Heur.w32 problem z usunięciem...

**Posty:** 4 · przez **aelfric** 29 Mar 2009, 15:10

Logi z hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:00:37, on 2009-03-29 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16809) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Windows\AGRSMMSG.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe D:\Games\# readme #\DVD Mini-Image\YASU.exe C:\Windows\system32\conime.exe C:\Windows\system32\wuauclt.exe C:\Windows\Explorer.exe C:\Program Files\ArcaBit\ArcaVir\abregmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.benq.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [Unattend0000000001{4697EEAC-FD53-4475-82F2-C40B479A6FF4}] wscript.exe c:\windows\winbom.vbs O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [Q-MediaBar] "C:\Program Files\BenQ\Q-MediaBar\QBar.exe" /stop O4 - HKLM\..\Run: [Unattend0000000001{FA2576D7-90CF-48B9-93F1-49F6307A4AD2}] wscript.exe c:\windows\winbom.vbs O4 - HKLM\..\Run: [Unattend0000000001{FDAF7DC3-0F11-4FB5-BFBF-3ABC197C9D32}] wscript.exe c:\windows\winbom.vbs O4 - HKLM\..\Run: [Unattend0000000001{44FD91B5-340C-4E93-9D07-B3E01F4F09AA}] wscript.exe c:\windows\winbom.vbs O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: SmartDel.lnk = C:\Windows\SmartDEL.vbs O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O13 - Gopher Prefix: O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 5155 bytes

A tu logi z combofixa

Kod: Zaznacz wszystko: ComboFix 09-03-28.06 - kuba 2009-03-29 15:18:51.2 - NTFSx86 Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.1.1045.18.894.358 [GMT 2:00] Uruchomiony z: c:\users\kuba\Downloads\ComboFix.exe AV: ArcaVir *On-access scanning disabled* (Updated) FW: ArcaFirewall 2007 *disabled* . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-28 do 2009-03-29 ))))))))))))))))))))))))))))))) . 2009-03-29 14:57 . 2009-03-29 14:57 <DIR> d-------- c:\program files\Trend Micro 2009-03-29 14:53 . 2009-03-29 14:53 <DIR> d-------- c:\program files\CCleaner 2009-03-29 14:22 . 2009-03-29 14:22 <DIR> d--h----- c:\windows\PIF 2009-03-26 09:02 . 2009-03-26 09:05 <DIR> d-------- c:\users\kuba\AppData\Roaming\Command & Conquer 3 Tiberium Wars 2009-03-24 11:52 . 2009-03-24 11:52 <DIR> d-------- c:\program files\IPX-SPX Protocol 2009-03-24 11:35 . 2009-03-24 11:36 94,208 --a------ c:\windows\ScUnin.exe 2009-03-24 11:35 . 2009-03-24 11:36 33,021 --a------ c:\windows\scunin.dat 2009-03-24 11:35 . 2009-03-24 11:36 967 --a------ c:\windows\ScUnin.pif 2009-03-21 21:19 . 2009-03-21 21:19 <DIR> d-------- c:\windows\Sun 2009-03-20 18:18 . 2009-03-20 18:18 4 --a------ c:\windows\System32\proc-322085784.bin 2009-03-18 21:38 . 2009-03-18 21:37 410,984 --a------ c:\windows\System32\deploytk.dll 2009-03-18 21:37 . 2009-03-18 21:37 <DIR> d-------- c:\program files\Java 2009-03-14 15:34 . 2009-03-14 15:34 <DIR> d-------- c:\users\Public\Lanthir Lamath 2009-03-13 13:47 . 2009-03-13 13:48 <DIR> d-------- c:\users\Public\Helm Hammerhand 2009-03-12 14:09 . 2009-03-26 20:00 <DIR> d-------- c:\users\kuba\AppData\Roaming\Moje pliki gry Władca Pierścieni, Król Nazguli 2009-03-12 08:08 . 2009-03-12 08:08 <DIR> d-------- c:\program files\Common Files\Symantec Shared 2009-03-12 08:07 . 2009-03-27 19:00 <DIR> d-------- c:\program files\Norton Security Scan 2009-03-11 07:36 . 2008-12-16 07:53 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-11 07:36 . 2008-12-16 07:53 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-11 07:36 . 2008-12-16 07:53 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-11 07:35 . 2008-12-16 06:00 8,147,968 --a------ c:\windows\System32\wmploc.DLL 2009-03-11 07:35 . 2009-02-09 03:59 2,028,032 --a------ c:\windows\System32\win32k.sys 2009-03-11 07:35 . 2008-11-27 06:42 269,824 --a------ c:\windows\System32\schannel.dll 2009-03-10 00:02 . 2009-03-10 00:02 <DIR> d-------- c:\windows\System32\Adobe 2009-03-09 18:20 . 2009-03-09 18:21 <DIR> d-------- c:\users\kuba\AppData\Roaming\PacificPoker 2009-03-07 12:36 . 2009-03-07 12:54 <DIR> d-------- c:\users\kuba\AppData\Roaming\Moje pliki Bitwy o Śródziemie™ II 2009-03-07 01:14 . 2009-03-07 01:14 <DIR> d--hs---- c:\windows\ftpcache 2009-03-07 01:14 . 2009-03-07 01:14 <DIR> d-------- c:\users\kuba\AppData\Roaming\fizzy . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-26 18:00 --------- d-----w c:\users\kuba\AppData\Roaming\Moje pliki gry Władca Pierścieni, Król Nazguli 2009-03-20 16:18 --------- d-----w c:\users\kuba\AppData\Roaming\GanymedeNet 2009-03-18 19:45 --------- d-----w c:\program files\Ganymede 2009-03-12 11:15 --------- d-----w c:\program files\DAEMON Tools Lite 2009-03-12 02:07 --------- d-----w c:\program files\Windows Mail 2009-03-09 17:03 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-07 10:54 --------- d-----w c:\users\kuba\AppData\Roaming\Moje pliki Bitwy o Śródziemie™ II 2009-02-21 09:33 --------- d-----w c:\program files\Metin2_PL 2009-02-18 08:09 --------- d-----w c:\program files\Common Files\INCA Shared 2009-02-18 07:02 --------- d-----w c:\programdata\PMB Files 2009-02-18 07:01 --------- d-----w c:\program files\Pando Networks 2009-02-04 14:30 --------- d-----w c:\program files\Common Files\Ahead 2009-02-04 14:09 --------- d-----w c:\program files\Ahead 2009-01-28 02:01 --------- d-----w c:\program files\MSXML 4.0 2009-01-15 04:16 826,368 ----a-w c:\windows\System32\wininet.dll 2009-01-15 04:16 56,320 ----a-w c:\windows\System32\iesetup.dll 2009-01-15 04:16 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2009-01-15 04:15 26,624 ----a-w c:\windows\System32\ieUnatt.exe 2008-12-10 19:56 174 --sha-w c:\program files\desktop.ini . ((((((((((((((((((((((((((((( SnapShot@2009-03-29_14.36.56,30 ))))))))))))))))))))))))))))))))))))))))) . - 2009-03-29 12:36:01 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2009-03-29 13:21:59 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2009-03-29 13:21:59 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-03-29 12:30:41 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-03-29 12:53:34 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-03-29 12:30:41 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-03-29 12:53:34 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-03-29 12:30:41 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-03-29 12:53:34 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832] "Q-MediaBar"="c:\program files\BenQ\Q-MediaBar\QBar.exe" [2007-01-26 159744] "AvMenu"="c:\program files\ArcaBit\ArcaVir\AVMenu.exe" [2008-01-29 481800] "ABRegmon"="c:\program files\ArcaBit\ArcaVir\ABregmon.exe" [2007-07-12 303104] "ArcaCheck"="c:\program files\ArcaBit\ArcaVir\ArcaCheck.exe" [2007-07-27 836912] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-18 148888] "Unattend0000000001{4697EEAC-FD53-4475-82F2-C40B479A6FF4}"="wscript.exe" [2006-11-02 c:\windows\System32\wscript.exe] "RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 c:\windows\RtHDVCpl.exe] "Unattend0000000001{FA2576D7-90CF-48B9-93F1-49F6307A4AD2}"="wscript.exe" [2006-11-02 c:\windows\System32\wscript.exe] "Unattend0000000001{FDAF7DC3-0F11-4FB5-BFBF-3ABC197C9D32}"="wscript.exe" [2006-11-02 c:\windows\System32\wscript.exe] "Unattend0000000001{44FD91B5-340C-4E93-9D07-B3E01F4F09AA}"="wscript.exe" [2006-11-02 c:\windows\System32\wscript.exe] "AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 c:\windows\AGRSMMSG.exe] c:\users\kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000] UniSpiker-2.6.lnk - c:\program files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2006-03-06 86016] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] SmartDel.lnk - c:\windows\SmartDEL.vbs [2006-02-08 2661] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{5F21E859-F3E1-4D2A-8063-137D3FFD4EC6}d:\\program files\\warcraft iii\\war3.exe"= UDP:d:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{2CC21A40-E620-482E-8FF7-542E9CBE06F8}d:\\program files\\warcraft iii\\war3.exe"= TCP:d:\program files\warcraft iii\war3.exe:Warcraft III "TCP Query User{C1F03285-508F-4EF7-B945-A62E4557C355}d:\\program files\\warcraft iii\\war3.exe"= UDP:d:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{A8991EDE-C1D9-48B3-A20E-4D5469BDAE0A}d:\\program files\\warcraft iii\\war3.exe"= TCP:d:\program files\warcraft iii\war3.exe:Warcraft III "{6186A0C7-F637-47B7-AE9B-05C2EB061953}"= UDP:d:\program files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2 "{617F4D5F-CFA6-442B-9F92-6ED8935B9C0C}"= TCP:d:\program files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2 "TCP Query User{7B30D3C7-8530-4BB4-8DEA-907031476338}d:\\program files\\worms\\frontend.exe"= UDP:d:\program files\worms\frontend.exe:Worms 2 Frontend "UDP Query User{A0ABB659-3AD9-4DD6-970A-8E5D50853FFF}d:\\program files\\worms\\frontend.exe"= TCP:d:\program files\worms\frontend.exe:Worms 2 Frontend "TCP Query User{725AED87-F9B4-431A-B876-FF0292988AD0}d:\\sierra\\empire earth\\empire earth.exe"= UDP:d:\sierra\empire earth\empire earth.exe:Empire Earth "UDP Query User{61C8CDE0-E2DF-4B25-98D6-66DDEAE362FA}d:\\sierra\\empire earth\\empire earth.exe"= TCP:d:\sierra\empire earth\empire earth.exe:Empire Earth "TCP Query User{35C63CD7-E526-4B4E-ADF4-3FDF3EAC2BC1}d:\\program files\\activision\\rome - total war\\rometw.exe"= UDP:d:\program files\activision\rome - total war\rometw.exe:Rome: Total War "UDP Query User{D26AB4F9-4EA2-454D-9E45-B6707A8ED8E0}d:\\program files\\activision\\rome - total war\\rometw.exe"= TCP:d:\program files\activision\rome - total war\rometw.exe:Rome: Total War "TCP Query User{9A78CA38-E61C-42AE-B00C-506B4D0ED15B}d:\\program files\\ubisoft\\far cry\\bin32\\farcry.exe"= UDP:d:\program files\ubisoft\far cry\bin32\farcry.exe:Far Cry "UDP Query User{6AE0AD95-FA74-4DA2-AB3F-A6538306888C}d:\\program files\\ubisoft\\far cry\\bin32\\farcry.exe"= TCP:d:\program files\ubisoft\far cry\bin32\farcry.exe:Far Cry "TCP Query User{4050DB50-6184-4B93-8F1F-508FC21EB283}d:\\program files\\infinite loop\\tzar\\tzar.exe"= UDP:d:\program files\infinite loop\tzar\tzar.exe:Tzar "UDP Query User{E1A05AF1-BADF-4708-8A60-717B46061483}d:\\program files\\infinite loop\\tzar\\tzar.exe"= TCP:d:\program files\infinite loop\tzar\tzar.exe:Tzar "TCP Query User{24659B71-736A-4532-8EEA-7291F9B5EB34}d:\\program files\\ea games\\battlefield 2\\bf2.exe"= UDP:d:\program files\ea games\battlefield 2\bf2.exe:BF2 "UDP Query User{AD433CAE-9374-4BC6-B0AE-0C210C6429A1}d:\\program files\\ea games\\battlefield 2\\bf2.exe"= TCP:d:\program files\ea games\battlefield 2\bf2.exe:BF2 "TCP Query User{D21B2688-046D-459A-A2C1-8A4B2A3E7E06}d:\\program files\\infinite loop\\tzar\\tzar.exe"= UDP:d:\program files\infinite loop\tzar\tzar.exe:Tzar "UDP Query User{8CC44E8A-19C6-45C0-B233-C500CAF911FC}d:\\program files\\infinite loop\\tzar\\tzar.exe"= TCP:d:\program files\infinite loop\tzar\tzar.exe:Tzar "TCP Query User{8601995E-519A-44DB-B1C0-EAD0C1AF2C7A}d:\\program files\\valve\\hlds.exe"= UDP:d:\program files\valve\hlds.exe:HLDS Launcher "UDP Query User{A1946336-55AB-446E-B85C-35913BB072C2}d:\\program files\\valve\\hlds.exe"= TCP:d:\program files\valve\hlds.exe:HLDS Launcher "TCP Query User{E9A0AEC7-354D-4177-9D6B-A66A3385FDE9}d:\\program files\\valve\\hl.exe"= UDP:d:\program files\valve\hl.exe:Half-Life Launcher "UDP Query User{45ACE77A-28AA-4432-B582-B8461000DBF8}d:\\program files\\valve\\hl.exe"= TCP:d:\program files\valve\hl.exe:Half-Life Launcher "{60DEEDC7-E057-4A13-B9CE-57DC22FD4B66}"= UDP:d:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{BD0C7491-7185-4F01-864A-B109D40E2582}"= TCP:d:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "TCP Query User{82B39635-351B-48CC-A4F7-AF3DA824D6AD}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{ACC07333-3C69-42FD-AC55-53E3104E0022}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{0D19B349-D52C-49BC-B7F6-F6902FDAF408}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver "UDP Query User{916178B2-B108-4C15-BC2B-CF85ADE4A939}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver "TCP Query User{C092F798-8F2E-45BF-8FDE-8BC98120273D}c:\\program files\\tvants\\tvants.exe"= UDP:c:\program files\tvants\tvants.exe:TVAnts "UDP Query User{2106119E-DDC0-4680-A2C7-90B63C1BF0F3}c:\\program files\\tvants\\tvants.exe"= TCP:c:\program files\tvants\tvants.exe:TVAnts "{97A4217B-D105-4831-B3D8-28F0F395FDEB}"= UDP:d:\fmanager 2009\fm.exe:Football Manager 2009 "{60555E24-1665-4773-8474-DD4955B85B4C}"= TCP:d:\fmanager 2009\fm.exe:Football Manager 2009 "TCP Query User{6E4AE745-AA59-4277-8FC5-0812EC84E96D}d:\\diablo ii\\diablo ii\\game.exe"= UDP:d:\diablo ii\diablo ii\game.exe:Diablo II "UDP Query User{DBB0CA29-2BAA-419F-9892-C3B81F458D68}d:\\diablo ii\\diablo ii\\game.exe"= TCP:d:\diablo ii\diablo ii\game.exe:Diablo II "TCP Query User{FB4EB2EE-2387-40DC-90B0-DF55E2E45DCD}d:\\program files\\ea games\\battlefield 1942\\bf1942.exe"= UDP:d:\program files\ea games\battlefield 1942\bf1942.exe:BF1942 "UDP Query User{6F6E1912-BDDC-449D-A770-F0F5B7D551D1}d:\\program files\\ea games\\battlefield 1942\\bf1942.exe"= TCP:d:\program files\ea games\battlefield 1942\bf1942.exe:BF1942 "TCP Query User{36CC8794-8D96-47E1-A806-B563DD80DA55}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{0456D03F-EECE-4E03-A259-4E5CAA1BC840}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{A6BA3FEA-9E1C-41CB-9AC8-3EB5A78D377B}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver "UDP Query User{F152E343-D2E8-445A-AE2D-0D4AC96E6AA6}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver "TCP Query User{A4F61507-BFF0-445D-97BA-ED09715408E3}c:\\program files\\tvants\\tvants.exe"= UDP:c:\program files\tvants\tvants.exe:TVAnts "UDP Query User{3BCC1A66-52C5-4C17-AE2C-61631B1297AE}c:\\program files\\tvants\\tvants.exe"= TCP:c:\program files\tvants\tvants.exe:TVAnts "TCP Query User{47F408A1-D4EE-47EF-A9DC-7D12B2ABF9F8}c:\\program files\\metin2_pl\\metin2.bin"= UDP:c:\program files\metin2_pl\metin2.bin:metin2.bin "UDP Query User{DB781441-B261-4276-BBD9-1CF43FB2D2EE}c:\\program files\\metin2_pl\\metin2.bin"= TCP:c:\program files\metin2_pl\metin2.bin:metin2.bin "TCP Query User{5782C6A1-0AF4-4E61-83A6-FC1C08551E72}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{6A663D76-A8A6-47CC-BBC9-AFE2178FB9E2}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "TCP Query User{4660AB30-8112-4B85-AC81-57B3A1164FE6}d:\\program files\\bitlord\\bitlord.exe"= UDP:d:\program files\bitlord\bitlord.exe:BitLord "UDP Query User{2B6210B0-7D0C-47FF-BCC7-97D86D3DB013}d:\\program files\\bitlord\\bitlord.exe"= TCP:d:\program files\bitlord\bitlord.exe:BitLord "{703AC41A-0149-4A1F-B975-F38E800231CF}"= UDP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster "{53433B0C-B7D5-4DC2-9934-1CA87991ABD2}"= TCP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster "TCP Query User{6613B37F-FAC0-4715-ADA6-959FB1A63A46}d:\\program files\\ea games\\need for speed most wanted\\speed.exe"= UDP:d:\program files\ea games\need for speed most wanted\speed.exe:speed "UDP Query User{9F7AB961-72B0-480C-AE73-F1D6A1AD8FE0}d:\\program files\\ea games\\need for speed most wanted\\speed.exe"= TCP:d:\program files\ea games\need for speed most wanted\speed.exe:speed "{F35ADE4F-CAF9-4DE2-A213-2D1CD92BEBBE}"= UDP:d:\program files\Electronic Arts\Bitwa o Śródziemie II\game.dat:Bitwa o Śródziemie™ II "{C0A33270-AE33-47B4-BD70-E69AFA5B25AA}"= TCP:d:\program files\Electronic Arts\Bitwa o Śródziemie II\game.dat:Bitwa o Śródziemie™ II "{D60E302A-3B19-4514-AC15-E333C878541F}"= Disabled:UDP:d:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{20D140BB-6C94-458A-8101-231C29934442}"= Disabled:TCP:d:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "TCP Query User{5A0BCE58-ECEC-47FC-BF4B-A7F151B351DC}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{DE5FF7DE-9061-47AF-BEEC-D65D3BAD927C}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{3F8F8A33-FA32-4288-932C-7B53217F26D6}"= UDP:d:\program files\Electronic Arts\Król Nazguli\game.dat:Władca Pierścieni, Król Nazguli "{4B852E62-8522-4C0C-AAC5-3601FA358B32}"= TCP:d:\program files\Electronic Arts\Król Nazguli\game.dat:Władca Pierścieni, Król Nazguli "TCP Query User{EB1DDE49-8D2A-4B97-9E2F-451A6BAB3269}c:\\windows\\system32\\dpnsvr.exe"= UDP:c:\windows\system32\dpnsvr.exe:Microsoft DirectPlay8 Server "UDP Query User{448BF818-BE7B-427A-8F66-46829BA70FE0}c:\\windows\\system32\\dpnsvr.exe"= TCP:c:\windows\system32\dpnsvr.exe:Microsoft DirectPlay8 Server "TCP Query User{37075D29-4140-457A-8A90-A409BE68718C}d:\\program files\\play\\warlords battlecry iii\\battlecry iii.exe"= UDP:d:\program files\play\warlords battlecry iii\battlecry iii.exe:Warlords Battlecry III "UDP Query User{7F7D9A54-EE64-4D4C-9AFD-80075B359E13}d:\\program files\\play\\warlords battlecry iii\\battlecry iii.exe"= TCP:d:\program files\play\warlords battlecry iii\battlecry iii.exe:Warlords Battlecry III "TCP Query User{622FC9DF-B73D-47DF-9DCD-0797C0C90288}d:\\program files\\starcraft\\starcraft.exe"= UDP:d:\program files\starcraft\starcraft.exe:Starcraft "UDP Query User{940B2747-9A3B-4E31-9ADA-F683CB202B06}d:\\program files\\starcraft\\starcraft.exe"= TCP:d:\program files\starcraft\starcraft.exe:Starcraft "{40246330-2386-4A6D-9EDE-B963AF7493B1}"= d:\games\RetailExe\1.2\cnc3game.dat:Command & Conquer 3 Tiberium Wars [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R1 ABTDI;ABTDI;c:\program files\ArcaBit\ArcaVir\ABTDI.sys [2007-05-08 44032] R2 ABFileMon;ArcaBit FileMonitor;c:\program files\ArcaBit\ArcaVir\filemonsv.exe [2009-01-02 158216] R2 AVUpdate;ArcaBit Update Service;c:\program files\ArcaBit\ArcaUpdate\update.exe [2007-02-26 167936] R3 ABFLT;ArcaBit File Monitor Driver;c:\progra~1\ArcaBit\ArcaVir\ABFLT.sys [2007-09-12 30208] R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;c:\program files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe [2007-01-11 200704] R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;c:\program files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe [2007-01-11 237568] S2 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;c:\program files\ArcaBit\Common\taskscheduler.exe [2007-01-12 270336] S3 QBIOSIOdetect.dll;QBIOSIOdetect.dll;c:\drv\WLAN\WLANCHK\QBIOSIoDetect.dll [2006-02-08 11520] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - sptd [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e057b2bb-8d80-11dd-912d-001b24f1416a}] \shell\AutoRun\command - J:\qphdin.com \shell\open\Command - J:\qphdin.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f2ba5299-8a59-11dd-9619-001b24f1416a}] \shell\AutoRun\command - F:\nba2k9setup.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static] msiexec /fums {E616A801-DF44-76CA-4CD7-F84E3D77B01A} /qb . Zawartość folderu 'Zaplanowane zadania' 2009-03-27 c:\windows\Tasks\Norton Security Scan for kuba.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 05:18] 2009-03-29 c:\windows\Tasks\User_Feed_Synchronization-{97095695-A3E5-4F9D-82F8-1E055AEBABDB}.job - c:\windows\system32\msfeedssync.exe [2006-11-02 11:45] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.benq.com FF - ProfilePath - c:\users\kuba\AppData\Roaming\Mozilla\Firefox\Profiles\shyi3774.default\ FF - prefs.js: browser.startup.homepage - www.nba.com FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-29 15:22:08 Windows 6.0.6000 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-03-29 15:24:36 ComboFix-quarantined-files.txt 2009-03-29 13:24:31 ComboFix2.txt 2009-03-29 12:38:48 Przed: 13 441 089 536 bajtów wolnych Po: 13,409,390,592 bajtów wolnych 228 --- E O F --- 2009-03-27 15:28:02

Ogólnie to podczas skanowania arcavirem mi to wykryło w jednym pliku i teraz mam z tym kłopot. Jakieś wskazania?

**Posty:** 8001 · przez **Okocza** 29 Mar 2009, 15:11

aelfric, wstaw log z combofixa w tagi code i tu popraw tagi i do tego opisz swój problem

**Posty:** 4 · przez **aelfric** 29 Mar 2009, 15:29

poprawione

**Posty:** 8001 · przez **Okocza** 29 Mar 2009, 15:47

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 4 · przez **aelfric** 29 Mar 2009, 16:14

probowalem uruchomic runthis.bat lecz nic sie nie dzieje...

**Posty:** 8001 · przez **Okocza** 29 Mar 2009, 16:20

aelfric, robisz to oczywiście w trybie awaryjnym?

**Posty:** 4 · przez **aelfric** 29 Mar 2009, 23:00

jak najbardziej

**Posty:** 18165 · przez **wojtas** 29 Mar 2009, 23:07

w jakim pliku CI wykryło ?:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.