antivirus2008 i malware2008

**Posty:** 36 · przez **wojtas9** 17 Lip 2008, 20:55

Logfile of HijackThis v1.99.1
Scan saved at 20:05:08, on 2008-07-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\Alwil Software\Avast4\aswUpdSv.exe
d:\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Documents and Settings\Arek\ie_updates3r.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
d:\Alwil Software\Avast4\ashMaiSv.exe
d:\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
D:\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\wcescomm.exe
D:\rapimgr.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\DOCUME~1\Arek\USTAWI~1\Temp\csrssc.exe
C:\WINDOWS\system32\ztmx802.exe
C:\DOCUME~1\Arek\USTAWI~1\Temp\Rar$EX00.563\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.imesh.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winras.exe,C:\WINDOWS\system32\winras.exe,
O2 - BHO: C:\WINDOWS\system32\jdgf8edfsde.dll - {C5AF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jdgf8edfsde.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll
O4 - HKLM\..\Run: [avast!] d:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SMrhc5dcj0e53l] C:\Program Files\rhc5dcj0e53l\rhc5dcj0e53l.exe
O4 - HKLM\..\Run: [SMshc7dcj0e53l] C:\Program Files\shc7dcj0e53l\shc7dcj0e53l.exe
O4 - HKLM\..\Run: [lphc1dcj0e53l] C:\WINDOWS\system32\lphc1dcj0e53l.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\wcescomm.exe"
O4 - HKCU\..\Run: [Zinio DLM] C:\Documents and Settings\Arek\Pulpit\Zinio\ZinioDeliveryManager.exe /autostart
O4 - HKCU\..\Run: [iexplorer] C:\WINDOWS\iexplorer.exe --system
O4 - HKCU\..\Run: [msserv] C:\WINDOWS\msserv.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [cdmlosc] ztmx473.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\Arek\USTAWI~1\Temp\csrssc.exe
O4 - Global Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
O8 - Extra context menu item: Download with &Shareaza - res://D:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~2\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://arcaonline.arcabit.com
O15 - Trusted Zone: http://www.mks.com.pl
O15 - Trusted Zone: http://mapa.um.warszawa.pl
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.33/g_bin/pl/cards_2_0_0_77.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_31.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/24.16/uploader2.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_29.cab
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} (WebLauncherX Control) - http://www.kuchnie.pl/online/cad/launcher.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_43.cab
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.33/g_bin/pl/marbles_2_0_0_32.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game01.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_34.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ClipBook ClipSrv Agent Service (default) (ClipSrv Agent Service (default)) - Unknown owner - .exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Klient DHCP Dhcpvsmon (dhcpvsmon) - Unknown owner - .exe (file missing)
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\Arek\ie_updates3r.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Routing i dostęp zdalny RemoteAccessdmserver (RemoteAccessdmserver) - Unknown owner - .exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorFastUserSwitchingCompatibility (RpcLocatorFastUserSwitchingCompatibility) - Unknown owner - .exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: MS Software Shadow Copy Provider SwPrvUTSCSI (SwPrvUTSCSI) - Unknown owner - .exe (file missing)
O23 - Service: Kompozycje Themeslanmanworkstation (themeslanmanworkstation) - Unknown owner - .exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows User Mode Driver Framework UMWdfDcomLaunch (UMWdfDcomLaunch) - Unknown owner - .exe (file missing)
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: CLCV0 UTSCSI PMSP Service (utscsi pmsp service) - Unknown owner - .exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Usługa numeru seryjnego multimediów przenośnych WmdmPmSNAppMgmt (WmdmPmSNAppMgmt) - Unknown owner - .exe (file missing)
O23 - Service: Konfiguracja zerowej sieci bezprzewodowej WZCSVCImapiService (wzcsvcimapiservice) - Unknown owner - .exe (file missing)

[code][/code]

**Posty:** 84 · przez **gloni** 17 Lip 2008, 20:58

napisz czego problem dotyczy i logo combofixa

Autor postu otrzymał pochwałę

**Posty:** 7956 · przez **Magik** 17 Lip 2008, 20:58

http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

:!:

jakis opis problemu-->zasady jakies sa

masz tyle syfu

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

**Posty:** 36 · przez **wojtas9** 17 Lip 2008, 23:50

objawy to brak usuniecia wirusów C:\WINDOWS\system32\jdgf8edfsde.dll przez avast no i te dwie ikony które mam na pulpicie i nie moge ich usunąć.
Dodatkowo co jakiś czas wyswietla mi sie na caly ekran informacja że mam uszkodzony system i musze żeby cokolwiek zrobic zrestartować kompa.

w SDFix mam do wyboru A,B,C,D,U,1,2,3,4, or E to Exit...
jak klikam Y i enter to okienko mi znika ale później nic sie nie dzieje?

**Posty:** 7956 · przez **Magik** 17 Lip 2008, 23:51

wojtas9 napisał(a):w SDFix mam do wyboru A,B,C,D,U,1,2,3,4, or E to Exit...
jak klikam Y i enter to okienko mi znika ale później nic sie nie dzieje?

to zrob najpierw log z combofix'a

http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 00:12

ComboFix 08-07-15.4 - Arek 2008-07-18 0:06:37.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.700 [GMT 2:00]
Running from: C:\Documents and Settings\Arek\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\d.exe
C:\Documents and Settings\Administrator.RJHBZ5BSI02DJY1\Dane aplikacji\rhc5dcj0e53l
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Malware Protector 2008.lnk
C:\Documents and Settings\Arek\Dane aplikacji\rhc5dcj0e53l
C:\Documents and Settings\Arek\Dane aplikacji\shc7dcj0e53l
C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start\Programy\Autostart\userinit.exe
C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\svchost.exe
C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
C:\Program Files\AskSBar\bar\Cache\01C41ECC
C:\Program Files\AskSBar\bar\Cache\01C4238F
C:\Program Files\AskSBar\bar\Cache\01C425B1.bin
C:\Program Files\AskSBar\bar\Cache\01C428AF.bin
C:\Program Files\AskSBar\bar\Cache\01C42A36.bin
C:\Program Files\AskSBar\bar\Cache\files.ini
C:\Program Files\AskSBar\bar\History\search2
C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
C:\Program Files\MyWay
C:\Program Files\MyWay\SrchAstt\1.bin\PARTNER.DAT
C:\Program Files\MyWay\SrchAstt\1.bin\UNINSTAL.INF
C:\Program Files\MyWay\SrchAstt\Cache\0003C0D0
C:\Program Files\MyWay\SrchAstt\Cache\0003FD4D
C:\Program Files\MyWay\SrchAstt\Cache\0023E499
C:\Program Files\MyWay\SrchAstt\Cache\002F241D
C:\Program Files\MyWay\SrchAstt\Cache\00D4B04D
C:\Program Files\MyWay\SrchAstt\Cache\017A476A
C:\Program Files\MyWay\SrchAstt\Cache\files.ini
C:\Program Files\rhc5dcj0e53l
C:\Program Files\rhc5dcj0e53l\license.txt
C:\Program Files\rhc5dcj0e53l\MFC71.dll
C:\Program Files\rhc5dcj0e53l\msvcp71.dll
C:\Program Files\rhc5dcj0e53l\msvcr71.dll
C:\WINDOWS\msserv.config
C:\WINDOWS\system32\back.exe.exe
C:\WINDOWS\system32\blphc1dcj0e53l.scr
C:\WINDOWS\system32\dlh9jkd1q8.exe
C:\WINDOWS\system32\drivers\services.exe
C:\WINDOWS\system32\paars.ini
C:\WINDOWS\system32\phc1dcj0e53l.bmp
C:\WINDOWS\system32\svchost.t__
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winhelp.exe
C:\WINDOWS\system32\winras.exe
C:\WINDOWS\system32\winsub.xml

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GOOGLE_ONLINE_SERVICES
-------\Legacy_WINCOM32
-------\Service_Google Online Services

((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
.

2008-07-17 22:17 . 2008-07-17 22:17 16,896 --a------ C:\WINDOWS\system32\ztmx797.exe
2008-07-17 21:31 . 2008-07-17 21:31 7,680 --a------ C:\WINDOWS\system32\ztmx534.exe
2008-07-17 21:25 . 2008-07-17 21:25 68,608 --a------ C:\WINDOWS\system32\ztmx801.exe
2008-07-17 21:25 . 2008-07-17 21:25 705 --a------ C:\d1.exe
2008-07-17 21:24 . 2008-07-17 23:46 <DIR> d-------- C:\SDFix
2008-07-17 21:24 . 2008-07-17 21:24 45,056 --a------ C:\WINDOWS\system32\lbbd32.dll
2008-07-17 21:24 . 2008-07-17 21:24 12,793 --a------ C:\ktcqqb.exe
2008-07-17 21:24 . 2008-07-17 21:24 131 --a------ C:\WINDOWS\system32\mvx.dat
2008-07-17 21:24 . 2008-07-17 21:24 2 --a------ C:\1747097809
2008-07-17 19:57 . 2008-07-17 21:24 65,536 --a------ C:\ipehr.exe
2008-07-14 20:37 . 2008-07-14 20:38 <DIR> dr------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ulubione
2008-07-14 20:37 . 2008-07-14 20:38 <DIR> dr------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ulubione
2008-07-14 20:37 . 2008-07-14 20:37 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Pulpit
2008-07-14 20:37 . 2008-07-14 20:37 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Pulpit
2008-07-14 20:37 . 2008-07-14 20:38 <DIR> dr------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Moje dokumenty
2008-07-14 20:37 . 2008-07-14 20:38 <DIR> dr------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Moje dokumenty
2008-07-14 19:55 . 2008-07-17 22:17 <DIR> d--hs---- C:\WINDOWS\system32\winras
2008-07-14 19:55 . 2008-07-14 19:55 44,032 --a------ C:\WINDOWS\system32\ztmx799.exe
2008-07-14 19:33 . 2008-07-14 19:33 0 --------- C:\WINDOWS\system32\3ivxDSDecoderx.sys
2008-07-14 12:49 . 2008-07-14 12:49 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-07-13 21:04 . 2008-07-13 21:04 120 --a------ C:\delrb.bat
2008-07-13 21:04 . 2008-07-13 21:04 100 --a------ C:\delrb1.reg
2008-07-13 03:05 . 2008-07-14 20:23 1,615,126 --ahs---- C:\WINDOWS\system32\AC3APIh.sys
2008-07-13 00:26 . 2008-07-13 00:26 0 --a------ C:\WINDOWS\iunhg.x
2008-07-13 00:20 . 2008-07-13 00:20 54,272 --a------ C:\dqklrp.exe
2008-07-13 00:18 . 2008-07-13 00:18 29 --a------ C:\WINDOWS\system32\giystfhw.tmp
2008-07-13 00:18 . 2008-07-13 03:12 0 --a------ C:\WINDOWS\system32\drivers\977f429a.sys
2008-07-13 00:17 . 2008-07-13 00:17 3,121 --a------ C:\ie_updater.exe
2008-07-13 00:17 . 2008-07-13 00:17 3,121 --a------ C:\Documents and Settings\Arek\ie_updates3r.exe
2008-07-13 00:17 . 2008-07-14 19:34 342 --a-s---- C:\WINDOWS\system32\4033842317.dat
2008-07-13 00:17 . 2008-07-17 22:17 1 --a------ C:\WINDOWS\system32\cekjzl.tmp
2008-07-09 20:39 . 2008-07-09 20:39 <DIR> d-------- C:\Documents and Settings\Arek\Dane aplikacji\WA-PRO
2008-07-09 20:39 . 2008-07-09 20:39 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\WA-PRO
2008-07-01 23:06 . 2008-07-01 23:38 <DIR> d-------- C:\Documents and Settings\Arek\Dane aplikacji\uTorrent
2008-06-30 22:48 . 2008-06-30 22:48 <DIR> d-------- C:\Documents and Settings\Arek\Dane aplikacji\Gadu-Gadu
2008-06-30 22:43 . 2008-06-30 22:44 4,350,416 --a------ C:\gg77.exe
2008-06-30 17:52 . 2008-06-30 17:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-30 17:52 . 2008-06-30 17:52 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-29 20:59 . 2008-06-29 20:59 <DIR> d-------- C:\Documents and Settings\Arek\Dane aplikacji\ZoomBrowser EX
2008-06-29 20:55 . 2008-06-29 21:10 <DIR> d-------- C:\Program Files\Canon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 18:21 --------- d-----w C:\Program Files\Java
2008-07-14 17:48 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy
2008-07-12 21:15 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\iMesh
2008-07-10 18:41 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-07-09 20:30 --------- d-----w C:\Program Files\VOX BOX 2.02
2008-07-01 21:43 --------- d-----w C:\Program Files\iMesh Applications
2008-07-01 21:42 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\Azureus
2008-07-01 21:36 --------- d-----w C:\Program Files\Azureus
2008-06-24 21:15 --------- d-----w C:\Program Files\SkanerOnline
2008-06-16 22:26 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-24 23:38 --------- d-----w C:\Documents and Settings\Administrator.RJHBZ5BSI02DJY1\Dane aplikacji\Nokia
2008-05-24 23:36 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\Ashampoo
2008-05-24 23:22 --------- d-----w C:\Program Files\Nokia
2008-05-24 23:22 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-05-24 23:22 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-24 23:21 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-05-24 23:20 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Installations
2008-05-24 23:18 --------- d-----w C:\Program Files\Ashampoo
2008-05-24 23:18 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ashampoo
2008-05-24 23:18 --------- d-----w C:\Documents and Settings\Administrator.RJHBZ5BSI02DJY1\Dane aplikacji\Ashampoo
2008-05-24 23:15 --------- d-----w C:\Program Files\Sun
2008-05-24 23:08 --------- d-----w C:\Documents and Settings\Administrator.RJHBZ5BSI02DJY1\Dane aplikacji\PC Suite
2008-05-21 15:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-21 15:52 --------- d-----w C:\Documents and Settings\Arek\Dane aplikacji\ContentGuard
2008-05-21 15:50 --------- d-----w C:\Program Files\Common Files\Zinio
2008-05-21 15:44 5,359,352 ----a-w C:\WINDOWS\ZinioReaderSetup_.exe
2004-11-23 14:36 36 ------w C:\Documents and Settings\Arek Wiśniewski\klextlock.dat
2003-06-03 15:49 448,256 ----a-w C:\WINDOWS\inf\EL2K_N64.sys
2003-06-03 15:48 147,328 ----a-w C:\WINDOWS\inf\EL2K_XP.sys
2003-06-03 15:47 147,328 ----a-w C:\WINDOWS\inf\EL2K_2K.sys
2004-08-04 07:44 4,096 --sha-w C:\WINDOWS\system32\qweasdf.dat
.

------- Sigcheck -------

2005-03-14 02:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR\tcpip.sys
2005-05-25 21:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 19:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2005-02-23 04:00 339968 466cbd4831e80729173654ab2b8c0fee C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-04 08:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2002-08-29 02:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB893066_0$\tcpip.sys
2006-01-13 04:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2005-05-25 21:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446_0$\tcpip.sys
2004-08-04 08:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2006-01-13 19:07 360448 88e085a02ae1e4d4ae2b143d1325f383 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-07-17_22.55.00.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 09:30:02 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-17 20:51:37 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-05-17 09:30:02 68,334 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-07-17 20:51:37 68,334 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-05-17 09:30:02 383,254 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-17 20:51:37 383,254 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-05-17 09:30:02 439,194 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-07-17 20:51:38 439,194 ----a-w C:\WINDOWS\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5AF49A2-94F3-42BD-F434-3604812C897D}]
C:\WINDOWS\system32\jdgf8edfsde.dll [BU]

**Posty:** 7956 · przez **Magik** 18 Lip 2008, 00:16

dzieki za ten log :arrow:

az za glowe sie zlapalem---> w huuUgo tego bylo :!:

dobra teraz lecimy dalej

odpal
http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

nastepnie jeszcze raz log z HijackThis i combofix'a, bo tyle rzeczy poszlo w eter ze az log jest uciety i wpisow rejestru nie widac

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 00:24

dzięki za poswiecenie
narazie przesyłam Log FixIEDef zaraz reszta

*

*******************************************************************************
* *
* FixIEDef Log *
* Version 1.5.0.5987 *
* *
********************************************************************************

Created at 00:21:47 on Friday, July 18, 2008

Time Zone :

Logged On User : Arek

Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2
OS Version : 5.1.2600
System Langauge : Polish
Keyboard Layout : Polish
Processor : X86 Intel(R) Pentium(R) 4 CPU 2.60GHz

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

Total Physical Memory : 1047276 KB
Free Physical Memory : 701620 KB
Total Virtual Memory : 2097024 KB
Free Virtual Memory : 2025552 KB

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

C:\Documents and Settings\Arek\Dane aplikacji\Sun\Java\Deployment\cache\javapi\*.*
C:\WINDOWS\SwSys1.bmp
C:\WINDOWS\SwSys2.bmp

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done

ShadowPuterDude

Safe Surfing!!!

[ Dodano: Dzisiaj o 23:27 ]

Logfile of HijackThis v1.99.1
Scan saved at 00:28, on 2008-07-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\Alwil Software\Avast4\aswUpdSv.exe
d:\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
d:\Alwil Software\Avast4\ashMaiSv.exe
d:\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\wcescomm.exe
D:\rapimgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Arek\USTAWI~1\Temp\Rar$EX00.532\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: C:\WINDOWS\system32\jdgf8edfsde.dll - {C5AF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jdgf8edfsde.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKLM\..\Run: [CTHelper] ; CTHELPER.EXE
O4 - HKLM\..\Run: [DAEMON Tools] ; "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DataLayer] ; C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [DeviceDiscovery] ; C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [F-Secure Manager] ; "D:\Program Files\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] ; "D:\Program Files\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure TNB] ; "D:\Program Files\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Gainward] ; C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [HP Software Update] ; C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] ; C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [IST Service] ; C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [iTunesHelper] ; D:\iTunesHelper.exe
O4 - HKLM\..\Run: [Jet Detection] ; "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NeroCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [PCSuiteTrayApplication] ; C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SoundMAXPnP] ; C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SurfAccuracy] ; C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [UpdReg] ; C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [WinampAgent] ; d:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\wcescomm.exe"
O4 - HKCU\..\Run: [Zinio DLM] C:\Documents and Settings\Arek\Pulpit\Zinio\ZinioDeliveryManager.exe /autostart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [iexplorer] C:\WINDOWS\iexplorer.exe --system
O4 - HKCU\..\Run: [msserv] C:\WINDOWS\msserv.exe
O4 - HKCU\..\Run: [cdmlosc] ztmx473.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
O8 - Extra context menu item: Download with &Shareaza - res://D:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~2\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://arcaonline.arcabit.com
O15 - Trusted Zone: http://www.mks.com.pl
O15 - Trusted Zone: http://mapa.um.warszawa.pl
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.33/g_bin/pl/cards_2_0_0_77.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_31.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/24.16/uploader2.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} -
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} -
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} -
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.33/g_bin/pl/marbles_2_0_0_32.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game01.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_34.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ClipBook ClipSrv Agent Service (default) (ClipSrv Agent Service (default)) - Unknown owner - .exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Klient DHCP Dhcpvsmon (dhcpvsmon) - Unknown owner - .exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Routing i dostęp zdalny RemoteAccessdmserver (RemoteAccessdmserver) - Unknown owner - .exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorFastUserSwitchingCompatibility (RpcLocatorFastUserSwitchingCompatibility) - Unknown owner - .exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: MS Software Shadow Copy Provider SwPrvUTSCSI (SwPrvUTSCSI) - Unknown owner - .exe (file missing)
O23 - Service: Kompozycje Themeslanmanworkstation (themeslanmanworkstation) - Unknown owner - .exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows User Mode Driver Framework UMWdfDcomLaunch (UMWdfDcomLaunch) - Unknown owner - .exe (file missing)
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: CLCV0 UTSCSI PMSP Service (utscsi pmsp service) - Unknown owner - .exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Usługa numeru seryjnego multimediów przenośnych WmdmPmSNAppMgmt (WmdmPmSNAppMgmt) - Unknown owner - .exe (file missing)
O23 - Service: Konfiguracja zerowej sieci bezprzewodowej WZCSVCImapiService (wzcsvcimapiservice) - Unknown owner - .exe (file missing)

[ Dodano: Dzisiaj o 23:31 ]

ComboFix 08-07-15.4 - Arek 2008-07-18 0:29:27.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.680 [GMT 2:00]
Running from: C:\Documents and Settings\Arek\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\d.exe
C:\Documents and Settings\Administrator.RJHBZ5BSI02DJY1\Dane aplikacji\rhc5dcj0e53l
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Malware Protector 2008.lnk
C:\Documents and Settings\Arek\Dane aplikacji\rhc5dcj0e53l
C:\Documents and Settings\Arek\Dane aplikacji\shc7dcj0e53l
C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Menu Start\Programy\Autostart\userinit.exe
C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\svchost.exe
C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
C:\Program Files\AskSBar\bar\Cache\01C41ECC
C:\Program Files\AskSBar\bar\Cache\01C4238F
C:\Program Files\AskSBar\bar\Cache\01C425B1.bin
C:\Program Files\AskSBar\bar\Cache\01C428AF.bin
C:\Program Files\AskSBar\bar\Cache\01C42A36.bin
C:\Program Files\AskSBar\bar\Cache\files.ini
C:\Program Files\AskSBar\bar\History\search2
C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
C:\Program Files\MyWay
C:\Program Files\MyWay\SrchAstt\1.bin\PARTNER.DAT
C:\Program Files\MyWay\SrchAstt\1.bin\UNINSTAL.INF
C:\Program Files\MyWay\SrchAstt\Cache\0003C0D0
C:\Program Files\MyWay\SrchAstt\Cache\0003FD4D
C:\Program Files\MyWay\SrchAstt\Cache\0023E499
C:\Program Files\MyWay\SrchAstt\Cache\002F241D
C:\Program Files\MyWay\SrchAstt\Cache\00D4B04D
C:\Program Files\MyWay\SrchAstt\Cache\017A476A
C:\Program Files\MyWay\SrchAstt\Cache\files.ini
C:\Program Files\rhc5dcj0e53l
C:\Program Files\rhc5dcj0e53l\license.txt
C:\Program Files\rhc5dcj0e53l\MFC71.dll
C:\Program Files\rhc5dcj0e53l\msvcp71.dll
C:\Program Files\rhc5dcj0e53l\msvcr71.dll
C:\WINDOWS\msserv.config
C:\WINDOWS\system32\back.exe.exe
C:\WINDOWS\system32\blphc1dcj0e53l.scr
C:\WINDOWS\system32\dlh9jkd1q8.exe
C:\WINDOWS\system32\drivers\services.exe
C:\WINDOWS\system32\paars.ini
C:\WINDOWS\system32\phc1dcj0e53l.bmp
C:\WINDOWS\system32\svchost.t__
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winhelp.exe
C:\WINDOWS\system32\winras.exe
C:\WINDOWS\system32\winsub.xml

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GOOGLE_ONLINE_SERVICES
-------\Legacy_WINCOM32
-------\Service_Google Online Services

((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
.

**Posty:** 7956 · przez **Magik** 18 Lip 2008, 00:38

wojtas9 napisał(a):dzięki za poswiecenie

nie ma sprawy--->troche roboty bedzie z tym, nazbieralo Ci sie badziewia

te wpisy dajesz w HiJackThis na fix wtrybie awaryjnym(wciskasz F8 przy starcie kompa) i wybierasz tryb awaryjny

Kod: Zaznacz wszystko: O2 - BHO: C:\WINDOWS\system32\jdgf8edfsde.dll - {C5AF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jdgf8edfsde.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll O4 - HKLM\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe O4 - HKLM\..\Run: [IST Service] ; C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [SurfAccuracy] ; C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKCU\..\Run: [iexplorer] C:\WINDOWS\iexplorer.exe --system O4 - HKCU\..\Run: [msserv] C:\WINDOWS\msserv.exe O4 - HKCU\..\Run: [cdmlosc] ztmx473.exe O23 - Service: ClipBook ClipSrv Agent Service (default) (ClipSrv Agent Service (default)) - Unknown owner - .exe (file missing) O23 - Service: Klient DHCP Dhcpvsmon (dhcpvsmon) - Unknown owner - .exe (file missing) O23 - Service: Routing i dostęp zdalny RemoteAccessdmserver (RemoteAccessdmserver) - Unknown owner - .exe (file missing) O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorFastUserSwitchingCompatibility (RpcLocatorFastUserSwitchingCompatibility) - Unknown owner - .exe (file missing) O23 - Service: Kompozycje Themeslanmanworkstation (themeslanmanworkstation) - Unknown owner - .exe (file missing) Unknown O23 - Service: CLCV0 UTSCSI PMSP Service (utscsi pmsp service) - Unknown owner - .exe (file missing)

jak cos
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

w tym topicku, jest napisane jak dac te wpisy na fix
Usuwanie-->podpunkt 4

i pzrepraszam ze z tym combofixem tak Cie mecze ale on caly czas nie wchodzi caly to wrzuc mi go na

www.wklej.org

i sprobuj odpalic sdfix'a

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 01:21

OK nie ma sprawy

Logfile of HijackThis v1.99.1
Scan saved at 01:22, on 2008-07-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\Alwil Software\Avast4\aswUpdSv.exe
d:\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\wcescomm.exe
D:\rapimgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\UTSCSI.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
d:\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
d:\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Arek\USTAWI~1\Temp\Rar$EX00.610\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {C5AF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CTHelper] ; CTHELPER.EXE
O4 - HKLM\..\Run: [DAEMON Tools] ; "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DataLayer] ; C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [DeviceDiscovery] ; C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [F-Secure Manager] ; "D:\Program Files\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] ; "D:\Program Files\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure TNB] ; "D:\Program Files\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Gainward] ; C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [HP Software Update] ; C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] ; C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [iTunesHelper] ; D:\iTunesHelper.exe
O4 - HKLM\..\Run: [Jet Detection] ; "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NeroCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [PCSuiteTrayApplication] ; C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SoundMAXPnP] ; C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [UpdReg] ; C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [WinampAgent] ; d:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\wcescomm.exe"
O4 - HKCU\..\Run: [Zinio DLM] C:\Documents and Settings\Arek\Pulpit\Zinio\ZinioDeliveryManager.exe /autostart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\Arek\USTAWI~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [iexplorer] C:\WINDOWS\iexplorer.exe --system
O4 - HKCU\..\Run: [msserv] C:\WINDOWS\msserv.exe
O4 - HKCU\..\Run: [cdmlosc] ztmx473.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
O8 - Extra context menu item: Download with &Shareaza - res://D:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\INetRepl.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~2\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://arcaonline.arcabit.com
O15 - Trusted Zone: http://www.mks.com.pl
O15 - Trusted Zone: http://mapa.um.warszawa.pl
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.33/g_bin/pl/cards_2_0_0_77.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_31.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/24.16/uploader2.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} -
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} -
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} -
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.33/g_bin/pl/marbles_2_0_0_32.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game01.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_34.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ClipBook ClipSrv Agent Service (default) (ClipSrv Agent Service (default)) - Unknown owner - .exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Klient DHCP Dhcpvsmon (dhcpvsmon) - Unknown owner - .exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Routing i dostęp zdalny RemoteAccessdmserver (RemoteAccessdmserver) - Unknown owner - .exe (file missing)
O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorFastUserSwitchingCompatibility (RpcLocatorFastUserSwitchingCompatibility) - Unknown owner - .exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: MS Software Shadow Copy Provider SwPrvUTSCSI (SwPrvUTSCSI) - Unknown owner - .exe (file missing)
O23 - Service: Kompozycje Themeslanmanworkstation (themeslanmanworkstation) - Unknown owner - .exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows User Mode Driver Framework UMWdfDcomLaunch (UMWdfDcomLaunch) - Unknown owner - .exe (file missing)
O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE
O23 - Service: CLCV0 UTSCSI PMSP Service (utscsi pmsp service) - Unknown owner - .exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Usługa numeru seryjnego multimediów przenośnych WmdmPmSNAppMgmt (WmdmPmSNAppMgmt) - Unknown owner - .exe (file missing)
O23 - Service: Konfiguracja zerowej sieci bezprzewodowej WZCSVCImapiService (wzcsvcimapiservice) - Unknown owner - .exe (file missing)

**Posty:** 7956 · przez **Magik** 18 Lip 2008, 01:26

3 ciezkie rzeczy dalej siedza

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\iexplorer.exe C:\WINDOWS\msserv.exe

plik zapisz jako CFScript.txt, przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

wygeneruje sie log, wklej go

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 01:39

wrzucilem ComboFix na www.wklej.org

**Posty:** 7956 · przez **Magik** 18 Lip 2008, 01:40

wojtas9 napisał(a):wrzucilem ComboFix na www.wklej.org

ale zapodaj link do pliku a nie adres stronki

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 02:30

no masz rację tu bedzie Combofix i zaraz Sdfix

http://wklej.org/id/10df212cf1

[ Dodano: Dzisiaj o 1:30 ]

SDFix: Version 1.206
Run by Arek on 2008-07-18 at 01:52

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems]

Trojan File basepcv32.dll and startup entry Found!
basepcv32.dll will be removed after reboot if registry value is repaired

Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing SharedAccess Service

Rebooting

Session Manager\SubSystems:
Windows ServerDll value restored to basesrv
Key export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
"Windows"=%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

Removing C:\WINDOWS\system32\basepcv32.dll

Checking Files :

Trojan Files Found:

C:\174709~1 - Deleted
C:\Documents and Settings\Arek\ie_updates3r.exe - Deleted
C:\Documents and Settings\Arek\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk - Deleted
C:\ie_updater.exe - Deleted
C:\WINDOWS\system32\lbbd32.dll - Deleted
C:\WINDOWS\system32\mvx.dat - Deleted
C:\WINDOWS\wiaservb.log - Deleted
C:\WINDOWS\system32\basepcv32.dll - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-18 02:15:42
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:6c0e3b72
"s1"=dword:d7c08f2b
"s2"=dword:803a3310
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:44,ad,f0,6e,ff,38,84,1d,05,f5,1b,79,50,a5,26,d0,4b,ef,20,1f,0c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:44,ad,f0,6e,ff,38,84,1d,05,f5,1b,79,50,a5,26,d0,4b,ef,20,1f,0c,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000004f
"TracesSuccessful"=dword:00000006

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\\rapimgr.exe"="D:\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"D:\\wcescomm.exe"="D:\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"D:\\WCESMgr.exe"="D:\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"D:\\rapimgr.exe"="D:\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"D:\\wcescomm.exe"="D:\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"D:\\WCESMgr.exe"="D:\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 14 Jul 2008 1,615,126 A.SH. --- "C:\WINDOWS\system32\AC3APIh.sys"
Wed 25 Feb 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 24 Jun 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Sat 2 Jun 2007 36,352 ...H. --- "C:\Documents and Settings\Arek\Moje dokumenty\Word\~WRL1719.tmp"

Finished!

**Posty:** 84 · przez **gloni** 18 Lip 2008, 09:43

C:\WINDOWS\msserv.exe
C:\WINDOWS\iexplorer.exe

te pliki skasuj tym programem http://kajtekjr.neostrada.pl/killbox_Programosy.pl.exe

W HijackThis tryb awaryjny usun te wpisy :

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [iexplorer] C:\WINDOWS\iexplorer.exe --system O4 - HKCU\..\Run: [msserv] C:\WINDOWS\msserv.exe O4 - HKCU\..\Run: [cdmlosc] ztmx473.exe O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\Arek\USTAWI~1\Temp\csrssc.exe O2 - BHO: (no name) - {C5AF49A2-94F3-42BD-F434-3604812C897D} - (no file) O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing) Unknown O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} - Unknown O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} - O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} - Unknown O23 - Service: ClipBook ClipSrv Agent Service (default) (ClipSrv Agent Service (default)) - Unknown owner - .exe (file missing) Unknown O23 - Service: Klient DHCP Dhcpvsmon (dhcpvsmon) - Unknown owner - .exe (file missing) Unknown O23 - Service: Routing i dostęp zdalny RemoteAccessdmserver (RemoteAccessdmserver) - Unknown owner - .exe (file missing) Unknown O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorFastUserSwitchingCompatibility Unknown O23 - Service: MS Software Shadow Copy Provider SwPrvUTSCSI (SwPrvUTSCSI) - Unknown owner - .exe (file missing) Unknown O23 - Service: Kompozycje Themeslanmanworkstation (themeslanmanworkstation) - Unknown owner - .exe (file missing) O23 - Service: Windows User Mode Driver Framework UMWdfDcomLaunch (UMWdfDcomLaunch) - Unknown owner - .exe (file missing) Unknown O23 - Service: CLCV0 UTSCSI PMSP Service (utscsi pmsp service) - Unknown owner - .exe (file missing) Unknown O23 - Service: Usługa numeru seryjnego multimediów przenośnych WmdmPmSNAppMgmt (WmdmPmSNAppMgmt) - Unknown owner - .exe (file missing) Unknown O23 - Service: Konfiguracja zerowej sieci bezprzewodowej WZCSVCImapiService (wzcsvcimapiservice) - Unknown owner - .exe (file missing)

Potem przeskanuj tym : http://download.grisoft.cz/softw/70/filedir/inst/avgas-setup-7.5.1.43-3339.exe

W notatniku

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"iexplorer"=-
"msserv"=-
"Jnskdfmf9eldfd"=-
"MSMSGS"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5AF49A2-94F3-42BD-F434-3604812C897D}]

Notatnika -> Plik -> Zapisz jako -> Zmień rozszerzenie z .txt na wszystkie pliki -> zapisz pod nazwą Fix.reg i uruchom go .

**Posty:** 18165 · przez **wojtas** 18 Lip 2008, 12:06

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\ztmx797.exe
C:\WINDOWS\glok+serv.config
C:\WINDOWS\system32\ztmx534.exe
C:\WINDOWS\system32\ztmx801.exe
C:\d1.exe
C:\ktcqqb.exe
C:\ipehr.exe
C:\WINDOWS\system32\ztmx799.exe
C:\WINDOWS\system32\3ivxDSDecoderx.sys
C:\WINDOWS\system32\drivers\977f429a.sys
C:\WINDOWS\system32\qweasdf.dat
C:\delrb.bat
C:\delrb1.reg
C:\WINDOWS\system32\cekjzl.tmp
C:\WINDOWS\iunhg.x
C:\dqklrp.exe
C:\WINDOWS\system32\giystfhw.tmp

Folder::
C:\WINDOWS\system32\winras

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdmlosc"=-
"iexplorer"=-
"msserv"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"jkfdjg9e4rgfgfdgftdf"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winbc73.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winde04.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winir82.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlv36.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winoe01.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winpq87.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winys65.sys]

Driver::
Winbc73
winde04
Winir82
Winlv36
winoe01
winpq87
Winys65
Wanizer
977f429a
wzcsvcimapiservice
WmdmPmSNAppMgmt
utscsi pmsp service
UMWdfDcomLaunch
themeslanmanworkstation
SwPrvUTSCSI
RPC
RemoteAccessdmserver
dhcpvsmon
ClipSrv Agent Service (default)

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

Autor postu otrzymał pochwałę

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 13:36

teraz pracuję na innym kompie tamten mam w domu ale jak wrócę to co mam zrobić to co pisze gloni czy wojtas?

**Posty:** 8001 · przez **Okocza** 18 Lip 2008, 13:37

zrób to co kazał wojtas bo ma to co kazał gloni + to czego zapomniał gloni

**Posty:** 84 · przez **gloni** 18 Lip 2008, 13:39

wojtas9 napisał(a):teraz pracuję na innym kompie tamten mam w domu ale jak wrócę to co mam zrobić to co pisze gloni czy wojtas?

Najpierw zrób to co wojtas napisał potem to :

Jesli bedą jeszcze te pliki to usun tym programem
C:\WINDOWS\msserv.exe
C:\WINDOWS\iexplorer.exe

te pliki skasuj tym programem http://kajtekjr.neostrada.pl/killbox_Programosy.pl.exe

W HijackThis tryb awaryjny usun te wpisy :

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [iexplorer] C:\WINDOWS\iexplorer.exe --system O4 - HKCU\..\Run: [msserv] C:\WINDOWS\msserv.exe O4 - HKCU\..\Run: [cdmlosc] ztmx473.exe O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\Arek\USTAWI~1\Temp\csrssc.exe O2 - BHO: (no name) - {C5AF49A2-94F3-42BD-F434-3604812C897D} - (no file) O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing) Unknown O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} - Unknown O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} - O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} - Unknown O23 - Service: ClipBook ClipSrv Agent Service (default) (ClipSrv Agent Service (default)) - Unknown owner - .exe (file missing) Unknown O23 - Service: Klient DHCP Dhcpvsmon (dhcpvsmon) - Unknown owner - .exe (file missing) Unknown O23 - Service: Routing i dostęp zdalny RemoteAccessdmserver (RemoteAccessdmserver) - Unknown owner - .exe (file missing) Unknown O23 - Service: Lokalizator usługi zdalnego wywołania procedury (RPC) RpcLocatorFastUserSwitchingCompatibility Unknown O23 - Service: MS Software Shadow Copy Provider SwPrvUTSCSI (SwPrvUTSCSI) - Unknown owner - .exe (file missing) Unknown O23 - Service: Kompozycje Themeslanmanworkstation (themeslanmanworkstation) - Unknown owner - .exe (file missing) O23 - Service: Windows User Mode Driver Framework UMWdfDcomLaunch (UMWdfDcomLaunch) - Unknown owner - .exe (file missing) Unknown O23 - Service: CLCV0 UTSCSI PMSP Service (utscsi pmsp service) - Unknown owner - .exe (file missing) Unknown O23 - Service: Usługa numeru seryjnego multimediów przenośnych WmdmPmSNAppMgmt (WmdmPmSNAppMgmt) - Unknown owner - .exe (file missing) Unknown O23 - Service: Konfiguracja zerowej sieci bezprzewodowej WZCSVCImapiService (wzcsvcimapiservice) - Unknown owner - .exe (file missing)

Potem przeskanuj tym : http://download.grisoft.cz/softw/70/filedir/inst/avgas-setup-7.5.1.43-3339.exe

potem jak ci wygeneruje logo z cobofixa to podaj plus HijackThis nowy log

**Posty:** 36 · przez **wojtas9** 18 Lip 2008, 14:03

OK tylko jak wrócę z roboty.
Dzięki

[ Dodano: Dzisiaj o 18:44 ]
to działamy

http://www.wklej.org/id/c8afa6a099
log ComboFixa

[ Dodano: Dzisiaj o 20:33 ]

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 21:33 2008-07-18

+ Scan result:

C:\System Volume Information\_restore{7DF89338-E1D6-48BB-A00E-49D46701424F}\RP400\A0065629.exe/ZangoInstaller.dll -> Adware.180Solutions : No action taken.
C:\System Volume Information\_restore{7DF89338-E1D6-48BB-A00E-49D46701424F}\RP400\A0065629.exe/ZangoLib.dll -> Adware.180Solutions : No action taken.
D:\Program Files\Tlen.pl\tlen.exe\plugins\DozaKultury.tpl -> Adware.Doza : No action taken.
:mozilla.534:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Adobe : No action taken.
:mozilla.274:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Imrworldwide : No action taken.
:mozilla.275:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Imrworldwide : No action taken.
:mozilla.456:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Information : No action taken.
:mozilla.476:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Netflame : No action taken.
:mozilla.477:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Netflame : No action taken.
:mozilla.447:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Revsci : No action taken.
:mozilla.448:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Revsci : No action taken.
:mozilla.466:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Skype : No action taken.
C:\Documents and Settings\Arek\Cookies\arek@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.311:C:\Documents and Settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\s3ddmxa7.default\cookies.txt -> TrackingCookie.Webtrends : No action taken.
C:\Documents and Settings\Administrator.RJHBZ5BSI02DJY1\Cookies\administrator@m.webtrends[2].txt -> TrackingCookie.Webtrends : No action taken.

::Report end

antivirus2008 i malware2008

Antivirus2008 i Malware2008

Kto jest na forum