infekcje,alerty

**Posty:** 3 · przez **pablodh** 27 Maj 2008, 20:56

prosze o sprawdzenie loga po usunieciu 1400infekcji dalej cos jest

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:27:37, on 2008-05-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe C:\Program Files\Common Files\OczyszczaczKomputerza\stm.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Winamp\winamp.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll F3 - REG:win.ini: load=C:\YDPDict\watch.exe O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: BearShareMediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\BearShareMediaBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [MSRegInfo] C:\WINDOWS\pagefile.sys.vbs O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\OczyszczaczKomputerza\stm.exe" dm=http://oczyszczaczkomputerza.com ad=http://oczyszczaczkomputerza.com sd=http://paistutta.oczyszczaczkomputerza.com O4 - HKLM\..\Run: [Windows Update] update32.exe O4 - HKLM\..\Run: [28c3b71f] rundll32.exe "C:\WINDOWS\system32\jywaiepp.dll",b O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKLM\..\Run: [BM2bf08483] Rundll32.exe "C:\WINDOWS\system32\ygdocxpv.dll",s O4 - HKLM\..\RunServices: [Windows Update] update32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Le Petit Robert Hyperappel] C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Startup Manager] "C:\Program Files\Advanced System Optimizer\startUp manager.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: SecuROM User Access Service (UserAccess) - Unknown owner - C:\WINDOWS\system32\UAService.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe -- End of file - 9823 bytes

**Posty:** 18165 · przez **wojtas** 27 Maj 2008, 21:14

witaj

pamietaj że na forum zawsze na starcie dajemy 2 logi

http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 3 · przez **pablodh** 29 Maj 2008, 00:30

sfixowalem te rzeczy

Kod: Zaznacz wszystko: O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: BearShareMediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\BearShareMediaBar.dll s [Fix] uj też wpisy a pliki usun z dysku ręcznie lub Unlocker'em: O4 - HKLM\..\Run: [MSRegInfo] C:\WINDOWS\pagefile.sys.vbs (nie pomyl z pafefile.sys) O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\OczyszczaczKomputerza\stm.exe" dm=http://oczyszczaczkomputerza.com ad=http://oczyszczaczkomputerza.com sd=http://paistutta.oczyszczaczkomputerza.com O4 - HKLM\..\Run: [Windows Update] update32.exe O4 - HKLM\..\Run: [28c3b71f] rundll32.exe "C:\WINDOWS\system32\jywaiepp.dll",b O4 - HKLM\..\Run: [BM2bf08483] Rundll32.exe "C:\WINDOWS\system32\ygdocxpv.dll",s O4 - HKLM\..\RunServices: [Windows Update] update32.exe O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

pozniej zrobilem skan combofixem

Kod: Zaznacz wszystko: ComboFix 08-05-27.4 - ewela 2008-05-28 23:00:23.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.103 [GMT 2:00] Running from: C:\Documents and Settings\ewela\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]002C365 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]030E5A3.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]030E7F5.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]030EB60.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0B04609 C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\WINDOWS\BM2bf08483.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\bvcasjar.ini C:\WINDOWS\system32\dhgtmbga.exe C:\WINDOWS\system32\dqxofgpu.exe C:\WINDOWS\system32\dtrbvcmg.exe C:\WINDOWS\system32\fvdwyakq.exe C:\WINDOWS\system32\fxammbas.ini C:\WINDOWS\system32\gbpjcewc.dll C:\WINDOWS\system32\gjvqdokx.ini C:\WINDOWS\system32\hyjvgkud.ini C:\WINDOWS\system32\jkkHWppp.dll C:\WINDOWS\system32\kfhblgol.dll C:\WINDOWS\system32\kuueaauw.dll C:\WINDOWS\system32\kxajitjo.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\ppeiawyj.ini C:\WINDOWS\system32\pppWHkkj.ini C:\WINDOWS\system32\pppWHkkj.ini2 C:\WINDOWS\system32\pyoprchp.exe C:\WINDOWS\system32\rajsacvb.dll C:\WINDOWS\system32\xyulobpo.dll C:\WINDOWS\system32\ygdocxpv.dll D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 ))))))))))))))))))))))))))))))) . 2008-05-27 20:26 . 2008-05-27 20:26 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-27 18:43 . 2008-05-27 18:43 <DIR> d-------- C:\Documents and Settings\ewela\Dane aplikacji\PC Tools 2008-05-27 18:40 . 2008-05-28 23:07 <DIR> d-------- C:\Program Files\PC Tools AntiVirus 2008-05-27 18:40 . 2008-05-27 18:40 <DIR> d-------- C:\Program Files\Common Files\PC Tools 2008-05-27 18:40 . 2008-05-28 23:10 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-27 18:40 . 2008-05-27 18:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Tools 2008-05-27 18:40 . 2007-12-06 15:51 28,568 --a------ C:\WINDOWS\system32\drivers\AVHook.sys 2008-05-27 18:40 . 2007-12-06 15:51 21,912 --a------ C:\WINDOWS\system32\drivers\AVRec.sys 2008-05-27 18:40 . 2008-02-12 10:44 21,904 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys 2008-05-27 10:58 . 2008-05-27 10:58 58,880 --a------ C:\WINDOWS\system32\rqRJYsTm.dll 2008-05-26 21:14 . 2008-05-26 21:14 58,880 --a------ C:\WINDOWS\system32\jkkKbATn.dll 2008-05-26 14:29 . 2008-05-26 14:29 58,880 --a------ C:\WINDOWS\system32\yayvWoOI.dll 2008-05-25 18:09 . 2008-05-25 18:09 58,880 --a------ C:\WINDOWS\system32\mlJBRKAR.dll 2008-05-25 14:48 . 2008-05-25 14:48 <DIR> d-------- C:\Documents and Settings\ewela\Dane aplikacji\OczyszczaczKomputerza 2008-05-25 14:43 . 2008-05-25 14:43 <DIR> d-------- C:\Program Files\Common Files\OczyszczaczKomputerza 2008-05-25 14:43 . 2008-05-25 14:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OczyszczaczKomputerza 2008-05-25 13:57 . 2008-05-25 13:57 58,880 --a------ C:\WINDOWS\system32\urqNEWqq.dll 2008-05-25 12:27 . 2008-05-25 12:27 58,880 --a------ C:\WINDOWS\system32\rqRJYsRH.dll 2008-05-25 00:07 . 2008-05-25 00:07 58,880 --a------ C:\WINDOWS\system32\xxyaBRlm.dll 2008-05-19 19:14 . 2008-05-19 19:14 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-05-01 15:52 . 2008-05-01 15:52 <DIR> d-------- C:\Program Files\Kalendarz Top Secret . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-28 18:08 --------- d-----w C:\Documents and Settings\ewela\Dane aplikacji\skypePM 2008-05-28 11:11 --------- d-----w C:\Program Files\Winamp 2008-05-27 16:26 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-27 16:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-05-27 16:12 --------- d-----w C:\Program Files\Symantec 2008-05-26 18:55 --------- d-----w C:\Documents and Settings\ewela\Dane aplikacji\Skype 2008-05-19 17:10 --------- d-----w C:\Documents and Settings\ewela\Dane aplikacji\AdobeUM 2008-05-17 05:49 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-16 10:05 --------- d-----w C:\Program Files\Français Translator 2008-04-14 19:45 --------- d-----w C:\Program Files\English Translator 3 2008-04-01 15:42 --------- d-----w C:\Program Files\eMule 2008-04-01 15:35 --------- d-----w C:\Program Files\HotPotatoes6 2008-04-01 15:26 --------- d-----w C:\Program Files\Audacity 2008-03-30 09:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:52 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll 2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-25 04:52 178,976 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,504 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 16:32 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:59 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:59 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-11-24 19:46 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2003-03-21 11:45 250,544 ----a-w C:\Program Files\Common Files\keyhelp.ocx . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7207D135-731E-490A-80CD-B14A19ACB531}] 2008-05-28 23:12 372736 --a------ C:\WINDOWS\system32\nnnkIcyX.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}] 2007-09-30 14:04 389120 --a------ C:\Program Files\BearShare applications\BearShare MediaBar\BearShareIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E09D32C-E5E6-4184-B177-784CEE1E09C4}] 2008-05-25 00:07 58880 --a------ C:\WINDOWS\system32\xxyaBRlm.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1] @={E4000AC4-5E5F-4956-807A-C5854405D64F} [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00 15360] "Le Petit Robert Hyperappel"="C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe" [2001-10-11 13:11 22560] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 15:29 68856] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024] "Startup Manager"="C:\Program Files\Advanced System Optimizer\startUp manager.exe" [ ] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-12-01 12:46 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 22:58 458752] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-22 22:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-22 22:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-22 22:17 118784] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 17:02 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 07:22 794713] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-19 15:14 102400] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 11:33 163840] "Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 10:50 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23 1187840] "Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52 643072] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-10-25 07:37 35328] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-20 15:10 185632] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 17:04 3313664] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 12:22 517768] "hpqSRMon"="C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 17:31 80896] "PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [2008-03-05 09:37 1238928] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23:00 15360] C:\Documents and Settings\ewela\Menu Start\Programy\Autostart\ VirtualExpander.lnk - C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe [2008-02-03 11:19:38 430080] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] HP Photosmart Premier - Szybkie uruchomienie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 09:39:30 73728] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 11:15:54 65588] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{7E09D32C-E5E6-4184-B177-784CEE1E09C4}"= C:\WINDOWS\system32\xxyaBRlm.dll [2008-05-25 00:07 58880] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyaBRlm] xxyaBRlm.dll 2008-05-25 00:07 58880 C:\WINDOWS\system32\xxyaBRlm.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\nnnkIcyX [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;C:\WINDOWS\system32\Drivers\5U870CAP.sys [2006-06-06 22:39] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03c35e31-d18e-11dc-b181-0014a5f834ab}] \Shell\AutoRun\command - F:\m9j.com \Shell\explore\Command - F:\m9j.com \Shell\open\Command - F:\m9j.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2aba3f1a-847e-11db-ade3-0014a5f834ab}] \Shell\AutoRun\command - F:\6l6w8.com \Shell\explore\Command - F:\6l6w8.com \Shell\open\Command - F:\6l6w8.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4864e824-1829-11dd-b253-0014a5f834ab}] \Shell\AutoRun\command - F:\xlu8a8sy.exe \Shell\explore\Command - F:\xlu8a8sy.exe \Shell\open\Command - F:\xlu8a8sy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f25cf502-c20e-11dc-b135-0014a5f834ab}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe pagefile.sys.vbs [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{18B0E5C2-99CB-11CF-AYX5-00401C648513}] C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\iuhi64.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-28 23:08:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????]??????`?@?????L?@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\xxyaBRlm.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\nnnkIcyX.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\WINDOWS\system32\UAService.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\SoftwareDistribution\Download\6687d911a85a0a6527f589a448ad4e95\update\update.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-05-28 23:15:04 - machine was rebooted [ewela] ComboFix-quarantined-files.txt 2008-05-28 21:14:26 Pre-Run: 1,742,667,776 bajtów wolnych Post-Run: 2,917,404,672 bajt˘w wolnych 225 --- E O F --- 2008-05-17 09:33:04

a na koniec SDFIX

Kod: Zaznacz wszystko: [b]SDFix: Version 1.186 [/b] Run by ewela on 2008-05-28 at 23:49 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Folder C:\Documents and Settings\All Users\Application Data\SalesMon - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-28 23:54:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:0000003e "TracesSuccessful"=dword:00000001 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sat 15 Dec 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 24 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT8.tmp" Sat 25 Nov 2006 444 ...HR --- "C:\Documents and Settings\ewela\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Sun 7 Oct 2007 180,700 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22d177b61fde58f114e05dfd9b70c96d\download\BIT4E.tmp" [b]Finished![/b]

**Posty:** 7956 · przez **Magik** 29 Maj 2008, 00:37

Witam

i wszystko ok........mozesz tez zrobic to czyszczenie systemu by okocz', w kazdym temacie jest info czyli wyczyszczenie reejstru, dll'i etc........

infekcje,alerty

infekcje,alerty

Kto jest na forum