Drwtsn.exe i explorer problem

**Posty:** 8 · przez **duduso** 27 Gru 2008, 04:25

witam
mam problem z drwtsn.exe i explorer
pojawia sie komunikat ze --wystąpił problem z aplikacją explorer.exe i zostanie ona zamknięta", po czym "wystąpił problem z aplikacją drwtsn32.exe i zostanie ona zamknięta"
robilem skana hijackiemthis oto on::

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:25, on 2008-12-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [MSRegInfo] C:\WINDOWS\pagefile.sys.vbs
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = D:\programy\Office10\OSA.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178734838443
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 6201 bytes

z gory dzieki za pomoc

**Posty:** 300 · przez **sgsman** 27 Gru 2008, 11:11

1. Wsadź loga w tagi code;
2. Wrzuć loga z ComboFixa;
3. Czekaj na pomoc

**Posty:** 8 · przez **duduso** 27 Gru 2008, 13:24

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:25, on 2008-12-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [MSRegInfo] C:\WINDOWS\pagefile.sys.vbs
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = D:\programy\Office10\OSA.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8734838443
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 6201 bytes[code][/code]

Dodano Dzisiaj, 13:06:
http://wklej.org/id/32075/

tutaj link do loga z combofixa
z gory dzieki za pomoc

Dodano Dzisiaj, 13:06:
http://wklej.org/id/32075/

tutaj link do loga z combofixa
z gory dzieki za pomoc

**Posty:** 18165 · przez **wojtas** 27 Gru 2008, 16:24

prosze objąć log w tagi

**Posty:** 8 · przez **duduso** 27 Gru 2008, 18:53

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:19:25, on 2008-12-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [MSRegInfo] C:\WINDOWS\pagefile.sys.vbs O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = D:\programy\Office10\OSA.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178734838443 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- End of file - 6201 bytes

Dodano Dzisiaj, 17:56:
ok-nie wiedzialem dokladnie jak to zrobic -tzn w tagi-ale juz mam nadzieje ze bedzie ok
pozdrawiam

Dodano Dzisiaj, 18:49:
ok-nie wiedzialem dokladnie jak to zrobic -tzn w tagi-ale juz mam nadzieje ze bedzie ok
pozdrawiam

**Posty:** 18165 · przez **wojtas** 28 Gru 2008, 16:44

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 8 · przez **duduso** 29 Gru 2008, 02:06

Kod: Zaznacz wszystko: ComboFix 08-12-26.03 - Darek 2008-12-28 23:49:51.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1022.689 [GMT 1:00] Uruchomiony z: h:\programosy\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) AV: avast! antivirus 4.8.1296 [VPS 081228-0] *On-access scanning disabled* (Outdated) FW: COMODO Firewall Pro *disabled* . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-28 do 2008-12-28 ))))))))))))))))))))))))))))))) . 2008-12-28 21:46 . 2008-12-28 23:31 <DIR> d-------- C:\SDFix 2008-12-27 03:30 . 2008-12-27 03:30 <DIR> d-------- c:\windows\BDOSCAN8 2008-12-27 03:12 . 2008-12-28 23:22 <DIR> d-------- c:\windows\ERUNT 2008-12-27 03:12 . 2008-12-27 03:12 <DIR> d-------- C:\ERDNT 2008-12-27 03:12 . 2008-12-27 03:13 <DIR> d-------- C:\!FixIEDef 2008-12-27 02:35 . 2006-10-11 23:44 55,296 --a------ c:\program files\Seconfig XP.exe 2008-12-27 02:35 . 2008-12-27 02:35 38,899 --a------ c:\program files\SeconfigXP.zip 2008-12-27 01:14 . 2008-12-27 01:14 <DIR> d-------- c:\program files\Trend Micro 2008-12-26 20:29 . 2008-12-26 20:29 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-12-25 04:47 . 2008-05-08 02:03 453,632 --a------ c:\windows\system32\SetACL.ocx 2008-12-22 01:54 . 2008-12-22 01:52 48,335 --a------ C:\ja i lujania w fox london 2008.jpg 2008-12-21 22:07 . 2008-12-21 22:07 <DIR> d-------- c:\program files\Winamp Toolbar 2008-12-21 22:07 . 2008-12-21 22:07 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar 2008-12-21 22:06 . 2008-12-21 22:06 <DIR> d-------- c:\program files\Winamp Remote 2008-12-21 22:06 . 2008-12-21 22:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2008-12-21 22:05 . 2008-12-22 01:46 <DIR> d-------- c:\documents and settings\Darek\Dane aplikacji\Winamp 2008-12-21 22:04 . 2008-12-21 22:04 9,345,672 --a------ c:\program files\winamp5541_full_emusic-7plus_pl-pl.exe 2008-12-18 03:53 . 2008-12-18 03:53 268 --ah----- C:\sqmdata19.sqm 2008-12-18 03:53 . 2008-12-18 03:53 244 --ah----- C:\sqmnoopt19.sqm 2008-12-18 03:02 . 2008-12-18 03:02 268 --ah----- C:\sqmdata18.sqm 2008-12-18 03:02 . 2008-12-18 03:02 244 --ah----- C:\sqmnoopt18.sqm 2008-12-17 12:24 . 2008-12-17 12:24 268 --ah----- C:\sqmdata17.sqm 2008-12-17 12:24 . 2008-12-17 12:24 244 --ah----- C:\sqmnoopt17.sqm 2008-12-17 03:37 . 2008-12-17 03:37 268 --ah----- C:\sqmdata16.sqm 2008-12-17 03:37 . 2008-12-17 03:37 244 --ah----- C:\sqmnoopt16.sqm 2008-12-13 04:29 . 2008-12-13 04:29 268 --ah----- C:\sqmdata15.sqm 2008-12-13 04:29 . 2008-12-13 04:29 244 --ah----- C:\sqmnoopt15.sqm 2008-12-13 01:20 . 2008-12-13 01:20 268 --ah----- C:\sqmdata14.sqm 2008-12-13 01:20 . 2008-12-13 01:20 244 --ah----- C:\sqmnoopt14.sqm 2008-12-12 12:28 . 2008-12-12 12:28 268 --ah----- C:\sqmdata13.sqm 2008-12-12 12:28 . 2008-12-12 12:28 244 --ah----- C:\sqmnoopt13.sqm 2008-12-12 04:27 . 2008-12-12 04:27 268 --ah----- C:\sqmdata12.sqm 2008-12-12 04:27 . 2008-12-12 04:27 244 --ah----- C:\sqmnoopt12.sqm 2008-12-11 12:36 . 2008-12-11 12:36 268 --ah----- C:\sqmdata11.sqm 2008-12-11 12:36 . 2008-12-11 12:36 244 --ah----- C:\sqmnoopt11.sqm 2008-12-11 02:17 . 2008-12-11 02:17 268 --ah----- C:\sqmdata10.sqm 2008-12-11 02:17 . 2008-12-11 02:17 244 --ah----- C:\sqmnoopt10.sqm 2008-12-10 12:39 . 2008-12-10 12:39 268 --ah----- C:\sqmdata09.sqm 2008-12-10 12:39 . 2008-12-10 12:39 244 --ah----- C:\sqmnoopt09.sqm 2008-12-10 02:56 . 2008-12-10 02:56 268 --ah----- C:\sqmdata08.sqm 2008-12-10 02:56 . 2008-12-10 02:56 244 --ah----- C:\sqmnoopt08.sqm 2008-12-09 12:25 . 2008-12-09 12:25 268 --ah----- C:\sqmdata07.sqm 2008-12-09 12:25 . 2008-12-09 12:25 244 --ah----- C:\sqmnoopt07.sqm . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-27 23:33 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-12-21 21:07 --------- d-----w c:\program files\Winamp 2008-12-10 01:56 --------- d-----w c:\documents and settings\Darek\Dane aplikacji\Azureus 2008-11-21 21:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\avg8 2008-11-21 00:54 --------- d-----w c:\program files\COMODO 2008-11-21 00:54 --------- d-----w c:\documents and settings\Darek\Dane aplikacji\Comodo 2008-11-21 00:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\comodo 2008-11-19 23:05 --------- d-----w c:\program files\AskSBar 2008-11-19 23:04 249,592 ----a-w c:\windows\system32\cssdll32.dll 2008-11-19 22:23 --------- d-----w c:\program files\AVG 2008-11-19 22:04 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2008-11-19 21:21 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\McAfee 2008-11-19 17:08 1,416,944 ----a-w C:\WM9Codecs.exe 2008-11-19 09:57 --------- d-----w c:\documents and settings\LocalService\Dane aplikacji\SACore 2008-11-18 23:47 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\SiteAdvisor 2008-11-18 23:33 1,226,248 ----a-w C:\DMSetup.exe 2008-11-12 21:36 21,537,489 ----a-w C:\PES2009Patch120_official.zip 2008-11-11 11:29 --------- d-----w c:\program files\Gadu-Gadu 2008-11-11 00:41 --------- d-----w c:\program files\Unlocker 2008-11-11 00:34 243,204 ----a-w C:\unlocker1.8.7.exe 2008-11-11 00:34 --------- d-----w c:\documents and settings\Darek\Dane aplikacji\Desktopicon 2008-11-02 01:18 3,887,378 ----a-w c:\program files\aimp_2.50.312.zip 2008-10-31 00:21 --------- d-----w c:\documents and settings\Darek\Dane aplikacji\fltk.org 2008-10-31 00:17 40,038,907 ----a-w c:\program files\WEOL'08_3.0_National_Teams+Club_Teams_by_www.WEOL.pl_BETA.zip 2008-10-30 19:14 21,751,400 ----a-w C:\PES2009Patch120.exe 2008-10-16 00:02 576,222 ----a-w c:\program files\slownik-hipszansko-polski-traducto.zip 2008-10-10 00:00 16,746,352 ----a-w c:\program files\Install_Messenger.exe 2008-10-01 20:43 21,440,208 ----a-w c:\program files\VeohSetup-3.9.8.1082.exe 2008-04-10 15:05 1,445,575 ----a-w c:\program files\spamihilator_0_9_9_10.exe 2008-04-08 22:38 519,012 ----a-w c:\program files\aws-setup.exe 2008-02-24 19:22 3,328,770 ----a-w c:\program files\SopCast-2.0.4(dobreprogramy.pl).zip 2008-01-22 13:05 1,695,184 ----a-w c:\program files\tcmdr656.exe 2008-01-20 10:21 3,417,160 ----a-w c:\program files\setupinternetcalls.exe 2008-01-19 12:15 32,981,120 ----a-w c:\program files\avg75free_516a1225.exe 2008-01-19 11:57 59,053,000 ----a-w c:\program files\avg75f_516a1225.exe 2007-11-20 15:18 2,294 ----a-w c:\program files\changeLog.txt 2007-11-20 15:15 3,351,778 ----a-w c:\program files\Setup-SopCast-2.0.4-2007-11-20.exe 2007-11-06 18:12 17,901 ----a-w c:\program files\irunin.ini 2007-11-06 18:11 9,694 ----a-w c:\program files\irunin.dat 2007-11-06 18:11 8,134 ----a-w c:\program files\irunin.bmp 2007-11-06 18:11 15,938 ----a-w c:\program files\irunin.lng 2007-09-25 16:44 64,000 ----a-w c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-09-25 10:56 23,567,008 ----a-w c:\program files\AdbeRdr80_pl_PL.exe 2007-09-25 10:49 15,427,360 ----a-w c:\program files\gimp-2.4.0-rc3-i586-setup_[www.programosy.pl].exe 2007-05-13 19:14 4,282,528 ----a-w c:\program files\GOMPLAYERENBETASETUP.EXE 2007-05-13 19:01 1,163,592 ----a-w c:\program files\install_flash_player.exe 2006-04-29 17:46 179 ----a-w c:\program files\Free-Codecs.txt 2006-02-20 08:21 963,072 ----a-w c:\program files\TRADUCT0.EXE 2005-06-23 09:08 1,530,000 ----a-w c:\program files\X_PL_ES.ASC 2005-06-23 09:07 1,530,000 ----a-w c:\program files\X_ES_PL.ASC 2003-01-09 03:19 40,038,689 ----a-w c:\program files\WEOL'08_3.0_National_Teams+Club_Team_by_www.WEOL.pl_BETA.exe 2002-05-04 11:05 549 ---ha-w c:\program files\COPYFSTQ.EXE.manifest 2002-04-18 17:16 94,636 ----a-w c:\program files\dropcpyr.dll 2002-03-24 11:54 46,080 ----a-w c:\program files\COPYFSTQ.EXE . ((((((((((((((((((((((((((((( snapshot_2008-12-27_11.45.50,62 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-12-28 22:22:22 5,582,848 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-28 22:22:22 217,088 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-12-28 22:22:02 5,582,848 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-28 22:22:02 217,088 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-12-27 10:01:49 66,710 ----a-w c:\windows\system32\perfc009.dat + 2008-12-28 22:47:21 66,710 ----a-w c:\windows\system32\perfc009.dat - 2008-12-27 10:01:49 82,428 ----a-w c:\windows\system32\perfc015.dat + 2008-12-28 22:47:21 82,428 ----a-w c:\windows\system32\perfc015.dat - 2008-12-27 10:01:49 427,926 ----a-w c:\windows\system32\perfh009.dat + 2008-12-28 22:47:21 427,926 ----a-w c:\windows\system32\perfh009.dat - 2008-12-27 10:01:49 485,216 ----a-w c:\windows\system32\perfh015.dat + 2008-12-28 22:47:21 485,216 ----a-w c:\windows\system32\perfh015.dat + 2008-12-28 22:43:09 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6a8.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-11-20 66912] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-11-20 00:05 66912 --a------ c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.sl_anet"= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm "vidc.ap41"= APmpg4v1.dll "msacm.divxa32"= DivXa32.acm "vidc.iyuv"= c:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= c:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "msacm.msaudio1"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm "msacm.l3codec"= L3codecp.acm "vidc.ffds"= ffdshow.ax [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2006-01-02 17:41 45056 c:\program files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2007-03-16 18:10 1392640 c:\windows\system32\WLTRAY.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2008-04-01 02:54 507904 c:\program files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-31 18:42 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 c:\program files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a------ 2006-03-24 17:30 282624 c:\windows\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wltrysvc"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "idsvc"=3 (0x3) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "c:\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "d:\\New Folder\\pes2009.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-19 111184] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-19 20560] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8bcaf868-f687-11dc-99f1-0019b95ae65d}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe pagefile.sys.vbs . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-28 23:51:12 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(884) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-12-28 23:52:08 ComboFix-quarantined-files.txt 2008-12-28 22:52:02 ComboFix2.txt 2008-12-27 10:46:10 Przed: 6 768 181 248 bajtów wolnych Po: 6,786,207,744 bajtów wolnych 227 --- E O F --- 2008-11-20 09:19:04

Dodano Dzisiaj, 01:07:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Darek on 2008-12-28 at 23:25 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\Program Files\Setup.exe - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-28 23:29:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Disabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"="C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "D:\\New Folder\\pes2009.exe"="D:\\New Folder\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Thu 20 Sep 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 23 Jan 2003 65,952 ..SHR --- "C:\Program Files\Autodesk\Autodesk Express Viewer\Setup.exe" Wed 9 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4ced0fea4ab34597591f30ad4967c0fb\BIT23.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5df4bafc26c11ad6e01c1190f9becca3\BIT30.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6687d911a85a0a6527f589a448ad4e95\BIT1C.tmp" Thu 20 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\66bbe901ee61b85acb3f51f475c66bc4\BIT2.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\75434e67d2b0d0e703a75d51e5600274\BIT28.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9bdb478ba8417d739a3c7ead1452ae1c\BIT2F.tmp" Thu 20 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a5bdfdcdce5622175d5398bf36b7cfcc\BIT4.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e0afa7c543f98972689a91dc65aaf2ee\BIT21.tmp" Thu 20 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f2eef0e0d3751bdf787b52b9f6c9fa43\BIT3.tmp" Wed 19 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f99caf315eddf99a1888d73e43fa1f8d\BIT1E.tmp" Thu 20 Nov 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f9fb4e211863a230fae23793d5838718\BIT5.tmp" [b]Finished![/b]

Dodano Dzisiaj, 01:12:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:09:28, on 2008-12-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = D:\programy\Office10\OSA.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178734838443 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- End of file - 5773 bytes

Dodano Dzisiaj, 01:14:
dalem logi-dzieki za sprawdzenie logow

)

**Posty:** 18165 · przez **wojtas** 29 Gru 2008, 18:37

skasuj:

R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

Otworz notatnik i wklej w nim to:

File::
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\sqmdata18.sqm
C:\sqmnoopt18.sqm
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
C:\sqmdata16.sqm
C:\sqmnoopt16.sqm
C:\sqmdata15.sqm
C:\sqmnoopt15.sqm
C:\sqmdata14.sqm
C:\sqmnoopt14.sqm
C:\sqmdata13.sqm
C:\sqmnoopt13.sqm
C:\sqmdata12.sqm
C:\sqmnoopt12.sqm
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
C:\sqmdata09.sqm
C:\sqmnoopt09.sqm
C:\sqmdata08.sqm
C:\sqmnoopt08.sqm
C:\sqmdata07.sqm
C:\sqmnoopt07.sqm

Folder::
c:\program files\AskSBar

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8bcaf868-f687-11dc-99f1-0019b95ae65d}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 8 · przez **duduso** 31 Gru 2008, 01:26

Kod: Zaznacz wszystko: ComboFix 08-12-26.03 - Darek 2008-12-30 23:18:41.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1022.611 [GMT 1:00] Uruchomiony z: h:\programosy\ComboFix.exe Użyto następujących komend :: h:\programosy\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) AV: avast! antivirus 4.8.1296 [VPS 081230-0] *On-access scanning disabled* (Outdated) FW: COMODO Firewall Pro *disabled* * Utworzono nowy punkt przywracania FILE :: C:\sqmdata07.sqm C:\sqmdata08.sqm C:\sqmdata09.sqm C:\sqmdata10.sqm C:\sqmdata11.sqm C:\sqmdata12.sqm C:\sqmdata13.sqm C:\sqmdata14.sqm C:\sqmdata15.sqm C:\sqmdata16.sqm C:\sqmdata17.sqm C:\sqmdata18.sqm C:\sqmdata19.sqm C:\sqmnoopt07.sqm C:\sqmnoopt08.sqm C:\sqmnoopt09.sqm C:\sqmnoopt10.sqm C:\sqmnoopt11.sqm C:\sqmnoopt12.sqm C:\sqmnoopt13.sqm C:\sqmnoopt14.sqm C:\sqmnoopt15.sqm C:\sqmnoopt16.sqm C:\sqmnoopt17.sqm C:\sqmnoopt18.sqm C:\sqmnoopt19.sqm . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\AskSBar c:\program files\AskSBar\bar\1.bin\A2FFXTBR.JAR c:\program files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST c:\program files\AskSBar\bar\1.bin\A2HIGHIN.EXE c:\program files\AskSBar\bar\1.bin\A2NTSTBR.JAR c:\program files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST c:\program files\AskSBar\bar\1.bin\A2PLUGIN.DLL c:\program files\AskSBar\bar\1.bin\ASKSBAR.DLL c:\program files\AskSBar\bar\1.bin\NPASKSBR.DLL c:\program files\AskSBar\bar\Cache\[u]0[/u]001BC17 c:\program files\AskSBar\bar\Cache\[u]0[/u]0055E44.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056132.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056393.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056614.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056847.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056A0C.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056BD1.bin c:\program files\AskSBar\bar\Cache\[u]0[/u]0056D86.bin c:\program files\AskSBar\bar\Cache\files.ini c:\program files\AskSBar\bar\History\search2 c:\program files\AskSBar\bar\Settings\prevcfg2.htm C:\sqmdata07.sqm C:\sqmdata08.sqm C:\sqmdata09.sqm C:\sqmdata10.sqm C:\sqmdata11.sqm C:\sqmdata12.sqm C:\sqmdata13.sqm C:\sqmdata14.sqm C:\sqmdata15.sqm C:\sqmdata16.sqm C:\sqmdata17.sqm C:\sqmdata18.sqm C:\sqmdata19.sqm C:\sqmnoopt07.sqm C:\sqmnoopt08.sqm C:\sqmnoopt09.sqm C:\sqmnoopt10.sqm C:\sqmnoopt11.sqm C:\sqmnoopt12.sqm C:\sqmnoopt13.sqm C:\sqmnoopt14.sqm C:\sqmnoopt15.sqm C:\sqmnoopt16.sqm C:\sqmnoopt17.sqm C:\sqmnoopt18.sqm C:\sqmnoopt19.sqm . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-28 do 2008-12-30 ))))))))))))))))))))))))))))))) . 2008-12-30 11:37 . 2008-12-30 11:37 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-29 03:18 . 2008-12-29 03:18 7,217,599 --a------ C:\odk11.3.0808setup_[www.programosy.pl].exe 2008-12-29 01:16 . 2008-12-29 01:16 0 --a------ c:\windows\nsreg.dat 2008-12-29 00:25 . 2008-12-29 00:25 <DIR> d-------- C:\!KillBox 2008-12-28 21:46 . 2008-12-28 23:31 <DIR> d-------- C:\SDFix 2008-12-27 03:30 . 2008-12-27 03:30 <DIR> d-------- c:\windows\BDOSCAN8 2008-12-27 03:12 . 2008-12-28 23:22 <DIR> d-------- c:\windows\ERUNT 2008-12-27 03:12 . 2008-12-27 03:12 <DIR> d-------- C:\ERDNT 2008-12-27 03:12 . 2008-12-27 03:13 <DIR> d-------- C:\!FixIEDef 2008-12-27 02:35 . 2006-10-11 23:44 55,296 --a------ c:\program files\Seconfig XP.exe 2008-12-27 02:35 . 2008-12-27 02:35 38,899 --a------ c:\program files\SeconfigXP.zip 2008-12-27 01:14 . 2008-12-27 01:14 <DIR> d-------- c:\program files\Trend Micro 2008-12-26 20:29 . 2008-12-26 20:29 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-12-25 04:47 . 2008-05-08 02:03 453,632 --a------ c:\windows\system32\SetACL.ocx 2008-12-22 01:54 . 2008-12-22 01:52 48,335 --a------ C:\ja i lujania w fox london 2008.jpg 2008-12-21 22:07 . 2008-12-21 22:07 <DIR> d-------- c:\program files\Winamp Toolbar 2008-12-21 22:07 . 2008-12-21 22:07 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar 2008-12-21 22:06 . 2008-12-21 22:06 <DIR> d-------- c:\program files\Winamp Remote 2008-12-21 22:06 . 2008-12-21 22:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2008-12-21 22:05 . 2008-12-22 01:46 <DIR> d-------- c:\documents and settings\Darek\Dane aplikacji\Winamp 2008-12-21 22:04 . 2008-12-21 22:04 9,345,672 --a------ c:\program files\winamp5541_full_emusic-7plus_pl-pl.exe 2008-11-24 23:32 . 2008-11-24 23:32 268 --ah----- C:\sqmdata06.sqm 2008-11-24 23:32 . 2008-11-24 23:32 244 --ah----- C:\sqmnoopt06.sqm 2008-11-24 11:09 . 2008-11-24 11:09 268 --ah----- C:\sqmdata05.sqm 2008-11-24 11:09 . 2008-11-24 11:09 244 --ah----- C:\sqmnoopt05.sqm 2008-11-24 05:38 . 2008-11-24 05:38 268 --ah----- C:\sqmdata04.sqm 2008-11-24 05:38 . 2008-11-24 05:38 244 --ah----- C:\sqmnoopt04.sqm 2008-11-23 13:10 . 2008-11-23 13:10 268 --ah----- C:\sqmdata03.sqm 2008-11-23 13:10 . 2008-11-23 13:10 244 --ah----- C:\sqmnoopt03.sqm 2008-11-23 03:58 . 2008-11-23 03:58 268 --ah----- C:\sqmdata02.sqm 2008-11-23 03:58 . 2008-11-23 03:58 244 --ah----- C:\sqmnoopt02.sqm 2008-11-22 22:10 . 2008-12-18 22:17 268 --ah----- C:\sqmdata01.sqm 2008-11-22 22:10 . 2008-12-18 22:17 244 --ah----- C:\sqmnoopt01.sqm 2008-11-22 12:20 . 2008-12-18 12:39 268 --ah----- C:\sqmdata00.sqm 2008-11-22 12:20 . 2008-12-18 12:39 244 --ah----- C:\sqmnoopt00.sqm 2008-11-20 00:04 . 2008-11-20 00:04 249,592 --a------ c:\windows\system32\cssdll32.dll 2008-11-20 00:03 . 2008-11-21 01:54 <DIR> d-------- c:\program files\COMODO 2008-11-20 00:03 . 2008-11-21 01:54 <DIR> d-------- c:\documents and settings\Darek\Dane aplikacji\Comodo 2008-11-20 00:03 . 2008-11-21 01:52 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\comodo 2008-11-19 23:23 . 2008-11-19 23:23 <DIR> d-------- c:\program files\AVG 2008-11-19 23:23 . 2008-11-21 22:11 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\avg8 2008-11-19 23:01 . 2008-11-19 23:04 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2008-11-19 22:28 . 2008-11-19 22:46 <DIR> d-------- c:\windows\system32\CatRoot_bak 2008-11-19 22:27 . 2008-08-14 10:51 138,368 -----c--- c:\windows\system32\dllcache\afd.sys 2008-11-19 22:26 . 2008-05-01 15:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2008-11-19 22:26 . 2008-06-14 19:01 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-19 22:22 . 2007-07-30 19:19 38,232 --a------ c:\windows\system32\wucltui.dll.mui 2008-11-19 22:22 . 2007-07-30 19:20 30,040 --a------ c:\windows\system32\wuaucpl.cpl.mui 2008-11-19 22:22 . 2007-07-30 19:20 30,040 --a------ c:\windows\system32\wuapi.dll.mui 2008-11-19 22:22 . 2007-07-30 19:18 21,336 --a------ c:\windows\system32\wuaueng.dll.mui 2008-11-19 18:08 . 2008-11-19 18:08 1,416,944 --a------ C:\WM9Codecs.exe 2008-11-19 10:57 . 2008-11-19 10:57 <DIR> d-------- c:\documents and settings\LocalService\Dane aplikacji\SACore 2008-11-19 00:47 . 2008-11-19 00:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\SiteAdvisor 2008-11-19 00:33 . 2008-11-19 22:21 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\McAfee 2008-11-19 00:33 . 2008-11-19 00:33 1,226,248 --a------ C:\DMSetup.exe 2008-11-12 22:44 . 2008-10-30 20:14 21,751,400 --a------ C:\PES2009Patch120.exe 2008-11-12 22:44 . 2008-11-05 18:16 8,334 --a------ C:\readme_ver120.html 2008-11-12 22:44 . 2008-11-05 15:48 5,067 --a------ C:\readme_ver110.html 2008-11-12 22:36 . 2008-11-12 22:36 21,537,489 --a------ C:\PES2009Patch120_official.zip 2008-11-12 21:52 . 2008-11-12 21:52 664 --a------ c:\windows\system32\d3d9caps.dat 2008-11-11 01:34 . 2008-11-11 01:41 <DIR> d-------- c:\program files\Unlocker 2008-11-11 01:34 . 2008-11-11 01:34 <DIR> d-------- c:\documents and settings\Darek\Dane aplikacji\Desktopicon 2008-11-11 01:34 . 2008-11-11 01:34 243,204 --a------ C:\unlocker1.8.7.exe 2008-11-02 02:18 . 2008-11-02 02:18 3,887,378 --a------ c:\program files\aimp_2.50.312.zip 2008-11-01 21:10 . 2008-11-01 21:10 57 --a------ c:\windows\wininit.ini . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-29 00:13 --------- d-----w c:\program files\Winamp 2008-12-27 23:33 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-12-10 01:56 --------- d-----w c:\documents and settings\Darek\Dane aplikacji\Azureus 2008-10-31 00:21 --------- d-----w c:\documents and settings\Darek\Dane aplikacji\fltk.org 2008-10-31 00:17 40,038,907 ----a-w c:\program files\WEOL'08_3.0_National_Teams+Club_Teams_by_www.WEOL.pl_BETA.zip 2008-10-16 00:02 576,222 ----a-w c:\program files\slownik-hipszansko-polski-traducto.zip 2008-10-10 00:00 16,746,352 ----a-w c:\program files\Install_Messenger.exe 2008-10-01 20:43 21,440,208 ----a-w c:\program files\VeohSetup-3.9.8.1082.exe 2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:46 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-04-10 15:05 1,445,575 ----a-w c:\program files\spamihilator_0_9_9_10.exe 2008-04-08 22:38 519,012 ----a-w c:\program files\aws-setup.exe 2008-02-24 19:22 3,328,770 ----a-w c:\program files\SopCast-2.0.4(dobreprogramy.pl).zip 2008-01-22 13:05 1,695,184 ----a-w c:\program files\tcmdr656.exe 2008-01-19 12:15 32,981,120 ----a-w c:\program files\avg75free_516a1225.exe 2008-01-19 11:57 59,053,000 ----a-w c:\program files\avg75f_516a1225.exe 2007-11-20 15:18 2,294 ----a-w c:\program files\changeLog.txt 2007-11-20 15:15 3,351,778 ----a-w c:\program files\Setup-SopCast-2.0.4-2007-11-20.exe 2007-11-06 18:12 17,901 ----a-w c:\program files\irunin.ini 2007-11-06 18:11 9,694 ----a-w c:\program files\irunin.dat 2007-11-06 18:11 8,134 ----a-w c:\program files\irunin.bmp 2007-11-06 18:11 15,938 ----a-w c:\program files\irunin.lng 2007-09-25 16:44 64,000 ----a-w c:\documents and settings\Darek\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-09-25 10:56 23,567,008 ----a-w c:\program files\AdbeRdr80_pl_PL.exe 2007-09-25 10:49 15,427,360 ----a-w c:\program files\gimp-2.4.0-rc3-i586-setup_[www.programosy.pl].exe 2007-05-13 19:14 4,282,528 ----a-w c:\program files\GOMPLAYERENBETASETUP.EXE 2007-05-13 19:01 1,163,592 ----a-w c:\program files\install_flash_player.exe 2006-04-29 17:46 179 ----a-w c:\program files\Free-Codecs.txt 2006-02-20 08:21 963,072 ----a-w c:\program files\TRADUCT0.EXE 2005-06-23 09:08 1,530,000 ----a-w c:\program files\X_PL_ES.ASC 2005-06-23 09:07 1,530,000 ----a-w c:\program files\X_ES_PL.ASC 2003-01-09 03:19 40,038,689 ----a-w c:\program files\WEOL'08_3.0_National_Teams+Club_Team_by_www.WEOL.pl_BETA.exe 2002-05-04 11:05 549 ---ha-w c:\program files\COPYFSTQ.EXE.manifest 2002-04-18 17:16 94,636 ----a-w c:\program files\dropcpyr.dll 2002-03-24 11:54 46,080 ----a-w c:\program files\COPYFSTQ.EXE . ((((((((((((((((((((((((((((( snapshot_2008-12-27_11.45.50,62 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-12-28 22:22:22 5,582,848 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-28 22:22:22 217,088 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-12-28 22:22:02 5,582,848 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-28 22:22:02 217,088 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-12-27 10:01:49 66,710 ----a-w c:\windows\system32\perfc009.dat + 2008-12-30 19:57:23 66,710 ----a-w c:\windows\system32\perfc009.dat - 2008-12-27 10:01:49 82,428 ----a-w c:\windows\system32\perfc015.dat + 2008-12-30 19:57:23 82,428 ----a-w c:\windows\system32\perfc015.dat - 2008-12-27 10:01:49 427,926 ----a-w c:\windows\system32\perfh009.dat + 2008-12-30 19:57:23 427,926 ----a-w c:\windows\system32\perfh009.dat - 2008-12-27 10:01:49 485,216 ----a-w c:\windows\system32\perfh015.dat + 2008-12-30 19:57:23 485,216 ----a-w c:\windows\system32\perfh015.dat + 2008-12-30 19:53:13 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6ac.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.sl_anet"= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm "vidc.ap41"= APmpg4v1.dll "msacm.divxa32"= DivXa32.acm "vidc.iyuv"= c:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= c:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "msacm.msaudio1"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm "msacm.l3codec"= L3codecp.acm "vidc.ffds"= ffdshow.ax [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2006-01-02 17:41 45056 c:\program files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2007-03-16 18:10 1392640 c:\windows\system32\WLTRAY.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2008-04-01 02:54 507904 c:\program files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-31 18:42 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 c:\program files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a------ 2006-03-24 17:30 282624 c:\windows\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wltrysvc"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "idsvc"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "c:\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "d:\\New Folder\\pes2009.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-19 111184] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-19 20560] . - - - - USUNIĘTO PUSTE WPISY - - - - URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file) . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html FF - ProfilePath - c:\documents and settings\Darek\Dane aplikacji\Mozilla\Firefox\Profiles\2q9ushis.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-30 23:20:09 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(884) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-12-30 23:21:10 ComboFix-quarantined-files.txt 2008-12-30 22:21:07 ComboFix2.txt 2008-12-28 22:52:09 ComboFix3.txt 2008-12-27 10:46:10 Przed: 6 584 602 624 bajtów wolnych Po: 6,611,058,688 bajtów wolnych 310 --- E O F --- 2008-11-20 09:19:04

Dodano Dzisiaj, 00:27:
dziekowka za pomoc

**Posty:** 18165 · przez **wojtas** 31 Gru 2008, 01:52

2008-11-24 23:32 . 2008-11-24 23:32 268 --ah----- C:\sqmdata06.sqm
2008-11-24 23:32 . 2008-11-24 23:32 244 --ah----- C:\sqmnoopt06.sqm
2008-11-24 11:09 . 2008-11-24 11:09 268 --ah----- C:\sqmdata05.sqm
2008-11-24 11:09 . 2008-11-24 11:09 244 --ah----- C:\sqmnoopt05.sqm
2008-11-24 05:38 . 2008-11-24 05:38 268 --ah----- C:\sqmdata04.sqm
2008-11-24 05:38 . 2008-11-24 05:38 244 --ah----- C:\sqmnoopt04.sqm
2008-11-23 13:10 . 2008-11-23 13:10 268 --ah----- C:\sqmdata03.sqm
2008-11-23 13:10 . 2008-11-23 13:10 244 --ah----- C:\sqmnoopt03.sqm
2008-11-23 03:58 . 2008-11-23 03:58 268 --ah----- C:\sqmdata02.sqm
2008-11-23 03:58 . 2008-11-23 03:58 244 --ah----- C:\sqmnoopt02.sqm
2008-11-22 22:10 . 2008-12-18 22:17 268 --ah----- C:\sqmdata01.sqm
2008-11-22 22:10 . 2008-12-18 22:17 244 --ah----- C:\sqmnoopt01.sqm
2008-11-22 12:20 . 2008-12-18 12:39 268 --ah----- C:\sqmdata00.sqm
2008-11-22 12:20 . 2008-12-18 12:39 244 --ah----- C:\sqmnoopt00.sqm

skasuj te pliki moga byc ukryte...

**Posty:** 8 · przez **duduso** 02 Sty 2009, 03:49

probowalem skasowac te pliki ale cos poszlo nie tak.
uzylem aplikacji MOVEIT2 i programik nie wykryl tych plikow-nie skasowalem.wiem ze pisales ze moge byc ukryte.jak je usunac?pzdr

**Posty:** 18165 · przez **wojtas** 02 Sty 2009, 12:20

daj jeszcze raz nowego loga

Kto jest na forum