Heur.w32 prosze o pomoc!!!

**Posty:** 5 · przez **ftrx** 08 Paź 2008, 13:40

scan z Hijacka:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:23, on 2008-10-08
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Documents and Settings\Burrows\so7.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Burrows\so7.exe
C:\Documents and Settings\Burrows\so7.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\programy\AVG\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\system32\firewall.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\Documents and Settings\Burrows\so7.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [\\SPISKOWC-7E803B\EPSON Stylus CX7400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE /FU "C:\DOCUME~1\Burrows\USTAWI~1\Temp\E_S6.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Auto EPSON Stylus CX7400 Series na SPISKOWC-7E803B] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE /FU "C:\WINDOWS\TEMP\E_S580.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.optimus.pl
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://stoogetv.com/SOPCORE.CAB
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6365 bytes

poza tym w procesach pokazuje sie cos takiego so7.exe kilka razy i svchost.exe tez po kilka razy....

**Posty:** 7956 · przez **Magik** 08 Paź 2008, 14:53

Witam

gdzie log z combofix'a??

po drugie
http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

to dajesz na fix:

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\programy\AVG\avgssie.dll (file missing) O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (file missing) O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\system32\firewall.exe O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\Documents and Settings\Burrows\so7.exe

+
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

**Posty:** 5 · przez **ftrx** 08 Paź 2008, 15:04

tu jeszcze log z combofixa

Kod: Zaznacz wszystko: ComboFix 08-10-07.06 - Burrows 2008-10-08 14:59:30.9 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1664 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Burrows\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-08 do 2008-10-08 ))))))))))))))))))))))))))))))) . 2008-10-08 09:53 . 2008-10-08 09:53 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2008-10-08 09:53 . 2008-10-08 09:53 <DIR> d-------- C:\WINDOWS\system32\pl 2008-10-08 09:53 . 2008-10-08 09:53 <DIR> d-------- C:\WINDOWS\system32\bits 2008-10-08 09:53 . 2008-10-08 09:53 <DIR> d-------- C:\WINDOWS\l2schemas 2008-10-08 09:25 . 2008-04-14 19:19 136,192 --------- C:\WINDOWS\system32\aaclient.dll 2008-09-30 20:14 . 2008-09-30 20:14 <DIR> d-------- C:\Program Files\Mplayer 2008-09-30 20:13 . 2008-09-30 20:14 746 --a------ C:\WINDOWS\QIII.INI 2008-09-18 14:22 . 2008-09-18 14:22 34,304 --a------ C:\WINDOWS\system32\shwfcyg.exe 2008-09-18 13:49 . 2008-09-18 13:49 34,304 --a------ C:\WINDOWS\system32\vzlbll.exe 2008-09-18 09:35 . 2008-09-18 09:35 34,304 --a------ C:\WINDOWS\system32\yfyicsu.exe 2008-09-18 02:41 . 2008-09-18 02:41 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-09-17 19:16 . 2008-09-17 19:16 34,304 --a------ C:\WINDOWS\system32\fmovh.exe 2008-09-17 07:10 . 2008-09-17 07:10 34,304 --a------ C:\WINDOWS\system32\uxzllrxy.exe 2008-09-16 01:20 . 2008-09-16 01:20 34,304 --a------ C:\WINDOWS\system32\zptelqsm.exe 2008-09-15 18:27 . 2008-09-15 18:28 34,304 --a------ C:\WINDOWS\system32\ekvvamg.exe 2008-09-14 11:46 . 2008-09-14 11:46 34,304 --a------ C:\WINDOWS\system32\tjghatxt.exe 2008-09-14 07:54 . 2008-09-14 07:54 34,304 --a------ C:\WINDOWS\system32\ling.exe 2008-09-13 14:07 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-09-13 14:06 . 2008-09-13 14:06 34,304 --a------ C:\WINDOWS\system32\cqqeri.exe 2008-09-12 23:57 . 2008-09-12 23:57 34,304 --a------ C:\WINDOWS\system32\kgzuljdw.exe 2008-09-12 11:41 . 2008-09-12 11:41 34,304 --a------ C:\WINDOWS\system32\qsehz.exe 2008-09-11 22:19 . 2008-09-11 22:19 34,304 --a------ C:\WINDOWS\system32\dipp.exe 2008-09-11 00:38 . 2008-09-19 12:31 27,136 --a------ C:\Documents and Settings\Burrows\x3.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-08 12:28 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-10-08 11:12 138,136 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-08 11:12 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-10-07 23:03 --------- d-----w C:\Program Files\mks_vir_2007 2008-10-07 21:36 --------- d-----w C:\Documents and Settings\Burrows\Dane aplikacji\Xfire 2008-10-07 10:15 24,064 ----a-w C:\Documents and Settings\Burrows\so7.exe 2008-10-06 17:15 --------- d-----w C:\Documents and Settings\Burrows\Dane aplikacji\teamspeak2 2008-10-05 18:25 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-05 18:04 --------- d-s---w C:\Program Files\Xfire 2008-09-30 13:51 --------- d-----w C:\Documents and Settings\Burrows\Dane aplikacji\Hamachi 2008-09-25 14:56 --------- d-----w C:\Program Files\mIRC 2008-09-15 15:54 --------- d-----w C:\Program Files\Google 2008-09-14 10:49 --------- d-----w C:\Program Files\PKR 2008-09-07 19:40 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-09-01 09:34 43,520 ----a-w C:\Documents and Settings\Burrows\winhost.exe 2008-08-28 15:43 --------- d-----w C:\Program Files\ALLPlayer 2008-08-28 15:42 892,928 ----a-w C:\WINDOWS\system32\iconv.dll 2008-08-28 15:42 456,192 ----a-w C:\WINDOWS\system32\libmplayer.dll 2008-08-28 15:42 3,569,152 ----a-w C:\WINDOWS\system32\libavcodec.dll 2008-08-28 15:42 258,048 ----a-w C:\WINDOWS\system32\libFLAC.dll 2008-08-28 15:42 119,296 ----a-w C:\WINDOWS\system32\libmpeg2_ff.dll 2008-08-28 15:40 2,041,363 ----a-w C:\WINDOWS\system32\x264vfw.dll 2008-08-28 15:40 --------- d-----w C:\Program Files\Real Alternative 2008-08-21 17:28 22,016 ----a-w C:\Documents and Settings\Burrows\cwin.exe 2008-08-05 08:40 45,056 ----a-w C:\Documents and Settings\Burrows\system.exe 2008-08-03 18:26 45,056 ----a-w C:\Documents and Settings\Burrows\program.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-03-25 22:53 22,328 ----a-w C:\Documents and Settings\Burrows\Dane aplikacji\PnkBstrK.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{0A94B116-4504-4e26-AB05-E61E474AA38B}"= "C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL" [2008-02-12 61440] [HKEY_CLASSES_ROOT\clsid\{0a94b116-4504-4e26-ab05-e61e474aa38b}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "\\SPISKOWC-7E803B\EPSON Stylus CX7400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE" [2007-02-15 179200] "Auto EPSON Stylus CX7400 Series na SPISKOWC-7E803B"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE" [2007-02-15 179200] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 1849032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 8491008] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-16 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] C:\Documents and Settings\Burrows\Menu Start\Programy\Autostart\ Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-09-18 3089232] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\digital imaging\bin\hpqtra08.exe [2004-05-28 241664] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\digital imaging\bin\hpqthb08.exe [2004-05-29 53248] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\startupfolder\^cwin.exe] path=\cwin.exe backup=C:\WINDOWS\pss\cwin.exeCommon Startup [HKLM\~\startupfolder\^program.exe] path=\program.exe backup=C:\WINDOWS\pss\program.exeCommon Startup [HKLM\~\startupfolder\^so7.exe] path=\so7.exe backup=C:\WINDOWS\pss\so7.exeCommon Startup [HKLM\~\startupfolder\^system.exe] path=\system.exe backup=C:\WINDOWS\pss\system.exeCommon Startup [HKLM\~\startupfolder\^x3.exe] path=\x3.exe backup=C:\WINDOWS\pss\x3.exeCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced DHTML Enable] --a------ 2008-10-07 12:15 24064 C:\Documents and Settings\Burrows\so7.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-04-01 11:39 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2006-11-14 11:12 1849032 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2008-05-18 00:47 1838592 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2004-05-12 16:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-02-12 14:38 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2004-04-06 12:28 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06] --a------ 2004-06-07 07:28 659456 C:\WINDOWS\system32\hphmon06.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06] --a------ 2004-06-07 07:34 49152 C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-05-21 08:39 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-09-16 19:07 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"= "C:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "D:\\Guitar Hero3\\GH3.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\EA Sports\\FIFA 08\\FIFA08.exe"= "E:\\Gry\\Call of Duty 4\\iw3mp.exe"= "C:\\Documents and Settings\\Burrows\\so7.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8069:TCP"= 8069:TCP:BitComet 8069 TCP "8069:UDP"= 8069:UDP:BitComet 8069 UDP [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64ca7348-de02-11dc-86b9-001a4df8cbd3}] \Shell\AutoRun\command - L:\EXPLORER.EXE \Shell\explore\Command - L:\EXPLORER.EXE \Shell\open\Command - L:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{722f7948-362d-11dd-b9b1-001a4df8cbd3}] \Shell\auto\command - N:\Knight.exe open \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open \Shell\explore\command - N:\Knight.exe open \Shell\find\command - N:\Knight.exe open \Shell\install\command - N:\Knight.exe open \Shell\open\command - N:\Knight.exe open [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a530f92-456c-11dd-b9d1-001a4df8cbd3}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a530f93-456c-11dd-b9d1-001a4df8cbd3}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90e797bd-d189-11dc-86a3-001a4df8cbd3}] \Shell\AutoRun\command - d.com \Shell\explore\Command - d.com \Shell\open\Command - d.com [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}] C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe . Zawartość folderu 'Zaplanowane zadania' 2008-10-08 C:\WINDOWS\Tasks\HP Usg Daily.job - C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe [2004-06-07 07:35] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-Windows Network Firewall - C:\WINDOWS\system32\firewall.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Burrows\Dane aplikacji\Mozilla\Firefox\Profiles\mf8nt3ys.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ig?ct=1056755551 FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPBILLARD8.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npOggX.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 15:00:38 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... C:\DOCUME~1\Burrows\USTAWI~1\Temp\TMP4352$.TMP skanowanie pomyślnie ukończone ukryte pliki: 1 ************************************************************************** . Czas ukończenia: 2008-10-08 15:01:37 ComboFix-quarantined-files.txt 2008-10-08 13:01:28 Przed: 734 806 016 bajtów wolnych Po: 1,010,565,120 bajtów wolnych 218 --- E O F --- 2008-10-08 07:56:26

**Posty:** 7956 · przez **Magik** 08 Paź 2008, 15:25

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\shwfcyg.exe C:\WINDOWS\system32\vzlbll.exe C:\WINDOWS\system32\yfyicsu.exe C:\WINDOWS\system32\xfcodec.dll C:\WINDOWS\system32\fmovh.exe C:\WINDOWS\system32\uxzllrxy.exe C:\WINDOWS\system32\zptelqsm.exe C:\WINDOWS\system32\ekvvamg.exe C:\WINDOWS\system32\tjghatxt.exe C:\WINDOWS\system32\ling.exe C:\WINDOWS\system32\drivers\mouhid.sys C:\WINDOWS\system32\cqqeri.exe C:\WINDOWS\system32\kgzuljdw.exe C:\WINDOWS\system32\qsehz.exe C:\WINDOWS\system32\dipp.exe C:\Documents and Settings\Burrows\x3.exe C:\Documents and Settings\Burrows\cwin.exe C:\Documents and Settings\Burrows\system.exe C:\Documents and Settings\Burrows\program.exe

Zapisz jako CFScript.txt. Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64ca7348-de02-11dc-86b9-001a4df8cbd3}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{722f7948-362d-11dd-b9b1-001a4df8cbd3}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a530f92-456c-11dd-b9d1-001a4df8cbd3}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a530f93-456c-11dd-b9d1-001a4df8cbd3}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90e797bd-d189-11dc-86a3-001a4df8cbd3}] [-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]

zapisz jako fix.reg i odpal

gdzie log z sdfix'a??