Częste zawiasy po uruchomieniu systemu

[bluejack]

Komputer zawiesza sie kilkukrotnie przy jego odpaleniu...
Log z Combofixa

ComboFix 08-08-03.05 - Jaca 2008-08-04 19:08:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.86 [GMT 2:00]Running from: C:\Documents and Settings\Jaca\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\smp.bat

.
((((((((((((((((((((((((( Files Created from 2008-07-04 to 2008-08-04 )))))))))))))))))))))))))))))))
.

2008-08-04 19:02 . 2008-08-04 19:02 1,928 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-04 19:00 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-04 19:00 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-04 19:00 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-04 19:00 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-04 19:00 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-04 19:00 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-04 19:00 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-04 19:00 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-04 19:00 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-01 12:57 . 2008-08-01 12:57 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-31 11:18 . 2008-07-31 11:18 20,336 --a------ C:\Documents and Settings\Jaca\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-07-27 09:44 . 2008-07-27 09:44 48 --a------ C:\WINDOWS\papatka.cfg
2008-07-26 14:14 . 2008-07-26 14:14 <DIR> d-------- C:\Gratka
2008-07-11 22:42 . 2008-07-11 22:42 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-07-06 16:59 . 2008-07-06 17:02 <DIR> d-------- C:\Program Files\Conflict Desert Storm PL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-04 09:44 --------- d-----w C:\Documents and Settings\Jaca\Dane aplikacji\Skype
2008-08-04 08:18 --------- d-----w C:\Documents and Settings\Jaca\Dane aplikacji\skypePM
2008-07-27 18:35 --------- d-----w C:\Documents and Settings\Jaca\Dane aplikacji\GanymedeNet
2008-07-27 18:11 --------- d-----w C:\Program Files\Ganymede
2008-06-28 10:06 --------- d-----w C:\Program Files\Panda Security
2008-06-22 09:06 --------- d-----w C:\Program Files\Creative
2008-06-22 08:54 --------- d-----w C:\Program Files\Winamp
2008-06-21 18:18 --------- d-----w C:\Program Files\Skype
2008-06-21 18:18 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-21 18:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-20 14:08 --------- d-----w C:\Program Files\Konnekt
2008-06-18 08:02 --------- d-----w C:\Documents and Settings\Jaca\Dane aplikacji\Tlen.pl
2008-06-16 16:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\stamina
2008-06-15 10:54 --------- d-----w C:\Program Files\Grupa IMAGE
2008-06-04 19:01 --------- d-----w C:\Documents and Settings\Jaca\Dane aplikacji\Ahead
2008-06-04 18:58 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-04 18:55 --------- d-----w C:\Program Files\Nero
2008-06-04 18:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-05-20 15:04 90,112 ----a-w C:\WINDOWS\DUMP9097.tmp
2008-05-20 15:02 90,112 ----a-w C:\WINDOWS\DUMP442d.tmp
2008-05-20 15:01 90,112 ----a-w C:\WINDOWS\DUMP95f6.tmp
2008-05-20 15:00 90,112 ----a-w C:\WINDOWS\DUMPa73c.tmp
2008-05-19 15:29 90,112 ----a-w C:\WINDOWS\DUMP4853.tmp
2008-05-19 15:28 90,112 ----a-w C:\WINDOWS\DUMP709c.tmp
2008-05-19 15:27 90,112 ----a-w C:\WINDOWS\DUMP79f2.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 01:55 189952]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00 90112]
"CTAvTray"="C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE" [2000-09-01 01:00 21504]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm
"aux"= ctwdm32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jaca^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jaca\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]
--a------ 2001-05-10 18:49 102400 C:\Program Files\Creative\SBLive\Program\AHQInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioHQ]
--a------ 2001-08-17 17:01 180224 C:\Program Files\Creative\SBLive\AudioHQ\ahqtb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
--a------ 2005-05-24 23:41 503808 C:\Program Files\Konnekt\konnekt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\Konnekt\\konnekt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-WinampAgent - C:\Program Files\Winamp\winampa.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Jaca\Dane aplikacji\Mozilla\Firefox\Profiles\ncya037o.default\


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-04 19:11:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A???????B???@?$?@?? C?????U?@?????????@?B???A???????A???????B???@?????P???$?@?????????k??w??????????@???????????????????B???????????????????????????????????B
CTAvTray = C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE??s$??????w????$???2??w???????w??????`???`???????????????????????????@?????????????????d??????????w???sx??s@????????O7?D??sh??s$??????????s????(????&?s?????O7??O7?????(????B?s?;7? @@????? @@??O7??B?s??

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-04 19:15:43
ComboFix-quarantined-files.txt 2008-08-04 17:15:17

Pre-Run: 4,869,419,008 bajtów wolnych
Post-Run: 4,943,192,064 bajtów wolnych

132
Log z HJ

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:21:47, on 2008-08-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CTAvTray] C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7867C6AE-1138-4D5F-B7C5-88A19FB5C1E2}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 5174 bytes

[djarta]

Wklej do Notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\WS2Fix.exe


>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

C:\WINDOWS\DUMP9097.tmp
C:\WINDOWS\DUMP442d.tmp
C:\WINDOWS\DUMP95f6.tmp
C:\WINDOWS\DUMPa73c.tmp
C:\WINDOWS\DUMP4853.tmp
C:\WINDOWS\DUMP709c.tmp
C:\WINDOWS\DUMP79f2.tmp

Usuń ręcznie te zrzuty pamięci.

[bluejack]

Jest to samo :-/
Log z HJ

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11, on 2008-08-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\V0350Mon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CTAvTray] C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [V0350Mon.exe] C:\WINDOWS\V0350Mon.exe
O4 - HKLM\..\RunOnce: [CTAVTray] C:\Program Files\Creative\SBLive\Program\CTAvStub.EXE EAX.AVI
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7867C6AE-1138-4D5F-B7C5-88A19FB5C1E2}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\WINDOWS\PSEXESVC.EXE

--
End of file - 5628 bytes


Log z Combofixa

Kod: Zaznacz wszystko

ComboFix 08-08-03.05 - Jaca 2008-08-10 12:14:45.3 - NTFSx86
Running from: C:\Documents and Settings\Jaca\Moje dokumenty\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-07-10 to 2008-08-10  )))))))))))))))))))))))))))))))
.

2008-08-07 19:53 . 2008-08-07 19:54   <DIR>   d--------   C:\Documents and Settings\Jaca\Dane aplikacji\muvee Technologies
2008-08-07 19:28 . 2008-08-07 19:28   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-06 22:05 . 2008-08-06 22:05   <DIR>   d--------   C:\Documents and Settings\Jaca\Dane aplikacji\Creative
2008-08-06 22:05 . 2008-08-06 22:08   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-08-06 15:16 . 2003-06-12 23:25   7,062   --a------   C:\WINDOWS\system32\audiopid.vxd
2008-08-06 15:13 . 2000-05-22 10:58   647,872   ---------   C:\WINDOWS\system32\Mscomct2.ocx
2008-08-06 15:13 . 2004-08-03 22:58   5,504   --a------   C:\WINDOWS\system32\drivers\MSTEE.sys
2008-08-06 15:13 . 2004-08-03 22:58   5,504   --a--c---   C:\WINDOWS\system32\dllcache\mstee.sys
2008-08-06 15:12 . 2004-08-03 23:10   19,328   --a------   C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2008-08-06 15:12 . 2004-08-03 23:10   19,328   --a--c---   C:\WINDOWS\system32\dllcache\wstcodec.sys
2008-08-06 15:12 . 2004-08-04 00:44   16,384   --a------   C:\WINDOWS\system32\ipsink.ax
2008-08-06 15:12 . 2004-08-04 00:44   16,384   --a--c---   C:\WINDOWS\system32\dllcache\ipsink.ax
2008-08-06 15:12 . 2004-08-03 23:10   15,360   --a------   C:\WINDOWS\system32\drivers\StreamIP.sys
2008-08-06 15:12 . 2004-08-03 23:10   15,360   --a--c---   C:\WINDOWS\system32\dllcache\streamip.sys
2008-08-06 15:12 . 2004-08-03 23:10   11,136   --a------   C:\WINDOWS\system32\drivers\SLIP.sys
2008-08-06 15:12 . 2004-08-03 23:10   11,136   --a--c---   C:\WINDOWS\system32\dllcache\slip.sys
2008-08-06 15:12 . 2004-08-03 23:10   10,880   --a------   C:\WINDOWS\system32\drivers\NdisIP.sys
2008-08-06 15:12 . 2004-08-03 23:10   10,880   --a--c---   C:\WINDOWS\system32\dllcache\ndisip.sys
2008-08-06 15:10 . 2007-06-04 19:02   299,008   -ra------   C:\WINDOWS\system32\V0350Cvw.dll
2008-08-06 15:08 . 2008-08-06 15:08   <DIR>   d--------   C:\WINDOWS\CtDrvInstall
2008-08-06 15:03 . 2008-08-06 15:03   <DIR>   d--------   C:\Program Files\muvee Technologies
2008-08-06 15:03 . 2008-08-06 15:03   <DIR>   d--------   C:\Program Files\Common Files\muvee Technologies
2008-08-06 14:54 . 2008-08-06 14:54   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies
2008-08-06 14:53 . 2008-08-06 14:53   <DIR>   d--------   C:\Program Files\SightSpeed
2008-08-06 14:53 . 2008-08-06 14:53   <DIR>   d--------   C:\Documents and Settings\Jaca\Dane aplikacji\InstallShield
2008-08-06 14:42 . 2006-08-29 10:11   1,047,552   ---------   C:\WINDOWS\system32\MFC71u.dll
2008-08-04 19:20 . 2008-08-04 19:20   <DIR>   d--------   C:\Program Files\Trend Micro
2008-08-04 19:02 . 2008-08-04 19:02   1,928   --a------   C:\WINDOWS\system32\tmp.reg
2008-08-04 19:00 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-08-04 19:00 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-08-04 19:00 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-08-04 19:00 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-08-04 19:00 . 2008-07-02 13:33   82,432   --a------   C:\WINDOWS\system32\IEDFix.C.exe
2008-08-04 19:00 . 2008-05-23 18:21   81,920   --a------   C:\WINDOWS\system32\404Fix.exe
2008-08-04 19:00 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-08-04 19:00 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-08-04 19:00 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-08-01 12:57 . 2008-08-01 12:57   <DIR>   d--------   C:\Program Files\Alwil Software
2008-07-31 11:18 . 2008-07-31 11:18   20,336   --a------   C:\Documents and Settings\Jaca\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-07-27 09:44 . 2008-07-27 09:44   48   --a------   C:\WINDOWS\papatka.cfg
2008-07-26 14:14 . 2008-07-26 14:14   <DIR>   d--------   C:\Gratka
2008-07-11 22:42 . 2008-07-11 22:42   <DIR>   d--------   C:\Program Files\Microsoft Silverlight

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-08 19:28   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-08-08 10:37   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\Skype
2008-08-08 08:57   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\skypePM
2008-08-06 12:52   ---------   d-----w   C:\Program Files\Creative
2008-08-06 12:38   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2008-08-04 22:21   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\GanymedeNet
2008-07-27 18:11   ---------   d-----w   C:\Program Files\Ganymede
2008-07-06 15:02   ---------   d-----w   C:\Program Files\Conflict Desert Storm PL
2008-06-28 10:06   ---------   d-----w   C:\Program Files\Panda Security
2008-06-22 08:54   ---------   d-----w   C:\Program Files\Winamp
2008-06-21 18:18   ---------   d-----w   C:\Program Files\Skype
2008-06-21 18:18   ---------   d-----w   C:\Program Files\Common Files\Skype
2008-06-21 18:18   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-20 14:08   ---------   d-----w   C:\Program Files\Konnekt
2008-06-18 08:02   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\Tlen.pl
2008-06-16 16:58   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\stamina
2008-06-15 10:54   ---------   d-----w   C:\Program Files\Grupa IMAGE
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 14:01 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 01:55 189952]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00 90112]
"CTAvTray"="C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE" [2000-09-01 01:00 21504]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"V0350Mon.exe"="C:\WINDOWS\V0350Mon.exe" [2007-06-04 19:02 32768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm
"aux"= ctwdm32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jaca^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jaca\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]
--a------ 2001-05-10 18:49 102400 C:\Program Files\Creative\SBLive\Program\AHQInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioHQ]
--a------ 2001-08-17 17:01 180224 C:\Program Files\Creative\SBLive\AudioHQ\ahqtb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
--a------ 2005-05-24 23:41 503808 C:\Program Files\Konnekt\konnekt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\Konnekt\\konnekt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 VF0350Afx;VF0350 Audio FX;C:\WINDOWS\system32\Drivers\V0350Afx.sys [2007-06-10 19:01]
R3 VF0350Vfx;VF0350 Video FX;C:\WINDOWS\system32\DRIVERS\V0350VFx.sys [2007-03-05 12:45]
R3 VF0350Vid;Live! Cam Video IM (VF0350);C:\WINDOWS\system32\DRIVERS\V0350Vid.sys [2007-05-10 19:02]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Jaca\Dane aplikacji\Mozilla\Firefox\Profiles\ncya037o.default\


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-10 12:19:32
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A???????B???@?$?@?? C?????U?@?????????@?B???A???????A?? ????B???@?????P???$?@?????????k??w??????????@??? ???????????????B?????? ????????????????????????????B
  CTAvTray = C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE??s$??????w????$???2??w???????w??????`???`???????????????????????????@?????????????????d??????????w???sx??s@????????O7?D??sh??s$??????????s????(????&?s?????O7??O7?????(????B?s?;7? @@????? @@??O7??B?s??

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-10 12:25:21
ComboFix-quarantined-files.txt  2008-08-10 10:24:41

Pre-Run: 3,040,862,208 bajtów wolnych
Post-Run: 3,042,308,096 bajtów wolnych

146


[djarta]

Coś u Ciebie się nie chce usuwać.Zrobimy inną metodą.

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko

Files to delete:
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\WS2Fix.exe


Kopiujesz - klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

Potem:
Użyj--->SDFix.(niżej na stronie linku).
Uruchom go w trybie awaryjnym
Pokaż Report.txt znajdujący się w folderze SDFix.

[bluejack]

C:\avenger.txt

Kod: Zaznacz wszystko

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error:  file "C:\WINDOWS\system32\VCCLSID.exe" not found!
Deletion of file "C:\WINDOWS\system32\VCCLSID.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\SrchSTS.exe" not found!
Deletion of file "C:\WINDOWS\system32\SrchSTS.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\VACFix.exe" not found!
Deletion of file "C:\WINDOWS\system32\VACFix.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\IEDFix.exe" not found!
Deletion of file "C:\WINDOWS\system32\IEDFix.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\IEDFix.C.exe" not found!
Deletion of file "C:\WINDOWS\system32\IEDFix.C.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\404Fix.exe" not found!
Deletion of file "C:\WINDOWS\system32\404Fix.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\Process.exe" not found!
Deletion of file "C:\WINDOWS\system32\Process.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\dumphive.exe" not found!
Deletion of file "C:\WINDOWS\system32\dumphive.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\WINDOWS\system32\WS2Fix.exe" not found!
Deletion of file "C:\WINDOWS\system32\WS2Fix.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Completed script processing.

*******************

Finished!  Terminate.


Kod: Zaznacz wszystko

SmitFraudFix v2.333

Scan done at 13:54:31,92, 2008-08-10
Run from C:\Documents and Settings\Jaca\Moje dokumenty\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End



Report.txt

[djarta]

Widzę,że pomyliłeś/łaś nardzędzia.Daj teraz log z ComboFixa.

[bluejack]

Kod: Zaznacz wszystko

ComboFix 08-08-03.05 - Jaca 2008-08-10 14:25:21.4 - NTFSx86
Running from: C:\Documents and Settings\Jaca\Moje dokumenty\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-07-10 to 2008-08-10  )))))))))))))))))))))))))))))))
.

2008-08-10 13:34 . 2007-09-06 00:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-08-10 13:34 . 2006-04-27 17:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-08-10 13:34 . 2008-05-29 09:35   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-08-10 13:34 . 2008-05-18 21:40   82,944   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-08-10 13:34 . 2008-07-02 13:33   82,432   --a------   C:\WINDOWS\system32\IEDFix.C.exe
2008-08-10 13:34 . 2008-05-23 18:21   81,920   --a------   C:\WINDOWS\system32\404Fix.exe
2008-08-10 13:34 . 2003-06-05 21:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-08-10 13:34 . 2004-07-31 18:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-08-10 13:34 . 2007-10-04 00:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-08-07 19:53 . 2008-08-07 19:54   <DIR>   d--------   C:\Documents and Settings\Jaca\Dane aplikacji\muvee Technologies
2008-08-07 19:28 . 2008-08-07 19:28   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-06 22:05 . 2008-08-06 22:05   <DIR>   d--------   C:\Documents and Settings\Jaca\Dane aplikacji\Creative
2008-08-06 22:05 . 2008-08-06 22:08   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-08-06 15:16 . 2003-06-12 23:25   7,062   --a------   C:\WINDOWS\system32\audiopid.vxd
2008-08-06 15:13 . 2000-05-22 10:58   647,872   ---------   C:\WINDOWS\system32\Mscomct2.ocx
2008-08-06 15:13 . 2004-08-03 22:58   5,504   --a------   C:\WINDOWS\system32\drivers\MSTEE.sys
2008-08-06 15:13 . 2004-08-03 22:58   5,504   --a--c---   C:\WINDOWS\system32\dllcache\mstee.sys
2008-08-06 15:12 . 2004-08-03 23:10   19,328   --a------   C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2008-08-06 15:12 . 2004-08-03 23:10   19,328   --a--c---   C:\WINDOWS\system32\dllcache\wstcodec.sys
2008-08-06 15:12 . 2004-08-04 00:44   16,384   --a------   C:\WINDOWS\system32\ipsink.ax
2008-08-06 15:12 . 2004-08-04 00:44   16,384   --a--c---   C:\WINDOWS\system32\dllcache\ipsink.ax
2008-08-06 15:12 . 2004-08-03 23:10   15,360   --a------   C:\WINDOWS\system32\drivers\StreamIP.sys
2008-08-06 15:12 . 2004-08-03 23:10   15,360   --a--c---   C:\WINDOWS\system32\dllcache\streamip.sys
2008-08-06 15:12 . 2004-08-03 23:10   11,136   --a------   C:\WINDOWS\system32\drivers\SLIP.sys
2008-08-06 15:12 . 2004-08-03 23:10   11,136   --a--c---   C:\WINDOWS\system32\dllcache\slip.sys
2008-08-06 15:12 . 2004-08-03 23:10   10,880   --a------   C:\WINDOWS\system32\drivers\NdisIP.sys
2008-08-06 15:12 . 2004-08-03 23:10   10,880   --a--c---   C:\WINDOWS\system32\dllcache\ndisip.sys
2008-08-06 15:10 . 2007-06-04 19:02   299,008   -ra------   C:\WINDOWS\system32\V0350Cvw.dll
2008-08-06 15:08 . 2008-08-06 15:08   <DIR>   d--------   C:\WINDOWS\CtDrvInstall
2008-08-06 15:03 . 2008-08-06 15:03   <DIR>   d--------   C:\Program Files\muvee Technologies
2008-08-06 15:03 . 2008-08-06 15:03   <DIR>   d--------   C:\Program Files\Common Files\muvee Technologies
2008-08-06 14:54 . 2008-08-06 14:54   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies
2008-08-06 14:53 . 2008-08-06 14:53   <DIR>   d--------   C:\Program Files\SightSpeed
2008-08-06 14:53 . 2008-08-06 14:53   <DIR>   d--------   C:\Documents and Settings\Jaca\Dane aplikacji\InstallShield
2008-08-06 14:42 . 2006-08-29 10:11   1,047,552   ---------   C:\WINDOWS\system32\MFC71u.dll
2008-08-04 19:20 . 2008-08-04 19:20   <DIR>   d--------   C:\Program Files\Trend Micro
2008-08-04 19:02 . 2008-08-10 13:54   2,016   --a------   C:\WINDOWS\system32\tmp.reg
2008-08-01 12:57 . 2008-08-01 12:57   <DIR>   d--------   C:\Program Files\Alwil Software
2008-07-31 11:18 . 2008-07-31 11:18   20,336   --a------   C:\Documents and Settings\Jaca\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-07-27 09:44 . 2008-07-27 09:44   48   --a------   C:\WINDOWS\papatka.cfg
2008-07-26 14:14 . 2008-07-26 14:14   <DIR>   d--------   C:\Gratka
2008-07-11 22:42 . 2008-07-11 22:42   <DIR>   d--------   C:\Program Files\Microsoft Silverlight

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-08 19:28   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-08-08 10:37   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\Skype
2008-08-08 08:57   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\skypePM
2008-08-06 12:52   ---------   d-----w   C:\Program Files\Creative
2008-08-06 12:38   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2008-08-04 22:21   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\GanymedeNet
2008-07-27 18:11   ---------   d-----w   C:\Program Files\Ganymede
2008-07-06 15:02   ---------   d-----w   C:\Program Files\Conflict Desert Storm PL
2008-06-28 10:06   ---------   d-----w   C:\Program Files\Panda Security
2008-06-22 08:54   ---------   d-----w   C:\Program Files\Winamp
2008-06-21 18:18   ---------   d-----w   C:\Program Files\Skype
2008-06-21 18:18   ---------   d-----w   C:\Program Files\Common Files\Skype
2008-06-21 18:18   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-20 14:08   ---------   d-----w   C:\Program Files\Konnekt
2008-06-18 08:02   ---------   d-----w   C:\Documents and Settings\Jaca\Dane aplikacji\Tlen.pl
2008-06-16 16:58   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\stamina
2008-06-15 10:54   ---------   d-----w   C:\Program Files\Grupa IMAGE
.

(((((((((((((((((((((((((((((   snapshot@2008-08-10_12.24.04.51   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-10 12:00:49   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_438.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 01:55 189952]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00 90112]
"CTAvTray"="C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE" [2000-09-01 01:00 21504]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"V0350Mon.exe"="C:\WINDOWS\V0350Mon.exe" [2007-06-04 19:02 32768]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-04 00:44 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= C:\WINDOWS\system32\ctmp3.acm
"aux"= ctwdm32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jaca^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jaca\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]
--a------ 2001-05-10 18:49 102400 C:\Program Files\Creative\SBLive\Program\AHQInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioHQ]
--a------ 2001-08-17 17:01 180224 C:\Program Files\Creative\SBLive\AudioHQ\ahqtb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Live! Cam Manager]
--------- 2007-06-07 14:01 155648 C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
--a------ 2005-05-24 23:41 503808 C:\Program Files\Konnekt\konnekt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\Konnekt\\konnekt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R3 VF0350Afx;VF0350 Audio FX;C:\WINDOWS\system32\Drivers\V0350Afx.sys [2007-06-10 19:01]
R3 VF0350Vfx;VF0350 Video FX;C:\WINDOWS\system32\DRIVERS\V0350VFx.sys [2007-03-05 12:45]
R3 VF0350Vid;Live! Cam Video IM (VF0350);C:\WINDOWS\system32\DRIVERS\V0350Vid.sys [2007-05-10 19:02]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Jaca\Dane aplikacji\Mozilla\Firefox\Profiles\ncya037o.default\


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-10 14:31:34
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A???????B???@?$?@?? C?????U?@?????????@?B???A???????A?? ????B???@?????P???$?@?????????k??w??????????@?u?3???????????????B?????? ????????????????????????????B
  CTAvTray = C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE??s$??????w????$???2??w???????w??????`???`???????????????????????????@?????????????????d??????????w???sx??s@????????O7?D??sh??s$??????????s????(????&?s?????O7??O7?????(????B?s?;7? @@????? @@??O7??B?s??

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-10 14:37:12
ComboFix-quarantined-files.txt  2008-08-10 12:36:54
ComboFix2.txt  2008-08-10 10:25:24

Pre-Run: 3,078,156,288 bajtów wolnych
Post-Run: 3,068,293,120 bajtów wolnych

153


Czemu pomyliłem narzedzia?

[djarta]

Napisałem SDFix a nie SmitFraudFix.

Użyj--->SDFix.(niżej na stronie linku).
Uruchom go w trybie awaryjnym
Pokaż Report.txt znajdujący się w folderze SDFix.
Nie wiem czemu się to nie chce usunąć,ale SDFix powinien to wywalić.

[bluejack]

Musialem zrobic przywracanie systemu, bo nie chcial mi sie normalnie system ladowac (tylko w trybie awaryjnym)
A plik Report.txt wyglada tak:

Kod: Zaznacz wszystko

[b]SDFix: Version 1.214 [/b]
Run by Jaca on 2008-08-10 at 19:05

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File


[Magik]

A plik Report.txt wyglada tak:

wklej caly bo jest urwany


a potem

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

[bluejack]

A plik Report.txt wyglada tak:

wklej caly bo jest urwany

no wlasnie w folderze innego reportu nie ma...

[Magik]

no wlasnie w folderze innego reportu nie ma...

usun ten report i zrob scan Sdfixe'm jeszcze raz...jesli znow bedzie urwany to trudno.zrob cala reszte i ebdzie gut