Log " hijackthis/combofix " wirus heur.win32

**Posty:** 4 · przez **PLOUNZER** 16 Sty 2009, 15:15

LOCK Z HIJACKTHIS

Kod: Zaznacz wszystko: [quote]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:06:36, on 2009-01-16 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\DNA\btdna.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Paweł\Pulpit\fgk\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: raid_tool.exe.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 6816 bytes [/quote]

LOG Z COMBOFIX

Kod: Zaznacz wszystko
ComboFix 09-01-15.01 - Paweł 2009-01-16 13:53:36.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.512.225 [GMT 1:00] Uruchomiony z: c:\documents and settings\Paweł\Pulpit\ComboFix.exe AV: System antywirusowy NOD32 2.70 *On-access scanning disabled* (Outdated) * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\msssc.dll D:\install.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-16 do 2009-01-16 ))))))))))))))))))))))))))))))) . 2009-01-13 22:27 . 2009-01-13 22:27 <DIR> d-------- c:\documents and settings\Paweł\Dane aplikacji\Remere's Map Editor 2009-01-01 23:26 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys 2009-01-01 23:24 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2009-01-01 23:24 . 2007-03-08 06:11 1,036,288 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2009-01-01 23:24 . 2008-10-16 21:33 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2009-01-01 23:24 . 2008-10-16 21:33 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2009-01-01 23:24 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2009-01-01 23:24 . 2008-06-14 18:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2009-01-01 23:24 . 2008-10-16 21:33 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2009-01-01 23:24 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2009-01-01 23:23 . 2008-10-16 21:33 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2009-01-01 23:23 . 2008-10-16 21:33 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2009-01-01 23:23 . 2008-10-16 21:33 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2009-01-01 23:18 . 2008-09-15 16:27 1,846,656 -----c--- c:\windows\system32\dllcache\win32k.sys 2009-01-01 23:16 . 2008-08-14 14:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2009-01-01 23:16 . 2008-08-14 14:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-01-01 23:16 . 2008-08-14 14:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-01-01 23:16 . 2008-08-14 14:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2009-01-01 23:15 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2009-01-01 23:15 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2009-01-01 23:15 . 2008-05-01 15:37 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2009-01-01 23:15 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys 2009-01-01 23:08 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2009-01-01 23:08 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-12-30 23:16 . 2008-12-30 23:16 <DIR> d-------- c:\program files\Ventrilo 2008-12-28 19:27 . 2008-12-28 19:27 <DIR> d-------- c:\program files\Common Files\INCA Shared 2008-12-28 19:25 . 2003-07-21 04:17 5,174 --a------ c:\windows\system32\nppt9x.vxd 2008-12-28 19:25 . 2005-01-04 19:43 4,682 --a------ c:\windows\system32\npptNT2.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-16 12:54 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\DNA 2009-01-16 12:53 --------- d-----w c:\program files\ESET 2009-01-16 09:15 --------- d-----w c:\program files\BitComet 2009-01-16 09:15 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\Skype 2009-01-16 09:14 --------- d-----w c:\program files\DNA 2009-01-16 09:14 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\skypePM 2009-01-15 21:20 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\Tibia 2009-01-15 21:19 --------- d-----w c:\program files\TibiaCam TV Lite 2009-01-15 15:52 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\teamspeak2 2009-01-12 17:48 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\uTorrent 2009-01-10 11:19 --------- d-----w c:\program files\Tibia 2009-01-10 11:13 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-08 10:59 --------- d-----w c:\program files\ALLPlayer 2008-12-30 22:16 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-14 18:05 --------- d-----w c:\program files\SkanerOnline 2008-12-12 14:47 --------- d-----w c:\program files\NAPI-PROJEKT 2008-12-12 14:37 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-12-12 14:37 --------- d-----w c:\program files\Java 2008-12-09 20:04 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\DivX 2008-12-09 19:59 --------- d-----w c:\program files\DivX 2008-12-09 19:47 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-12-09 19:47 348,160 ----a-w c:\windows\system32\msvcr71.dll 2008-12-09 19:47 --------- d-----w c:\program files\Real 2008-12-09 19:47 --------- d-----w c:\program files\Common Files\xing shared 2008-12-09 19:47 --------- d-----w c:\program files\Common Files\Real 2008-12-06 08:51 --------- d-----w c:\program files\uTorrent 2008-12-04 13:00 --------- d-----w c:\program files\TibiaBot NG 2008-12-04 09:15 869,563 ----a-w c:\windows\system32\python24.zip 2008-12-01 18:51 --------- d-----w c:\documents and settings\Paweł\Dane aplikacji\Ventrilo 2008-11-24 16:36 --------- d-----w c:\program files\SubEdit-Player 2008-11-23 12:51 --------- d-----w c:\program files\Teamspeak2_RC2 2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-11-21 21:47 129,784 ------w c:\windows\system32\pxafs.dll 2008-11-21 21:47 120,056 ------w c:\windows\system32\pxcpyi64.exe 2008-11-21 21:47 118,520 ------w c:\windows\system32\pxinsi64.exe 2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-11-20 13:46 --------- d-----w c:\program files\Skype 2008-11-20 13:46 --------- d-----w c:\program files\Common Files\Skype 2008-11-20 13:46 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-11-07 18:38 90,112 ----a-w c:\windows\DUMP630f.tmp 2008-11-06 20:20 298,104 ----a-w c:\windows\system32\imon.dll 2008-11-06 20:18 451,072 ----a-w c:\windows\Radeon Omega Drivers v3.8.421 Uninstall.exe 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2003-06-03 15:49 448,256 ----a-w c:\windows\inf\EL2K_N64.sys 2003-06-03 15:48 147,328 ----a-w c:\windows\inf\EL2K_XP.sys 2003-06-03 15:47 147,328 ----a-w c:\windows\inf\EL2K_2K.sys 2008-12-20 08:24 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 08:24 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 08:24 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 08:24 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 08:24 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-11-24 94208] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "Steam"="c:\progra~1\valve\steam\steam.exe" [2008-11-08 1410296] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-04-23 22058792] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-01 342848] "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-12-03 2514744] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-11-06 949376] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-12 136600] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-09 185872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ ATI CATALYST - pasek zadaä.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2006-01-02 45056] raid_tool.exe.lnk - c:\program files\VIA\RAID\raid_tool.exe [2008-11-06 561152] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\wykrentxp\\counter-strike\\hl.exe"= "c:\\Documents and Settings\\Paweł\\Pulpit\\utorrent.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Documents and Settings\\Paweł\\Moje dokumenty\\TibiCam\\TibiCAM.exe"= "c:\\Program Files\\Tibia\\Tibia.exe"= "c:\\Documents and Settings\\Paweł\\Pulpit\\polskiots\\Tibia.exe"= "d:\\Dysk C\\Pulpit\\hfs.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\wykrentxp\\condition zero\\hl.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\proeloziomus\\counter-strike\\hl.exe"= "d:\\Tibia\\Tibia.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\proeloziomus\\condition zero\\hl.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25752:TCP"= 25752:TCP:BitComet 25752 TCP "25752:UDP"= 25752:UDP:BitComet 25752 UDP R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2004-04-13 77312] R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-11-06 15424] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-1824466437 - c:\documents and settings\All Users\Application Data\1353899697\1824466437.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.atcomet.com/b/ IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm LSP: c:\windows\system32\imon.dll c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FF - ProfilePath - c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\rqu2djid.default\ FF - prefs.js: browser.startup.homepage - hxxp://pl.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official FF - component: c:\documents and settings\Paweł\Dane aplikacji\Mozilla\Firefox\Profiles\rqu2djid.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-16 13:55:05 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(676) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(732) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Czas ukończenia: 2009-01-16 13:56:13 ComboFix-quarantined-files.txt 2009-01-16 12:56:08 Przed: 32 517 451 776 bajtów wolnych Po: 33,582,059,520 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 212 --- E O F --- 2009-01-14 10:08:22

Prosze o szybką pomoc, tak mi słabo komputer pracuje, bardzo słabo

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 15:43

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

**Posty:** 4 · przez **PLOUNZER** 16 Sty 2009, 15:47

Tam napisałeś "i tym: "
a pod spodem nic? Czym jeszcze?

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 15:49

tym

sorka nie wkleiło mi się wszystko:

FixIEDef.

**Posty:** 4 · przez **PLOUNZER** 16 Sty 2009, 15:53

Ok, widze wojtas bardzo sie znacz najbardziej tu pomagasz, zrobiłem już wszystko jeszcze tylko skany i wkleje raport, ale co z logami, usuwać coś czy jak? Bo widzisz pierwszy raz mam sytuacje z tym wirusem, i nie wiem jak dokładnie postępować ^^

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 17:05

czekamy na raport ze skanera online bo w tych logach mało co widać złego...

**Posty:** 4 · przez **PLOUNZER** 16 Sty 2009, 17:48

Kod: Zaznacz wszystko
******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7268 * * * ******************************************************************************** Created at 16:42:42 on Friday, January 16, 2009 Time Zone : Logged On User : Paweł Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Sempron(TM) 2600+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 65 GB System Drive Free : 35.27 GB Total Physical Memory: 512 MB Free Physical Memory : 151 MB Total Page File : 512 MB Free Page File : 901 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1953 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

To z fixi defa, chyba nic nie ma a z kasperskego dam potem lub jutro, ale wiem dziś skanowałem na mks.com.pl/skaner i wyskoczyl mi ten wirus co w temacie to napewno musi cuś być ;/

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 20:47

no to czekamy na raport z kaspra