cr@ck oraz trojan w jednym?

**Posty:** 2042 · przez **Wojtaz** 16 Sty 2008, 19:20

"Kupiłem" cr@ck@ to Ulead VideoStudio 11 Plus z Emule no i zainstalował się, komp się zresetował, ale mam chyba trojana, Avast nic nie wykrył.
Sądzę o tym, że pojawił mi się:

Kod: Zaznacz wszystko: Użytkownik Wojtaz chce wyłączyć komputer

daję oki no i się zresetował.
Log z Hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:17:36, on 2008-01-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\nvsvc32.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\Alwil Software\Avast4\setup\avast.setup D:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Wojtaz\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [V0230Mon.exe] F:\DRIVERS\English\V0230Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 6778 bytes

Edit: no i uruchamiał mi się wpis z folderu: Ulead VideoStudio 11 Plus, więc go wyłączyłem podczas uruchamiania, nazywa się:

Kod: Zaznacz wszystko: uvPL.exe

[/code]

**Posty:** 3854 · przez **Dzi@dek** 16 Sty 2008, 20:16

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

Skasuj te wpisy w HJ pogrubione ręcznie usuwasz do kosza.
I daj log z Combofix

Kod: Zaznacz wszystko: uvPL.exe

to jest plik startujący od Ulead.
Na drugi raz kupuj w bezpiecznym sklepie.

Autor postu otrzymał pochwałę

**Posty:** 2042 · przez **Wojtaz** 17 Sty 2008, 16:51

Log z ComboFixa przed usunięciem wpisów z Hijacka:

Kod: Zaznacz wszystko: ComboFix 08-01-17.5 - Wojtaz 2008-01-17 15:46:28.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.228 [GMT 1:00] Running from: C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]00316C5 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0031B88 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0031D8B.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0032C22.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0032EE1.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm . ((((((((((((((((((((((((( Files Created from 2007-12-17 to 2008-01-17 ))))))))))))))))))))))))))))))) . 2008-01-17 15:45 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-16 18:47 . 2008-01-16 18:48 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-01-16 17:46 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-01-16 17:46 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-01-16 17:46 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-01-16 17:46 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-01-16 17:46 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-01-16 17:46 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-01-16 17:45 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-01-16 17:45 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-01-16 15:38 . 2008-01-16 15:44 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Ulead Systems 2008-01-16 15:37 . 2008-01-16 15:37 <DIR> d-------- C:\Program Files\Windows Media Components 2008-01-16 15:37 . 2008-01-16 15:37 <DIR> d-------- C:\Program Files\Common Files\InterVideo 2008-01-16 15:37 . 2007-03-27 19:56 210,456 --a------ C:\WINDOWS\system32\IVIresizeW7.dll 2008-01-16 15:37 . 2007-03-27 19:56 206,360 --a------ C:\WINDOWS\system32\IVIresizeA6.dll 2008-01-16 15:37 . 2007-03-27 19:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeP6.dll 2008-01-16 15:37 . 2007-03-27 19:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeM6.dll 2008-01-16 15:37 . 2007-03-27 19:56 194,072 --a------ C:\WINDOWS\system32\IVIresizePX.dll 2008-01-16 15:37 . 2007-03-27 19:56 26,136 --a------ C:\WINDOWS\system32\IVIresize.dll 2008-01-16 15:36 . 2008-01-16 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-01-16 10:21 . 2008-01-16 10:21 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\AdobeUM 2008-01-16 07:35 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2008-01-16 07:33 . 2008-01-16 07:34 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-01-14 16:14 . 2008-01-16 07:35 421 --a------ C:\WINDOWS\ODBC.INI 2008-01-14 16:13 . 2008-01-14 16:13 <DIR> d-------- C:\Program Files\Microsoft Works 2008-01-14 16:12 . 2008-01-14 16:12 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-01-13 18:03 . 2008-01-13 18:03 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\AccurateRip 2008-01-12 18:54 . 2000-05-22 22:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-01-12 16:58 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-01-12 16:58 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll 2008-01-12 16:58 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-01-12 14:02 . 2008-01-11 12:39 <DIR> d-------- C:\Program Files\AviSynth 2.5 2008-01-11 18:45 . 2008-01-11 18:45 <DIR> d-------- C:\WINDOWS\Applian FLV Player 2008-01-11 13:30 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2008-01-11 13:04 . 2008-01-11 13:04 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Ahead 2008-01-11 12:47 . 2003-09-21 07:09 794,624 --a------ C:\WINDOWS\system32\mpgfiltr.ax 2008-01-11 12:45 . 2008-01-11 12:45 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\DivX 2008-01-11 12:43 . 2008-01-04 22:58 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2008-01-11 12:43 . 2008-01-04 22:58 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2008-01-11 12:39 . 2008-01-11 12:39 <DIR> d-------- C:\Program Files\Media Player Classic 2008-01-11 12:39 . 2008-01-11 12:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-01-11 09:39 . 2008-01-12 17:01 1,738 --a------ C:\WINDOWS\unins000.dat 2008-01-11 09:36 . 2008-01-11 09:36 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity 2008-01-11 08:36 . 2004-08-04 00:38 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-01-11 08:36 . 2004-08-04 00:38 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-01-11 08:36 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-01-11 08:36 . 2001-10-26 16:57 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-01-10 13:35 . 2008-01-16 19:07 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-01-09 14:09 . 2008-01-09 14:09 <DIR> d-------- C:\WINDOWS\system32\URTTemp 2008-01-09 14:02 . 2008-01-09 14:02 <DIR> d-------- C:\WINDOWS\San Andreas Mod Installer 2008-01-09 13:40 . 2008-01-09 13:40 737,280 --a------ C:\WINDOWS\iun6002.exe 2008-01-08 18:49 . 2008-01-12 15:08 <DIR> d-------- C:\Movies 2008-01-07 15:59 . 2008-01-07 15:59 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-01-07 15:59 . 2006-09-28 13:10 11,648 --a------ C:\WINDOWS\system32\drivers\gggen.sys 2008-01-07 15:44 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2008-01-07 15:15 . 2008-01-07 15:16 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-01-07 13:22 . 2004-08-03 23:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-01-06 20:09 . 2008-01-06 20:09 <DIR> d-------- C:\WINDOWS\Sun 2008-01-06 20:08 . 2008-01-06 20:08 <DIR> d-------- C:\Program Files\Java 2008-01-06 20:08 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-06 20:06 . 2008-01-06 20:06 <DIR> d-------- C:\Program Files\Common Files\Java 2008-01-06 20:04 . 2008-01-06 20:04 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Gadu-Gadu 2008-01-06 19:42 . 2008-01-15 20:16 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2008-01-06 19:42 . 2008-01-06 19:42 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-01-06 19:19 . 2008-01-06 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2008-01-06 19:08 . 2008-01-16 19:14 116 --a------ C:\WINDOWS\NeroDigital.ini 2008-01-06 19:07 . 2008-01-06 19:07 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\muvee Technologies 2008-01-06 19:07 . 2008-01-06 19:08 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Creative 2008-01-06 19:07 . 2008-01-06 19:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-01-06 17:50 . 2008-01-15 14:02 2,152 --a------ C:\WINDOWS\wincmd.ini 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF 2008-01-06 17:50 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF 2008-01-06 17:44 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-01-06 17:42 . 2008-01-06 17:42 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Media Player Classic 2008-01-06 17:42 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd 2008-01-06 17:40 . 2008-01-06 17:40 <DIR> d-------- C:\Program Files\Common Files\muvee Technologies 2008-01-06 17:40 . 2008-01-06 17:40 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies 2008-01-06 17:38 . 2008-01-06 17:39 <DIR> d-------- C:\Program Files\SightSpeed 2008-01-06 17:37 . 2003-03-19 06:19 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL 2008-01-06 17:37 . 2003-03-18 13:14 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-01-06 17:37 . 2003-02-20 21:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-01-06 17:37 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-01-06 17:36 . 2008-01-07 13:22 <DIR> d-------- C:\Program Files\Creative 2008-01-06 17:33 . 2008-01-06 17:33 <DIR> d-------- C:\WINDOWS\CtDrvInstall 2008-01-06 17:13 . 2005-04-20 12:32 2,916,352 --------- C:\WINDOWS\UNNMP.exe 2008-01-06 17:13 . 2006-03-22 12:55 47,867 --------- C:\WINDOWS\UNNMP.cfg 2008-01-06 17:12 . 2008-01-06 17:12 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-01-06 17:12 . 2005-07-29 16:12 2,977,792 --------- C:\WINDOWS\UNNeroVision.exe 2008-01-06 17:12 . 2006-03-22 12:55 179,261 --------- C:\WINDOWS\UNNeroVision.cfg 2008-01-06 17:12 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-01-06 17:12 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll 2008-01-06 17:10 . 2004-03-09 00:00 224,016 --a------ C:\WINDOWS\system32\TabCtl32.ocx 2008-01-06 17:08 . 2008-01-06 17:08 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-06 17:08 . 2008-01-06 17:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-01-06 17:08 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-16 17:47 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-06 14:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Talkback 2008-01-06 14:36 --------- d-----w C:\Program Files\SAGEM 2008-01-06 14:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield 2008-01-06 14:33 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-06 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-01-06 14:28 --------- d-----w C:\Program Files\Analog Devices 2008-01-06 14:22 --------- d-----w C:\Program Files\AMD 2008-01-06 14:11 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-06 14:09 --------- d-----w C:\Program Files\Usługi online 2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-10-22 02:39 267,272 ----a-w C:\WINDOWS\system32\xactengine2_10.dll 2007-10-22 02:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll 2007-10-22 02:31 76,808 ----a-w C:\WINDOWS\DSETUP.dll 2007-10-22 02:31 502,792 ----a-w C:\WINDOWS\DXSETUP.exe 2007-10-22 02:31 1,673,224 ----a-w C:\WINDOWS\dsetup32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 18:11 925696] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 10:20 6803456] "nwiz"="nwiz.exe" [2005-06-15 10:20 1519616 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 10:20 86016] "RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "V0230Mon.exe"="F:\DRIVERS\English\V0230Mon.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328] "avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "UVS11 Preload"="D:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 12:17 340136] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] R3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 18:00] R3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-07-24 18:00] S3 gggen;Generic USB Flash Driver;C:\WINDOWS\system32\DRIVERS\gggen.sys [2006-09-28 13:10] S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47] *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-17 15:47:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-17 15:47:54 ComboFix-quarantined-files.txt 2008-01-17 14:47:46

[ Dodano: Dzisiaj o 16:00 ]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:59:24, on 2008-01-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\Program Files\Winamp\winampa.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Wojtaz\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [V0230Mon.exe] F:\DRIVERS\English\V0230Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [UVS11 Preload] D:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 6454 bytes

Log z HiJacka po usunięciu:

Kod: Zaznacz wszystko: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/

Niestety tych dwóch wpisów nie było już :roll:

oraz tego folderu w C:\MyGlobarSearch też nie ma :roll:

Jest już lepiej?

**Posty:** 18165 · przez **wojtas** 17 Sty 2008, 18:14

czysto

Autor postu otrzymał pochwałę

**Posty:** 2042 · przez **Wojtaz** 17 Sty 2008, 18:28

Dzięki, eot.
Strasznie mi komp muli :roll:

A szkoda, bo nie jest najgorszy, a format był w tym miesiącu.

**Posty:** 18165 · przez **wojtas** 17 Sty 2008, 18:43

looknij:

http://forum.programosy.pl/optymalizacja-windowsa-xp-vt89133.html

**Posty:** 2042 · przez **Wojtaz** 17 Sty 2008, 19:28

Spróbuję się tym pobawić

cr@ck oraz trojan w jednym?

cr@ck oraz trojan w jednym?

Kto jest na forum