Komputer zamulony-wirusy,trojany-log

**Posty:** 16 · przez **miszza** 31 Maj 2009, 12:22

witam prosze pomoc.
przestaly sie wlaczac niektore programy + blokuje updaty od antywirusa.przy prawidlowym wylaczeniu -uruchamia sie ponownie.jesli ktos moze prosze o pomoc. z gory bardzo dziekuje

Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:14:09, on 2009-05-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Wireless Console 2\wcourier.exe C:\Program Files\Atheros\ACU.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\System32\AcroRd32.exe C:\windows\ld08.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\TEMP\A049.tmp C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\SYSDLL.exe C:\Documents and Settings\Klaudia\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Wireless Console 2] "C:\Program Files\Wireless Console 2\wcourier.exe" O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [AdobeReader] "C:\WINDOWS\System32\AcroRd32.exe" O4 - HKLM\..\Run: [sysldtray] C:\windows\ld08.exe O4 - HKLM\..\Run: [pp] C:\windows\pp10.exe O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [SYSDLL] SYSDLL O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: CCC.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll O20 - Winlogon Notify: winrvc32 - C:\WINDOWS\SYSTEM32\winrvc32.dll O23 - Service: Usługa konfiguracji Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- End of file - 8008 bytes

**Posty:** 18165 · przez **wojtas** 31 Maj 2009, 12:28

daj loga z http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 16 · przez **miszza** 31 Maj 2009, 12:46

jest napisane na forum ze mamy nie uzywac combofixa...

**Posty:** 18165 · przez **wojtas** 31 Maj 2009, 20:17

tak ale mozna go użyć wtedy gdy ktoś ze sprawdzajacych logi o niego poprosi

wiec daj

**Posty:** 16 · przez **miszza** 01 Cze 2009, 16:08

Kod: Zaznacz wszystko
ComboFix 09-05-31.05 - Klaudia 2009-06-01 15:50.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.895.463 [GMT 2:00] Uruchomiony z: c:\documents and settings\Klaudia\Pulpit\ComboFix.exe AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Klaudia\Dane aplikacji\wiaserva.log c:\windows\9g2234wesdf3dfgjf23 c:\windows\IE4 Error Log.txt c:\windows\ld08.exe c:\windows\pp10.exe c:\windows\st_1243543164.exe c:\windows\st_1243543382.exe c:\windows\st_1243756061.exe c:\windows\st_1243756748.exe c:\windows\system32\crypts.dll c:\windows\system32\drivers\str.sys c:\windows\system32\mpg4c32.dll c:\windows\system32\SYSDLL.exe c:\windows\system32\uninstall.exe c:\windows\system32\wbem\grpconv.exe c:\windows\system32\wbem\proquota.exe c:\windows\system32\winrvc32.dll c:\windows\system32\grpconv.exe - brakowało pliku Plik odzyskano z - c:\windows\system32\proquota.exe - brakowało pliku Plik odzyskano z - . ((((((((((((((((((((((((( Pliki utworzone od 2009-05-01 do 2009-06-01 ))))))))))))))))))))))))))))))) . 2009-06-01 13:53 . 2004-08-03 22:44 50688 -c--a-w- c:\windows\system32\dllcache\proquota.exe 2009-06-01 13:53 . 2004-08-03 22:44 50688 ----a-w- c:\windows\system32\proquota.exe 2009-06-01 13:53 . 2004-08-03 22:44 39424 -c--a-w- c:\windows\system32\dllcache\grpconv.exe 2009-06-01 13:53 . 2004-08-03 22:44 39424 ----a-w- c:\windows\system32\grpconv.exe 2009-05-30 23:48 . 2009-05-30 23:48 -------- d-----w- C:\ERDNT 2009-05-30 23:48 . 2009-05-30 23:48 -------- d-----w- c:\windows\ERUNT 2009-05-30 23:48 . 2009-05-30 23:48 -------- d-----w- C:\!FixIEDef 2009-05-28 12:33 . 2009-05-28 11:23 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-05-28 11:33 . 2009-05-28 11:33 -------- d-----w- c:\documents and settings\LocalService\Pulpit 2009-05-28 11:24 . 2009-05-28 11:23 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-05-28 11:20 . 2009-05-28 11:20 -------- dc-h--w- c:\documents and settings\All Users\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-05-28 11:20 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe 2009-05-28 11:20 . 2009-05-28 11:23 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-05-28 11:20 . 2009-05-28 11:20 -------- d-----w- c:\program files\Lavasoft 2009-05-28 10:27 . 2009-05-28 10:27 2 ---h--w- c:\windows\sonce123140.dat 2009-05-28 08:27 . 2009-05-28 08:27 2 ---h--w- c:\windows\sonce122730.dat 2009-05-22 15:31 . 2009-05-22 15:31 -------- d-----w- c:\program files\Tlen.pl 2009-05-22 11:51 . 2009-05-22 11:51 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Grisoft 2009-05-21 19:11 . 2009-06-01 12:55 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\Tlen.pl 2009-05-21 19:11 . 2009-05-21 19:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Tlen.pl 2009-05-20 16:02 . 2009-05-20 16:02 1878984 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-05-20 07:14 . 2009-03-08 22:33 414208 --sh--w- c:\windows\system32\AcroRd32.exe 2009-05-11 19:50 . 2009-05-22 11:45 -------- d-----w- c:\program files\Norton Security Scan 2009-05-11 19:14 . 2009-05-22 11:44 -------- d-----w- c:\program files\Panda Security 2009-05-11 09:21 . 2009-05-11 09:21 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\AVS4YOU 2009-05-11 09:10 . 2009-05-11 09:10 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-05-11 09:10 . 2007-09-27 12:22 261632 ----a-w- c:\windows\system32\mcdvd_32.dll 2009-05-11 09:10 . 2003-05-21 21:50 1700352 ----a-w- c:\windows\system32\GdiPlus.dll 2009-05-11 09:10 . 2009-05-11 09:10 -------- d-----w- c:\program files\AVS4YOU 2009-05-11 09:10 . 2002-01-05 13:48 974848 ----a-w- c:\windows\system32\mfc70.dll 2009-05-11 09:10 . 2002-01-05 12:40 487424 ----a-w- c:\windows\system32\msvcp70.dll 2009-05-11 09:10 . 2002-01-05 00:37 344064 ----a-w- c:\windows\system32\msvcr70.dll 2009-05-10 02:21 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2009-05-10 02:21 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2009-05-10 02:21 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2009-05-10 02:21 . 2009-05-10 02:21 -------- d-----w- c:\program files\Avira 2009-05-10 02:21 . 2009-05-10 02:21 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Avira 2009-05-08 15:19 . 2009-05-08 15:19 -------- d-----w- c:\documents and settings\Klaudia\.gstreamer-0.10 2009-05-08 15:19 . 2009-05-08 15:19 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\OpenFM 2009-05-07 18:13 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-05-07 13:24 . 2009-05-07 13:24 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-07 13:21 . 2009-05-07 13:21 152576 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-06 11:32 . 2007-10-23 07:27 110592 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\U3\temp\cleanup.exe 2009-05-06 11:27 . 2007-10-23 07:22 3350528 ---ha-w- c:\documents and settings\Klaudia\Dane aplikacji\U3\temp\Launchpad Removal.exe 2009-05-06 11:27 . 2009-05-06 11:51 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\U3 2009-05-05 12:40 . 2009-05-04 13:07 2298680 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll 2009-05-05 12:40 . 2008-03-04 16:52 286720 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll 2009-05-05 12:40 . 2007-10-31 07:39 59904 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll 2009-05-05 12:40 . 2007-05-17 11:58 143360 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll 2009-05-05 12:40 . 2006-10-18 15:32 499712 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll 2009-05-05 12:40 . 2006-10-18 15:32 348160 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll 2009-05-05 12:40 . 2006-10-16 16:44 196608 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll 2009-05-05 12:40 . 2006-10-16 16:44 1028096 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-22 11:49 . 2008-02-21 18:17 -------- d-----w- c:\program files\CyberLink 2009-05-22 11:47 . 2008-02-21 15:36 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-05-20 10:53 . 2009-02-11 18:20 -------- d-----w- c:\program files\Soulseek 2009-05-11 14:41 . 2009-02-11 14:09 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\Skype 2009-05-11 14:06 . 2008-07-05 10:05 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\skypePM 2009-05-11 09:32 . 2008-02-21 15:39 40064 ----a-w- c:\documents and settings\Klaudia\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-05-07 13:24 . 2008-03-02 22:44 -------- d-----w- c:\program files\Java 2009-04-28 10:58 . 2009-04-28 10:58 -------- d-----w- c:\program files\iTunes 2009-04-28 10:58 . 2009-04-28 10:58 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-28 10:58 . 2009-04-28 10:58 -------- d-----w- c:\program files\iPod 2009-04-28 10:58 . 2009-02-11 14:11 -------- d-----w- c:\program files\Common Files\Apple 2009-04-28 10:56 . 2009-04-28 10:55 -------- d-----w- c:\program files\QuickTime 2009-04-28 10:50 . 2009-04-28 10:50 75048 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-04-28 10:49 . 2009-04-28 10:49 -------- d-----w- c:\program files\Bonjour 2009-04-23 15:09 . 2009-04-23 14:51 -------- d-----w- c:\program files\INTERIAPL 2009-04-04 11:38 . 2009-04-03 13:15 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-03-29 01:41 . 2001-10-26 18:15 74648 ----a-w- c:\windows\system32\perfc015.dat 2009-03-29 01:41 . 2001-10-26 18:15 448586 ----a-w- c:\windows\system32\perfh015.dat 2009-03-26 13:23 . 2009-04-28 10:53 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-03-26 13:23 . 2009-04-28 10:53 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-03-19 14:32 . 2009-03-19 14:32 23400 ----a-w- c:\documents and settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 14:32 . 2009-02-11 14:14 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2009-01-17 5853672] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592] "SMSERIAL"="c:\windows\sm56hlpr.exe" [2006-03-21 544768] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521] "Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-07 148888] "Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384] "ACU"="c:\program files\Atheros\ACU.exe" [2007-10-23 376921] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "AdobeReader"="c:\windows\System32\AcroRd32.exe" [2009-03-08 414208] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-28 518488] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-10-30 16269312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Klaudia\Menu Start\Programy\Autostart\ CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696] Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-22 2756608] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave1"= serwvdrv.dll "wave2"= serwvdrv.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BitLord\\BitLord.exe"= "c:\\Program Files\\Soulseek\\slsk.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-05-28 64160] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-10 108289] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 1005904] R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\ATK0100\ASNDIS5.sys [2008-02-21 16269] R3 DCamUSBGene;USB2.0 1.3M PC Cam;c:\windows\system32\drivers\USBGENE.sys [2008-02-21 142720] R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2008-03-03 57344] S2 eblxr;eblxr;\??\c:\windows\system32\drivers\dcmrs.sys --> c:\windows\system32\drivers\dcmrs.sys [?] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static] msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb . Zawartość folderu 'Zaplanowane zadania' 2009-05-28 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 11:23] 2009-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe SafeBoot-procexp90.Sys . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Settings,ProxyOverride = *.local;<local> uInternet Settings,ProxyServer = http=localhost:7171 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - prefs.js: network.proxy.http - localhost FF - prefs.js: network.proxy.http_port - 7171 FF - prefs.js: network.proxy.type - 1 FF - plugin: c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-01 15:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1044) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(1588) c:\windows\system32\browselc.dll c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll c:\windows\system32\ODBC32.dll c:\program files\Microsoft Office\OFFICE11\msohev.dll c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll c:\windows\system32\shdoclc.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\acs.exe c:\windows\system32\ati2evxx.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\drivers\CDAC11BA.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\ATK0100\ATKOSD.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\Common Files\Nero\Lib\NMIndexingService.exe c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-06-01 16:00 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-06-01 13:59 Przed: 5 707 321 344 bajtów wolnych Po: 7 122 681 856 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 256

Dodano 01.06.2009 15:09:31:
log do sprawdzenia ale juz i tak jest chyba lepiej po combofixe:)

**Posty:** 18165 · przez **wojtas** 01 Cze 2009, 17:51

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\AcroRd32.exe
c:\windows\system32\drivers\dcmrs.sys

Folder::
c:\documents and settings\Klaudia\Dane aplikacji\U3\temp

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeReader"=-

Driver::
eblxr

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 16 · przez **miszza** 01 Cze 2009, 20:43

Kod: Zaznacz wszystko
ComboFix 09-05-31.06 - Klaudia 2009-06-01 20:28.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.895.484 [GMT 2:00] Uruchomiony z: c:\documents and settings\Klaudia\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Klaudia\Pulpit\CFScript.txt.txt AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FILE :: "c:\windows\system32\AcroRd32.exe" "c:\windows\system32\drivers\dcmrs.sys" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Klaudia\Dane aplikacji\U3\temp c:\documents and settings\Klaudia\Dane aplikacji\U3\temp\cleanup.exe c:\documents and settings\Klaudia\Dane aplikacji\U3\temp\Launchpad Removal.exe c:\windows\system32\AcroRd32.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_EBLXR -------\Service_eblxr ((((((((((((((((((((((((( Pliki utworzone od 2009-05-01 do 2009-06-01 ))))))))))))))))))))))))))))))) . 2009-06-01 13:53 . 2004-08-03 22:44 50688 -c--a-w- c:\windows\system32\dllcache\proquota.exe 2009-06-01 13:53 . 2004-08-03 22:44 50688 ----a-w- c:\windows\system32\proquota.exe 2009-06-01 13:53 . 2004-08-03 22:44 39424 -c--a-w- c:\windows\system32\dllcache\grpconv.exe 2009-06-01 13:53 . 2004-08-03 22:44 39424 ----a-w- c:\windows\system32\grpconv.exe 2009-05-30 23:48 . 2009-05-30 23:48 -------- d-----w- C:\ERDNT 2009-05-30 23:48 . 2009-05-30 23:48 -------- d-----w- c:\windows\ERUNT 2009-05-30 23:48 . 2009-05-30 23:48 -------- d-----w- C:\!FixIEDef 2009-05-28 11:33 . 2009-05-28 11:33 -------- d-----w- c:\documents and settings\LocalService\Pulpit 2009-05-28 11:20 . 2009-06-01 14:17 -------- d-----w- c:\program files\Lavasoft 2009-05-28 11:20 . 2009-06-01 14:17 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-05-28 10:27 . 2009-05-28 10:27 2 ---h--w- c:\windows\sonce123140.dat 2009-05-28 08:27 . 2009-05-28 08:27 2 ---h--w- c:\windows\sonce122730.dat 2009-05-22 15:31 . 2009-05-22 15:31 -------- d-----w- c:\program files\Tlen.pl 2009-05-22 11:51 . 2009-05-22 11:51 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Grisoft 2009-05-21 19:11 . 2009-06-01 12:55 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\Tlen.pl 2009-05-21 19:11 . 2009-05-21 19:11 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Tlen.pl 2009-05-20 16:02 . 2009-05-20 16:02 1878984 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-05-11 19:50 . 2009-05-22 11:45 -------- d-----w- c:\program files\Norton Security Scan 2009-05-11 19:14 . 2009-05-22 11:44 -------- d-----w- c:\program files\Panda Security 2009-05-11 09:21 . 2009-05-11 09:21 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\AVS4YOU 2009-05-11 09:10 . 2009-05-11 09:10 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-05-11 09:10 . 2007-09-27 12:22 261632 ----a-w- c:\windows\system32\mcdvd_32.dll 2009-05-11 09:10 . 2003-05-21 21:50 1700352 ----a-w- c:\windows\system32\GdiPlus.dll 2009-05-11 09:10 . 2009-05-11 09:10 -------- d-----w- c:\program files\AVS4YOU 2009-05-11 09:10 . 2002-01-05 13:48 974848 ----a-w- c:\windows\system32\mfc70.dll 2009-05-11 09:10 . 2002-01-05 12:40 487424 ----a-w- c:\windows\system32\msvcp70.dll 2009-05-11 09:10 . 2002-01-05 00:37 344064 ----a-w- c:\windows\system32\msvcr70.dll 2009-05-10 02:21 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2009-05-10 02:21 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2009-05-10 02:21 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2009-05-10 02:21 . 2009-05-10 02:21 -------- d-----w- c:\program files\Avira 2009-05-10 02:21 . 2009-05-10 02:21 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Avira 2009-05-08 15:19 . 2009-05-08 15:19 -------- d-----w- c:\documents and settings\Klaudia\.gstreamer-0.10 2009-05-08 15:19 . 2009-05-08 15:19 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\OpenFM 2009-05-07 18:13 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-05-07 13:24 . 2009-05-07 13:24 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-07 13:21 . 2009-05-07 13:21 152576 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-06 11:27 . 2009-06-01 18:28 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\U3 2009-05-05 12:40 . 2009-05-04 13:07 2298680 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll 2009-05-05 12:40 . 2008-03-04 16:52 286720 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll 2009-05-05 12:40 . 2007-10-31 07:39 59904 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll 2009-05-05 12:40 . 2007-05-17 11:58 143360 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll 2009-05-05 12:40 . 2006-10-18 15:32 499712 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll 2009-05-05 12:40 . 2006-10-18 15:32 348160 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll 2009-05-05 12:40 . 2006-10-16 16:44 196608 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll 2009-05-05 12:40 . 2006-10-16 16:44 1028096 ----a-w- c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-22 11:49 . 2008-02-21 18:17 -------- d-----w- c:\program files\CyberLink 2009-05-22 11:47 . 2008-02-21 15:36 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-05-20 10:53 . 2009-02-11 18:20 -------- d-----w- c:\program files\Soulseek 2009-05-11 14:41 . 2009-02-11 14:09 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\Skype 2009-05-11 14:06 . 2008-07-05 10:05 -------- d-----w- c:\documents and settings\Klaudia\Dane aplikacji\skypePM 2009-05-11 09:32 . 2008-02-21 15:39 40064 ----a-w- c:\documents and settings\Klaudia\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-05-07 13:24 . 2008-03-02 22:44 -------- d-----w- c:\program files\Java 2009-04-28 10:58 . 2009-04-28 10:58 -------- d-----w- c:\program files\iTunes 2009-04-28 10:58 . 2009-04-28 10:58 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-28 10:58 . 2009-04-28 10:58 -------- d-----w- c:\program files\iPod 2009-04-28 10:58 . 2009-02-11 14:11 -------- d-----w- c:\program files\Common Files\Apple 2009-04-28 10:56 . 2009-04-28 10:55 -------- d-----w- c:\program files\QuickTime 2009-04-28 10:50 . 2009-04-28 10:50 75048 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-04-28 10:49 . 2009-04-28 10:49 -------- d-----w- c:\program files\Bonjour 2009-04-23 15:09 . 2009-04-23 14:51 -------- d-----w- c:\program files\INTERIAPL 2009-04-04 11:38 . 2009-04-03 13:15 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-03-29 01:41 . 2001-10-26 18:15 74648 ----a-w- c:\windows\system32\perfc015.dat 2009-03-29 01:41 . 2001-10-26 18:15 448586 ----a-w- c:\windows\system32\perfh015.dat 2009-03-26 13:23 . 2009-04-28 10:53 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-03-26 13:23 . 2009-04-28 10:53 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-03-19 14:32 . 2009-03-19 14:32 23400 ----a-w- c:\documents and settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 14:32 . 2009-02-11 14:14 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys . ((((((((((((((((((((((((((((( SnapShot@2009-06-01_13.56.26 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-01 18:33 . 2009-06-01 18:33 16384 c:\windows\Temp\Perflib_Perfdata_23c.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2009-01-17 5853672] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592] "SMSERIAL"="c:\windows\sm56hlpr.exe" [2006-03-21 544768] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521] "Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-07 148888] "Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384] "ACU"="c:\program files\Atheros\ACU.exe" [2007-10-23 376921] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-10-30 16269312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Klaudia\Menu Start\Programy\Autostart\ CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696] Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-22 2756608] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave1"= serwvdrv.dll "wave2"= serwvdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BitLord\\BitLord.exe"= "c:\\Program Files\\Soulseek\\slsk.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-10 108289] R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\ATK0100\ASNDIS5.sys [2008-02-21 16269] R3 DCamUSBGene;USB2.0 1.3M PC Cam;c:\windows\system32\drivers\USBGENE.sys [2008-02-21 142720] R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2008-03-03 57344] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static] msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb . Zawartość folderu 'Zaplanowane zadania' 2009-02-11 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Settings,ProxyOverride = *.local;<local> uInternet Settings,ProxyServer = http=localhost:7171 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - prefs.js: network.proxy.http - localhost FF - prefs.js: network.proxy.http_port - 7171 FF - prefs.js: network.proxy.type - 1 FF - plugin: c:\documents and settings\Klaudia\Dane aplikacji\Mozilla\Firefox\Profiles\otjszrn6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-01 20:33 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1032) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\acs.exe c:\windows\system32\ati2evxx.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\drivers\CDAC11BA.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\ATK0100\ATKOSD.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\Common Files\Nero\Lib\NMIndexingService.exe c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-06-01 20:36 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-06-01 18:36 ComboFix2.txt 2009-06-01 14:00 Przed: 5 924 536 320 bajtów wolnych Po: 6 031 740 928 bajtów wolnych 216

**Posty:** 18165 · przez **wojtas** 01 Cze 2009, 21:03

Otworz notatnik i wklej w nim to:

File::
c:\windows\sonce123140.dat
c:\windows\sonce122730.dat

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

1.Uruchom OTListIt2 z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

Autor postu otrzymał pochwałę

**Posty:** 16 · przez **miszza** 02 Cze 2009, 11:48

Zrobilem wszystko jak kazales-kaspersky nie znalazl nic-malwarebytes anti znalaz jakies dwa zainfekowane pliki,dr web curelt usunal cos zwiazanego z combofixem... dziala teraz wszystko tak jak powinno-Wielkie dzieki za pomoc! masz u mnie piwo!!!

jeszcze raz dzieki