[log] problem z uruchamiename programow

**Posty:** 13 · przez **Zollek** 12 Sie 2008, 14:24

Witam mam problem od jakiegoś czasu programy które wcześniej działały nagle przestały a podczas uruchamiana pojawia się komunikat ze nie da się odczytać z pamięci.
Proszę o pomoc.

Combofix

Kod: Zaznacz wszystko: ComboFix 08-08-11.01 - Zollek 2008-08-12 14:08:39.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1073 [GMT 2:00] Running from: E:\MuzykaLato\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM47358e8c.txt C:\WINDOWS\pskt.ini C:\WINDOWS\system32\bsndcom.dll C:\WINDOWS\system32\CID C:\WINDOWS\system32\SvcNm C:\WINDOWS\system32\url1 C:\WINDOWS\system32\url2 C:\WINDOWS\system32\url3 . ((((((((((((((((((((((((( Files Created from 2008-07-12 to 2008-08-12 ))))))))))))))))))))))))))))))) . 2008-08-10 22:31 . 2008-08-10 22:31 <DIR> d-------- C:\Program Files\OpenAL 2008-08-10 22:31 . 2008-08-10 22:31 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-10 22:31 . 2008-08-10 22:31 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-10 22:30 . 2008-08-10 23:09 <DIR> d-------- C:\Program Files\Puzzle Quest 2008-08-08 19:41 . 2007-09-27 14:46 48,896 --a------ C:\WINDOWS\system32\drivers\JmtFltr.sys 2008-08-08 19:41 . 2005-12-22 03:23 14,592 --a------ C:\WINDOWS\system32\drivers\USBICP.sys 2008-08-08 19:40 . 2008-08-08 19:41 <DIR> d-------- C:\Program Files\n52te 2008-08-08 19:40 . 2007-12-06 15:16 49,152 --a------ C:\WINDOWS\system32\Jomantha.cpl 2008-08-08 13:38 . 2008-08-08 13:38 <DIR> d-------- C:\Program Files\DIFX 2008-08-08 13:37 . 2007-09-19 17:01 12,672 --a------ C:\WINDOWS\system32\drivers\vhidmini.sys 2008-08-07 20:46 . 2008-08-07 20:57 256,512 --a------ C:\oferta_b2.xls 2008-07-29 18:42 . 2008-07-29 18:42 <DIR> d-------- C:\Program Files\Azure Gaming 2008-07-29 18:31 . 2008-07-29 18:31 <DIR> d-------- C:\Documents and Settings\Zollek\Dane aplikacji\InstallShield 2008-07-29 18:30 . 2006-02-04 04:50 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd 2008-07-29 18:30 . 2006-02-04 04:50 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2008-07-24 12:22 . 2008-07-24 12:22 <DIR> d-------- C:\Program Files\Atomic RAR Password Recovery 2008-07-24 12:08 . 2008-07-24 12:08 <DIR> d-------- C:\Program Files\Intelore 2008-07-24 09:09 . 2008-07-24 09:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-24 09:09 . 2008-07-24 09:09 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-15 17:07 . 2008-08-10 23:21 <DIR> d-------- C:\Program Files\Warcraft III . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-11 21:34 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\Hamachi 2008-08-11 14:33 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-11 13:55 --------- d-----w C:\Program Files\Spyware Doctor 2008-08-11 13:51 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-30 11:00 --------- d-----w C:\Program Files\mIRC 2008-07-23 15:51 --------- d-----w C:\Program Files\FlashGet 2008-07-22 19:36 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\teamspeak2 2008-07-09 16:42 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\Radmin 2008-07-09 12:32 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\uTorrent 2008-06-30 19:18 --------- d-----w C:\Program Files\Ontrack 2008-06-30 19:17 --------- d-----w C:\Program Files\Sonic Foundry 2008-06-30 16:23 --------- d-----w C:\Program Files\TC PowerPack 2008-06-29 18:13 --------- d-----w C:\Program Files\Trend Micro 2008-06-29 17:57 --------- d-----w C:\Program Files\Realtek AC97 2008-06-29 14:12 --------- d-----w C:\Program Files\Alwil Software 2008-06-29 13:47 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\PC Tools 2008-06-28 11:04 --------- d-----w C:\Program Files\Red Storm Entertainment 2008-06-27 11:37 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-06-27 10:00 314,368 ----a-w C:\WINDOWS\KSGDeInstall.exe 2008-06-26 20:09 --------- d-----w C:\Program Files\DOSBox-0.72 2008-06-16 08:09 --------- d-----w C:\Program Files\Silvercrest MTS2118 driver 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-25 19:41 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2008-05-25 19:41 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2008-05-25 19:41 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-02-01 17:45 98304] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:23 221568] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2006-01-12 16:40 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-12-05 01:41 8523776] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-12-05 01:41 81920] "Jomantha"="C:\Program Files\n52te\razerhid.exe" [2007-12-12 11:58 163840] "SoundMan"="SOUNDMAN.EXE" [2005-07-22 09:00 81920 C:\WINDOWS\SOUNDMAN.EXE] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ZMBV"= zmbv.dll "VIDC.XFR1"= xfcodec.dll "VIDC.YV12"= yv12vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "E:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"= "C:\\Program Files\\uTorrent\\utorrent.exe"= R1 aswsp;avast! Self Protection;C:\WINDOWS\system32\drivers\aswsp.sys [2008-05-16 01:20] R2 aswfsblk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R3 JmtFltr;n52te;C:\WINDOWS\system32\Drivers\JmtFltr.sys [2007-09-27 14:46] R3 vhidmini;Virtual Hid Device;C:\WINDOWS\system32\DRIVERS\vhidmini.sys [2007-09-19 17:01] S2 DHNB;Security Service;C:\WINDOWS\System32\svcd\svchost.exe [] S3 dump_wmimmc;dump_wmimmc;G:\Lineage II\system\GameGuard\dump_wmimmc.sys [] S3 mirrorv3;mirrorv3;C:\WINDOWS\system32\DRIVERS\rminiv3.sys [2006-11-01 05:01] S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys [2005-12-22 03:23] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc27be5b-6473-11dd-9341-0013d39ff00d}] \Shell\AutoRun\command - H:\software.exe *Newly Created Service* - CATCHME . - - - - ORPHANS REMOVED - - - - HKCU-Run-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe HKLM-Run-ISUSPM Startup - C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe HKLM-Run-AASecuUFD - (no file) Notify-AtiExtEvent - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Zollek\Dane aplikacji\Mozilla\Firefox\Profiles\rmwroc1h.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.onet.pl/ FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-12 14:13:41 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-08-12 14:17:43 ComboFix-quarantined-files.txt 2008-08-12 12:16:40 ComboFix2.txt 2008-06-29 19:41:26 Pre-Run: 1,770,717,184 bajtów wolnych Post-Run: 1,850,859,520 bajtów wolnych 142 --- E O F --- 2008-07-05 01:53:35

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:23:03, on 2008-08-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\n52te\razerhid.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\n52te\razertra.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Jomantha] C:\Program Files\n52te\razerhid.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.msi.com.tw O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS1\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS2\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS3\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Security Service (DHNB) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: USBest Service Zero (UTSCSI) - Unknown owner - C:\WINDOWS\System32\UTSCSI.EXE -- End of file - 6926 bytes

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 14:28

wklej w notatnik

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc27be5b-6473-11dd-9341-0013d39ff00d}]

zapisz jako fix.reg i odpal

Kod: Zaznacz wszystko: O23 - Service: Security Service (DHNB) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe (file missing)

to fixujesz w hj

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 13 · przez **Zollek** 12 Sie 2008, 15:49

Nowe logi:

Combofix

Kod: Zaznacz wszystko: ComboFix 08-08-11.01 - Zollek 2008-08-12 15:33:43.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1128 [GMT 2:00] Running from: E:\MuzykaLato\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-12 to 2008-08-12 ))))))))))))))))))))))))))))))) . 2008-08-12 15:13 . 2008-08-12 15:13 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-12 15:02 . 2008-08-12 15:28 <DIR> d-------- C:\SDFix 2008-08-10 22:31 . 2008-08-10 22:31 <DIR> d-------- C:\Program Files\OpenAL 2008-08-10 22:31 . 2008-08-10 22:31 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-10 22:31 . 2008-08-10 22:31 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-10 22:30 . 2008-08-10 23:09 <DIR> d-------- C:\Program Files\Puzzle Quest 2008-08-08 19:41 . 2007-09-27 14:46 48,896 --a------ C:\WINDOWS\system32\drivers\JmtFltr.sys 2008-08-08 19:41 . 2005-12-22 03:23 14,592 --a------ C:\WINDOWS\system32\drivers\USBICP.sys 2008-08-08 19:40 . 2008-08-08 19:41 <DIR> d-------- C:\Program Files\n52te 2008-08-08 19:40 . 2007-12-06 15:16 49,152 --a------ C:\WINDOWS\system32\Jomantha.cpl 2008-08-08 13:38 . 2008-08-08 13:38 <DIR> d-------- C:\Program Files\DIFX 2008-08-08 13:37 . 2007-09-19 17:01 12,672 --a------ C:\WINDOWS\system32\drivers\vhidmini.sys 2008-08-07 20:46 . 2008-08-07 20:57 256,512 --a------ C:\oferta_b2.xls 2008-07-29 18:42 . 2008-07-29 18:42 <DIR> d-------- C:\Program Files\Azure Gaming 2008-07-29 18:31 . 2008-07-29 18:31 <DIR> d-------- C:\Documents and Settings\Zollek\Dane aplikacji\InstallShield 2008-07-29 18:30 . 2006-02-04 04:50 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd 2008-07-29 18:30 . 2006-02-04 04:50 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2008-07-24 12:22 . 2008-07-24 12:22 <DIR> d-------- C:\Program Files\Atomic RAR Password Recovery 2008-07-24 12:08 . 2008-07-24 12:08 <DIR> d-------- C:\Program Files\Intelore 2008-07-24 09:09 . 2008-07-24 09:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-24 09:09 . 2008-07-24 09:09 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-15 17:07 . 2008-08-10 23:21 <DIR> d-------- C:\Program Files\Warcraft III . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-11 21:34 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\Hamachi 2008-08-11 14:33 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-11 13:55 --------- d-----w C:\Program Files\Spyware Doctor 2008-08-11 13:51 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-30 11:00 --------- d-----w C:\Program Files\mIRC 2008-07-23 15:51 --------- d-----w C:\Program Files\FlashGet 2008-07-22 19:36 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\teamspeak2 2008-07-09 16:42 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\Radmin 2008-07-09 12:32 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\uTorrent 2008-06-30 19:18 --------- d-----w C:\Program Files\Ontrack 2008-06-30 19:17 --------- d-----w C:\Program Files\Sonic Foundry 2008-06-30 16:23 --------- d-----w C:\Program Files\TC PowerPack 2008-06-29 18:13 --------- d-----w C:\Program Files\Trend Micro 2008-06-29 17:57 --------- d-----w C:\Program Files\Realtek AC97 2008-06-29 14:12 --------- d-----w C:\Program Files\Alwil Software 2008-06-29 13:47 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\PC Tools 2008-06-28 11:04 --------- d-----w C:\Program Files\Red Storm Entertainment 2008-06-27 11:37 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-06-27 10:00 314,368 ----a-w C:\WINDOWS\KSGDeInstall.exe 2008-06-26 20:09 --------- d-----w C:\Program Files\DOSBox-0.72 2008-06-16 08:09 --------- d-----w C:\Program Files\Silvercrest MTS2118 driver 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-25 19:41 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2008-05-25 19:41 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2008-05-25 19:41 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-12_14.16.26.46 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-12 13:13:42 6,082,560 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-12 13:13:42 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-12 13:13:39 6,082,560 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-12 13:13:39 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-12 13:09:46 2,872 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{4E6D3F4C-CA73-417D-93E1-B8C317525FED}.bin + 2008-08-12 13:20:52 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_568.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-02-01 17:45 98304] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:23 221568] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2006-01-12 16:40 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-12-05 01:41 8523776] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-12-05 01:41 81920] "Jomantha"="C:\Program Files\n52te\razerhid.exe" [2007-12-12 11:58 163840] "SoundMan"="SOUNDMAN.EXE" [2005-07-22 09:00 81920 C:\WINDOWS\SOUNDMAN.EXE] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ZMBV"= zmbv.dll "VIDC.XFR1"= xfcodec.dll "VIDC.YV12"= yv12vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "E:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"= "C:\\Program Files\\uTorrent\\utorrent.exe"= R1 aswsp;avast! Self Protection;C:\WINDOWS\system32\drivers\aswsp.sys [2008-05-16 01:20] R2 aswfsblk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R3 JmtFltr;n52te;C:\WINDOWS\system32\Drivers\JmtFltr.sys [2007-09-27 14:46] R3 vhidmini;Virtual Hid Device;C:\WINDOWS\system32\DRIVERS\vhidmini.sys [2007-09-19 17:01] S2 DHNB;Security Service;C:\WINDOWS\System32\svcd\svchost.exe [] S3 dump_wmimmc;dump_wmimmc;G:\Lineage II\system\GameGuard\dump_wmimmc.sys [] S3 mirrorv3;mirrorv3;C:\WINDOWS\system32\DRIVERS\rminiv3.sys [2006-11-01 05:01] S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys [2005-12-22 03:23] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] . - - - - ORPHANS REMOVED - - - - Notify-WgaLogon - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Zollek\Dane aplikacji\Mozilla\Firefox\Profiles\rmwroc1h.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.onet.pl/ FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-12 15:35:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-08-12 15:38:43 ComboFix-quarantined-files.txt 2008-08-12 13:37:38 ComboFix2.txt 2008-08-12 12:17:44 ComboFix3.txt 2008-06-29 19:41:26 Pre-Run: 2,318,536,704 bajtów wolnych Post-Run: 2,306,109,440 bajtów wolnych 138 --- E O F --- 2008-08-12 13:09:41

SDFIX:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.215 [/b] Run by Zollek on 2008-08-12 at 15:17 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\114129~1 - Deleted C:\Documents and Settings\Zollek\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com\settings.sol - Deleted C:\WINDOWS\system32\mrdt.log - Deleted C:\WINDOWS\system32\msft.txt - Deleted C:\WINDOWS\system32\upds.log - Deleted Folder C:\Documents and Settings\Zollek\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com - Removed Folder C:\WINDOWS\system32\svcd - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-12 15:25:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:c0c7a3cc "s2"=dword:d9a2748f "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:c9,13,90,58,61,7a,d0,e4,ef,5c,ce,0c,a4,eb,81,89,14,2f,d8,b3,25,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:d2,31,4b,a5,42,4d,22,5d,b1,29,d2,40,19,5a,69,22,57,bb,65,57,2d,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:c9,13,90,58,61,7a,d0,e4,ef,5c,ce,0c,a4,eb,81,89,14,2f,d8,b3,25,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Hamachi\\hamachi.exe"="C:\\Program Files\\Hamachi\\hamachi.exe:*:Enabled:Hamachi Client" "E:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"="E:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat:*:Enabled:game" "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:uTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 29 Oct 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 12 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8a7603e7cf792509c9ebbd8c74c82553\BIT1.tmp" Fri 4 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT2.tmp" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Zollek\Dane aplikacji\U3\temp\Launchpad Removal.exe" [b]Finished![/b]

Hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:49:13, on 2008-08-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\n52te\razerhid.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\n52te\razertra.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Jomantha] C:\Program Files\n52te\razerhid.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.msi.com.tw O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS1\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS2\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS3\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Security Service (DHNB) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: USBest Service Zero (UTSCSI) - Unknown owner - C:\WINDOWS\System32\UTSCSI.EXE -- End of file - 7049 bytes

**Posty:** 684 · przez **djarta** 12 Sie 2008, 16:06

1)

O23 - Service: Security Service (DHNB) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe (file missing)

>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\System32\svcd\svchost.exe Driver:: DHNB

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

**Posty:** 13 · przez **Zollek** 12 Sie 2008, 16:32

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-08-11.01 - Zollek 2008-08-12 16:10:03.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1132 [GMT 2:00] Running from: E:\MuzykaLato\ComboFix.exe Command switches used :: E:\MuzykaLato\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\System32\svcd\svchost.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_DHNB -------\Service_DHNB ((((((((((((((((((((((((( Files Created from 2008-07-12 to 2008-08-12 ))))))))))))))))))))))))))))))) . 2008-08-12 15:13 . 2008-08-12 15:13 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-12 15:02 . 2008-08-12 15:28 <DIR> d-------- C:\SDFix 2008-08-10 22:31 . 2008-08-10 22:31 <DIR> d-------- C:\Program Files\OpenAL 2008-08-10 22:31 . 2008-08-10 22:31 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-10 22:31 . 2008-08-10 22:31 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-10 22:30 . 2008-08-10 23:09 <DIR> d-------- C:\Program Files\Puzzle Quest 2008-08-08 19:41 . 2007-09-27 14:46 48,896 --a------ C:\WINDOWS\system32\drivers\JmtFltr.sys 2008-08-08 19:41 . 2005-12-22 03:23 14,592 --a------ C:\WINDOWS\system32\drivers\USBICP.sys 2008-08-08 19:40 . 2008-08-08 19:41 <DIR> d-------- C:\Program Files\n52te 2008-08-08 19:40 . 2007-12-06 15:16 49,152 --a------ C:\WINDOWS\system32\Jomantha.cpl 2008-08-08 13:38 . 2008-08-08 13:38 <DIR> d-------- C:\Program Files\DIFX 2008-08-08 13:37 . 2007-09-19 17:01 12,672 --a------ C:\WINDOWS\system32\drivers\vhidmini.sys 2008-08-07 20:46 . 2008-08-07 20:57 256,512 --a------ C:\oferta_b2.xls 2008-07-29 18:42 . 2008-07-29 18:42 <DIR> d-------- C:\Program Files\Azure Gaming 2008-07-29 18:31 . 2008-07-29 18:31 <DIR> d-------- C:\Documents and Settings\Zollek\Dane aplikacji\InstallShield 2008-07-29 18:30 . 2006-02-04 04:50 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd 2008-07-29 18:30 . 2006-02-04 04:50 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2008-07-24 12:22 . 2008-07-24 12:22 <DIR> d-------- C:\Program Files\Atomic RAR Password Recovery 2008-07-24 12:08 . 2008-07-24 12:08 <DIR> d-------- C:\Program Files\Intelore 2008-07-24 09:09 . 2008-07-24 09:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-24 09:09 . 2008-07-24 09:09 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-15 17:07 . 2008-08-10 23:21 <DIR> d-------- C:\Program Files\Warcraft III . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-11 21:34 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\Hamachi 2008-08-11 14:33 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-11 13:55 --------- d-----w C:\Program Files\Spyware Doctor 2008-08-11 13:51 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-30 11:00 --------- d-----w C:\Program Files\mIRC 2008-07-23 15:51 --------- d-----w C:\Program Files\FlashGet 2008-07-22 19:36 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\teamspeak2 2008-07-09 16:42 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\Radmin 2008-07-09 12:32 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\uTorrent 2008-06-30 19:18 --------- d-----w C:\Program Files\Ontrack 2008-06-30 19:17 --------- d-----w C:\Program Files\Sonic Foundry 2008-06-30 16:23 --------- d-----w C:\Program Files\TC PowerPack 2008-06-29 18:13 --------- d-----w C:\Program Files\Trend Micro 2008-06-29 17:57 --------- d-----w C:\Program Files\Realtek AC97 2008-06-29 14:12 --------- d-----w C:\Program Files\Alwil Software 2008-06-29 13:47 --------- d-----w C:\Documents and Settings\Zollek\Dane aplikacji\PC Tools 2008-06-28 11:04 --------- d-----w C:\Program Files\Red Storm Entertainment 2008-06-27 11:37 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-06-27 10:00 314,368 ----a-w C:\WINDOWS\KSGDeInstall.exe 2008-06-26 20:09 --------- d-----w C:\Program Files\DOSBox-0.72 2008-06-16 08:09 --------- d-----w C:\Program Files\Silvercrest MTS2118 driver 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-25 19:41 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2008-05-25 19:41 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2008-05-25 19:41 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-12_14.16.26.46 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-12 13:13:42 6,082,560 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-12 13:13:42 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-12 13:13:39 6,082,560 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-12 13:13:39 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-12 13:09:46 2,872 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{4E6D3F4C-CA73-417D-93E1-B8C317525FED}.bin + 2008-08-12 14:15:59 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_56c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-02-01 17:45 98304] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:23 221568] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2006-01-12 16:40 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-12-05 01:41 8523776] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-12-05 01:41 81920] "Jomantha"="C:\Program Files\n52te\razerhid.exe" [2007-12-12 11:58 163840] "SoundMan"="SOUNDMAN.EXE" [2005-07-22 09:00 81920 C:\WINDOWS\SOUNDMAN.EXE] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ZMBV"= zmbv.dll "VIDC.XFR1"= xfcodec.dll "VIDC.YV12"= yv12vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "E:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"= "C:\\Program Files\\uTorrent\\utorrent.exe"= R1 aswsp;avast! Self Protection;C:\WINDOWS\system32\drivers\aswsp.sys [2008-05-16 01:20] R2 aswfsblk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R3 JmtFltr;n52te;C:\WINDOWS\system32\Drivers\JmtFltr.sys [2007-09-27 14:46] R3 vhidmini;Virtual Hid Device;C:\WINDOWS\system32\DRIVERS\vhidmini.sys [2007-09-19 17:01] S3 dump_wmimmc;dump_wmimmc;G:\Lineage II\system\GameGuard\dump_wmimmc.sys [] S3 mirrorv3;mirrorv3;C:\WINDOWS\system32\DRIVERS\rminiv3.sys [2006-11-01 05:01] S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys [2005-12-22 03:23] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-12 16:16:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\n52te\razertra.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-08-12 16:27:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-12 14:27:15 ComboFix2.txt 2008-08-12 13:38:44 ComboFix3.txt 2008-08-12 12:17:44 ComboFix4.txt 2008-06-29 19:41:26 Pre-Run: 2,279,391,232 bajtów wolnych Post-Run: 2,267,521,024 bajt˘w wolnych 157 --- E O F --- 2008-08-12 13:09:41

HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:32:18, on 2008-08-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\n52te\razerhid.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\n52te\razertra.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Jomantha] C:\Program Files\n52te\razerhid.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.msi.com.tw O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS1\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS2\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O17 - HKLM\System\CS3\Services\Tcpip\..\{3C4E4C03-26A0-4EA9-9D96-DCEF871F8344}: NameServer = 10.0.0.12,10.0.0.13 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: USBest Service Zero (UTSCSI) - Unknown owner - C:\WINDOWS\System32\UTSCSI.EXE -- End of file - 6856 bytes

**Posty:** 684 · przez **djarta** 12 Sie 2008, 16:34

Ja nie widzę teraz nic szkodliwego.

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

EDIT:

C:\oferta_b2.xls

Sprawdź go na --> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

==========================================
K.