do sprawdzenia

**Posty:** 924 · przez **kepa416** 01 Mar 2008, 03:50

Komputer po ataku w autostracie sa nowe pozycje i nowe procesy

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 02:45, on 2008-03-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe D:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe H:\MOJE\Programy\system\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [AutoUpdate] C:\WINDOWS\debug64\smss.exe O4 - HKLM\..\Run: [AutoUpdate32] C:\WINDOWS\debug64\services.exe O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 11:20

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 924 · przez **kepa416** 01 Mar 2008, 12:45

kepa416 napisał(a):O4 - HKLM\..\Run: [AutoUpdate] C:\WINDOWS\debug64\smss.exe
O4 - HKLM\..\Run: [AutoUpdate32] C:\WINDOWS\debug64\services.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

a co z tymi wpisami ?

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 15:47

wykonaj co kazałem pozniej sie zajmiemy nimi nie martw sie

**Posty:** 924 · przez **kepa416** 01 Mar 2008, 18:55

wojtas napisał(a):SDFix

ten sie nie uruchamia wyskakuje jakiś błąd hardlock driver

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 19:57

to zrob co mozesz

**Posty:** 924 · przez **kepa416** 02 Mar 2008, 00:10

Wywalilem te dwa wpisy debug64 no i przeskanowałem nod'em i avg tez coś wywalił .. i zniknęło z autostaru i nie ma problemów ;]

**Posty:** 3854 · przez **Dzi@dek** 02 Mar 2008, 01:23

kepa416
My tutaj walczymy do końca, więc daj te logi z Combofix oraz Hijackthis.

**Posty:** 924 · przez **kepa416** 02 Mar 2008, 02:11

Kod: Zaznacz wszystko: ComboFix 08-03-01.3 - User 2008-03-02 1:03:19.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1476 [GMT 1:00] Running from: E:\zassane\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-02 to 2008-03-02 ))))))))))))))))))))))))))))))) . 2008-03-01 17:07 . 2008-03-01 17:07 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-01 02:22 . 2008-03-01 02:22 <DIR> d-------- C:\Program Files\Accessories 2008-03-01 02:22 . 2002-08-25 10:17 109,248 --a------ C:\WINDOWS\system32\MSWINSCK.OCX 2008-03-01 02:22 . 1999-08-18 09:54 69,120 --a------ C:\WINDOWS\hpeg.dll 2008-03-01 02:22 . 2007-08-11 14:37 26 --a------ C:\WINDOWS\refsdm.dll 2008-02-29 14:36 . 2004-08-03 23:08 142,976 --a--c--- C:\WINDOWS\system32\dllcache\usbport.sys 2008-02-26 16:18 . 2008-02-26 16:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-26 16:18 . 2008-02-26 16:18 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-25 17:44 . 2008-02-27 15:23 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\skypePM 2008-02-25 17:44 . 2008-02-25 17:44 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-02-25 17:43 . 2008-02-25 17:43 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-02-25 17:43 . 2008-02-27 15:30 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Skype 2008-02-25 17:43 . 2008-02-25 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-02-25 16:17 . 2008-02-25 16:29 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe 2008-02-25 16:17 . 2008-02-25 16:29 139,264 --a--c--- C:\WINDOWS\system32\dllcache\sndvol32.exe 2008-02-23 13:17 . 2008-03-01 11:47 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\teamspeak2 2008-02-23 13:17 . 2008-02-23 13:17 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-02-23 04:43 . 2008-02-23 04:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-02-23 04:40 . 2008-02-23 04:40 <DIR> d-------- C:\Program Files\Bonjour 2008-02-23 04:34 . 2008-02-23 04:34 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-02-23 03:59 . 2008-02-23 03:59 <DIR> d-------- C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2008-02-21 02:57 . 2008-02-21 02:57 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-02-18 11:46 . 2008-02-18 11:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-02-18 11:38 . 2006-08-29 15:56 32,377 --a------ C:\WINDOWS\system32\drivers\prodigy.sys 2008-02-16 13:48 . 2008-02-16 13:48 <DIR> d-------- C:\Program Files\Lonely Cat Games 2008-02-15 17:22 . 2008-02-15 17:22 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-02-15 17:22 . 2008-02-15 17:22 <DIR> d-------- C:\Program Files\DIFX 2008-02-15 17:22 . 2008-02-15 17:22 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-02-15 17:22 . 2008-02-18 11:51 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-02-15 17:22 . 2008-02-15 17:25 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\PC Suite 2008-02-15 17:22 . 2008-02-15 17:22 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Nokia 2008-02-15 17:22 . 2008-02-15 17:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-02-15 17:21 . 2008-02-18 11:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-02-15 17:21 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-02-15 17:21 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-02-15 17:21 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-02-15 17:21 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-02-15 17:21 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-02-14 01:50 . 2008-02-14 14:08 <DIR> d-------- C:\Program Files\Yahoo! 2008-02-13 12:29 . 2007-07-01 04:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-02-13 12:29 . 2007-07-01 04:36 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-02-10 23:27 . 2008-02-11 01:12 <DIR> d-------- C:\Program Files\WapSter 2008-02-10 23:27 . 2008-02-10 23:52 <DIR> d-------- C:\Documents and Settings\User\WapSter 2008-02-09 22:06 . 2008-02-09 22:06 53,220 --a------ C:\WINDOWS\BricoPackUninst.cmd 2008-02-09 21:55 . 2008-02-09 21:55 <DIR> d-------- C:\WINDOWS\BricoPacks 2008-02-09 21:55 . 2008-02-09 22:06 6,025 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-02-07 15:30 . 2008-02-07 15:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2008-02-07 15:29 . 2008-02-07 15:30 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\DAEMON Tools Pro 2008-02-07 15:22 . 2008-02-07 15:22 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-02-07 15:22 . 2008-02-07 15:22 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-02-04 20:40 . 2008-03-02 00:54 1,481,457 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-02-04 18:14 . 2008-02-12 21:49 <DIR> d-------- C:\Program Files\ESET 2008-02-04 18:13 . 2008-02-04 18:13 <DIR> d-------- C:\Program Files\Sunbelt Software 2008-02-04 17:18 . 2008-02-04 18:17 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Comodo 2008-02-03 00:49 . 2008-02-03 00:49 <DIR> d-------- C:\WINDOWS\system32\VIRepair 2008-02-03 00:46 . 2008-02-03 00:46 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Styler 2008-02-03 00:45 . 2008-02-03 00:51 <DIR> d-------- C:\WINDOWS\system32\VITrans 2008-02-03 00:45 . 2006-12-03 17:15 111,104 --a------ C:\WINDOWS\system32\Uharc.exe 2008-02-03 00:45 . 2006-12-03 17:15 19,968 --a------ C:\WINDOWS\system32\reico.exe 2008-02-03 00:45 . 2006-12-03 17:14 8,636 --a------ C:\WINDOWS\system32\modifype.exe 2008-02-02 17:24 . 2008-03-01 22:59 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Xfire 2008-02-02 15:51 . 2008-02-02 15:51 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Apple Computer 2008-02-02 15:50 . 2008-02-02 15:50 <DIR> d-------- C:\Program Files\Apple Software Update 2008-02-02 15:50 . 2008-02-26 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-02-02 15:50 . 2008-02-02 15:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-02-02 15:44 . 2008-02-02 15:44 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-01 22:58 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\uTorrent 2008-03-01 17:22 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-01 17:21 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-03-01 01:21 --------- d-----w C:\Program Files\eMule 2008-03-01 00:55 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-02-23 03:41 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-23 03:17 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-02-20 13:40 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\gtk-2.0 2008-02-20 13:27 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Corel 2008-02-20 13:26 5,018 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-02-16 01:57 98 --sha-w C:\Program Files\desktop.ini 2008-02-09 21:05 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-02-07 14:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-04 15:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-01-30 21:21 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Desktop Sidebar 2008-01-30 20:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-01-27 00:34 --------- d-----w C:\Program Files\Winamp 2008-01-26 22:51 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\DivX 2008-01-26 11:17 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\InstallShield 2008-01-19 16:09 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-01-18 16:00 --------- d-----w C:\Program Files\xp-AntiSpy 2008-01-16 21:04 --------- d-----w C:\Program Files\Real Alternative 2008-01-16 21:03 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-01-15 17:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-01-15 16:59 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-14 17:30 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Expressivo 2008-01-02 16:03 --------- d-----w C:\Program Files\Common Files\DirectX 2007-12-08 13:07 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-12-08 11:46 191,488 ----a-w C:\WINDOWS\system32\hlvdd.dll 2007-12-07 17:28 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll 2007-09-27 15:02 2,510,070 ----a-w C:\WINDOWS\inf\SET9D.tmp . ------- Sigcheck ------- 8283a4d489b207991efdc8328733d0bc C:\WINDOWS\system32\drivers\tcpip.sys ----a-w 360,832 2007-10-30 16:53:32 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys -c----w 359,808 2007-12-01 11:55:51 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys -c--a-w 360,064 2008-01-19 16:09:19 C:\WINDOWS\system32\dllcache\tcpip.sys ----a-w 360,064 2008-01-19 16:09:19 C:\WINDOWS\system32\drivers\tcpip.sys e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\explorer.exe ----a-w 976,896 2007-06-13 13:23:50 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="D:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27 295424] "AQQ"="C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe" [2008-02-27 13:58 1183728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AdslTaskBar"="stmctrl.dll" [2006-06-02 11:01 151552 C:\WINDOWS\system32\stmctrl.dll] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-11-23 21:51 1410304] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MaxRecentDocs"= 4 (0x4) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\uTorrent\\uTorrent.exe"= R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-23 21:52] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 14:51] R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 15:28] S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-05-31 14:29] S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l151x86.sys [2007-07-03 12:06] S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-06-18 15:19] S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-22 19:33] S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2007-05-07 15:11] . Contents of the 'Scheduled Tasks' folder "2008-02-26 15:13:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-02 01:06:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-02 1:07:17 . 2008-02-13 11:38:28 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:08:18, on 2008-03-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
D:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\WapSter\WapSter AQQ\AQQ.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\explorer.exe
E:\zassane\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{20E0ED49-D8A9-4DE3-9B24-B41D2167D4C0}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 4958 bytes

**Posty:** 3854 · przez **Dzi@dek** 02 Mar 2008, 02:22

C:\Documents and Settings\User\Dane aplikacji\Comodo

Pozostałość po Comodo - do kosza.
Reszta OK.

Autor postu otrzymał pochwałę

do sprawdzenia

do sprawdzenia

Kto jest na forum