILE0013.CHK C:\FOUND.071\FILE0014.CHK C:\FOUND.071\FILE0015.CHK C:\FOUND.071\FILE0016.CHK C:\FOUND.071\FILE0017.CHK C:\FOUND.071\FILE0018.CHK C:\FOUND.071\FILE0019.CHK C:\FOUND.071\FILE0020.CHK C:\FOUND.071\FILE0021.CHK C:\FOUND.071\FILE0022.CHK C:\FOUND.071\FILE0023.CHK C:\FOUND.071\FILE0024.CHK C:\FOUND.071\FILE0025.CHK C:\FOUND.071\FILE0026.CHK C:\FOUND.071\FILE0027.CHK C:\FOUND.071\FILE0028.CHK C:\FOUND.071\FILE0029.CHK C:\FOUND.071\FILE0030.CHK C:\FOUND.071\FILE0031.CHK C:\FOUND.071\FILE0032.CHK C:\FOUND.071\FILE0033.CHK C:\FOUND.071\FILE0034.CHK C:\FOUND.071\FILE0035.CHK C:\FOUND.071\FILE0036.CHK C:\FOUND.071\FILE0037.CHK C:\FOUND.071\FILE0038.CHK C:\FOUND.071\FILE0039.CHK C:\FOUND.071\FILE0040.CHK C:\FOUND.071\FILE0041.CHK C:\FOUND.071\FILE0042.CHK C:\FOUND.071\FILE0043.CHK C:\FOUND.071\FILE0044.CHK C:\FOUND.071\FILE0045.CHK C:\FOUND.071\FILE0046.CHK C:\FOUND.071\FILE0047.CHK C:\FOUND.071\FILE0048.CHK C:\FOUND.071\FILE0049.CHK C:\FOUND.071\FILE0050.CHK C:\FOUND.071\FILE0051.CHK C:\FOUND.071\FILE0052.CHK C:\FOUND.071\FILE0053.CHK C:\FOUND.071\FILE0054.CHK C:\FOUND.071\FILE0055.CHK C:\FOUND.071\FILE0056.CHK C:\FOUND.071\FILE0057.CHK C:\FOUND.071\FILE0058.CHK C:\FOUND.071\FILE0059.CHK C:\FOUND.071\FILE0060.CHK C:\FOUND.071\FILE0061.CHK C:\FOUND.071\FILE0062.CHK C:\FOUND.071\FILE0063.CHK C:\FOUND.071\FILE0064.CHK C:\FOUND.071\FILE0065.CHK C:\FOUND.071\FILE0066.CHK C:\FOUND.071\FILE0067.CHK C:\FOUND.071\FILE0068.CHK C:\FOUND.071\FILE0069.CHK C:\FOUND.071\FILE0070.CHK C:\FOUND.071\FILE0071.CHK C:\FOUND.071\FILE0072.CHK C:\FOUND.071\FILE0073.CHK C:\FOUND.071\FILE0074.CHK C:\FOUND.071\FILE0075.CHK C:\FOUND.071\FILE0076.CHK C:\FOUND.071\FILE0077.CHK C:\FOUND.071\FILE0078.CHK C:\FOUND.071\FILE0079.CHK C:\FOUND.071\FILE0080.CHK C:\FOUND.071\FILE0081.CHK C:\FOUND.071\FILE0082.CHK C:\FOUND.071\FILE0083.CHK C:\FOUND.071\FILE0084.CHK C:\FOUND.071\FILE0085.CHK C:\FOUND.071\FILE0086.CHK C:\FOUND.071\FILE0087.CHK C:\FOUND.071\FILE0088.CHK C:\FOUND.071\FILE0089.CHK C:\FOUND.071\FILE0090.CHK C:\FOUND.071\FILE0091.CHK C:\FOUND.071\FILE0092.CHK C:\FOUND.071\FILE0093.CHK C:\FOUND.071\FILE0094.CHK C:\FOUND.071\FILE0095.CHK C:\FOUND.071\FILE0096.CHK C:\FOUND.071\FILE0097.CHK C:\FOUND.071\FILE0098.CHK C:\FOUND.071\FILE0099.CHK C:\FOUND.071\FILE0100.CHK C:\FOUND.071\FILE0101.CHK C:\FOUND.071\FILE0102.CHK C:\FOUND.071\FILE0103.CHK C:\FOUND.071\FILE0104.CHK C:\FOUND.071\FILE0105.CHK C:\FOUND.071\FILE0106.CHK C:\FOUND.071\FILE0107.CHK C:\FOUND.071\FILE0108.CHK C:\FOUND.071\FILE0109.CHK C:\FOUND.071\FILE0110.CHK C:\FOUND.071\FILE0111.CHK C:\FOUND.071\FILE0112.CHK C:\FOUND.071\FILE0113.CHK C:\FOUND.071\FILE0114.CHK C:\FOUND.071\FILE0115.CHK C:\FOUND.071\FILE0116.CHK C:\FOUND.071\FILE0117.CHK C:\FOUND.071\FILE0118.CHK C:\FOUND.071\FILE0119.CHK C:\FOUND.071\FILE0120.CHK C:\FOUND.071\FILE0121.CHK C:\FOUND.071\FILE0122.CHK C:\FOUND.071\FILE0123.CHK C:\FOUND.071\FILE0124.CHK C:\FOUND.071\FILE0125.CHK C:\FOUND.071\FILE0126.CHK C:\FOUND.071\FILE0127.CHK C:\FOUND.071\FILE0128.CHK C:\FOUND.071\FILE0129.CHK C:\FOUND.071\FILE0130.CHK C:\FOUND.071\FILE0131.CHK C:\FOUND.071\FILE0132.CHK C:\FOUND.071\FILE0133.CHK C:\FOUND.071\FILE0134.CHK C:\FOUND.071\FILE0135.CHK C:\FOUND.071\FILE0136.CHK C:\FOUND.071\FILE0137.CHK C:\FOUND.071\FILE0138.CHK C:\FOUND.071\FILE0139.CHK C:\FOUND.071\FILE0140.CHK C:\FOUND.071\FILE0141.CHK C:\FOUND.071\FILE0142.CHK C:\FOUND.071\FILE0143.CHK C:\FOUND.071\FILE0144.CHK C:\FOUND.071\FILE0145.CHK C:\FOUND.071\FILE0146.CHK C:\FOUND.071\FILE0147.CHK C:\FOUND.071\FILE0148.CHK C:\FOUND.071\FILE0149.CHK C:\FOUND.071\FILE0150.CHK C:\FOUND.071\FILE0151.CHK C:\FOUND.071\FILE0152.CHK C:\FOUND.071\FILE0153.CHK C:\FOUND.071\FILE0154.CHK C:\FOUND.071\FILE0155.CHK C:\FOUND.071\FILE0156.CHK C:\FOUND.071\FILE0157.CHK C:\FOUND.071\FILE0158.CHK C:\FOUND.071\FILE0159.CHK C:\FOUND.071\FILE0160.CHK C:\FOUND.071\FILE0161.CHK C:\FOUND.071\FILE0162.CHK C:\FOUND.071\FILE0163.CHK C:\FOUND.071\FILE0164.CHK C:\FOUND.071\FILE0165.CHK C:\FOUND.071\FILE0166.CHK C:\FOUND.071\FILE0167.CHK C:\FOUND.071\FILE0168.CHK C:\FOUND.071\FILE0169.CHK C:\FOUND.071\FILE0170.CHK C:\FOUND.071\FILE0171.CHK C:\FOUND.071\FILE0172.CHK C:\FOUND.071\FILE0173.CHK C:\FOUND.071\FILE0174.CHK C:\FOUND.071\FILE0175.CHK C:\FOUND.071\FILE0176.CHK C:\FOUND.071\FILE0177.CHK C:\FOUND.071\FILE0178.CHK C:\FOUND.071\FILE0179.CHK C:\FOUND.071\FILE0180.CHK C:\FOUND.071\FILE0181.CHK C:\FOUND.071\FILE0182.CHK C:\FOUND.071\FILE0183.CHK C:\FOUND.071\FILE0184.CHK C:\FOUND.071\FILE0185.CHK C:\FOUND.071\FILE0186.CHK C:\FOUND.071\FILE0187.CHK C:\FOUND.071\FILE0188.CHK C:\FOUND.071\FILE0189.CHK C:\FOUND.071\FILE0190.CHK C:\FOUND.071\FILE0191.CHK C:\FOUND.071\FILE0192.CHK C:\FOUND.071\FILE0193.CHK C:\FOUND.071\FILE0194.CHK C:\FOUND.071\FILE0195.CHK C:\FOUND.071\FILE0196.CHK C:\FOUND.071\FILE0197.CHK C:\FOUND.071\FILE0198.CHK C:\FOUND.071\FILE0199.CHK C:\FOUND.071\FILE0200.CHK C:\FOUND.071\FILE0201.CHK C:\FOUND.071\FILE0202.CHK C:\FOUND.071\FILE0203.CHK C:\FOUND.071\FILE0204.CHK C:\FOUND.071\FILE0205.CHK C:\FOUND.071\FILE0206.CHK C:\FOUND.071\FILE0207.CHK C:\FOUND.071\FILE0208.CHK C:\FOUND.071\FILE0209.CHK C:\FOUND.071\FILE0210.CHK C:\FOUND.071\FILE0211.CHK C:\FOUND.071\FILE0212.CHK C:\FOUND.071\FILE0213.CHK C:\FOUND.071\FILE0214.CHK C:\FOUND.071\FILE0215.CHK C:\FOUND.071\FILE0216.CHK C:\FOUND.071\FILE0217.CHK C:\FOUND.071\FILE0218.CHK C:\FOUND.071\FILE0219.CHK C:\FOUND.071\FILE0220.CHK C:\FOUND.071\FILE0221.CHK C:\FOUND.071\FILE0222.CHK C:\FOUND.071\FILE0223.CHK C:\FOUND.071\FILE0224.CHK C:\FOUND.071\FILE0225.CHK C:\FOUND.071\FILE0226.CHK C:\FOUND.071\FILE0227.CHK C:\FOUND.071\FILE0228.CHK C:\FOUND.071\FILE0229.CHK C:\FOUND.071\FILE0230.CHK C:\FOUND.071\FILE0231.CHK C:\FOUND.071\FILE0232.CHK C:\FOUND.071\FILE0233.CHK C:\FOUND.071\FILE0234.CHK C:\FOUND.071\FILE0235.CHK C:\FOUND.071\FILE0236.CHK C:\FOUND.071\FILE0237.CHK C:\FOUND.071\FILE0238.CHK C:\FOUND.071\FILE0239.CHK C:\FOUND.071\FILE0240.CHK C:\FOUND.071\FILE0241.CHK C:\FOUND.071\FILE0242.CHK C:\FOUND.071\FILE0243.CHK C:\FOUND.071\FILE0244.CHK C:\FOUND.071\FILE0245.CHK C:\FOUND.071\FILE0246.CHK C:\FOUND.071\FILE0247.CHK C:\FOUND.071\FILE0248.CHK C:\FOUND.071\FILE0249.CHK C:\FOUND.071\FILE0250.CHK C:\FOUND.071\FILE0251.CHK C:\FOUND.071\FILE0252.CHK C:\FOUND.071\FILE0253.CHK C:\FOUND.071\FILE0254.CHK C:\FOUND.071\FILE0255.CHK C:\FOUND.071\FILE0256.CHK C:\FOUND.071\FILE0257.CHK C:\FOUND.071\FILE0258.CHK C:\FOUND.071\FILE0259.CHK C:\FOUND.071\FILE0260.CHK C:\FOUND.071\FILE0261.CHK C:\FOUND.071\FILE0262.CHK C:\FOUND.071\FILE0263.CHK C:\FOUND.071\FILE0264.CHK C:\FOUND.071\FILE0265.CHK C:\FOUND.071\FILE0266.CHK C:\FOUND.071\FILE0267.CHK C:\FOUND.071\FILE0268.CHK C:\FOUND.071\FILE0269.CHK C:\FOUND.071\FILE0270.CHK C:\FOUND.071\FILE0271.CHK C:\FOUND.071\FILE0272.CHK C:\FOUND.071\FILE0273.CHK C:\FOUND.071\FILE0274.CHK C:\FOUND.071\FILE0275.CHK C:\FOUND.071\FILE0276.CHK C:\FOUND.071\FILE0277.CHK C:\FOUND.071\FILE0278.CHK C:\FOUND.071\FILE0279.CHK C:\FOUND.071\FILE0280.CHK C:\FOUND.071\FILE0281.CHK C:\FOUND.071\FILE0282.CHK C:\FOUND.071\FILE0283.CHK C:\FOUND.071\FILE0284.CHK C:\FOUND.071\FILE0285.CHK C:\FOUND.071\FILE0286.CHK C:\FOUND.071\FILE0287.CHK C:\FOUND.071\FILE0288.CHK C:\FOUND.071\FILE0289.CHK C:\FOUND.071\FILE0290.CHK C:\FOUND.071\FILE0291.CHK C:\FOUND.071\FILE0292.CHK C:\FOUND.071\FILE0293.CHK C:\FOUND.071\FILE0294.CHK C:\FOUND.071\FILE0295.CHK C:\FOUND.071\FILE0296.CHK C:\FOUND.071\FILE0297.CHK C:\FOUND.071\FILE0298.CHK C:\FOUND.071\FILE0299.CHK C:\FOUND.071\FILE0300.CHK C:\FOUND.071\FILE0301.CHK C:\FOUND.071\FILE0302.CHK C:\FOUND.071\FILE0303.CHK C:\FOUND.071\FILE0304.CHK C:\FOUND.071\FILE0305.CHK C:\FOUND.071\FILE0306.CHK C:\FOUND.071\FILE0307.CHK C:\FOUND.071\FILE0308.CHK C:\FOUND.071\FILE0309.CHK C:\FOUND.071\FILE0310.CHK C:\FOUND.071\FILE0311.CHK C:\FOUND.071\FILE0312.CHK C:\FOUND.071\FILE0313.CHK C:\FOUND.071\FILE0314.CHK C:\FOUND.071\FILE0315.CHK C:\FOUND.071\FILE0316.CHK C:\FOUND.071\FILE0317.CHK C:\FOUND.071\FILE0318.CHK C:\FOUND.071\FILE0319.CHK C:\FOUND.071\FILE0320.CHK C:\FOUND.071\FILE0321.CHK C:\FOUND.071\FILE0322.CHK C:\FOUND.071\FILE0323.CHK C:\FOUND.071\FILE0324.CHK C:\FOUND.071\FILE0325.CHK C:\FOUND.071\FILE0326.CHK C:\FOUND.071\FILE0327.CHK C:\FOUND.071\FILE0328.CHK C:\FOUND.071\FILE0329.CHK C:\FOUND.071\FILE0330.CHK C:\FOUND.071\FILE0331.CHK C:\FOUND.071\FILE0332.CHK C:\FOUND.071\FILE0333.CHK C:\FOUND.071\FILE0334.CHK C:\FOUND.071\FILE0335.CHK C:\FOUND.071\FILE0336.CHK C:\FOUND.071\FILE0337.CHK C:\FOUND.072 C:\FOUND.072\FILE0000.CHK C:\FOUND.072\FILE0001.CHK C:\FOUND.072\FILE0002.CHK C:\FOUND.072\FILE0003.CHK C:\FOUND.072\FILE0004.CHK C:\FOUND.072\FILE0005.CHK C:\FOUND.073 C:\FOUND.073\FILE0000.CHK C:\FOUND.073\FILE0001.CHK C:\FOUND.073\FILE0002.CHK C:\FOUND.073\FILE0003.CHK C:\FOUND.073\FILE0004.CHK C:\FOUND.073\FILE0005.CHK C:\FOUND.073\FILE0006.CHK C:\FOUND.074 C:\FOUND.074\FILE0000.CHK C:\FOUND.075 C:\FOUND.075\FILE0000.CHK C:\FOUND.075\FILE0001.CHK C:\FOUND.075\FILE0002.CHK C:\FOUND.075\FILE0003.CHK C:\FOUND.075\FILE0004.CHK C:\FOUND.075\FILE0005.CHK C:\FOUND.075\FILE0006.CHK C:\FOUND.075\FILE0007.CHK C:\FOUND.075\FILE0008.CHK C:\FOUND.075\FILE0009.CHK C:\FOUND.075\FILE0010.CHK C:\FOUND.075\FILE0011.CHK C:\FOUND.075\FILE0012.CHK C:\FOUND.075\FILE0013.CHK C:\FOUND.075\FILE0014.CHK C:\FOUND.075\FILE0015.CHK C:\FOUND.076 C:\FOUND.076\FILE0000.CHK C:\FOUND.076\FILE0001.CHK C:\FOUND.076\FILE0002.CHK C:\FOUND.076\FILE0003.CHK C:\WINDOWS\bxsbang.dll C:\WINDOWS\cnerolf.dat C:\WINDOWS\kthemup.exe C:\WINDOWS\movctrlflm.dll C:\WINDOWS\search_res.txt . ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 ))))))))))))))))))))))))))))))) . 2007-10-26 13:14 <DIR> d--hs---- C:\FOUND.079 2007-10-26 12:40 <DIR> d--hs---- C:\FOUND.078 2007-10-26 12:18 <DIR> d--hs---- C:\FOUND.077 2007-10-25 23:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-25 22:58 <DIR> d-------- C:\VundoFix Backups 2007-10-25 22:53 2,262 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-25 22:49 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-25 22:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-25 22:49 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-25 22:49 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-25 22:49 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-25 18:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-25 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-24 20:16 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-24 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-10-14 23:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-14 23:21 <DIR> d-------- C:\NVIDIA 2007-10-14 16:46 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-10 13:14 <DIR> dr-h----- C:\Documents and Settings\AfgaN\Dane aplikacji\SecuROM 2007-10-10 13:05 <DIR> d-------- C:\Documents and Settings\AfgaN\Stellarium 2007-10-10 12:45 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\Ventrilo 2007-10-09 20:38 <DIR> d-------- C:\Program Files\WinHarp95 2007-10-09 20:38 284,160 --a------ C:\WINDOWS\uninst.exe 2007-10-08 00:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\RFA_Backups 2007-10-07 23:51 <DIR> d-------- C:\Program Files\7-Zip 2007-10-07 23:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2007-10-03 13:23 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\MEGAUPLOADTOOLBAR . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 12:06 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-14 21:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-09-21 22:46 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-21 22:46 --------- d--h--r C:\Documents and Settings\TT\Dane aplikacji\SecuROM 2007-09-21 22:38 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\InstallShield 2007-09-14 16:19 --------- d-----w C:\Program Files\Picasa2 2007-09-13 21:40 --------- d-----w C:\Program Files\Wykresy 2007-09-08 00:00 --------- d-----w C:\Program Files\MegauploadToolbar 2007-09-08 00:00 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\MegauploadToolbar 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-03 22:15 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\vlc 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2007-07-26 02:53 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-07-26 02:53 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2006-11-18 18:56 492,896 ----a-w C:\Documents and Settings\TT\Install.exe 2006-01-31 12:48 14,976 ----a-w C:\Documents and Settings\TT\Device.dat 2005-08-18 17:48:26 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2005-08-18 17:48:26 56 --sh--r C:\WINDOWS\system32\7A835BE76D.sys . ((((((((((((((((((((((((((((( snapshot@2007-10-25_23.16.20.68 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 08:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-10-26 14:05:44 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_664.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-05-12 00:34] "nwiz"="nwiz.exe" [2005-05-12 00:34 C:\WINDOWS\system32\nwiz.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "Ashampoo FireWall"="E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-05-12 00:34] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "bxsbang"= {E30C30C9-163F-43D3-8840-07AA95C82716} - C:\WINDOWS\bxsbang.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^TT^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\TT\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRaidService] C:\WINDOWS\system32\nvraidservice.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "D:\Programy\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "d:\gry\steam\steam.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50613502-6260-11da-9cdb-000feaeed153}] AutoRun\command - G:\Autorun.exe . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-26 16:06:13 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-26 16:06:48 - machine was rebooted C:\ComboFix2.txt ... 2007-10-25 23:16 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 16:22

Otworz notatnik i wklej w nim to:

Folder::
C:\FOUND.079
C:\FOUND.078
C:\FOUND.077

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bxsbang"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50613502-6260-11da-9cdb-000feaeed153}]

i upuszczasz na ikonke combofixa

prosze powiedziec czy znane jest Ci to:

C:\Program Files\WinHarp95

jesli nie usuwasz pogrubiony do kosza

te pliki:

C:\Documents and Settings\TT\Install.exe
C:\Documents and Settings\TT\Device.dat

przeskanuj na tych stronach

http://virusscan.jotti.org/
http://www.virustotal.com/

pytanko wykonales zadanie z SdFixem?

jesli tak to wejdz do folderu SDFix'a wrzuc zawartość pliku Report.txt raporty ze skanow, nowe logi na forum

**Posty:** 29 · przez **AfgaN** 26 Paź 2007, 16:28

Właśnie miałem napisać, z SDFixem nie bardzo bo nie daj mi się uruchomić tryb awaryjny. Podczas uruchamiania pceta wciskam f8 i nic.

Winharp95 jest mi znany, to taka stara już bardzo gierka

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 16:35

Użyj narzędzia BootSafe zaznacz opcje Safe Mode- Networking i kliknij reboot . bedziesz po restarcie w trybie awaryjnym i wykonasz dalsza czesc instrukcji

**Posty:** 29 · przez **AfgaN** 26 Paź 2007, 19:15

Raport z combofixa

Kod: Zaznacz wszystko: ComboFix 07-10-25.4 - TT 2007-10-26 19:03:40.3 - [color=red][b]FAT32[/b][/color]x86 Running from: E:\ComboFix.exe Command switches used :: E:\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\FOUND.077 C:\FOUND.077\FILE0000.CHK C:\FOUND.077\FILE0001.CHK C:\FOUND.078 C:\FOUND.078\FILE0000.CHK C:\FOUND.078\FILE0001.CHK C:\FOUND.078\FILE0002.CHK C:\FOUND.078\FILE0003.CHK C:\FOUND.078\FILE0004.CHK C:\FOUND.078\FILE0005.CHK C:\FOUND.078\FILE0006.CHK C:\FOUND.078\FILE0007.CHK C:\FOUND.078\FILE0008.CHK C:\FOUND.078\FILE0009.CHK C:\FOUND.079 C:\FOUND.079\FILE0000.CHK C:\FOUND.079\FILE0001.CHK . ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 ))))))))))))))))))))))))))))))) . 2007-10-26 18:30 <DIR> d--hs---- C:\FOUND.067 2007-10-25 23:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-25 22:58 <DIR> d-------- C:\VundoFix Backups 2007-10-25 22:53 2,262 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-25 22:49 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-25 22:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-25 22:49 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-25 22:49 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-25 22:49 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-25 18:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-25 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-24 20:16 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-24 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-10-14 23:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-14 23:21 <DIR> d-------- C:\NVIDIA 2007-10-14 16:46 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-10 13:14 <DIR> dr-h----- C:\Documents and Settings\AfgaN\Dane aplikacji\SecuROM 2007-10-10 13:05 <DIR> d-------- C:\Documents and Settings\AfgaN\Stellarium 2007-10-10 12:45 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\Ventrilo 2007-10-09 20:38 <DIR> d-------- C:\Program Files\WinHarp95 2007-10-09 20:38 284,160 --a------ C:\WINDOWS\uninst.exe 2007-10-08 00:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\RFA_Backups 2007-10-07 23:51 <DIR> d-------- C:\Program Files\7-Zip 2007-10-07 23:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2007-10-03 13:23 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\MEGAUPLOADTOOLBAR . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 12:06 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-14 21:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-09-21 22:46 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-21 22:46 --------- d--h--r C:\Documents and Settings\TT\Dane aplikacji\SecuROM 2007-09-21 22:38 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\InstallShield 2007-09-14 16:19 --------- d-----w C:\Program Files\Picasa2 2007-09-13 21:40 --------- d-----w C:\Program Files\Wykresy 2007-09-08 00:00 --------- d-----w C:\Program Files\MegauploadToolbar 2007-09-08 00:00 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\MegauploadToolbar 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-03 22:15 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\vlc 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2007-07-26 02:53 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-07-26 02:53 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2006-11-18 18:56 492,896 ----a-w C:\Documents and Settings\TT\Install.exe 2006-01-31 12:48 14,976 ----a-w C:\Documents and Settings\TT\Device.dat 2005-08-18 17:48:26 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2005-08-18 17:48:26 56 --sh--r C:\WINDOWS\system32\7A835BE76D.sys . ((((((((((((((((((((((((((((( snapshot@2007-10-25_23.16.20.68 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 08:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-09-11 18:57:10 188,028 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat + 2007-09-11 18:57:10 188,028 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat.bak + 2007-10-26 16:42:02 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_5b0.dat + 2007-10-26 16:30:42 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_654.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-05-12 00:34] "nwiz"="nwiz.exe" [2005-05-12 00:34 C:\WINDOWS\system32\nwiz.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "Ashampoo FireWall"="E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-05-12 00:34] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^TT^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\TT\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRaidService] C:\WINDOWS\system32\nvraidservice.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "D:\Programy\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "d:\gry\steam\steam.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-26 19:04:54 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-26 19:05:13 C:\ComboFix2.txt ... 2007-10-26 16:06 C:\ComboFix3.txt ... 2007-10-25 23:16 . --- E O F ---

Skany obu plików na obydwu stronach niczego nie wykazały, zaraz wykonam SDFixa i wrzuce reszte logów.
Nie wiem czemu, ale wchodząc na forum wyskakuje mi okienko "Polecamy Erotyczna Strona:

* 62 Filmy Erotyczne! (2,5 GB)

* Ponad 5000 zdjec Erotycznych

* Mnostwo Gier Erotycznych", używam opery jak coś.
Log z SDFix

Kod: Zaznacz wszystko: SDFix: Version 1.112 Run by Administrator on 2007-10-26 at 19:18 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default HomePage Value Restoring Default Desktop Components Value Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Thu 18 Aug 2005 1,682 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Thu 18 Aug 2005 56 ..SHR --- "C:\WINDOWS\system32\7A835BE76D.sys" Tue 24 Jan 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 26 Oct 2007 393,538 A..H. --- "C:\Documents and Settings\TT\Ustawienia lokalne\Temp\BITBC.tmp" Wed 28 Sep 2005 21 A..H. --- "C:\Documents and Settings\TT\Dane aplikacji\Kazaa Lite\db\np.tmp" Sun 14 Oct 2007 444 ...HR --- "C:\Documents and Settings\TT\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Wed 10 Oct 2007 444 ...HR --- "C:\Documents and Settings\AfgaN\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Finished!

Log z hijacka.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:27:28, on 2007-10-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\USB all-in-one game controller\SK_DevUpdate.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Ashampoo FireWall] "E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: SK_DevUpdate.lnk = C:\Program Files\USB all-in-one game controller\SK_DevUpdate.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - e:\Program Files\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - e:\Program Files\Hello\PicasaCapture.dll O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 5991 bytes

Spybot search & destroy wykrył mi "ważny wpis rejestru któren został zmieniony"
Kategoria: NT startup
Zmiana: Wartości usunięte
Wpis: load
Pyta czy zezwolić na zmiane.
Zezwoliłem bo nie wiedziałem co zrobić.
Teraz log z combofixa.

Kod: Zaznacz wszystko: ComboFix 07-10-26.4 - TT 2007-10-26 19:32:30.4 - [color=red][b]FAT32[/b][/color]x86 Running from: E:\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 ))))))))))))))))))))))))))))))) . 2007-10-26 19:18 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-26 19:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-26 19:17 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-10-26 19:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-10-26 19:17 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-10-26 19:17 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-10-26 19:17 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-10-26 19:17 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-10-26 18:30 <DIR> d--hs---- C:\FOUND.067 2007-10-25 23:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-25 22:53 2,262 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-25 22:49 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-25 22:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-25 22:49 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-25 22:49 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-25 22:49 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-25 18:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-25 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-24 20:16 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-24 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-10-14 23:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-14 23:21 <DIR> d-------- C:\NVIDIA 2007-10-14 16:46 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-10 13:14 <DIR> dr-h----- C:\Documents and Settings\AfgaN\Dane aplikacji\SecuROM 2007-10-10 13:05 <DIR> d-------- C:\Documents and Settings\AfgaN\Stellarium 2007-10-10 12:45 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\Ventrilo 2007-10-09 20:38 <DIR> d-------- C:\Program Files\WinHarp95 2007-10-09 20:38 284,160 --a------ C:\WINDOWS\uninst.exe 2007-10-08 00:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\RFA_Backups 2007-10-07 23:51 <DIR> d-------- C:\Program Files\7-Zip 2007-10-07 23:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2007-10-03 13:23 <DIR> d-------- C:\Documents and Settings\AfgaN\Dane aplikacji\MEGAUPLOADTOOLBAR . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 12:06 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-14 21:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-09-21 22:46 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-21 22:46 --------- d--h--r C:\Documents and Settings\TT\Dane aplikacji\SecuROM 2007-09-21 22:38 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\InstallShield 2007-09-14 16:19 --------- d-----w C:\Program Files\Picasa2 2007-09-13 21:40 --------- d-----w C:\Program Files\Wykresy 2007-09-08 00:00 --------- d-----w C:\Program Files\MegauploadToolbar 2007-09-08 00:00 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\MegauploadToolbar 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-03 22:15 --------- d-----w C:\Documents and Settings\TT\Dane aplikacji\vlc 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2007-07-26 02:53 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-07-26 02:53 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2006-11-18 18:56 492,896 ----a-w C:\Documents and Settings\TT\Install.exe 2006-01-31 12:48 14,976 ----a-w C:\Documents and Settings\TT\Device.dat 2005-08-18 17:48:26 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2005-08-18 17:48:26 56 --sh--r C:\WINDOWS\system32\7A835BE76D.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-05-12 00:34] "nwiz"="nwiz.exe" [2005-05-12 00:34 C:\WINDOWS\system32\nwiz.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "Ashampoo FireWall"="E:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-05-12 00:34] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^TT^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\TT\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRaidService] C:\WINDOWS\system32\nvraidservice.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "D:\Programy\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "d:\gry\steam\steam.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-26 19:33:40 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-26 19:34:01 C:\ComboFix3.txt ... 2007-10-26 16:06 C:\ComboFix2.txt ... 2007-10-26 19:05 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 19:34

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

skasuj te wpisy . nic w logu po za tym nie widac

AfgaN napisał(a):Pyta czy zezwolić na zmiane.

tak

**Posty:** 29 · przez **AfgaN** 26 Paź 2007, 19:46

Nie da rady, jak próbuję usunąć hijackiem to się zawiesz program, poza tym zaczyna przerywać mi internet - pisze że nie może znaleźć zdalnego serwera, nie wiem czy to problem sprzętowy czy coś się sypie.

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 21:05

daj loga z silent runners:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 29 · przez **AfgaN** 27 Paź 2007, 00:29

Jak wchodze na to forum to wyskakuje mi okienko:

"Polecamy Erotyczna Strona:

* 62 Filmy Erotyczne! (2,5 GB)

* Ponad 5000 zdjec Erotycznych

* Mnostwo Gier Erotycznych"
Tak ma być?(używam opery jakby coś)

Pobrałem silentrunners, ale nie idzie go odpalić. Przy próbie wyskakuje komunikat:
"SilentRunners cannot acces file services critical to proper script operation.
If you are running windows xp, make sure that the "cryptographic services" service is started.
You can also try reinstaling the latest version of the MS Windows Script Host.
Press ok to direct your browser to the download site or cancel to quit"

**Posty:** 18165 · przez **wojtas** 27 Paź 2007, 11:58

AfgaN napisał(a):Tak ma być?

jest to reklama z ktorej forum sie utrzymuje. w logach nic nie widac zeby byla jakas infekcja

**Posty:** 29 · przez **AfgaN** 27 Paź 2007, 12:44

Dzięki za pomoc, sprawa załatwiona.

[log] privacy protection , proszę o sprawdzenie loga

[log] privacy protection , proszę o sprawdzenie loga

Kto jest na forum