komp muli, dziwne bledy plikow exe.

[Piotrek89]

Witam!
Program Avast caly czas wykrywa mi jakies trojany i je usuwa, ale wykrywa
je doslownie co 1 min, gdy nie podlacze kompa do neta to wszystko gra.
Ale gdy podlacze to zaczynaja wyskakiwac jakies bledy typu:

16-bitowy podsystem MS-DOS
C:\WINDOWS\System32\(cpuy.exe)
NTVDM CPU: napotkano niedozwoloną instrukcję.
CS:0f6a IP:05dd OP:636f6d2f66 Wybierz przycisk "zamknij", aby zakonczyc dzialanie aplikacji.

ten plik exe dalem w nawiasie bo za kazdym razem jest on inny a gdy dam zamknij to nic to nie zmienia bo zaraz znowy wyskakuje blad z innym plikiem.
Formatowalem juz kompa z 2 razy ale nic nie pomaga nie mam pojecia co to moze byc, prosze o pomoc!!

Oto log z HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:29:11, on 2007-12-21
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ozlpzjv.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\winamp.exe
C:\WINDOWS\System32\spooIsv.exe
C:\WINDOWS\System32\explorer.exe
C:\WINDOWS\system32\dllcache\mravsc32.exe
C:\Program Files\Gadu-Gadu\gg .exe
C:\WINDOWS\System32\ctfmon .exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\cjuuyesw.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\System32\gebcd.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKLM\..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe
O4 - HKLM\..\Run: [Winamp Agent] C:\WINDOWS\System32\winamp.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\cjuuyesw.exe
O4 - HKLM\..\Run: [WinDLL (mysnlive.exe)] rundll32.exe C:\WINDOWS\System32\mysnlive.exe,start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-725345543-162531612-2147082517-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-725345543-162531612-2147082517-1003\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Distributed Allocated Memory Unit - Unknown owner - C:\WINDOWS\system32\dllcache\mravsc32.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4469 bytes

[wojtas]

Wykonaj to co jest podane w tym temacie


Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Piotrek89]

SDFix:

SDFix: Version 1.119

Run by piotrek on 2007-12-21 at 22:38

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
Distributed Allocated Memory Unit
runtime

Path:
"C:\WINDOWS\system32\dllcache\mravsc32.exe"
\??\C:\WINDOWS\System32\drivers\runtime.sys

Distributed Allocated Memory Unit - Deleted
runtime - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Service xpdx - Deleted after Reboot

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\HNIC.EXE - Deleted
C:\ADWARE.EXE - Deleted
C:\-12702~1 - Deleted
C:\Program Files\Helper\superfinderusa.dll - Deleted
C:\DOCUME~1\piotrek\USTAWI~1\Temp\removalfile.bat - Deleted
C:\WINDOWS\system32\5_exception.nls - Deleted
C:\WINDOWS\system32\dllcache\mravsc32.exe - Deleted
C:\WINDOWS\system32\explorer.exe - Deleted
C:\WINDOWS\system32\i - Deleted
C:\WINDOWS\system32\spooIsv.exe - Deleted
C:\WINDOWS\system32\winamp.exe - Deleted
C:\WINDOWS\Temp\removalfile.bat - Deleted
C:\WINDOWS\system32\xpdx.sys - Deleted



Folder C:\Program Files\Helper - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-21 22:41:12
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\System32\\winamp.exe"="C:\\WINDOWS\\System32\\winamp.exe:*:Enabled:Winamp Agent"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 21 Dec 2007 26,624 A..H. --- "C:\WINDOWS\system32\kuhk.exe"
Fri 21 Dec 2007 1,134,592 ..SH. --- "C:\WINDOWS\system32\mysnlive.exe"

Finished!

ComboFix:

ComboFix 07-12-21.4 - piotrek 2007-12-21 22:44:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.51 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awttrqr.dll
C:\WINDOWS\system32\byxuvtt.dll
C:\WINDOWS\system32\byxyaxy.dll
C:\WINDOWS\system32\byxywur.dll
C:\WINDOWS\system32\cbxwuss.dll
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\ddcbcbb.dll
C:\WINDOWS\system32\ddccabb.dll
C:\WINDOWS\system32\ddccd.dll
C:\WINDOWS\system32\efcdbyw.dll
C:\WINDOWS\system32\emcpnvqo.ini
C:\WINDOWS\system32\gebax.dll
C:\WINDOWS\system32\gebbyxw.dll
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\hgghgdd.dll
C:\WINDOWS\system32\iifedec.dll
C:\WINDOWS\system32\jkkiffe.dll
C:\WINDOWS\system32\mljhgfg.dll
C:\WINDOWS\system32\mljjkji.dll
C:\WINDOWS\system32\opnkllm.dll
C:\WINDOWS\system32\opnmjjh.dll
C:\WINDOWS\system32\oqvnpcme.dll
C:\WINDOWS\system32\pmnnnnm.dll
C:\WINDOWS\system32\qomnmnn.dll
C:\WINDOWS\system32\rqropnk.dll
C:\WINDOWS\system32\rqrqonm.dll
C:\WINDOWS\system32\ssqnlmj.dll
C:\WINDOWS\system32\tuvsroo.dll
C:\WINDOWS\system32\tuvttqo.dll
C:\WINDOWS\system32\tuvttsr.dll
C:\WINDOWS\system32\tuvvvtq.dll
C:\WINDOWS\system32\vturopo.dll
C:\WINDOWS\system32\vtusrro.dll
C:\WINDOWS\system32\wvurpmn.dll
C:\WINDOWS\system32\xxyxwxw.dll
C:\WINDOWS\system32\yaywurs.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-21 to 2007-12-21 )))))))))))))))))))))))))))))))
.

2007-12-21 22:47 . 336,384 C:\WINDOWS\system32\RCX14.tmp
2007-12-21 22:47 . 2007-12-21 22:47 332,896 --------- C:\WINDOWS\system32\gebcd.dll
2007-12-21 22:45 . 2007-12-21 22:45 0 --a------ C:\WINDOWS\system32\9_exception.nls
2007-12-21 22:42 . 2007-12-21 22:47 0 --a------ C:\adware.exe
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 22:36 . 2007-12-21 22:36 1,635 --a------ C:\WINDOWS\system32\lewovdjl.exe
2007-12-21 22:36 . 2007-12-21 22:36 1,635 --a------ C:\WINDOWS\system32\dytjzmj.exe
2007-12-21 22:28 . 2007-12-21 22:28 1,635 --a------ C:\WINDOWS\system32\ojxtt.exe
2007-12-21 22:28 . 2007-12-21 22:28 1,635 --a------ C:\WINDOWS\system32\mzafusc.exe
2007-12-21 22:24 . 2007-12-21 22:37 369,152 --a------ C:\WINDOWS\system32\dbelmay.exe
2007-12-21 22:24 . 2007-12-21 22:24 32,456 --a------ C:\WINDOWS\system32\ezmcqt.exe
2007-12-21 22:23 . 2007-12-21 22:23 32,456 --a------ C:\WINDOWS\system32\yvnrryv .exe
2007-12-21 22:22 . 2007-12-21 22:22 336,384 --a------ C:\WINDOWS\system32\RCX2F.tmp
2007-12-21 22:19 . 2007-12-21 22:19 1,635 --a------ C:\WINDOWS\system32\twecpxei.exe
2007-12-21 22:19 . 2007-12-21 22:19 1,635 --a------ C:\WINDOWS\system32\qakusoro.exe
2007-12-21 22:15 . 2007-12-21 22:22 369,152 --a------ C:\WINDOWS\system32\yvnrryv.exe
2007-12-21 22:15 . 2007-12-21 22:15 32,456 --a------ C:\WINDOWS\system32\fxxsencc.exe
2007-12-21 22:14 . 2007-12-21 22:14 32,456 --a------ C:\WINDOWS\system32\cjuuyesw .exe
2007-12-21 20:56 . 2007-12-21 20:56 1,635 --a------ C:\WINDOWS\system32\ywsqohzh.exe
2007-12-21 20:56 . 2007-12-21 20:56 1,635 --a------ C:\WINDOWS\system32\abbr.exe
2007-12-21 20:48 . 2007-12-21 20:48 1,635 --a------ C:\WINDOWS\system32\yhjrf.exe
2007-12-21 20:48 . 2007-12-21 20:48 1,635 --a------ C:\WINDOWS\system32\iyatgrn.exe
2007-12-21 20:39 . 2007-12-21 20:39 1,635 --a------ C:\WINDOWS\system32\xmvrdken.exe
2007-12-21 20:39 . 2007-12-21 20:39 1,635 --a------ C:\WINDOWS\system32\ucycuxo.exe
2007-12-21 20:31 . 2007-12-21 20:31 1,635 --a------ C:\WINDOWS\system32\ztpwtv.exe
2007-12-21 20:31 . 2007-12-21 20:31 1,635 --a------ C:\WINDOWS\system32\gprg.exe
2007-12-21 20:23 . 2007-12-21 20:23 1,635 --a------ C:\WINDOWS\system32\fcydc.exe
2007-12-21 20:23 . 2007-12-21 20:23 1,635 --a------ C:\WINDOWS\system32\adod.exe
2007-12-21 20:14 . 2007-12-21 20:14 1,635 --a------ C:\WINDOWS\system32\upqyj.exe
2007-12-21 20:14 . 2007-12-21 20:14 1,635 --a------ C:\WINDOWS\system32\ohqggzix.exe
2007-12-21 20:06 . 2007-12-21 20:06 1,635 --a------ C:\WINDOWS\system32\imlk.exe
2007-12-21 20:06 . 2007-12-21 20:06 1,635 --a------ C:\WINDOWS\system32\fspbna.exe
2007-12-21 19:58 . 2007-12-21 19:58 1,635 --a------ C:\WINDOWS\system32\ynyfzx.exe
2007-12-21 19:58 . 2007-12-21 19:58 1,635 --a------ C:\WINDOWS\system32\sbdajh.exe
2007-12-21 19:57 . 2007-12-21 22:21 462,848 --a------ C:\WINDOWS\system32\hqghumea.dll
2007-12-21 19:49 . 2007-12-21 19:49 1,635 --a------ C:\WINDOWS\system32\waiqexc.exe
2007-12-21 19:49 . 2007-12-21 19:49 1,635 --a------ C:\WINDOWS\system32\pvaz.exe
2007-12-21 19:45 . 2007-12-21 22:23 71,854 --a------ C:\WINDOWS\system32\winamp .exe
2007-12-21 19:41 . 2007-12-21 19:41 1,635 --a------ C:\WINDOWS\system32\nwafm.exe
2007-12-21 19:41 . 2007-12-21 19:41 1,635 --a------ C:\WINDOWS\system32\jxnsbn.exe
2007-12-21 19:33 . 2007-12-21 19:33 1,635 --a------ C:\WINDOWS\system32\vxbkhh.exe
2007-12-21 19:33 . 2007-12-21 19:33 1,635 --a------ C:\WINDOWS\system32\cpuy.exe
2007-12-21 19:24 . 2007-12-21 19:24 1,635 --a------ C:\WINDOWS\system32\ottb.exe
2007-12-21 19:24 . 2007-12-21 19:24 1,635 --a------ C:\WINDOWS\system32\ieqce.exe
2007-12-21 19:16 . 2007-12-21 19:16 1,635 --a------ C:\WINDOWS\system32\ngtnltb.exe
2007-12-21 19:16 . 2007-12-21 19:16 1,635 --a------ C:\WINDOWS\system32\fufyctc.exe
2007-12-21 19:08 . 2007-12-21 19:08 1,635 --a------ C:\WINDOWS\system32\nqxjutgc.exe
2007-12-21 19:08 . 2007-12-21 19:08 1,635 --a------ C:\WINDOWS\system32\mxbx.exe
2007-12-21 18:59 . 2007-12-21 18:59 1,635 --a------ C:\WINDOWS\system32\oyft.exe
2007-12-21 18:59 . 2007-12-21 18:59 1,635 --a------ C:\WINDOWS\system32\fowetth.exe
2007-12-21 18:51 . 2007-12-21 18:51 1,635 --a------ C:\WINDOWS\system32\nbecgopx.exe
2007-12-21 18:51 . 2007-12-21 18:51 1,635 --a------ C:\WINDOWS\system32\egdofl.exe
2007-12-21 18:45 . 2007-12-21 18:45 1,134,592 ---hs---- C:\WINDOWS\system32\mysnlive.exe
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 18:43 . 2007-12-21 18:43 1,635 --a------ C:\WINDOWS\system32\ziwqsl.exe
2007-12-21 18:43 . 2007-12-21 18:43 1,635 --a------ C:\WINDOWS\system32\tufvirzp.exe
2007-12-21 18:34 . 2007-12-21 18:34 1,635 --a------ C:\WINDOWS\system32\cjbvrd.exe
2007-12-21 18:34 . 2007-12-21 18:34 1,635 --a------ C:\WINDOWS\system32\cchetmsa.exe
2007-12-21 18:27 . 2007-12-21 19:45 369,152 --a------ C:\WINDOWS\system32\cjuuyesw.exe
2007-12-21 18:27 . 2007-12-21 18:27 1,635 --a------ C:\WINDOWS\system32\zqjvnu.exe
2007-12-21 18:26 . 2007-12-21 22:23 76,540 --a------ C:\WINDOWS\system32\explorer .exe
2007-12-21 18:25 . 2007-12-21 22:22 21,760 --a------ C:\WINDOWS\Sux35.sys
2007-12-21 18:18 . 2007-12-21 18:18 1,635 --a------ C:\WINDOWS\system32\zwpmta.exe
2007-12-21 18:18 . 2007-12-21 18:18 1,635 --a------ C:\WINDOWS\system32\tpfxa.exe
2007-12-21 18:10 . 2007-12-21 18:10 21,760 --a------ C:\WINDOWS\system32\drivers\Sux35.sys
2007-12-21 18:09 . 2007-12-21 18:09 1,635 --a------ C:\WINDOWS\system32\sxlra.exe
2007-12-21 18:09 . 2007-12-21 18:09 1,635 --a------ C:\WINDOWS\system32\ihlwhldf.exe
2007-12-21 18:07 . 2007-12-21 18:27 20,480 --a------ C:\mlah.exe
2007-12-21 18:06 . 2007-12-21 22:25 57,856 --a------ C:\actgm.exe
2007-12-21 18:01 . 2007-12-21 18:01 1,635 --a------ C:\WINDOWS\system32\rysav.exe
2007-12-21 18:01 . 2007-12-21 18:01 1,635 --a------ C:\WINDOWS\system32\dxeiprop.exe
2007-12-21 17:52 . 2007-12-21 17:52 1,635 --a------ C:\WINDOWS\system32\nkrfyprt.exe
2007-12-21 17:52 . 2007-12-21 17:52 1,635 --a------ C:\WINDOWS\system32\ehrtbzst.exe
2007-12-21 17:46 . 2007-12-21 18:26 369,152 --a------ C:\WINDOWS\system32\ozlpzjv.exe
2007-12-21 17:45 . 2007-12-21 17:45 32,456 --a------ C:\WINDOWS\system32\ubjfaxcv.exe
2007-12-21 17:44 . 2007-12-21 17:44 336,384 --a------ C:\WINDOWS\system32\RCX1C.tmp
2007-12-21 17:44 . 2007-12-21 22:22 71,175 --a------ C:\WINDOWS\system32\spooIsv .exe
2007-12-21 17:44 . 2007-12-21 22:23 13,312 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-21 17:36 . 2007-12-21 17:36 1,635 --a------ C:\WINDOWS\system32\jtsjy.exe
2007-12-21 17:36 . 2007-12-21 17:36 1,635 --a------ C:\WINDOWS\system32\jomo.exe
2007-12-21 17:27 . 2007-12-21 17:27 1,635 --a------ C:\WINDOWS\system32\lgubxnl.exe
2007-12-21 17:27 . 2007-12-21 17:27 1,635 --a------ C:\WINDOWS\system32\jospgfg.exe
2007-12-21 17:21 . 2007-12-21 17:21 26,624 --ah----- C:\WINDOWS\system32\kuhk.exe
2007-12-21 17:20 . 2007-12-21 17:20 81,381 --a------ C:\WINDOWS\system32\hxewnsds .exe
2007-12-21 17:19 . 2007-12-21 17:19 1,635 --a------ C:\WINDOWS\system32\dsdobn.exe
2007-12-21 17:19 . 2007-12-21 17:19 1,635 --a------ C:\WINDOWS\system32\deqqif.exe
2007-12-21 17:12 . 2007-12-21 22:47 336,384 --a------ C:\WINDOWS\system32\gebcd.exe
2007-12-21 17:11 . 2007-12-21 17:11 1,635 --a------ C:\WINDOWS\system32\yijgau.exe
2007-12-21 17:11 . 2007-12-21 17:11 1,635 --a------ C:\WINDOWS\system32\rtlm.exe
2007-12-21 17:10 . 2007-12-21 17:10 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 21:47 351,232 ----a-w C:\WINDOWS\system32\ctfmon.exe
2007-12-21 21:47 --------- d-----w C:\Program Files\Winamp
2007-12-21 21:47 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 16:06 32,456 ----a-w C:\WINDOWS\system32\cmml.exe
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:07 --------- d-----w C:\Program Files\Thomson
2007-12-21 15:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDA69EC1-9FF3-48AC-AFBF-DB8A2AA248E8}]
2007-12-21 22:47 332896 --------- C:\WINDOWS\System32\gebcd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-21 22:47]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-21 22:47]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-21 22:47]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-21 22:47]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-21 22:47]
"WinDLL (mysnlive.exe)"="C:\WINDOWS\System32\mysnlive.exe" [2007-12-21 18:45]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\gebcd.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\gebcd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sux35.sys]
@="Driver"

R0 Sux35;Sux35;C:\WINDOWS\System32\Drivers\Sux35.sys [2007-12-21 18:10]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-21 22:47:57
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-21 22:48:54 - machine was rebooted

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:53:06, on 2007-12-21
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Winamp\winampa .exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\System32\gebcd.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [WinDLL (mysnlive.exe)] rundll32.exe C:\WINDOWS\System32\mysnlive.exe,start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 3613 bytes

[Kuba1]

Jest masakra.


Zaczynasz z tym tematem o blokowaniu portów, używasz obydwa narzędzia:

http://www.forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
Startuj z SmitFraudFix z opcji nr 2 w trybie awaryjnym.

Po tym daj nowe logi.

[Piotrek89]

SmitFraudFix:

SmitFraudFix v2.274

Scan done at 8:27:31,25, 2007-12-22
Run from C:\Documents and Settings\piotrek\Pulpit\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix:

ComboFix 07-12-21.4 - piotrek 2007-12-22 8:32:31.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.54 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\9_exception.nls
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 )))))))))))))))))))))))))))))))
.

2007-12-22 08:35 . 2007-12-22 08:35 332,896 --------- C:\WINDOWS\system32\gebcd.dll
2007-12-22 08:30 . 2007-12-22 08:30 336,384 --a------ C:\WINDOWS\system32\RCX13.tmp
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-22 08:20 . 2007-12-22 08:20 336,384 --a------ C:\WINDOWS\system32\RCX16.tmp
2007-12-22 08:08 . 2007-12-22 08:08 336,384 --a------ C:\WINDOWS\system32\RCX15.tmp
2007-12-21 23:02 . 2007-12-21 23:02 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:42 . 2007-12-22 08:35 0 --a------ C:\adware.exe
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 22:36 . 2007-12-21 22:36 1,635 --a------ C:\WINDOWS\system32\lewovdjl.exe
2007-12-21 22:36 . 2007-12-21 22:36 1,635 --a------ C:\WINDOWS\system32\dytjzmj.exe
2007-12-21 22:28 . 2007-12-21 22:28 1,635 --a------ C:\WINDOWS\system32\ojxtt.exe
2007-12-21 22:28 . 2007-12-21 22:28 1,635 --a------ C:\WINDOWS\system32\mzafusc.exe
2007-12-21 22:24 . 2007-12-21 22:37 369,152 --a------ C:\WINDOWS\system32\dbelmay.exe
2007-12-21 22:24 . 2007-12-21 22:24 32,456 --a------ C:\WINDOWS\system32\ezmcqt.exe
2007-12-21 22:23 . 2007-12-21 22:23 32,456 --a------ C:\WINDOWS\system32\yvnrryv .exe
2007-12-21 22:22 . 2007-12-21 22:22 336,384 --a------ C:\WINDOWS\system32\RCX2F.tmp
2007-12-21 22:19 . 2007-12-21 22:19 1,635 --a------ C:\WINDOWS\system32\twecpxei.exe
2007-12-21 22:19 . 2007-12-21 22:19 1,635 --a------ C:\WINDOWS\system32\qakusoro.exe
2007-12-21 22:15 . 2007-12-21 22:22 369,152 --a------ C:\WINDOWS\system32\yvnrryv.exe
2007-12-21 22:15 . 2007-12-21 22:15 32,456 --a------ C:\WINDOWS\system32\fxxsencc.exe
2007-12-21 22:14 . 2007-12-21 22:14 32,456 --a------ C:\WINDOWS\system32\cjuuyesw .exe
2007-12-21 20:56 . 2007-12-21 20:56 1,635 --a------ C:\WINDOWS\system32\ywsqohzh.exe
2007-12-21 20:56 . 2007-12-21 20:56 1,635 --a------ C:\WINDOWS\system32\abbr.exe
2007-12-21 20:48 . 2007-12-21 20:48 1,635 --a------ C:\WINDOWS\system32\yhjrf.exe
2007-12-21 20:48 . 2007-12-21 20:48 1,635 --a------ C:\WINDOWS\system32\iyatgrn.exe
2007-12-21 20:39 . 2007-12-21 20:39 1,635 --a------ C:\WINDOWS\system32\xmvrdken.exe
2007-12-21 20:39 . 2007-12-21 20:39 1,635 --a------ C:\WINDOWS\system32\ucycuxo.exe
2007-12-21 20:31 . 2007-12-21 20:31 1,635 --a------ C:\WINDOWS\system32\ztpwtv.exe
2007-12-21 20:31 . 2007-12-21 20:31 1,635 --a------ C:\WINDOWS\system32\gprg.exe
2007-12-21 20:23 . 2007-12-21 20:23 1,635 --a------ C:\WINDOWS\system32\fcydc.exe
2007-12-21 20:23 . 2007-12-21 20:23 1,635 --a------ C:\WINDOWS\system32\adod.exe
2007-12-21 20:14 . 2007-12-21 20:14 1,635 --a------ C:\WINDOWS\system32\upqyj.exe
2007-12-21 20:14 . 2007-12-21 20:14 1,635 --a------ C:\WINDOWS\system32\ohqggzix.exe
2007-12-21 20:06 . 2007-12-21 20:06 1,635 --a------ C:\WINDOWS\system32\imlk.exe
2007-12-21 20:06 . 2007-12-21 20:06 1,635 --a------ C:\WINDOWS\system32\fspbna.exe
2007-12-21 19:58 . 2007-12-21 19:58 1,635 --a------ C:\WINDOWS\system32\ynyfzx.exe
2007-12-21 19:58 . 2007-12-21 19:58 1,635 --a------ C:\WINDOWS\system32\sbdajh.exe
2007-12-21 19:57 . 2007-12-21 22:21 462,848 --a------ C:\WINDOWS\system32\hqghumea.dll
2007-12-21 19:49 . 2007-12-21 19:49 1,635 --a------ C:\WINDOWS\system32\waiqexc.exe
2007-12-21 19:49 . 2007-12-21 19:49 1,635 --a------ C:\WINDOWS\system32\pvaz.exe
2007-12-21 19:45 . 2007-12-21 22:23 71,854 --a------ C:\WINDOWS\system32\winamp .exe
2007-12-21 19:41 . 2007-12-21 19:41 1,635 --a------ C:\WINDOWS\system32\nwafm.exe
2007-12-21 19:41 . 2007-12-21 19:41 1,635 --a------ C:\WINDOWS\system32\jxnsbn.exe
2007-12-21 19:33 . 2007-12-21 19:33 1,635 --a------ C:\WINDOWS\system32\vxbkhh.exe
2007-12-21 19:33 . 2007-12-21 19:33 1,635 --a------ C:\WINDOWS\system32\cpuy.exe
2007-12-21 19:24 . 2007-12-21 19:24 1,635 --a------ C:\WINDOWS\system32\ottb.exe
2007-12-21 19:24 . 2007-12-21 19:24 1,635 --a------ C:\WINDOWS\system32\ieqce.exe
2007-12-21 19:16 . 2007-12-21 19:16 1,635 --a------ C:\WINDOWS\system32\ngtnltb.exe
2007-12-21 19:16 . 2007-12-21 19:16 1,635 --a------ C:\WINDOWS\system32\fufyctc.exe
2007-12-21 19:08 . 2007-12-21 19:08 1,635 --a------ C:\WINDOWS\system32\nqxjutgc.exe
2007-12-21 19:08 . 2007-12-21 19:08 1,635 --a------ C:\WINDOWS\system32\mxbx.exe
2007-12-21 18:59 . 2007-12-21 18:59 1,635 --a------ C:\WINDOWS\system32\oyft.exe
2007-12-21 18:59 . 2007-12-21 18:59 1,635 --a------ C:\WINDOWS\system32\fowetth.exe
2007-12-21 18:51 . 2007-12-21 18:51 1,635 --a------ C:\WINDOWS\system32\nbecgopx.exe
2007-12-21 18:51 . 2007-12-21 18:51 1,635 --a------ C:\WINDOWS\system32\egdofl.exe
2007-12-21 18:45 . 2007-12-21 18:45 1,134,592 ---hs---- C:\WINDOWS\system32\mysnlive.exe
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 18:43 . 2007-12-21 18:43 1,635 --a------ C:\WINDOWS\system32\ziwqsl.exe
2007-12-21 18:43 . 2007-12-21 18:43 1,635 --a------ C:\WINDOWS\system32\tufvirzp.exe
2007-12-21 18:34 . 2007-12-21 18:34 1,635 --a------ C:\WINDOWS\system32\cjbvrd.exe
2007-12-21 18:34 . 2007-12-21 18:34 1,635 --a------ C:\WINDOWS\system32\cchetmsa.exe
2007-12-21 18:27 . 2007-12-21 19:45 369,152 --a------ C:\WINDOWS\system32\cjuuyesw.exe
2007-12-21 18:27 . 2007-12-21 18:27 1,635 --a------ C:\WINDOWS\system32\zqjvnu.exe
2007-12-21 18:26 . 2007-12-21 22:23 76,540 --a------ C:\WINDOWS\system32\explorer .exe
2007-12-21 18:25 . 2007-12-21 22:22 21,760 --a------ C:\WINDOWS\Sux35.sys
2007-12-21 18:18 . 2007-12-21 18:18 1,635 --a------ C:\WINDOWS\system32\zwpmta.exe
2007-12-21 18:18 . 2007-12-21 18:18 1,635 --a------ C:\WINDOWS\system32\tpfxa.exe
2007-12-21 18:10 . 2007-12-21 18:10 21,760 --a------ C:\WINDOWS\system32\drivers\Sux35.sys
2007-12-21 18:09 . 2007-12-21 18:09 1,635 --a------ C:\WINDOWS\system32\sxlra.exe
2007-12-21 18:09 . 2007-12-21 18:09 1,635 --a------ C:\WINDOWS\system32\ihlwhldf.exe
2007-12-21 18:07 . 2007-12-21 18:27 20,480 --a------ C:\mlah.exe
2007-12-21 18:06 . 2007-12-21 22:25 57,856 --a------ C:\actgm.exe
2007-12-21 18:01 . 2007-12-21 18:01 1,635 --a------ C:\WINDOWS\system32\rysav.exe
2007-12-21 18:01 . 2007-12-21 18:01 1,635 --a------ C:\WINDOWS\system32\dxeiprop.exe
2007-12-21 17:52 . 2007-12-21 17:52 1,635 --a------ C:\WINDOWS\system32\nkrfyprt.exe
2007-12-21 17:52 . 2007-12-21 17:52 1,635 --a------ C:\WINDOWS\system32\ehrtbzst.exe
2007-12-21 17:46 . 2007-12-21 18:26 369,152 --a------ C:\WINDOWS\system32\ozlpzjv.exe
2007-12-21 17:45 . 2007-12-21 17:45 32,456 --a------ C:\WINDOWS\system32\ubjfaxcv.exe
2007-12-21 17:44 . 2007-12-21 17:44 336,384 --a------ C:\WINDOWS\system32\RCX1C.tmp
2007-12-21 17:44 . 2007-12-21 22:22 71,175 --a------ C:\WINDOWS\system32\spooIsv .exe
2007-12-21 17:44 . 2007-12-22 08:30 13,312 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-21 17:36 . 2007-12-21 17:36 1,635 --a------ C:\WINDOWS\system32\jtsjy.exe
2007-12-21 17:36 . 2007-12-21 17:36 1,635 --a------ C:\WINDOWS\system32\jomo.exe
2007-12-21 17:27 . 2007-12-21 17:27 1,635 --a------ C:\WINDOWS\system32\lgubxnl.exe
2007-12-21 17:27 . 2007-12-21 17:27 1,635 --a------ C:\WINDOWS\system32\jospgfg.exe
2007-12-21 17:21 . 2007-12-21 17:21 26,624 --ah----- C:\WINDOWS\system32\kuhk.exe
2007-12-21 17:20 . 2007-12-21 17:20 81,381 --a------ C:\WINDOWS\system32\hxewnsds .exe
2007-12-21 17:19 . 2007-12-21 17:19 1,635 --a------ C:\WINDOWS\system32\dsdobn.exe
2007-12-21 17:19 . 2007-12-21 17:19 1,635 --a------ C:\WINDOWS\system32\deqqif.exe
2007-12-21 17:12 . 2007-12-22 08:35 336,384 --a------ C:\WINDOWS\system32\gebcd.exe
2007-12-21 17:11 . 2007-12-21 17:11 1,635 --a------ C:\WINDOWS\system32\yijgau.exe
2007-12-21 17:11 . 2007-12-21 17:11 1,635 --a------ C:\WINDOWS\system32\rtlm.exe
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 07:35 351,232 ----a-w C:\WINDOWS\system32\ctfmon.exe
2007-12-22 07:35 --------- d-----w C:\Program Files\Winamp
2007-12-22 07:35 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 16:06 32,456 ----a-w C:\WINDOWS\system32\cmml.exe
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:07 --------- d-----w C:\Program Files\Thomson
2007-12-21 15:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot@2007-12-21_22.48.24.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-21 15:25:10 8,138 ----a-w C:\WINDOWS\mozver.dat
+ 2007-12-21 22:13:38 8,741 ----a-w C:\WINDOWS\mozver.dat
- 2007-12-21 21:44:16 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-22 07:32:28 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-11-20 15:52:00 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2007-11-20 15:52:00 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2007-12-22 07:35:10 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_420.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B0F43E34-5317-47D9-96D6-AC75D01BE79C}]
2007-12-22 08:35 332896 --------- C:\WINDOWS\System32\gebcd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-22 08:32]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-22 08:35]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-22 08:35]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-22 08:35]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-22 08:35]
"WinDLL (mysnlive.exe)"="C:\WINDOWS\System32\mysnlive.exe" [2007-12-21 18:45]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\gebcd.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\gebcd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sux35.sys]
@="Driver"

R0 Sux35;Sux35;C:\WINDOWS\System32\Drivers\Sux35.sys [2007-12-21 18:10]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 08:35:47
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\dcbeg.ini

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-22 8:36:45 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-21 22:48

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:40:22, on 2007-12-22
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\Program Files\Winamp\winampa .exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Gadu-Gadu\gg .exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\System32\gebcd.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [WinDLL (mysnlive.exe)] rundll32.exe C:\WINDOWS\System32\mysnlive.exe,start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 3653 bytes

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\RCX13.tmp
C:\WINDOWS\system32\RCX16.tmp
C:\WINDOWS\system32\RCX15.tmp
C:\adware.exe
C:\WINDOWS\system32\lewovdjl.exe
C:\WINDOWS\system32\lewovdjl.exe
C:\WINDOWS\system32\dytjzmj.exe
C:\WINDOWS\system32\ojxtt.exe
C:\WINDOWS\system32\mzafusc.exe
C:\WINDOWS\system32\dbelmay.exe
C:\WINDOWS\system32\ezmcqt.exe
C:\WINDOWS\system32\yvnrryv .exe
C:\WINDOWS\system32\RCX2F.tmp
C:\WINDOWS\system32\twecpxei.exe
C:\WINDOWS\system32\qakusoro.exe
C:\WINDOWS\system32\yvnrryv.exe
C:\WINDOWS\system32\fxxsencc.exe
C:\WINDOWS\system32\cjuuyesw .exe
C:\WINDOWS\system32\ywsqohzh.exe
C:\WINDOWS\system32\abbr.exe
C:\WINDOWS\system32\yhjrf.exe
C:\WINDOWS\system32\iyatgrn.exe
C:\WINDOWS\system32\xmvrdken.exe
C:\WINDOWS\system32\ucycuxo.exe
C:\WINDOWS\system32\ztpwtv.exe
C:\WINDOWS\system32\gprg.exe
C:\WINDOWS\system32\fcydc.exe
C:\WINDOWS\system32\adod.exe
C:\WINDOWS\system32\upqyj.exe
C:\WINDOWS\system32\ohqggzix.exe
C:\WINDOWS\system32\imlk.exe
C:\WINDOWS\system32\fspbna.exe
C:\WINDOWS\system32\ynyfzx.exe
C:\WINDOWS\system32\sbdajh.exe
C:\WINDOWS\system32\hqghumea.dll
C:\WINDOWS\system32\waiqexc.exe
C:\WINDOWS\system32\pvaz.exe
C:\WINDOWS\system32\winamp .exe
C:\WINDOWS\system32\nwafm.exe
C:\WINDOWS\system32\jxnsbn.exe
C:\WINDOWS\system32\vxbkhh.exe
C:\WINDOWS\system32\cpuy.exe
C:\WINDOWS\system32\ottb.exe
C:\WINDOWS\system32\ieqce.exe
C:\WINDOWS\system32\ngtnltb.exe
C:\WINDOWS\system32\fufyctc.exe
C:\WINDOWS\system32\nqxjutgc.exe
C:\WINDOWS\system32\mxbx.exe
C:\WINDOWS\system32\oyft.exe
C:\WINDOWS\system32\fowetth.exe
C:\WINDOWS\system32\nbecgopx.exe
C:\WINDOWS\system32\egdofl.exe
C:\WINDOWS\system32\mysnlive.exe
C:\WINDOWS\system32\ziwqsl.exe
C:\WINDOWS\system32\tufvirzp.exe
C:\WINDOWS\system32\cjbvrd.exe
C:\WINDOWS\system32\cchetmsa.exe
C:\WINDOWS\system32\cjuuyesw.exe
C:\WINDOWS\system32\zqjvnu.exe
C:\WINDOWS\system32\explorer .exe
C:\WINDOWS\Sux35.sys
C:\WINDOWS\system32\zwpmta.exe
C:\WINDOWS\system32\tpfxa.exe
C:\WINDOWS\system32\drivers\Sux35.sys
C:\WINDOWS\system32\sxlra.exe
C:\WINDOWS\system32\ihlwhldf.exe
C:\mlah.exe
C:\actgm.exe
C:\WINDOWS\system32\rysav.exe
C:\WINDOWS\system32\dxeiprop.exe
C:\WINDOWS\system32\nkrfyprt.exe
C:\WINDOWS\system32\ehrtbzst.exe
C:\WINDOWS\system32\ozlpzjv.exe
C:\WINDOWS\system32\ubjfaxcv.exe
C:\WINDOWS\system32\RCX1C.tmp
C:\WINDOWS\system32\spooIsv .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\jtsjy.exe
C:\WINDOWS\system32\jomo.exe
C:\WINDOWS\system32\lgubxnl.exe
C:\WINDOWS\system32\jospgfg.exe
C:\WINDOWS\system32\kuhk.exe
C:\WINDOWS\system32\hxewnsds .exe
C:\WINDOWS\system32\dsdobn.exe
C:\WINDOWS\system32\deqqif.exe
C:\WINDOWS\system32\gebcd.exe
C:\WINDOWS\system32\yijgau.exe
C:\WINDOWS\system32\rtlm.exe
C:\WINDOWS\system32\cmml.exe
C:\WINDOWS\system32\dcbeg.ini

Driver::
Sux35

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B0F43E34-5317-47D9-96D6-AC75D01BE79C}]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sux35.sys]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinDLL (mysnlive.exe)"=-
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania


start>uruchom>regedit>przejdz do klucza:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

znajdz w tym kluczu:

Authentication Packages i edytuj: bedzie wygladal tak:

Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\gebcd

wykasuj to co pogrubilem a reszte zostaw
Potem nowy log z hijacka oraz combofixa

[Piotrek89]

gdy usunalem to co pogrubiles to poznije spowrotem sie zmienilo na to samoa, jak to edytuje to wyglada tak :

Kod: Zaznacz wszystko

msv1_0
C:\WINDOWS\System32\gebcd

ComboFix:

ComboFix 07-12-21.4 - piotrek 2007-12-22 17:40:49.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.40 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 )))))))))))))))))))))))))))))))
.

2007-12-22 17:43 . 2007-12-22 17:43 0 --a------ C:\WINDOWS\system32\gebcd.dll
2007-12-22 17:37 . 2007-12-22 17:37 13,312 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-12-22 17:01 . 2007-12-22 17:01 19 --a------ C:\WINDOWS\system32\b449482d
2007-12-22 16:52 . 2007-12-22 17:41 336,384 --a------ C:\WINDOWS\system32\gebcd.exe
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-21 23:02 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 16:44 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-22 16:41 --------- d-----w C:\Program Files\Winamp
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-12-22_16.52.20.06 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-22 15:51:46 351,232 ----a-w C:\WINDOWS\system32\ctfmon.exe
+ 2001-10-26 17:29:50 13,312 ----a-w C:\WINDOWS\system32\ctfmon.exe
+ 2007-12-22 16:43:33 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_418.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{977E48D8-3748-46C5-B3FB-14F408E88F41}]
2007-12-22 17:43 332896 --a------ C:\WINDOWS\System32\gebcd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-22 17:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-22 17:43]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-22 17:44]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-22 17:44]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-22 17:44]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-22 17:44]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\gebcd.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\gebcd


.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 17:43:54
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\dcbeg.ini

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-22 17:45:12 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-22 17:02

Hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:47:56, on 2007-12-22
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Winamp\winampa .exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\Program Files\Winamp Remote\bin\OrbTray .exe
C:\Program Files\Gadu-Gadu\gg .exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\System32\gebcd.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4014 bytes

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\gebcd.exe
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\b449482d

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

kasujesz wpis w hijacku"

F3 - REG:win.ini: load=C:\WINDOWS\System32\gebcd.exe

Potem nowy log z hijacka oraz combofixa

[Piotrek89]

ComboFix:

Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - piotrek 2007-12-23  9:42:15.8 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.0.1250.1.1045.18.53 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll

.
(((((((((((((((((((((((((   Files Created from 2007-11-23 to 2007-12-23  )))))))))))))))))))))))))))))))
.

2007-12-23 09:44 . 2007-12-23 09:44   321   --ahs----   C:\WINDOWS\system32\dcbeg.ini2
2007-12-23 09:44 . 2007-12-23 09:44   321   --ahs----   C:\WINDOWS\system32\dcbeg.ini
2007-12-23 09:37 . 2007-12-23 09:37   336,384   --a------   C:\WINDOWS\system32\RCX17.tmp
2007-12-22 17:37 . 2007-12-23 09:41   13,312   --a------   C:\WINDOWS\system32\ctfmon .exe
2007-12-22 17:27 . 2007-12-22 17:27   <DIR>   d--------   C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-22 17:27   <DIR>   d--h-----   C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53   5,606   --a------   C:\WINDOWS\system32\stci.dll
2007-12-22 17:01 . 2007-12-22 17:01   19   --a------   C:\WINDOWS\system32\b449482d
2007-12-22 16:52 . 2007-12-23 09:41   336,384   --a------   C:\WINDOWS\system32\gebcd.exe
2007-12-22 10:58 . 2007-12-22 10:58   <DIR>   d--------   C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58   <DIR>   d--------   C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57   316,640   --a------   C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51   129,784   ---------   C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51   9,464   ---------   C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51   9,336   ---------   C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27   1,092   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-21 23:02   <DIR>   d--------   C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45   33,952   --a------   C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44   <DIR>   d--------   C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02   <DIR>   d--------   C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06   <DIR>   d--------   C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 08:45   ---------   d-----w   C:\Program Files\Winamp
2007-12-23 08:44   351,232   ----a-w   C:\WINDOWS\system32\ctfmon.exe
2007-12-23 08:44   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-12-21 15:51   ---------   d-----w   C:\Program Files\C-Media 3D Audio
2007-12-21 15:46   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27   ---------   d-----w   C:\Program Files\mozilla.org
2007-12-21 15:25   ---------   d-----w   C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-12-21 14:52   ---------   d-----w   C:\Program Files\Alwil Software
2007-12-21 14:48   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-21 14:47   ---------   d-----w   C:\Program Files\Usługi online
2007-12-04 14:56   93,264   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55   94,544   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08   712,704   ----a-w   C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

(((((((((((((((((((((((((((((   snapshot_2007-12-22_16.52.20.06   )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-22 07:32:28   262,144   ----a-w   C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-23 08:42:12   262,144   ----a-w   C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-23 08:44:31   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_420.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49   1185120   --a------   C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2007-12-23 09:44]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-23 09:41]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg             .exe" [2007-12-23 09:44]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-23 09:45]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-23 09:45]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-23 09:45]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-23 09:45]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2007-12-23 09:44]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ      msv1_0 C:\\WINDOWS\\System32\\gebcd

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 09:45:01
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-23  9:45:58 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-22 20:26
C:\ComboFix3.txt ... 2007-12-22 20:12


Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:46:48, on 2007-12-23
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\Program Files\Gadu-Gadu\gg .exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa .exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\Program Files\Winamp Remote\bin\OrbTray .exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4143 bytes

[wojtas]

zainstaluj koniecznie:

http://www.programosy.pl/program,kerio-personal-firewall.html

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\RCX17.tmp
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\b449482d
C:\WINDOWS\system32\gebcd.exe

Folder:
C:\WINDOWS\system32\b449482d

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

[Piotrek89]

Combofix:

ComboFix 07-12-21.4 - piotrek 2007-12-23 15:06:48.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.72 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\piotrek\Pulpit\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\b449482d
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.exe
C:\WINDOWS\system32\RCX17.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\b449482d
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\gebcd.exe
C:\WINDOWS\system32\RCX17.tmp
C:\WINDOWS\system32\vxvvnpwq.dll
C:\WINDOWS\system32\xbgxuwmc.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 )))))))))))))))))))))))))))))))
.

2007-12-23 15:10 . 2007-12-23 15:10 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-23 15:04 . 2007-12-23 15:04 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-12-23 13:29 . 2007-12-23 13:29 336,384 --a------ C:\WINDOWS\system32\RCX1A.tmp
2007-12-23 10:49 . 2007-12-23 10:49 336,384 --a------ C:\WINDOWS\system32\RCX19.tmp
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-21 23:02 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 14:10 351,232 ----a-w C:\WINDOWS\system32\ctfmon.exe
2007-12-23 14:10 --------- d-----w C:\Program Files\Winamp
2007-12-23 14:10 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-12-22_16.52.20.06 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-22 07:32:28 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-23 08:42:12 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2005-12-15 17:13:34 274,432 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2005-12-15 17:01:52 81,920 ----a-w C:\WINDOWS\system32\drivers\khips.sys
+ 2007-12-23 14:09:48 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_460.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-23 15:10]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-23 15:10]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-23 15:10]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-23 15:10]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-23 15:10]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-23 15:10]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\\WINDOWS\\System32\\gebcd

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2005-12-15 18:01]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

*Newly Created Service* - FWDRV
*Newly Created Service* - KHIPS
*Newly Created Service* - KPF4
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 15:10:36
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-23 15:12:13 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-23 09:45
C:\ComboFix3.txt ... 2007-12-22 20:26

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:13:51, on 2007-12-23
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Winamp\winampa .exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\Program Files\Gadu-Gadu\gg .exe
C:\Program Files\Winamp Remote\bin\OrbTray .exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4495 bytes

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\RCX1A.tmp
C:\WINDOWS\system32\RCX19.tmp

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z combofixa

[Piotrek89]

Combofix:

ComboFix 07-12-21.4 - piotrek 2007-12-23 17:08:17.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.62 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\piotrek\Pulpit\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 )))))))))))))))))))))))))))))))
.

2007-12-23 16:28 . 2007-12-23 16:28 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\skypePM
2007-12-23 16:28 . 2007-12-23 16:28 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-23 16:26 . 2007-12-23 16:26 <DIR> d-------- C:\Program Files\Google
2007-12-23 16:26 . 2007-12-23 16:49 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Skype
2007-12-23 16:25 . 2007-12-23 16:25 <DIR> d-------- C:\Program Files\Skype
2007-12-23 16:25 . 2007-12-23 16:25 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-12-23 16:24 . 2007-12-23 16:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-12-23 15:10 . 2007-12-23 17:16 336,384 --a------ C:\WINDOWS\system32\gebcd.exe
2007-12-23 15:10 . 2007-12-23 17:16 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-23 15:04 . 2007-12-23 15:04 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-12-23 13:29 . 2007-12-23 13:29 336,384 --a------ C:\WINDOWS\system32\RCX1A.tmp
2007-12-23 10:49 . 2007-12-23 10:49 336,384 --a------ C:\WINDOWS\system32\RCX19.tmp
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-21 23:02 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 16:16 18,432 ----a-w C:\WINDOWS\system32\ctfmon.exe
2007-12-23 16:16 --------- d-----w C:\Program Files\Winamp
2007-12-23 16:16 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-12-22_16.52.20.06 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-22 07:32:28 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-23 08:42:12 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2005-12-15 17:13:34 274,432 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2005-12-15 17:01:52 81,920 ----a-w C:\WINDOWS\system32\drivers\khips.sys
+ 2007-12-23 16:15:16 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_458.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-23 17:16]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-23 17:16]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-23 17:16]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-23 17:16]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-23 17:16]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-23 17:16]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\\WINDOWS\\System32\\gebcd

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2005-12-15 18:01]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 17:16:05
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-23 17:18:10 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-23 15:12
C:\ComboFix3.txt ... 2007-12-23 09:45

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:19:08, on 2007-12-23
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Winamp\winampa .exe
C:\Program Files\Gadu-Gadu\gg .exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
C:\Program Files\Winamp Remote\bin\OrbTray .exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg .exe" /tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{09FAE22B-54E2-4C9C-8184-2DAD810FABE9}: NameServer = 80.244.140.241 80.244.128.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 5429 bytes

[wojtas]

zrobiles co jest podane w tym temacie >?

sciagnij gmera

Wklej do notatnika

gmer -del file C:\WINDOWS\system32\gebcd.exe
gmer -del file C:\WINDOWS\system32\mcrh.tmp
gmer -del file C:\WINDOWS\system32\RCX19.tmp
gmer -del file C:\WINDOWS\system32\RCX1A.tmp
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT


Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

potem nowy log z combofixa

[Piotrek89]

ComboFix 07-12-21.4 - piotrek 2007-12-23 17:52:40.11 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.29 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 )))))))))))))))))))))))))))))))
.

2007-12-23 17:58 . 2007-12-23 17:59 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-23 17:53 . 2007-12-23 17:53 336,384 --a------ C:\WINDOWS\system32\gebcd.exe
2007-12-23 17:50 . 2007-12-23 17:50 13,312 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-23 17:35 . 2007-12-23 17:48 250 --a------ C:\WINDOWS\gmer.ini
2007-12-23 16:28 . 2007-12-23 16:28 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\skypePM
2007-12-23 16:28 . 2007-12-23 16:28 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-23 16:26 . 2007-12-23 16:26 <DIR> d-------- C:\Program Files\Google
2007-12-23 16:26 . 2007-12-23 17:35 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Skype
2007-12-23 16:25 . 2007-12-23 16:25 <DIR> d-------- C:\Program Files\Skype
2007-12-23 16:25 . 2007-12-23 16:25 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-12-23 16:24 . 2007-12-23 16:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-12-23 15:04 . 2007-12-23 15:04 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-21 23:02 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 16:58 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-23 16:53 --------- d-----w C:\Program Files\Winamp
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-12-22_16.52.20.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-23 16:35:47 585,791 ----a-w C:\WINDOWS\gmer.dll
+ 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
- 2007-12-22 07:32:28 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-23 08:42:12 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2005-12-15 17:13:34 274,432 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2007-12-23 16:35:47 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2005-12-15 17:01:52 81,920 ----a-w C:\WINDOWS\system32\drivers\khips.sys
+ 2007-12-23 16:58:18 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_45c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-23 17:52]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-23 17:58]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-23 17:53]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-23 17:53]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-23 17:53]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-23 17:53]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-23 17:53]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\\WINDOWS\\System32\\gebcd

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2005-12-15 18:01]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 17:59:18
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-23 18:01:15 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-23 17:18
C:\ComboFix3.txt ... 2007-12-23 15:12

[wojtas]

wejdz do trybu awaryjnego (f8 przy starcie kompa) i :

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del file C:\WINDOWS\system32\mcrh.tmp
gmer -del file C:\WINDOWS\system32\gebcd.exe
gmer -del file C:\WINDOWS\system32\ctfmon .exe
gmer –reboot

I kliknij z prawej strony na Uruchom.

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=-
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
00

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na Wszystkie pliki >>> Zapisz jako FIX.REG >>> uruchom ten plik

wracasz z logami

[Piotrek89]

ComboFix 07-12-21.4 - piotrek 2007-12-24 12:11:18.12 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.45 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll

.
((((((((((((((((((((((((( Files Created from 2007-11-24 to 2007-12-24 )))))))))))))))))))))))))))))))
.

2007-12-24 12:17 . 2007-12-24 12:17 0 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-24 12:09 . 2007-12-24 12:17 336,384 --a------ C:\WINDOWS\system32\gebcd.exe
2007-12-24 12:06 . 2007-12-24 12:06 167 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-23 17:50 . 2007-12-24 12:09 13,312 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-23 17:35 . 2007-12-24 12:07 250 --a------ C:\WINDOWS\gmer.ini
2007-12-23 16:28 . 2007-12-23 16:28 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\skypePM
2007-12-23 16:28 . 2007-12-23 16:28 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-23 16:26 . 2007-12-23 16:26 <DIR> d-------- C:\Program Files\Google
2007-12-23 16:25 . 2007-12-23 18:26 <DIR> d-------- C:\Program Files\Skype
2007-12-23 16:24 . 2007-12-23 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-12-23 15:04 . 2007-12-23 15:04 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-21 23:02 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 11:17 18,432 ----a-w C:\WINDOWS\system32\ctfmon.exe
2007-12-24 11:17 --------- d-----w C:\Program Files\Winamp
2007-12-24 11:17 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot_2007-12-22_16.52.20.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-23 16:35:47 585,791 ----a-w C:\WINDOWS\gmer.dll
+ 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
- 2007-12-22 07:32:28 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2007-12-24 11:11:00 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2005-12-15 17:13:34 274,432 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2007-12-23 16:35:47 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys
+ 2005-12-15 17:01:52 81,920 ----a-w C:\WINDOWS\system32\drivers\khips.sys
+ 2007-12-24 11:16:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_45c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 18:29]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-12-24 12:17]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [2007-12-24 12:17]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-12-24 12:17]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-24 12:17]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-24 12:17]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2007-12-24 12:17]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\\WINDOWS\\System32\\gebcd

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2005-12-15 18:01]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-24 12:17:40
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2600.0000]
-> C:\WINDOWS\System32\gebcd.dll
.
Completion time: 2007-12-24 12:19:14 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-23 18:01
C:\ComboFix3.txt ... 2007-12-23 17:18

[wojtas]

masz zablokowane porty w WWDC? bo wirus ciagle wraca.....


Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\gebcd.exe
C:\WINDOWS\system32\ctfmon .exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofix
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

[Piotrek89]

Witam nie bylo mnie przez swieta i jakos mi sie niezbyt chcialo ruszac kompa wiec zabieram sie juz do pracy . Wiec porty mam zablokowane, a oto logi

Avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tlccrxew

*******************

Script file located at: \??\C:\WINDOWS\ilhlglta.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\mcrh.tmp not found!
Deletion of file C:\WINDOWS\system32\mcrh.tmp failed!

Could not process line:
C:\WINDOWS\system32\mcrh.tmp
Status: 0xc0000034



File C:\WINDOWS\system32\gebcd.exe not found!
Deletion of file C:\WINDOWS\system32\gebcd.exe failed!

Could not process line:
C:\WINDOWS\system32\gebcd.exe
Status: 0xc0000034



File C:\WINDOWS\system32\ctfmon .exe not found!
Deletion of file C:\WINDOWS\system32\ctfmon .exe failed!

Could not process line:
C:\WINDOWS\system32\ctfmon .exe
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

sdfix:

SDFix: Version 1.119

Run by piotrek on 2008-01-02 at 17:49

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 17:51:55
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:


Finished!

Combofix:

ComboFix 07-12-31.4 - piotrek 2008-01-02 17:54:29.15 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.96 [GMT 1:00]
Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-02 17:24 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-02 17:09 . 2008-01-02 17:09 1,080 --a------ C:\ujkddoyl .bat
2008-01-01 15:46 . 2008-01-01 15:46 336,384 --a------ C:\WINDOWS\system32\RCX1E.tmp
2008-01-01 08:59 . 2008-01-01 08:59 336,384 --a------ C:\WINDOWS\system32\RCX16.tmp
2007-12-31 21:59 . 2007-12-31 21:59 <DIR> d---s---- C:\Documents and Settings\piotrek\UserData
2007-12-31 19:43 . 2007-12-31 19:43 336,384 --a------ C:\WINDOWS\system32\RCXE.tmp
2007-12-31 13:05 . 2007-12-31 13:05 336,384 --a------ C:\WINDOWS\system32\RCXD.tmp
2007-12-31 08:29 . 2007-12-31 08:29 336,384 --a------ C:\WINDOWS\system32\RCXC.tmp
2007-12-30 09:57 . 2007-12-30 09:57 336,384 --a------ C:\WINDOWS\system32\RCXB.tmp
2007-12-28 14:53 . 2007-12-28 14:53 336,384 --a------ C:\WINDOWS\system32\RCXA.tmp
2007-12-28 11:53 . 2007-12-28 11:53 336,384 --a------ C:\WINDOWS\system32\RCX9.tmp
2007-12-28 09:13 . 2007-12-31 19:44 1,032,099 ---hs---- C:\WINDOWS\system32\qxgmcxcp.ini
2007-12-27 17:11 . 2007-12-27 18:11 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Skype
2007-12-26 21:14 . 2007-12-26 21:19 <DIR> d-------- C:\Program Files\RegCleaner
2007-12-26 20:07 . 2007-12-26 20:07 336,384 --a------ C:\WINDOWS\system32\RCX2C.tmp
2007-12-26 19:23 . 2007-12-26 19:23 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\ACD Systems
2007-12-26 19:11 . 2007-12-26 19:11 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2007-12-26 19:11 . 2007-12-26 19:11 <DIR> d-------- C:\Program Files\ACD Systems
2007-12-26 19:11 . 2007-12-26 19:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2007-12-26 19:11 . 2007-12-26 19:11 9,856 --a------ C:\WINDOWS\system32\drivers\pfc.sys
2007-12-26 19:09 . 2007-12-26 19:09 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-12-26 18:32 . 2001-10-26 17:29 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-12-26 18:32 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-26 18:32 . 2001-08-17 21:53 13,824 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-26 18:32 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-12-26 18:19 . 2007-12-26 18:19 336,384 --a------ C:\WINDOWS\system32\RCX26.tmp
2007-12-26 11:20 . 2007-12-26 11:20 336,384 --a------ C:\WINDOWS\system32\RCX25.tmp
2007-12-25 19:27 . 2007-12-25 19:27 <DIR> d-------- C:\Program Files\MarBit
2007-12-25 16:33 . 2007-12-25 16:33 336,384 --a------ C:\WINDOWS\system32\RCX24.tmp
2007-12-25 13:55 . 2007-12-25 13:55 336,384 --a------ C:\WINDOWS\system32\RCX1F.tmp
2007-12-25 13:17 . 2007-12-25 13:17 <DIR> d-------- C:\Program Files\Real Alternative
2007-12-25 13:17 . 2007-12-25 13:17 <DIR> d-------- C:\Program Files\Media Player Classic
2007-12-25 13:17 . 2007-12-25 13:17 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Media Player Classic
2007-12-25 12:28 . 2007-12-25 12:28 336,384 --a------ C:\WINDOWS\system32\RCX23.tmp
2007-12-25 10:57 . 2007-12-25 10:57 <DIR> d-------- C:\Program Files\Deluxe Ski Jump 3
2007-12-25 10:46 . 2007-12-25 10:46 <DIR> d-------- C:\Team17
2007-12-25 09:42 . 2007-12-25 09:42 336,384 --a------ C:\WINDOWS\system32\RCX22.tmp
2007-12-25 00:38 . 2007-12-25 00:38 336,384 --a------ C:\WINDOWS\system32\RCX1B.tmp
2007-12-24 22:32 . 2007-12-24 22:32 336,384 --a------ C:\WINDOWS\system32\RCX1A.tmp
2007-12-24 20:21 . 2007-12-24 20:21 336,384 --a------ C:\WINDOWS\system32\RCX19.tmp
2007-12-24 18:04 . 2007-12-24 18:04 <DIR> d-------- C:\Program Files\GTA2
2007-12-24 18:02 . 2007-12-24 18:02 336,384 --a------ C:\WINDOWS\system32\RCX15.tmp
2007-12-24 17:14 . 2007-12-24 17:14 336,384 --a------ C:\WINDOWS\system32\RCX18.tmp
2007-12-24 12:06 . 2008-01-02 17:48 623 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-23 17:35 . 2007-12-24 12:07 250 --a------ C:\WINDOWS\gmer.ini
2007-12-23 16:28 . 2007-12-23 16:28 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\skypePM
2007-12-23 16:28 . 2007-12-23 16:28 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-23 16:26 . 2007-12-23 16:26 <DIR> d-------- C:\Program Files\Google
2007-12-23 16:25 . 2007-12-23 18:26 <DIR> d-------- C:\Program Files\Skype
2007-12-23 16:24 . 2007-12-23 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2007-12-23 15:04 . 2007-12-23 15:04 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-12-22 17:27 . 2007-12-22 17:27 <DIR> d-------- C:\Program Files\Thomson
2007-12-22 17:27 . 2007-12-25 10:46 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-22 17:27 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Program Files\Winamp Remote
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-22 10:58 . 2007-12-22 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-22 10:57 . 2007-12-22 10:57 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-22 10:48 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-22 10:48 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-22 10:48 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-22 08:27 . 2007-12-22 08:27 1,092 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-21 23:02 . 2007-12-28 16:21 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Tibia
2007-12-21 22:38 . 2007-12-21 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-21 18:45 . 2007-12-21 18:45 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-12-21 18:44 . 2007-12-21 18:44 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-21 17:10 . 2007-12-21 23:02 <DIR> d-------- C:\Program Files\Tibia
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\XviD
2007-12-21 17:06 . 2007-12-21 17:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 16:29 --------- d-----w C:\Program Files\Winamp
2008-01-02 16:29 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 15:51 --------- d-----w C:\Program Files\C-Media 3D Audio
2007-12-21 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles
2007-12-21 15:27 --------- d-----w C:\Program Files\mozilla.org
2007-12-21 15:25 --------- d-----w C:\Documents and Settings\piotrek\Dane aplikacji\Talkback
2007-12-21 15:06 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-21 14:52 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-21 14:47 --------- d-----w C:\Program Files\Usługi online
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

Kod: Zaznacz wszystko

----a-w            79,224 2008-01-02 16:17:59  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w           217,088 2007-12-26 20:11:44  C:\Program Files\Common Files\ACD Systems\EN\DevDetect  .exe
----a-w         2,396,160 2007-12-23 16:58:53  C:\Program Files\Gadu-Gadu\gg                      .exe
----a-w         2,396,160 2007-12-31 18:43:55  C:\Program Files\Gadu-Gadu\gg                .exe
----a-w           171,448 2008-01-02 16:18:02  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier .exe
----a-w         1,077,277 2007-12-26 20:11:49  C:\Program Files\Messenger\msmsgs .exe
----a-w        21,686,568 2007-12-23 16:59:46  C:\Program Files\Skype\Phone\Skype .exe
----a-w           888,832 2007-12-26 20:11:48  C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
----a-w            37,376 2007-12-26 20:11:43  C:\Program Files\Winamp\winampa .exe
----a-w           471,040 2007-12-26 20:11:49  C:\Program Files\Winamp Remote\bin\OrbTray .exe


((((((((((((((((((((((((((((( snapshot@2008-01-02_17.32.30.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-02 16:13:27 3,047,424 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-01-02 16:49:18 3,047,424 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
- 2008-01-02 16:13:28 28,672 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-01-02 16:49:18 28,672 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-01-02 16:51:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_454.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49 1185120 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg .exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16 5058560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29 13312]

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2005-12-15 18:01]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-12-21 18:45]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2003-09-30 06:25]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 17:57:46
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-02 17:59:09
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-02 16:59:02
C:\qoobox\ComboFix2.txt 2008-01-02 16:33:27

[wojtas]

a wiec tak odinstaluj kerio personal

potem zainstaluj :

http://www.programosy.pl/program,comodo-firewall.html

i odlaczasz sie od neta i zaczynasz usuwac



Otworz notatnik i wklej w nim to:

File::
C:\ujkddoyl .bat
C:\WINDOWS\system32\RCX1E.tmp
C:\WINDOWS\system32\RCX16.tmp
C:\WINDOWS\system32\RCXE.tmp
C:\WINDOWS\system32\RCXD.tmp
C:\WINDOWS\system32\RCXC.tmp
C:\WINDOWS\system32\RCXB.tmp
C:\WINDOWS\system32\RCXA.tmp
C:\WINDOWS\system32\RCX9.tmp
C:\WINDOWS\system32\qxgmcxcp.ini
C:\WINDOWS\system32\RCX2C.tmp
C:\WINDOWS\system32\RCX26.tmp
C:\WINDOWS\system32\RCX25.tmp
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX1F.tmp
C:\WINDOWS\system32\RCX23.tmp
C:\WINDOWS\system32\RCX22.tmp
C:\WINDOWS\system32\RCX1B.tmp
C:\WINDOWS\system32\RCX1A.tmp
C:\WINDOWS\system32\RCX19.tmp
C:\WINDOWS\system32\RCX15.tmp
C:\WINDOWS\system32\RCX18.tmp

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa