log do sprawdzenia

**Posty:** 97 · przez **Pastuszek** 15 Mar 2008, 12:59

Ostatnio zaczęły mi wyskakiwać jakieś reklamy z on-line pokerem i troszke zwolnił internet... W związku z tym proszę o sprwadzenie loga

HijackThis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:32:32, on 2008-03-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Audacity\audacity.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.653\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\IH_iexplore.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\IH_iexplore.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

**Posty:** 18165 · przez **wojtas** 15 Mar 2008, 15:05

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa ( jak będziesz sciągał zapisz go pod nazwa combo-fix.exe) oraz daj loga z hijacka

**Posty:** 97 · przez **Pastuszek** 15 Mar 2008, 16:13

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-03-14.4 - Administrator 2008-03-15 14:47:46.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511 [GMT 1:00] Running from: C:\Documents and Settings\Administrator\Pulpit\Combo-Fix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 ))))))))))))))))))))))))))))))) . 2008-03-15 14:16 . 2004-08-04 00:44 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-03-15 14:15 . 2008-03-15 14:15 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-15 14:10 . 2008-03-15 14:22 <DIR> d-------- C:\SDFix 2008-03-14 19:53 . 2008-03-14 21:32 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-03-14 19:53 . 2008-03-14 21:32 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-14 19:52 . 2008-03-14 19:52 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-03-14 19:22 . 2008-03-14 19:22 <DIR> d-------- C:\Program Files\Sierra 2008-03-01 13:06 . 2008-03-01 13:06 <DIR> d-------- C:\vcs5BGEffects 2008-03-01 13:05 . 2008-03-01 13:09 <DIR> d-------- C:\Program Files\AV Vcs 6.0 DIAMOND 2008-02-21 20:44 . 2008-02-21 20:44 <DIR> d-------- C:\Program Files\Nowy folder . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-15 13:54 51,580,960 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-03-15 13:51 694,976 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-03-15 13:51 231,632 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-03-15 13:51 2,426,144 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-03-14 18:21 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-14 18:18 --------- d-----w C:\Program Files\Giant 2008-03-14 18:10 --------- d-----w C:\Program Files\Team17 Software Ltd 2008-03-14 14:02 --------- d-----w C:\Program Files\Valve 2008-03-08 11:16 --------- d-----w C:\Program Files\English Translator 3 2008-02-17 19:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-01-31 19:22 --------- d-----w C:\Program Files\ErrorKiller 2008-01-27 12:48 --------- d-----w C:\Program Files\Microsoft Works 2008-01-18 20:25 --------- d-----w C:\Program Files\Audacity 2007-12-31 12:14 7,279 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-12-31 12:14 64,713 ----a-w C:\WINDOWS\BricoPackUninst.cmd 1995-09-22 23:10 106,496 ----a-w C:\Documents and Settings\Administrator\SUPER_PI.EXE . ------- Sigcheck ------- 2001-10-26 18:29 596480 f83cf52c53f37189ae42f57995613a8d C:\WINDOWS\$NtServicePackUninstall$\wininet.dll 2004-08-04 00:44 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\ServicePackFiles\i386\wininet.dll 2004-08-04 00:44 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\system32\wininet.dll 2004-08-04 00:44 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\explorer.exe 2001-10-26 18:29 1002496 0b6cb4abb3166e1717bda7895f2029d8 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-08-04 16:00 1110528 9a41e77af64ca976e6f61b55401cbebb C:\WINDOWS\Resources\Themes\XP-CurvedEdition\Explorer.exe\explore.exe(EnglichVersion)\explorer.exe 2007-06-13 15:22 979456 394be08d7487d31500aad65e15f91a6f C:\WINDOWS\Resources\Themes\XP-CurvedEdition\Explorer.exe\explorer.exe(FrenchVersion)\explorer.exe 2004-08-04 00:44 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\ServicePackFiles\i386\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-23 17:15 335872] "kav"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-03-24 19:09 139367] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^AGC.lnk] backup=C:\WINDOWS\pss\AGC.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] --a------ 2002-10-15 19:00 1818624 C:\WINDOWS\mixer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 00:44 15360 C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery] --a------ 2002-12-02 20:56 40960 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\errorkiller] --a------ 2006-07-11 15:54 6475776 C:\Program Files\errorkiller\errorkiller.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] -ra------ 2002-12-17 11:40 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2003-03-26 08:19 172032 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InternetCalls] --a------ 2006-08-25 07:32 7046720 C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Outpost Firewall] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "cisvc"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"= "C:\\Program Files\\InternetCalls.com\\InternetCalls\\InternetCalls.exe"= "C:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"= [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\cda_menu.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-15 14:53:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\imapi.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-03-15 15:00:08 - machine was rebooted [Administrator] ComboFix-quarantined-files.txt 2008-03-15 14:00:03

**Posty:** 18165 · przez **wojtas** 15 Mar 2008, 19:37

znasz ten folder:

C:\vcs5BGEffects

jesli nie skasuj jesli tak zostaw w logach nic nie ma

log do sprawdzenia

log do sprawdzenia

Kto jest na forum