przez Miron185 26 Sie 2008, 12:26
mam problem zainfekowałem sobie komputer w pracy. Mój problem wygląda tak że komputer restartuje się co kilkanaście minut. Wcześniej wyskakiwało jeszcze sporo okien i przy zegarze w rogu było kilka ikonek i spory napis virus alert.
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:45, on 2008-08-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
D:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\common files\protexis\license service\psiservice_2.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Programy\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Act.Outlook.Service] "C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe"
O4 - HKLM\..\Run: [Act! Preloader] "C:\Program Files\ACT\Act for Windows\ActSage.exe" -preload
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = POMET.local
O17 - HKLM\Software\..\Telephony: DomainName = POMET.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4595921-D149-4C25-9553-9CA139B5AA8C}: NameServer = 192.168.100.3
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = POMET.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = POMET.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = POMET.local
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\program files\common files\protexis\license service\psiservice_2.exe
--
End of file - 3127 bytes
- Kod: Zaznacz wszystko
ComboFix 08-08-25.01 - zaopatrzenie 2008-08-26 12:10:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.234 [GMT 2:00]
Running from: C:\Documents and Settings\zaopatrzenie\Pulpit\ComboFix.exe
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\enqx.exe
C:\WINDOWS\system32\dyjuepny.dll
C:\WINDOWS\system32\mlJBRIcb.dll
C:\WINDOWS\system32\qoMDWOFU.dll
C:\WINDOWS\system32\UFOWDMoq.ini
C:\WINDOWS\system32\UFOWDMoq.ini2
C:\WINDOWS\system32\ynpeujyd.ini
.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.
2008-08-26 11:58 . 2008-08-26 11:58 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-26 11:09 . 2008-08-26 11:09 <DIR> d-------- C:\Program Files\VSD Software
2008-08-26 07:40 . 2008-08-26 07:40 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-08-25 12:19 . 2008-08-25 12:19 <DIR> d-------- C:\Program Files\HDDGURU LLF Tool
2008-08-25 10:40 . 2008-08-25 10:40 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-25 10:33 . 2008-08-25 10:33 <DIR> d-------- C:\Program Files\ESET
2008-08-25 10:33 . 2008-08-25 10:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-08-25 09:32 . 2008-08-25 10:29 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-25 09:30 . 2008-08-25 09:30 91 --a------ C:\WINDOWS\wininit.ini
2008-08-25 09:10 . 2008-08-25 10:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-08-25 09:01 . 2008-08-25 09:01 16,560 --a------ C:\Documents and Settings\zaopatrzenie\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-08-25 08:48 . 2008-08-25 08:48 <DIR> d-------- C:\Program Files\uTorrent
2008-08-25 08:34 . 2008-08-25 08:34 103,936 --a------ C:\WINDOWS\system32\oowbahhy.dll.vir
2008-08-25 08:15 . 2008-08-25 08:15 2,422 --a------ C:\WINDOWS\system32\wpa.bak
2008-08-22 14:48 . 2008-08-25 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-08-22 13:00 . 2008-08-22 12:42 86,016 --a------ C:\WINDOWS\tqwolser.exe
2008-08-20 07:49 . 2008-08-26 12:02 <DIR> d-------- C:\Documents and Settings\zaopatrzenie\Dane aplikacji\uTorrent
2008-08-20 07:25 . 2008-08-20 07:25 0 --a------ C:\WINDOWS\Ui.INI
2008-08-18 07:00 . 2008-08-18 07:00 0 --a------ C:\WINDOWS\WATCH.INI
2008-08-14 14:09 . 2001-06-18 10:53 57,344 --a------ C:\WINDOWS\system\BPEnhan.dll
2008-08-14 14:09 . 1997-04-17 00:36 32,768 --a------ C:\WINDOWS\system\Lfgif70n.dll
2008-08-12 07:34 . 2008-08-12 07:34 <DIR> d-------- C:\WINDOWS\Sun
2008-08-12 07:33 . 2008-08-12 07:33 <DIR> d-------- C:\Program Files\Java
2008-08-12 07:33 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-12 07:32 . 2008-08-12 07:32 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-01 13:27 . 2008-08-05 12:56 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-08-01 13:27 . 2008-06-17 15:14 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-07-31 10:52 . 2008-07-31 11:05 <DIR> d-------- C:\Program Files\SkanerOnline
2008-07-30 13:56 . 2008-08-25 06:52 <DIR> d-------- C:\Program Files\Damian Pasternak
2008-07-30 12:10 . 2008-08-01 08:28 <DIR> d-------- C:\Program Files\RegCleaner
2008-07-30 11:06 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-30 07:38 . 2008-07-30 07:38 <DIR> d-------- C:\Documents and Settings\zaopatrzenie\Dane aplikacji\Media Player Classic
2008-07-30 07:33 . 2008-07-30 07:33 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-07-30 07:11 . 2008-07-30 07:11 <DIR> d--h----- C:\WINDOWS\PIF
2008-07-30 06:59 . 2008-07-30 06:59 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-07-29 15:09 . 2008-07-29 15:09 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-07-29 15:08 . 2008-07-29 15:08 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-29 14:23 . 2008-08-26 11:57 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-07-29 12:14 . 2008-06-23 18:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-07-29 12:14 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-07-29 12:14 . 2007-03-08 07:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-07-29 12:14 . 2008-06-23 18:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-07-29 12:14 . 2008-06-23 18:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-07-29 12:14 . 2008-06-23 18:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-07-29 12:14 . 2008-06-23 18:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-07-29 12:14 . 2008-06-23 18:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-07-29 12:14 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-07-28 12:53 . 2008-07-28 12:53 <DIR> d-------- C:\Documents and Settings\zaopatrzenie\Dane aplikacji\Nero
2008-07-28 12:50 . 2008-07-28 12:50 <DIR> d-------- C:\Program Files\Nero
2008-07-28 12:50 . 2008-07-28 12:52 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-07-28 12:50 . 2008-07-28 12:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-07-28 11:58 . 2008-07-30 11:08 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-07-28 11:29 . 2008-07-30 07:00 <DIR> d-------- C:\WINDOWS\system32\pl-pl
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 12:29 88 --sh--r C:\Documents and Settings\All Users\Dane aplikacji\9FFC3361DB.sys
2008-07-28 12:29 848 --sha-w C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys
2008-07-24 11:42 --------- d-----w C:\Documents and Settings\zaopatrzenie\Dane aplikacji\IsolatedStorage
2008-07-24 11:42 --------- d-----w C:\Documents and Settings\zaopatrzenie\Dane aplikacji\ACT
2008-07-24 11:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ACT
2008-07-24 11:37 --------- d-----w C:\Program Files\ACT
2008-07-24 11:36 --------- d-----w C:\Program Files\Common Files\Matrix.pl
2008-07-24 11:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symfonia
2008-07-24 11:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 11:30 --------- d-----w C:\Program Files\Common Files\Protexis
2008-07-24 11:23 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-24 11:22 --------- d-----w C:\Program Files\MSXML 6.0
2008-07-24 11:22 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-07-24 11:21 --------- d-----w C:\Documents and Settings\administrator\Dane aplikacji\ACT
2008-07-24 11:09 --------- d-----w C:\Documents and Settings\zaopatrzenie\Dane aplikacji\Gadu-Gadu
2008-07-24 08:23 32,768 ----a-w C:\WINDOWS\closewnd.exe
2008-07-24 08:23 --------- d-----w C:\Program Files\hp LaserJet 1000
2008-07-24 07:32 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-24 07:30 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-07-24 07:30 --------- d-----w C:\Program Files\AvRack
2008-07-24 06:45 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-24 06:43 --------- d-----w C:\Program Files\Usługi online
