chyba wirus

**Posty:** 749 · przez **dresik** 06 Lip 2007, 23:09

Logfile of HijackThis v1.99.1
Scan saved at 22:43:07, on 2007-07-06
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Eset\nod32kui.exe
J:\programy\Gmail Notifier\gnotify.exe
C:\WINDOWS\system32\qttask.exe
C:\WINDOWS\system32\dllcache\ivchost.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
F:\jarek\programy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\programy\acrobe reader\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - J:\programy\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] J:\programy\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [startkey] C:\WINDOWS\System32\win.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "J:\programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = J:\programy\Office\OSA9.EXE
O8 - Extra context menu item: Download with GetRight Pro - J:\programy\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Pro Browser - J:\programy\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - J:\programy\Ebay\Ebay.htm
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: ms hexidecimal defx (mshexdefx) - Unknown owner - C:\WINDOWS\system32\dllcache\ivchost.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

odpalam neo i zmienia mi sie wyglad pulpitu i rozlacza neo pomocy!!

**Posty:** 18165 · przez **wojtas** 06 Lip 2007, 23:13

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

mshexdefx

Files to delete:

C:\WINDOWS\System32\win.exe
C:\WINDOWS\system32\dllcache\ivchost.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [startkey] C:\WINDOWS\System32\win.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: ms hexidecimal defx (mshexdefx) - Unknown owner - C:\WINDOWS\system32\dllcache\ivchost.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa + hijack

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 749 · przez **dresik** 06 Lip 2007, 23:17

a mam to robic z odpalonym neo??

**Posty:** 18165 · przez **wojtas** 06 Lip 2007, 23:18

dresik napisał(a):a mam to robic z odpalonym neo??

mozesz ale nie musisz

**Posty:** 749 · przez **dresik** 06 Lip 2007, 23:54

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\xnlgejuo

*******************

Script file located at: \??\C:\Documents and Settings\liypjitg.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver mshexdefx unloaded successfully.

File C:\WINDOWS\System32\win.exe not found!
Deletion of file C:\WINDOWS\System32\win.exe failed!

Could not process line:
C:\WINDOWS\System32\win.exe
Status: 0xc0000034

File C:\WINDOWS\system32\dllcache\ivchost.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:28:36, on 2007-07-06 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32kui.exe J:\programy\Gmail Notifier\gnotify.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\domek\Pulpit\HideBUS.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\domek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com O1 - Hosts: 127.255.255.255 www.alcohol-soft.com O1 - Hosts: 127.255.255.255 images.alcohol-soft.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\programy\acrobe reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - J:\programy\GetRight\xx2gr.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] J:\programy\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [startkey] C:\WINDOWS\System32\win.exe O4 - HKCU\..\Run: [Gadu-Gadu] "J:\programy\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = J:\programy\Office\OSA9.EXE O8 - Extra context menu item: Download with GetRight Pro - J:\programy\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Pro Browser - J:\programy\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - J:\programy\Ebay\Ebay.htm O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E2A1553-9F66-4650-823B-250AE6B7801B}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

"domek" - 2007-07-06 23:30:24 - ComboFix 07-07-04.4

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\ALLUSE~1\DANEAP~1.\TEMP
C:\DOCUME~1\domek\DANEAP~1.\macromedia\Flash Player\#SharedObjects\RT43HQMN\www.broadcaster.com
C:\DOCUME~1\domek\DANEAP~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\domek\DANEAP~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\scvhost.exe

((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 )))))))))))))))))))))))))))))))

2007-07-06 23:29 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-06 23:13 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-06 23:13 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-06 23:13 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-06 23:13 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-06 23:13 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-07-06 23:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-06 23:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-06 23:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-06 22:44 65,763 --a------ C:\msnd.exe
2007-07-01 11:42 <DIR> d-------- C:\Program Files\Canon
2007-07-01 11:34 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-07-01 11:34 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-07-01 11:34 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-30 18:06 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Media Player Classic
2007-06-30 16:56 <DIR> d-------- C:\Program Files\Real Alternative
2007-06-30 16:56 <DIR> d-------- C:\Program Files\Media Player Classic
2007-06-30 16:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real
2007-06-29 17:13 1,984 --a------ C:\WINDOWS\system32\drivers\papycpu2.sys
2007-06-29 17:13 1,856 --a------ C:\WINDOWS\system32\drivers\papyjoy.sys
2007-06-29 17:11 <DIR> d-------- C:\Papyrus
2007-06-28 13:48 <DIR> d-------- C:\Program Files\Kolekcja Klasyki
2007-06-27 19:28 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\MSN6
2007-06-27 19:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\MSN6
2007-06-27 12:53 <DIR> d-------- C:\Program Files\EA SPORTS
2007-06-26 16:44 <DIR> d-------- C:\DOCUME~1\domek\.jpi_cache
2007-06-26 16:43 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Talkback
2007-06-26 10:32 122,880 --a------ C:\WINDOWS\UnGins.exe
2007-06-24 22:05 <DIR> d-------- C:\Program Files\SkanerOnline
2007-06-24 22:04 <DIR> d---s---- C:\DOCUME~1\domek\UserData
2007-06-24 20:12 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-06-24 13:01 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Ahead
2007-06-23 23:36 <DIR> d-------- C:\Program Files\Common Files\BOONTY Shared
2007-06-23 23:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\BOONTY
2007-06-18 13:05 0 --a------ C:\WINDOWS\ijl11.dll
2007-06-17 22:40 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2007-06-17 22:05 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Hamachi
2007-06-17 19:21 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Skype
2007-06-17 19:20 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-06-17 19:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-06-15 13:02 <DIR> d-------- C:\WINDOWS\LastGood
2007-06-15 12:58 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-06-15 12:21 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2007-06-15 11:54 <DIR> d-------- C:\TEMP
2007-06-14 11:41 307,200 --a------ C:\WINDOWS\IsUn0415.exe
2007-06-14 10:44 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-06-14 10:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems
2007-06-13 18:38 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-06-13 18:38 <DIR> d--h----- C:\DOCUME~1\domek\InstallAnywhere
2007-06-13 18:10 <DIR> d-------- C:\Program Files\MyPhoneExplorer
2007-06-13 18:10 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\MyPhoneExplorer
2007-06-13 18:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Documents
2007-06-13 18:04 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-06-13 18:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca
2007-06-13 18:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson
2007-06-13 17:22 24,960 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-06-13 17:15 18,704 -ra------ C:\WINDOWS\system32\drivers\se27nd5.sys
2007-06-13 17:13 90,800 -ra------ C:\WINDOWS\system32\drivers\se27unic.sys
2007-06-13 17:13 5,872 -ra------ C:\WINDOWS\system32\drivers\se27wh.sys
2007-06-13 17:13 4,128 -ra------ C:\WINDOWS\system32\drivers\se27cr.sys
2007-06-13 17:12 88,688 -ra------ C:\WINDOWS\system32\drivers\SE27mgmt.sys
2007-06-13 17:12 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cmnt.sys
2007-06-13 17:12 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cm.sys
2007-06-13 17:09 86,560 -ra------ C:\WINDOWS\system32\drivers\SE27obex.sys
2007-06-13 17:07 97,184 -ra------ C:\WINDOWS\system32\drivers\SE27mdm.sys
2007-06-13 17:07 9,360 -ra------ C:\WINDOWS\system32\drivers\SE27mdfl.sys
2007-06-13 17:03 61,600 -ra------ C:\WINDOWS\system32\drivers\SE27bus.sys
2007-06-13 17:03 5,872 -ra------ C:\WINDOWS\system32\drivers\SE27whnt.sys
2007-06-13 17:02 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2007-06-13 17:00 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Teleca
2007-06-13 16:57 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-06-13 16:57 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2007-06-13 16:55 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2007-06-13 16:53 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-06-10 17:33 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Real
2007-06-10 17:03 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Xfire
2007-06-10 16:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles
2007-06-10 16:39 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-06-10 16:39 <DIR> d-------- C:\WINDOWS\nview
2007-06-10 16:39 <DIR> d-------- C:\NVIDIA
2007-06-10 16:35 <DIR> d-------- C:\WINDOWS\Cache
2007-06-10 16:33 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2007-06-10 16:32 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll
2007-06-10 16:32 974,848 --a------ C:\WINDOWS\system32\dxdiag.exe
2007-06-10 16:32 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2007-06-10 16:32 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe
2007-06-10 16:32 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll
2007-06-10 16:32 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll
2007-06-10 16:32 79,360 --a------ C:\WINDOWS\system32\dpwsockx.dll
2007-06-10 16:32 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll
2007-06-10 16:32 76,800 --a------ C:\WINDOWS\system32\dmscript.dll
2007-06-10 16:32 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll
2007-06-10 16:32 723,968 --a------ C:\WINDOWS\system32\dpnet.dll
2007-06-10 16:32 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2007-06-10 16:32 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll
2007-06-10 16:32 667,648 --a------ C:\WINDOWS\system32\dinput8.dll
2007-06-10 16:32 648,704 --a------ C:\WINDOWS\system32\dinput.dll
2007-06-10 16:32 64,512 --a------ C:\WINDOWS\system32\amstream.dll
2007-06-10 16:32 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll
2007-06-10 16:32 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-06-08 13:39:07 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2009-06-08 13:39:06 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2009-06-08 13:39:05 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-06-15 10:58:14 50,572 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-06-15 10:58:14 358,452 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-06-08 11:33:54 -------- d-----w C:\Program Files\Usługi online

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-04 00:17 54248 --a------ J:\programy\acrobe reader\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31FF080D-12A3-439A-A2EF-4BA95A3148E8}]
2006-12-08 17:45 243016 --a------ J:\programy\GetRight\xx2gr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2009-06-08 15:39]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="J:\programy\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"nwiz"="nwiz.exe" [2004-07-15 11:42 C:\WINDOWS\system32\nwiz.exe]
"@"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29]
"startkey"="C:\WINDOWS\System32\win.exe" []
"Gadu-Gadu"="J:\programy\Gadu-Gadu\gg.exe" [2007-05-10 16:36]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 16:10]
"J:\programy\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
"J:\programy\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
C:\WINDOWS\System32\win.exe s

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
rundll32 iesetup.dll,IEAccessUserInst

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F2042EE3-DE0E-AF96-C700-F4600B05E70F}
C:\WINDOWS\scvhost.exe

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-06 23:32:07
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-06 23:32:40
C:\ComboFix-quarantined-files.txt ... 2007-07-06 23:32

--- E O F ---

**Posty:** 18165 · przez **wojtas** 07 Lip 2007, 09:16

O4 - HKCU\..\Run: [startkey] C:\WINDOWS\System32\win.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.

uruchom narzędzie : The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\msnd.exe
C:\WINDOWS\ijl11.dll

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

wklejasz do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installedcomponents\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F2042EE3-DE0E-AF96-C700-F4600B05E70F}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

**Posty:** 749 · przez **dresik** 07 Lip 2007, 15:05

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\rbixrtsu

*******************

Script file located at: \??\C:\WINDOWS\System32\vdgugkul.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\msnd.exe deleted successfully.
File C:\WINDOWS\ijl11.dll deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Logfile of HijackThis v1.99.1
Scan saved at 14:39:34, on 2007-07-07
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
J:\programy\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NEOSTR~1\neostradatp.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\domek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\programy\acrobe reader\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - J:\programy\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] J:\programy\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [startkey] C:\WINDOWS\System32\win.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "J:\programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = J:\programy\Office\OSA9.EXE
O8 - Extra context menu item: Download with GetRight Pro - J:\programy\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Pro Browser - J:\programy\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - J:\programy\Ebay\Ebay.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E2A1553-9F66-4650-823B-250AE6B7801B}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Kod: Zaznacz wszystko: "domek" - 2007-07-07 14:40:05 - ComboFix 07-07-04.4 ((((((((((((((((((((((((( Files Created from 2007-06-07 to 2007-07-07 ))))))))))))))))))))))))))))))) 2007-07-06 23:52 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-07-06 23:29 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-06 23:13 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-07-06 23:13 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-07-06 23:13 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-07-06 23:13 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-07-06 23:13 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-07-06 23:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-07-06 23:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-07-06 23:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-07-01 11:42 <DIR> d-------- C:\Program Files\Canon 2007-07-01 11:34 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-07-01 11:34 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-07-01 11:34 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-06-30 18:06 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Media Player Classic 2007-06-30 16:56 <DIR> d-------- C:\Program Files\Real Alternative 2007-06-30 16:56 <DIR> d-------- C:\Program Files\Media Player Classic 2007-06-30 16:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-06-29 17:13 1,984 --a------ C:\WINDOWS\system32\drivers\papycpu2.sys 2007-06-29 17:13 1,856 --a------ C:\WINDOWS\system32\drivers\papyjoy.sys 2007-06-29 17:11 <DIR> d-------- C:\Papyrus 2007-06-28 13:48 <DIR> d-------- C:\Program Files\Kolekcja Klasyki 2007-06-27 19:28 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\MSN6 2007-06-27 19:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\MSN6 2007-06-27 12:53 <DIR> d-------- C:\Program Files\EA SPORTS 2007-06-26 16:44 <DIR> d-------- C:\DOCUME~1\domek\.jpi_cache 2007-06-26 16:43 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Talkback 2007-06-26 10:32 122,880 --a------ C:\WINDOWS\UnGins.exe 2007-06-24 22:05 <DIR> d-------- C:\Program Files\SkanerOnline 2007-06-24 22:04 <DIR> d---s---- C:\DOCUME~1\domek\UserData 2007-06-24 20:12 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-06-24 13:01 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Ahead 2007-06-23 23:36 <DIR> d-------- C:\Program Files\Common Files\BOONTY Shared 2007-06-23 23:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\BOONTY 2007-06-17 22:40 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-06-17 22:05 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Hamachi 2007-06-17 19:21 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Skype 2007-06-17 19:20 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-06-17 19:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype 2007-06-15 13:02 <DIR> d-------- C:\WINDOWS\LastGood 2007-06-15 12:58 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-06-15 12:21 <DIR> d-------- C:\WINDOWS\system32\URTTemp 2007-06-15 11:54 <DIR> d-------- C:\TEMP 2007-06-14 11:41 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-06-14 10:44 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-06-14 10:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems 2007-06-13 18:38 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-06-13 18:38 <DIR> d--h----- C:\DOCUME~1\domek\InstallAnywhere 2007-06-13 18:10 <DIR> d-------- C:\Program Files\MyPhoneExplorer 2007-06-13 18:10 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\MyPhoneExplorer 2007-06-13 18:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Documents 2007-06-13 18:04 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-06-13 18:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca 2007-06-13 18:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson 2007-06-13 17:22 24,960 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-06-13 17:15 18,704 -ra------ C:\WINDOWS\system32\drivers\se27nd5.sys 2007-06-13 17:13 90,800 -ra------ C:\WINDOWS\system32\drivers\se27unic.sys 2007-06-13 17:13 5,872 -ra------ C:\WINDOWS\system32\drivers\se27wh.sys 2007-06-13 17:13 4,128 -ra------ C:\WINDOWS\system32\drivers\se27cr.sys 2007-06-13 17:12 88,688 -ra------ C:\WINDOWS\system32\drivers\SE27mgmt.sys 2007-06-13 17:12 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cmnt.sys 2007-06-13 17:12 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cm.sys 2007-06-13 17:09 86,560 -ra------ C:\WINDOWS\system32\drivers\SE27obex.sys 2007-06-13 17:07 97,184 -ra------ C:\WINDOWS\system32\drivers\SE27mdm.sys 2007-06-13 17:07 9,360 -ra------ C:\WINDOWS\system32\drivers\SE27mdfl.sys 2007-06-13 17:03 61,600 -ra------ C:\WINDOWS\system32\drivers\SE27bus.sys 2007-06-13 17:03 5,872 -ra------ C:\WINDOWS\system32\drivers\SE27whnt.sys 2007-06-13 17:02 182,880 --a------ C:\WINDOWS\system32\iuengine.dll 2007-06-13 17:00 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Teleca 2007-06-13 16:57 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-06-13 16:57 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2007-06-13 16:55 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-06-13 16:53 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-06-10 17:33 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Real 2007-06-10 17:03 <DIR> d-------- C:\DOCUME~1\domek\DANEAP~1\Xfire 2007-06-10 16:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-06-10 16:39 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-06-10 16:39 <DIR> d-------- C:\WINDOWS\nview 2007-06-10 16:39 <DIR> d-------- C:\NVIDIA 2007-06-10 16:35 <DIR> d-------- C:\WINDOWS\Cache 2007-06-10 16:33 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-06-10 16:32 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-06-10 16:32 974,848 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-06-10 16:32 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-06-10 16:32 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-06-10 16:32 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-06-10 16:32 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-06-10 16:32 79,360 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-06-10 16:32 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-06-10 16:32 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-06-10 16:32 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-06-10 16:32 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-06-10 16:32 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-06-10 16:32 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-06-10 16:32 667,648 --a------ C:\WINDOWS\system32\dinput8.dll 2007-06-10 16:32 648,704 --a------ C:\WINDOWS\system32\dinput.dll 2007-06-10 16:32 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-06-10 16:32 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-06-10 16:32 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-06-10 16:32 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2009-06-08 13:39:07 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2009-06-08 13:39:06 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2009-06-08 13:39:05 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-06-15 10:58:14 50,572 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-15 10:58:14 358,452 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-08 11:33:54 -------- d-----w C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2003-11-04 00:17 54248 --a------ J:\programy\acrobe reader\Reader\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31FF080D-12A3-439A-A2EF-4BA95A3148E8}] 2006-12-08 17:45 243016 --a------ J:\programy\GetRight\xx2gr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2009-06-08 15:39] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="J:\programy\Gmail Notifier\gnotify.exe" [2005-07-15 23:48] "nwiz"="nwiz.exe" [2004-07-15 11:42 C:\WINDOWS\system32\nwiz.exe] "@"="" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29] "startkey"="C:\WINDOWS\System32\win.exe" [] "Gadu-Gadu"="J:\programy\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 16:10] "J:\programy\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "J:\programy\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9B71D88C-C598-4935-C5D1-43AA4DB90836} C:\WINDOWS\System32\win.exe s HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-07 14:41:48 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-07 14:42:44 C:\ComboFix-quarantined-files.txt ... 2007-07-07 14:42 C:\ComboFix2.txt ... 2007-07-06 23:32 --- E O F ---

**Posty:** 18165 · przez **wojtas** 07 Lip 2007, 19:35

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"startkey"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

chyba wirus

chyba wirus

Kto jest na forum