bardzo prosze o sprawdzenie loga

**Posty:** 218 · przez **TheBill** 31 Maj 2007, 20:23

Witam. Odpalam winde i na starcie antivir pokazuje komunikaty, ze wykrylo programy ktore sa wirusami nie raczej nie sa (gg, ie, bearshare, mozilla, opera) myslalem, ze to wina antywirusa wiec go wywalilem i zainstalowalem avasta to samo! Potem nod32 dalej to samo! Pomocy!

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:59:48, on 2007-05-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\netdde.exe C:\Program Files\Nakido\nakido.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\DAEMON Tools\daemon.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Documents and Settings\ppp\Pulpit\Łukasz\Q3E Minimizer_v1.45.EXE C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Opera\Opera.exe C:\Program Files\Xfire\xfire.exe D:\Program Files\Teamspeak2_RC2\TeamSpeak.exe C:\Program Files\Winamp\winamp.exe D:\Program Files\Last.fm\LastFM.exe C:\WINDOWS\system32\ntvdm.exe D:\download\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O1 - Hosts: 86.125.92.112 L2authd.lineage2.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - d:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb103\Dealio.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.1.0.0\Alcohol_Toolbar.dll (file missing) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - d:\PROGRA~1\FlashFXP\IEFlash.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - d:\Program Files\FlashGet\getflash.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.1.0.0\Alcohol_Toolbar.dll (file missing) O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb103\Dealio.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\RunOnce: [Q3E Minimizer v1.45] C:\Documents and Settings\ppp\Pulpit\Łukasz\Q3E Minimizer_v1.45.EXE O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - d:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - d:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb103\res\DealioSearch.html O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - d:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - d:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb103\Dealio.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4DDADA6A-7C5D-4C98-9A3A-907B374B0B91}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing) O23 - Service: Nakido - Nakido - C:\Program Files\Nakido\nakido.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

**Posty:** 18165 · przez **wojtas** 31 Maj 2007, 21:41

skasuj:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll

najpierw wymienione wpisy potem pogrubiony w awaryjnym

instalowales to sam:

O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O23 - Service: Nakido - Nakido - C:\Program Files\Nakido\nakido.exe

??

**Posty:** 218 · przez **TheBill** 01 Cze 2007, 19:53

Dalej to samo

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:30:19, on 2007-06-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\netdde.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\DAEMON Tools\daemon.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Documents and Settings\ppp\Pulpit\Łukasz\Q3E Minimizer_v1.45.EXE C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe D:\download\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 86.125.92.112 L2authd.lineage2.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - d:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb103\Dealio.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.1.0.0\Alcohol_Toolbar.dll (file missing) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - d:\PROGRA~1\FlashFXP\IEFlash.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - d:\Program Files\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.1.0.0\Alcohol_Toolbar.dll (file missing) O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb103\Dealio.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\RunOnce: [Q3E Minimizer v1.45] C:\Documents and Settings\ppp\Pulpit\Łukasz\Q3E Minimizer_v1.45.EXE O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - d:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - d:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb103\res\DealioSearch.html O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - d:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - d:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb103\Dealio.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4DDADA6A-7C5D-4C98-9A3A-907B374B0B91}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

**Posty:** 18165 · przez **wojtas** 02 Cze 2007, 15:33

znasz to:

O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe

??

daj loga z

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 218 · przez **TheBill** 02 Cze 2007, 18:21

znasz to

nie, wywalilem

Kod: Zaznacz wszystko: "ppp" - 2007-06-02 17:55:07 Dodatek Service Pack 2 ComboFix 07-05.27.BV - Running from: "D:\" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) "C:\WINDOWS\NDNuninstall6_38.exe" "C:\WINDOWS\NDNuninstall7_48.exe" "C:\Program Files\download plugin\DlPlugin-Moz\buddy.dat" "C:\Program Files\download plugin\DlPlugin-Moz\vendor.txt" "C:\WINDOWS\system32\rlls.dll" "C:\Program Files\download plugin" ((((((((((((((((((((((((((((((( Files Created from 2007-05-02 to 2007-06-02 )))))))))))))))))))))))))))))))))) 2007-06-01 16:04 512,096 --a--c--- C:\WINDOWS\system32\drivers\amon.sys 2007-06-01 16:04 298,104 --a--c--- C:\WINDOWS\system32\imon.dll 2007-06-01 16:04 15,424 --a--c--- C:\WINDOWS\system32\drivers\nod32drv.sys 2007-06-01 13:15 <DIR> d----c--- C:\cda 2007-05-29 07:44 <DIR> d----c--- C:\DOCUME~1\ppp\DANEAP~1\Command & Conquer 3 Tiberium Wars 2007-05-29 07:39 3,426,072 --a--c--- C:\WINDOWS\system32\d3dx9_32.dll 2007-05-29 07:29 <DIR> d----c--- C:\Program Files\Electronic Arts 2007-05-28 15:52 <DIR> d----c--- C:\qweta 2007-05-28 07:02 <DIR> d----c--- C:\Program Files\DAEMON Tools 2007-05-28 05:45 <DIR> dr-h-c--- C:\DOCUME~1\ppp\DANEAP~1\SecuROM 2007-05-27 10:47 16,859,136 --a--c--- C:\Program Files\trl.exe 2007-05-26 09:41 <DIR> d----c--- C:\USDownloader 2007-05-26 09:07 <DIR> d-------- C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2007-05-26 03:09 <DIR> d----c--- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Trymedia 2007-05-23 17:38 <DIR> d----c--- C:\Program Files\NAPI-PROJEKT 2007-05-22 16:55 <DIR> d----c--- C:\DOCUME~1\ALLUSE~1\DANEAP~1\POP3Profiles 2007-05-22 15:22 <DIR> d--hsc--- C:\RECYCLER 2007-05-17 20:59 118,784 --a--c--- C:\WINDOWS\regedit.exe 2007-05-17 20:46 <DIR> d----c--- C:\Program Files\RegEditR 2007-05-17 19:27 442,368 -ra--c--- C:\WINDOWS\system32\vp6vfw.dll 2007-05-16 17:00 <DIR> d----c--- C:\Program Files\backup 2007-05-16 14:16 <DIR> d----c--- C:\DOCUME~1\ppp\DANEAP~1\FlashFXP 2007-05-13 19:23 <DIR> d----c--- C:\Documents and Settings\ppp\quake3.exe 2007-05-13 19:23 <DIR> d----c--- C:\DOCUME~1\ppp\quake3.exe 2007-05-12 11:14 <DIR> d----c--- C:\DOCUME~1\ppp\DANEAP~1\HEXelon 2007-05-09 21:11 <DIR> d----c--- C:\Program Files\directx 2007-05-07 12:32 <DIR> d----c--- C:\Nowy folder (3) 2007-05-07 12:32 <DIR> d----c--- C:\3 2007-05-06 00:26 12,800 --a--c--- C:\WINDOWS\system\WING32.DLL 2007-05-06 00:17 <DIR> d----c--- C:\GOODIES 2007-05-05 14:02 4,823,552 --a--c--- C:\Documents and Settings\ppp\DawnOfWar.exe 2007-05-05 14:02 4,823,552 --a--c--- C:\DOCUME~1\ppp\DawnOfWar.exe 2007-05-05 13:26 <DIR> d----c--- C:\My Downloads 2007-05-05 10:17 <DIR> d----c--- C:\Program Files\Mplayer 2007-05-05 09:17 <DIR> d----c--- C:\a 2007-05-05 00:40 42,210 --a--c--- C:\WINDOWS\War3Unin.dat 2007-05-05 00:40 200,704 --a--c--- C:\WINDOWS\war3unin.exe 2007-05-05 00:40 2,829 --a--c--- C:\WINDOWS\War3Unin.pif 2007-05-04 19:44 <DIR> d----c--- C:\DOCUME~1\ppp\DANEAP~1\FlashGet 2007-05-03 22:06 <DIR> d----c--- C:\Program Files\mnProjects 2007-05-03 12:03 <DIR> d----c--- C:\Program Files\MegauploadToolbar 2007-05-03 12:03 <DIR> d----c--- C:\DOCUME~1\ppp\DANEAP~1\MegauploadToolbar 2007-05-02 18:29 <DIR> d----c--- C:\Documents and Settings\ppp\Temp 2007-05-02 18:29 <DIR> d----c--- C:\DOCUME~1\ppp\Temp (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-02 15:52:20 -------- dc----w C:\DOCUME~1\ppp\DANEAP~1\Skype 2007-06-02 15:45:10 -------- dc----w C:\DOCUME~1\ppp\DANEAP~1\Xfire 2007-06-02 15:44:56 -------- dcs---w C:\Program Files\Xfire 2007-06-02 14:33:29 -------- dc----w C:\Program Files\AutoConnect 2007-06-02 07:15:16 -------- dc-h--w C:\Program Files\InstallShield Installation Information 2007-06-01 17:26:17 -------- dc----w C:\Program Files\BearShare Applications 2007-06-01 14:24:17 -------- dc----w C:\Program Files\Winamp 2007-05-31 16:03:57 -------- dc----w C:\DOCUME~1\ppp\DANEAP~1\teamspeak2 2007-05-31 15:35:56 -------- dc----w C:\Program Files\Gadu-Gadu 2007-05-31 15:12:49 -------- dc----w C:\Program Files\SkanerOnline 2007-05-31 14:43:19 -------- dc----w C:\Program Files\Neostrada TP 2007-05-30 23:29:13 -------- dc----w C:\Program Files\mIRC 2007-05-28 04:59:32 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-05-28 03:45:12 108,144 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-05-24 21:10:06 -------- dc----w C:\DOCUME~1\ppp\DANEAP~1\Gearbox Software 2007-05-24 14:22:56 1,459 -c--a-w C:\WINDOWS\eReg.dat 2007-05-22 14:34:48 -------- dc----w C:\Program Files\7-Zip 2007-05-05 12:23:26 41 -c--a-w C:\WINDOWS\system32\aaacef_s.dll 2007-04-29 08:35:02 -------- dc----w C:\Program Files\ImageMagick-6.3.3-Q16 2007-04-27 17:27:44 -------- dc----w C:\DOCUME~1\ppp\DANEAP~1\ABBYY 2007-04-26 18:32:40 -------- dc----w C:\Program Files\GoD 2007-04-23 21:51:30 -------- dc----w C:\Program Files\jv16 PowerTools 2006 2007-04-23 17:29:22 8,464 -c--a-w C:\WINDOWS\system32\sporder.dll 2007-04-23 16:07:10 -------- dc----w C:\Program Files\Dealio 2007-04-23 16:06:04 -------- dc----w C:\Program Files\themexp 2007-04-22 21:49:12 94,776 -c--a-w C:\WINDOWS\system32\perfc015.dat 2007-04-22 21:49:12 493,682 -c--a-w C:\WINDOWS\system32\perfh015.dat 2007-04-21 23:05:36 -------- dc----w C:\Program Files\Headshot Player 2007-04-21 13:55:16 25,992 -c--a-w C:\WINDOWS\system32\pgdfgsvc.exe 2007-04-05 23:35:02 -------- dc----w C:\DOCUME~1\ppp\DANEAP~1\InstallShield Installation Information 2007-04-05 15:19:36 6,221,824 -c--a-w C:\WINDOWS\system32\ImageMagickObject.dll 2007-04-03 12:25:06 -------- dc----w C:\Program Files\Vstplugins 2007-04-03 12:24:34 -------- dc----w C:\Program Files\Sony 2007-03-19 05:53:14 21,840 -c--a-w C:\WINDOWS\system32\SIntfNT.dll 2007-03-19 05:53:14 17,212 -c--a-w C:\WINDOWS\system32\SIntf32.dll 2007-03-19 05:53:14 12,067 -c--a-w C:\WINDOWS\system32\SIntf16.dll 2007-03-16 03:55:58 40,960 -c--a-w C:\WINDOWS\system32\frapsvid.dll 2007-03-07 23:51:00 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll 2007-03-05 19:10:20 4,961 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys 2006-07-31 00:28:50 56 -csha-r C:\WINDOWS\system32\E00ECEDCEA.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=d:\Program Files\FlashGet\jccatch.dll [2007-04-13 10:34] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 08:55] {6A87B991-A31F-4130-AE72-6D0C294BF082}=C:\Program Files\Dealio\kb103\Dealio.dll [2007-02-06 19:31] {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489}=C:\Program Files\Alcohol Toolbar\v3.1.0.0\Alcohol_Toolbar.dll [] {E5A1691B-D188-4419-AD02-90002030B8EE}=d:\PROGRA~1\FlashFXP\IEFlash.dll [2006-03-31 22:27] {F156768E-81EF-470C-9057-481BA8380DBA}=d:\Program Files\FlashGet\getflash.dll [2007-04-13 11:34] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07] "EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 11:54] "@"="" [] "au"="C:\Program Files\Dealio\DealioAU.exe" [2006-11-08 20:29] "NvMediaCenter"="NvMCTray.dll" [2006-06-01 17:22 C:\WINDOWS\system32\nvmctray.dll] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-07-29 03:48] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-06-01 16:04] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-07-21 13:06] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2006-02-17 15:03] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^ppp^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\ppp\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGEIA PhysX SysTray] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BySoft FreeRAM] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Liveinter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TXP] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\cda_menu.exe Contents of the 'Scheduled Tasks' folder 2007-06-02 15:00:02 C:\WINDOWS\tasks\AA358AC191BE08D1.job ******************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-02 17:57:55 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-06-02 17:58:42 C:\ComboFix-quarantined-files.txt ... 2007-06-02 17:58 --- E O F ---

**Posty:** 18165 · przez **wojtas** 02 Cze 2007, 21:07

skasuj:

O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb103\Dealio.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb103\Dealio.dll
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb103\res\DealioSearch.html
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb103\Dealio.dll

start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługe Nakido

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\Program Files\trl.exe

Folders to delete:

C:\Program Files\Dealio
C:\Program Files\Nakido

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z
combofixa

bardzo prosze o sprawdzenie loga

Bardzo prosze o sprawdzenie loga

Kto jest na forum