Ckvo.exe

**Posty:** 9 · przez **cubanlink** 27 Paź 2008, 12:32

witam...przeszukujac forum znalazlem wiele podobnych tematow jednak nie znalazlem zadnych konkretnych i skutecznych sposobow usuniecuia tego lekko denerwujacego problemu...jedyna powtarzajaca informacja bylo przeskanowanie combofix'em i wrzucenie loga...wiec oto on:

http://www.yousendit.com/download/Y2o4K3BNQ1BGOFR2Wmc9PQ

prosze o pomoc bardziej zorientowanych forumowiczow

pzodrawiam

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 13:33

cubanlink napisał(a):http://www.yousendit.com/download/Y2o4K ... OFR2Wmc9PQ

to jakis zart?? masz wklej.org a co najwazniejsze

http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

log w tagi 'code' wrzucamy na forum, dalej a gdzie jest log z Hijacka??

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

w takiej kolejnosci

**Posty:** 9 · przez **cubanlink** 27 Paź 2008, 14:27

dzieki magik za pomoc...przede wszystkim o uswiadomieniu ze jest cos takeigo jak wklej.org

...sorry za neiwiedze o wszystkich procedurach (moja wina, powinienem byl sie z nimi zaznajomic)...dzikie za cierpliwosc a oto logi:

Combofix

Kod: Zaznacz wszystko: ComboFix 08-10-25.01 - czaro 2008-10-27 13:16:26.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2601 [GMT 1:00] Uruchomiony z: C:\Documents and Settings\czaro\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-27 do 2008-10-27 ))))))))))))))))))))))))))))))) . 2008-10-27 13:10 . 2008-10-27 13:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-27 12:57 . 2008-10-27 13:14 <DIR> d-------- C:\SDFix 2008-10-26 18:18 . 2008-10-26 18:18 <DIR> d-------- C:\WINDOWS\USB Vibration 2008-10-26 18:18 . 2008-10-26 18:18 <DIR> d-------- C:\Program Files\USB Vibration 2008-10-26 18:18 . 2002-11-14 22:32 55,808 --a------ C:\WINDOWS\system32\devcon.exe 2008-10-26 18:18 . 2006-07-04 17:17 53,921 --a------ C:\WINDOWS\system32\drivers\hid7906.sys 2008-10-26 09:31 . 2008-10-26 09:31 <DIR> d-------- C:\Documents and Settings\czaro\Dane aplikacji\Leadertech 2008-10-26 09:19 . 2008-10-26 09:19 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-10-26 09:19 . 2008-10-26 09:19 <DIR> d-------- C:\Program Files\D-Tools 2008-10-26 09:19 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-10-26 09:19 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-10-24 22:24 . 2008-10-24 22:24 <DIR> d-------- C:\Program Files\BitComet 2008-10-24 20:30 . 2008-10-26 15:20 4,096 --a------ C:\WINDOWS\system32\crash 2008-10-24 16:56 . 2008-10-22 15:28 104,123 -r-hs---- C:\xlk9.com 2008-10-24 16:55 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-10-24 16:55 . 2004-08-03 22:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-10-24 16:55 . 2004-08-03 22:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-10-24 16:19 . 2008-10-24 21:30 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-24 16:19 . 2008-10-24 16:33 22,328 --a------ C:\Documents and Settings\czaro\Dane aplikacji\PnkBstrK.sys 2008-10-24 16:18 . 2008-10-24 16:18 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-10-24 16:18 . 2008-10-24 16:33 2,506,752 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-10-24 16:18 . 2008-10-24 21:30 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-10-24 16:18 . 2008-10-24 16:18 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-10-24 16:15 . 2008-10-24 16:15 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-24 16:14 . 2008-10-24 16:14 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2008-10-24 16:14 . 2008-10-24 16:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-24 16:14 . 2008-10-24 16:14 <DIR> d-------- C:\Program Files\AGEIA Technologies 2008-10-24 15:53 . 2008-10-24 15:53 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-10-24 14:25 . 2008-10-24 21:50 30 --a------ C:\WINDOWS\TextSpy.ini 2008-10-24 14:14 . 2008-10-24 14:14 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-24 14:14 . 2008-10-24 14:14 <DIR> d-------- C:\WINDOWS\Profiles 2008-10-24 14:14 . 2008-10-24 14:15 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-10-24 14:14 . 2008-10-24 14:14 <DIR> d-------- C:\Documents and Settings\czaro\Dane aplikacji\InterTrust 2008-10-24 14:14 . 1998-10-07 12:54 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2008-10-24 11:55 . 2008-10-24 11:55 <DIR> dr-h----- C:\Documents and Settings\czaro\Dane aplikacji\SecuROM 2008-10-24 11:55 . 2008-10-24 11:55 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-10-24 11:52 . 2008-10-24 11:52 <DIR> d--h-c--- C:\Documents and Settings\All Users\Dane aplikacji\{0691F710-1ECA-4B5A-9727-25554F1BFDC6} 2008-10-24 11:23 . 2008-10-24 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Codemasters 2008-10-24 11:18 . 2008-10-24 11:18 <DIR> d-------- C:\Program Files\OpenAL 2008-10-24 11:18 . 2008-04-28 14:53 805,400 -ra------ C:\WINDOWS\system32\tmpD9.tmp 2008-10-24 11:18 . 2008-04-28 14:53 805,400 -ra------ C:\WINDOWS\system32\tmpD8.tmp 2008-10-24 11:18 . 2008-10-24 11:18 444,952 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-10-24 11:18 . 2008-10-24 11:18 109,080 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-10-24 11:05 . 2004-08-04 01:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-10-24 11:05 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-10-24 11:05 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-10-24 11:04 . 2004-08-04 01:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2008-10-24 11:02 . 2008-10-24 09:07 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2008-10-24 11:02 . 2008-10-26 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2008-10-24 11:02 . 2008-10-24 10:39 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2008-10-24 11:02 . 2008-10-24 10:16 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2008-10-24 11:02 . 2001-10-26 18:29 176,157 --a--c--- C:\WINDOWS\system32\dllcache\dgrpsetu.dll 2008-10-24 11:00 . 2008-10-27 13:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2008-10-24 11:00 . 2008-10-24 11:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2008-10-24 11:00 . 2008-10-24 11:55 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-27 12:14 --------- d-----w C:\Program Files\neostrada tp 2008-10-26 22:15 --------- d-----w C:\Documents and Settings\czaro\Dane aplikacji\Skype 2008-10-26 17:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-24 14:53 --------- d-----w C:\Program Files\Skype 2008-10-24 09:39 --------- d-----w C:\Program Files\Common Files\BioWare 2008-10-24 09:32 --------- d-----w C:\Program Files\Winamp3 2008-10-24 09:32 --------- d-----w C:\Program Files\iZotope 2008-10-24 09:31 --------- d-----w C:\Program Files\Winamp 2008-10-24 09:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-10-24 09:20 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-24 09:16 279,712 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2008-10-24 09:16 25,888 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys 2008-10-24 09:01 --------- d-----w C:\Documents and Settings\czaro\Dane aplikacji\ATI 2008-10-24 09:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ATI 2008-10-24 08:56 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE 2008-10-24 08:44 --------- d-----w C:\Program Files\ATI Technologies 2008-10-24 08:29 --------- d-----w C:\Program Files\Thomson 2008-10-24 08:28 --------- d-----w C:\Program Files\Java Web Start 2008-10-24 08:28 --------- d-----w C:\Program Files\Java 2008-10-24 08:28 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-10-24 08:25 --------- d-----w C:\Program Files\Realtek AC97 2008-10-24 08:23 --------- d-----w C:\Program Files\Alwil Software 2008-10-24 08:10 --------- d-----w C:\Program Files\microsoft frontpage 2008-10-24 08:09 --------- d-----w C:\Program Files\Usługi online 2008-09-24 03:09 3,331,072 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-09-24 02:18 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-09-24 02:17 311,296 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-09-24 02:09 10,772,480 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-09-24 02:07 188,416 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-09-24 02:06 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-09-24 02:06 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-09-24 02:06 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-09-24 02:06 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-09-24 02:04 581,632 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-09-24 02:03 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-09-24 01:56 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-09-24 01:54 4,008,864 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-09-24 01:38 2,399,744 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-09-24 01:24 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-09-24 01:20 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-09-24 01:19 39,424 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-09-24 01:18 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-09-24 01:18 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-09-24 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-09-24 01:12 573,440 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-09-23 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-07-30 17:00 90,112 ----a-w C:\WINDOWS\system32\atibrtmon.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-27_11.13.23,82 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-10-27 12:10:44 1,196,032 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-27 12:10:44 24,576 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-10-27 12:10:42 1,196,032 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-27 12:10:42 24,576 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-10-27 09:51:44 58,596 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-27 12:17:22 58,596 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-10-27 09:51:44 74,230 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-10-27 12:17:22 74,230 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-10-27 09:51:44 392,296 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-27 12:17:22 392,296 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-10-27 09:51:44 448,004 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-27 12:17:22 448,004 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-27 12:13:21 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_3f0.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920] "SoundMan"="SOUNDMAN.EXE" [2006-06-20 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"= "D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"= "D:\\gry\\Mass Effect\\Binaries\\MassEffect.exe"= "D:\\gry\\Mass Effect\\MassEffectLauncher.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\gry\\GRID\\GRID.exe"= "D:\\gry\\frontlines\\Binaries\\FFOW.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18278:TCP"= 18278:TCP:BitComet 18278 TCP "18278:UDP"= 18278:UDP:BitComet 18278 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] S3 hid7906;hid7906;C:\WINDOWS\system32\drivers\hid7906.sys [2006-07-04 53921] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{663222de-a37f-11dd-b39a-000e50f5372f}] \Shell\AutoRun\command - H:\xih9.cmd \Shell\explore\Command - H:\xih9.cmd \Shell\open\Command - H:\xih9.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7980c5a0-a1db-11dd-8283-000e50f5372f}] \Shell\AutoRun\command - G:\xlk9.com \Shell\explore\Command - G:\xlk9.com \Shell\open\Command - G:\xlk9.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7980c5a1-a1db-11dd-8283-000e50f5372f}] \Shell\AutoRun\command - H:\xlk9.com \Shell\explore\Command - H:\xlk9.com \Shell\open\Command - H:\xlk9.com . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\czaro\Dane aplikacji\Mozilla\Firefox\Profiles\sbpr8dxe.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 13:17:52 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-27 13:18:16 ComboFix-quarantined-files.txt 2008-10-27 12:18:14 ComboFix2.txt 2008-10-27 10:13:36 Przed: 44 707 692 544 bajtów wolnych Po: 44,697,911,296 bajtów wolnych 209

HiJack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:20:06, on 2008-10-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\czaro\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=www.onet.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{1D262BBF-A57E-44E9-BA6F-2F487331B357}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{1D262BBF-A57E-44E9-BA6F-2F487331B357}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 4932 bytes

Raport z SdFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.238 [/b] Run by czaro on 2008-10-27 at 13:11 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 13:13:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] "khjeh"=hex:20,02,00,00,d6,a9,4b,34,8f,47,5c,de,b2,8e,82,1f,70,33,d9,09,b1,.. "hj34z0"=hex:20,b0,ca,7c,1d,d3,94,6b,7d,7e,ce,7d,22,8c,68,49,62,9f,3c,9a,11,.. "hj34z1"=hex:86,b0,ca,7c,65,d3,94,6b,7c,7e,cf,7d,23,8c,68,49,62,9f,3c,9a,11,.. "hj34z2"=hex:86,b0,ca,7c,65,d3,94,6b,7c,7e,cf,7d,23,8c,68,49,62,9f,3c,9a,11,.. "hj34z3"=hex:86,b0,ca,7c,65,d3,94,6b,7c,7e,cf,7d,23,8c,68,49,62,9f,3c,9a,11,.. "hj34z4"=hex:86,b0,ca,7c,65,d3,94,6b,7c,7e,cf,7d,23,8c,68,49,62,9f,3c,9a,11,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"="D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)" "D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"="D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)" "D:\\gry\\Mass Effect\\Binaries\\MassEffect.exe"="D:\\gry\\Mass Effect\\Binaries\\MassEffect.exe:*:Enabled:Mass Effect Game" "D:\\gry\\Mass Effect\\MassEffectLauncher.exe"="D:\\gry\\Mass Effect\\MassEffectLauncher.exe:*:Enabled:Mass Effect Launcher" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "D:\\gry\\GRID\\GRID.exe"="D:\\gry\\GRID\\GRID.exe:*:Enabled:GRID" "D:\\gry\\frontlines\\Binaries\\FFOW.exe"="D:\\gry\\frontlines\\Binaries\\FFOW.exe:*:Enabled:Frontlines Game" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 22 Oct 2008 104,123 ..SHR --- "C:\xlk9.com" Mon 27 Oct 2008 2,834 ...HR --- "C:\Documents and Settings\czaro\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" [b]Finished![/b]

nei iwem kompletnie co to oznacza wiec jeszcze raz prosze o pomoc

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 14:40

HJT czysty

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{663222de-a37f-11dd-b39a-000e50f5372f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7980c5a0-a1db-11dd-8283-000e50f5372f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7980c5a1-a1db-11dd-8283-000e50f5372f}]

zapisz jako fix.reg i odpal

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\xlk9.com H:\xih9.cmd G:\xlk9.com

Plik -> zapisz jako -> CFScript.txt. Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

**Posty:** 9 · przez **cubanlink** 27 Paź 2008, 14:51

dzieki bardzo magiku

wyczytalem jeszcze w niektorych postach ze nalezy usunac katalog 'Qoobox' z dysku C....zrobic to???

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 14:52

cubanlink napisał(a):Qoobox' z dysku C....zrobic to???

pewnie ze mozesz

i ten log. ktory sie wygenerowal po zrobieniu skryptu tez moglbys wkleic

**Posty:** 9 · przez **cubanlink** 27 Paź 2008, 17:23

folder usuniety a oto logi po operacji :

Combofix:

Kod: Zaznacz wszystko: ComboFix 08-10-25.01 - czaro 2008-10-27 16:17:41.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2595 [GMT 1:00] Uruchomiony z: D:\PROGRAMY\ckvo deleter\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-27 do 2008-10-27 ))))))))))))))))))))))))))))))) . 2008-10-27 13:10 . 2008-10-27 13:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-27 12:57 . 2008-10-27 13:14 <DIR> d-------- C:\SDFix 2008-10-26 18:18 . 2008-10-26 18:18 <DIR> d-------- C:\WINDOWS\USB Vibration 2008-10-26 18:18 . 2008-10-26 18:18 <DIR> d-------- C:\Program Files\USB Vibration 2008-10-26 18:18 . 2002-11-14 22:32 55,808 --a------ C:\WINDOWS\system32\devcon.exe 2008-10-26 18:18 . 2006-07-04 17:17 53,921 --a------ C:\WINDOWS\system32\drivers\hid7906.sys 2008-10-26 09:31 . 2008-10-26 09:31 <DIR> d-------- C:\Documents and Settings\czaro\Dane aplikacji\Leadertech 2008-10-26 09:19 . 2008-10-26 09:19 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-10-26 09:19 . 2008-10-26 09:19 <DIR> d-------- C:\Program Files\D-Tools 2008-10-26 09:19 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-10-26 09:19 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-10-24 22:24 . 2008-10-24 22:24 <DIR> d-------- C:\Program Files\BitComet 2008-10-24 20:30 . 2008-10-26 15:20 4,096 --a------ C:\WINDOWS\system32\crash 2008-10-24 16:55 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-10-24 16:55 . 2004-08-03 22:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-10-24 16:55 . 2004-08-03 22:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-10-24 16:19 . 2008-10-24 21:30 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-24 16:19 . 2008-10-24 16:33 22,328 --a------ C:\Documents and Settings\czaro\Dane aplikacji\PnkBstrK.sys 2008-10-24 16:18 . 2008-10-24 16:18 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-10-24 16:18 . 2008-10-24 16:33 2,506,752 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-10-24 16:18 . 2008-10-24 21:30 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-10-24 16:18 . 2008-10-24 16:18 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-10-24 16:15 . 2008-10-24 16:15 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-24 16:14 . 2008-10-24 16:14 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2008-10-24 16:14 . 2008-10-24 16:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-24 16:14 . 2008-10-24 16:14 <DIR> d-------- C:\Program Files\AGEIA Technologies 2008-10-24 15:53 . 2008-10-24 15:53 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-10-24 14:25 . 2008-10-24 21:50 30 --a------ C:\WINDOWS\TextSpy.ini 2008-10-24 14:14 . 2008-10-24 14:14 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-24 14:14 . 2008-10-24 14:14 <DIR> d-------- C:\WINDOWS\Profiles 2008-10-24 14:14 . 2008-10-24 14:15 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-10-24 14:14 . 2008-10-24 14:14 <DIR> d-------- C:\Documents and Settings\czaro\Dane aplikacji\InterTrust 2008-10-24 14:14 . 1998-10-07 12:54 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2008-10-24 11:55 . 2008-10-24 11:55 <DIR> dr-h----- C:\Documents and Settings\czaro\Dane aplikacji\SecuROM 2008-10-24 11:55 . 2008-10-24 11:55 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-10-24 11:52 . 2008-10-24 11:52 <DIR> d--h-c--- C:\Documents and Settings\All Users\Dane aplikacji\{0691F710-1ECA-4B5A-9727-25554F1BFDC6} 2008-10-24 11:23 . 2008-10-24 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Codemasters 2008-10-24 11:18 . 2008-10-24 11:18 <DIR> d-------- C:\Program Files\OpenAL 2008-10-24 11:18 . 2008-04-28 14:53 805,400 -ra------ C:\WINDOWS\system32\tmpD9.tmp 2008-10-24 11:18 . 2008-04-28 14:53 805,400 -ra------ C:\WINDOWS\system32\tmpD8.tmp 2008-10-24 11:18 . 2008-10-24 11:18 444,952 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-10-24 11:18 . 2008-10-24 11:18 109,080 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-10-24 11:05 . 2004-08-04 01:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-10-24 11:05 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-10-24 11:05 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-10-24 11:04 . 2004-08-04 01:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2008-10-24 11:02 . 2008-10-24 09:07 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2008-10-24 11:02 . 2008-10-24 11:02 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2008-10-24 11:02 . 2008-10-26 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2008-10-24 11:02 . 2008-10-24 10:39 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2008-10-24 11:02 . 2008-10-24 10:16 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2008-10-24 11:02 . 2001-10-26 18:29 176,157 --a--c--- C:\WINDOWS\system32\dllcache\dgrpsetu.dll 2008-10-24 11:00 . 2008-10-27 13:17 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2008-10-24 11:00 . 2008-10-24 11:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2008-10-24 11:00 . 2008-10-24 11:55 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-27 15:17 --------- d-----w C:\Program Files\neostrada tp 2008-10-27 15:17 --------- d-----w C:\Documents and Settings\czaro\Dane aplikacji\Skype 2008-10-26 17:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-24 14:53 --------- d-----w C:\Program Files\Skype 2008-10-24 09:39 --------- d-----w C:\Program Files\Common Files\BioWare 2008-10-24 09:32 --------- d-----w C:\Program Files\Winamp3 2008-10-24 09:32 --------- d-----w C:\Program Files\iZotope 2008-10-24 09:31 --------- d-----w C:\Program Files\Winamp 2008-10-24 09:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-10-24 09:20 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-24 09:16 279,712 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2008-10-24 09:16 25,888 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys 2008-10-24 09:01 --------- d-----w C:\Documents and Settings\czaro\Dane aplikacji\ATI 2008-10-24 09:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ATI 2008-10-24 08:56 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE 2008-10-24 08:44 --------- d-----w C:\Program Files\ATI Technologies 2008-10-24 08:29 --------- d-----w C:\Program Files\Thomson 2008-10-24 08:28 --------- d-----w C:\Program Files\Java Web Start 2008-10-24 08:28 --------- d-----w C:\Program Files\Java 2008-10-24 08:28 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-10-24 08:25 --------- d-----w C:\Program Files\Realtek AC97 2008-10-24 08:23 --------- d-----w C:\Program Files\Alwil Software 2008-10-24 08:10 --------- d-----w C:\Program Files\microsoft frontpage 2008-10-24 08:09 --------- d-----w C:\Program Files\Usługi online 2008-09-24 03:09 3,331,072 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-09-24 02:18 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-09-24 02:17 311,296 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-09-24 02:09 10,772,480 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-09-24 02:07 188,416 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-09-24 02:06 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-09-24 02:06 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-09-24 02:06 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-09-24 02:06 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-09-24 02:04 581,632 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-09-24 02:03 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-09-24 01:56 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-09-24 01:54 4,008,864 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-09-24 01:38 2,399,744 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-09-24 01:24 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-09-24 01:20 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-09-24 01:19 39,424 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-09-24 01:18 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-09-24 01:18 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-09-24 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-09-24 01:12 573,440 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-09-23 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-07-30 17:00 90,112 ----a-w C:\WINDOWS\system32\atibrtmon.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920] "SoundMan"="SOUNDMAN.EXE" [2006-06-20 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"= "D:\\gry\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"= "D:\\gry\\Mass Effect\\Binaries\\MassEffect.exe"= "D:\\gry\\Mass Effect\\MassEffectLauncher.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\gry\\GRID\\GRID.exe"= "D:\\gry\\frontlines\\Binaries\\FFOW.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18278:TCP"= 18278:TCP:BitComet 18278 TCP "18278:UDP"= 18278:UDP:BitComet 18278 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] S3 hid7906;hid7906;C:\WINDOWS\system32\drivers\hid7906.sys [2006-07-04 53921] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\czaro\Dane aplikacji\Mozilla\Firefox\Profiles\sbpr8dxe.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 16:19:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-27 16:19:34 ComboFix-quarantined-files.txt 2008-10-27 15:19:32 ComboFix2.txt 2008-10-27 12:46:35 Przed: 44 912 316 416 bajtów wolnych Po: 44,905,156,608 bajtów wolnych 178

HiJack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:20:35, on 2008-10-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\WINDOWS\explorer.exe D:\PROGRAMY\ckvo deleter\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=www.onet.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{1D262BBF-A57E-44E9-BA6F-2F487331B357}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{1D262BBF-A57E-44E9-BA6F-2F487331B357}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 4963 bytes

jak teraz to wyglada???

**Posty:** 7956 · przez **Magik** 27 Paź 2008, 18:04

prawie idealnie

usuwasz te 2 pliki

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\tmpD9.tmp C:\WINDOWS\system32\tmpD8.tmp

Plik -> zapisz jako -> CFScript.txt. Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

i tyle ode mnie

Pozdrawiam

**Posty:** 9 · przez **cubanlink** 27 Paź 2008, 23:10

tak zrobilem

dzieki za pomoc magiku

pozdrawiam

Ckvo.exe

Ckvo.exe

Ckvo.exe

Ckvo.exe

Ckvo.exe

Re: ckvo.exe

Ckvo.exe

Re: ckvo.exe

Ckvo.exe

Re: ckvo.exe

Kto jest na forum