Menadzer zadan wylaczony i duzo wirusów

**Posty:** 64 · przez **tonis38** 20 Cze 2009, 09:19

Mam problem z drugim komputerem na którym siedzi tata.
Ciągle skarży się że coś nie działa np. menadzer zadan. Ponadto tez nie mozna wyłaczyć wbudowanego konta administratora.

Oto logi:
Skan Eset'a

Kod: Zaznacz wszystko: C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\0PYVKDEB\c1234[1].jpg - Win32/Injector.OE koń trojański - wyleczony przez usunięcie - poddany kwarantannie [1] C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\G5EFCPU3\18[1].jpg - Win32/AutoRun.IRCBot.AN robak - wyleczony przez usunięcie - poddany kwarantannie [1] C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\W9M3SHMZ\17[1].exe - IRC/SdBot koń trojański - wyleczony przez usunięcie - poddany kwarantannie [1] C:\Documents and Settings\xxx\Local Settings\Temp\48444.exe - Win32/AutoRun.IRCBot.AP robak - wyleczony przez usunięcie - poddany kwarantannie [1] C:\Documents and Settings\xxx\Local Settings\Temporary Internet Files\Content.IE5\KFANLCEO\19[1].jpg - Win32/AutoRun.IRCBot.AP robak - wyleczony przez usunięcie - poddany kwarantannie [1] C:\WINNT\Temp\25326.exe - Win32/AutoRun.IRCBot.AN robak - wyleczony przez usunięcie - poddany kwarantannie [1]

Log z OTL

http://wklej.org/id/108955/

Prosze o pomoc.

**Posty:** 18165 · przez **wojtas** 20 Cze 2009, 13:21

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 64 · przez **tonis38** 20 Cze 2009, 14:18

Log z Combo

Kod: Zaznacz wszystko: ComboFix 09-06-19.01 - xxx 2009-06-20 14:13.1 - NTFSx86 Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.511.309 [GMT 2:00] Running from: c:\documents and settings\xxx\Desktop\ComboFix.exe * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\arcldr.exe C:\arcsetup.exe c:\winnt\Web\default.htt . ((((((((((((((((((((((((( Files Created from 2009-05-20 to 2009-06-20 ))))))))))))))))))))))))))))))) . 2009-06-20 06:51 . 2009-06-20 06:51 -------- d-----w- c:\documents and settings\xxx\Application Data\Malwarebytes 2009-06-20 06:51 . 2009-06-17 09:27 38160 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys 2009-06-20 06:51 . 2009-06-20 06:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-20 06:51 . 2009-06-17 09:27 18456 ----a-w- c:\winnt\system32\drivers\mbam.sys 2009-06-20 06:51 . 2009-06-20 06:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-19 19:43 . 2009-06-19 19:43 -------- d-----w- c:\documents and settings\xxx\DoctorWeb 2009-06-19 19:28 . 2009-06-19 19:28 -------- d-----w- c:\program files\NAPI-PROJEKT 2009-06-19 19:26 . 2009-06-19 19:26 -------- d-----w- c:\documents and settings\xxx\Local Settings\Application Data\ESET 2009-06-14 21:04 . 2009-06-14 21:04 -------- d-----w- c:\documents and settings\xxx\Application Data\Media Player Classic 2009-06-14 21:03 . 2004-01-25 16:18 217088 ----a-w- c:\winnt\system32\yv12vfw.dll 2009-06-14 21:03 . 2009-05-01 21:02 90112 ----a-w- c:\winnt\system32\dpl100.dll 2009-06-14 21:03 . 2008-11-06 16:37 3596288 ----a-w- c:\winnt\system32\qt-dx331.dll 2009-06-14 21:03 . 2009-05-01 21:02 685056 ----a-w- c:\winnt\system32\divx.dll 2009-06-14 21:03 . 2009-06-02 16:11 85504 ----a-w- c:\winnt\system32\ff_vfw.dll 2009-06-14 20:44 . 2008-09-16 19:23 168448 ----a-w- c:\winnt\system32\unrar.dll 2009-06-14 20:44 . 2009-06-14 21:03 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-06-12 18:06 . 2009-06-20 06:47 -------- d-----w- c:\documents and settings\xxx\Application Data\Hamachi 2009-06-12 18:06 . 2009-06-12 18:06 25280 ----a-w- c:\winnt\system32\drivers\hamachi.sys 2009-06-12 18:06 . 2009-06-12 18:06 -------- d-----w- c:\program files\Hamachi 2009-06-12 16:24 . 2005-07-13 07:22 138000 -c--a-w- c:\winnt\system32\dllcache\faxui.dll 2009-06-12 16:24 . 2005-07-13 07:22 138000 ----a-w- c:\winnt\system32\faxui.dll 2009-06-03 19:25 . 2005-05-20 03:51 305908 ----a-w- c:\winnt\ETOSU.EXE 2009-06-03 19:21 . 2009-06-03 19:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\Autodata Limited 2009-06-03 19:19 . 2009-06-03 19:19 -------- d-----w- c:\program files\Common Files\Autodata Limited Shared 2009-06-03 19:19 . 2009-06-03 19:19 -------- d-----w- C:\ADCDTEMP 2009-05-29 14:12 . 2009-05-29 14:12 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\ESET 2009-05-25 21:31 . 2009-05-25 21:31 -------- d-----w- c:\documents and settings\xxx\Local Settings\Application Data\Identities 2009-05-25 19:16 . 2009-06-12 16:14 -------- d-----w- c:\documents and settings\xxx\Application Data\BESTplayer 2009-05-25 19:07 . 2009-05-25 19:07 -------- d-----w- c:\winnt\Logs 2009-05-25 18:45 . 2009-05-25 18:50 737280 ----a-w- c:\winnt\iun6002.exe 2009-05-24 19:05 . 2009-06-12 16:30 -------- d-----w- c:\winnt\winsxs 2009-05-24 19:05 . 2009-05-24 19:05 -------- d-----w- c:\winnt\PCHEALTH 2009-05-24 18:47 . 2009-05-24 18:47 258048 ----a-w- c:\winnt\system32\libFLAC.dll 2009-05-24 18:45 . 2009-05-24 18:45 75264 ----a-w- c:\winnt\system32\MACDec.dll 2009-05-24 18:45 . 2009-05-24 18:45 1291776 ----a-w- c:\winnt\system32\quartzXP.dll 2009-05-24 18:44 . 2009-05-24 18:44 108032 ----a-w- c:\winnt\system32\avi.dll 2009-05-24 18:44 . 2009-05-24 18:44 246784 ----a-w- c:\winnt\system32\dxr.dll 2009-05-24 18:44 . 2009-05-24 18:44 141312 ----a-w- c:\winnt\system32\mp4.dll 2009-05-24 18:44 . 2009-05-24 18:44 148480 ----a-w- c:\winnt\system32\mkx.dll 2009-05-24 18:44 . 2009-05-24 18:44 159744 ----a-w- c:\winnt\system32\mmfinfo.dll 2009-05-24 18:44 . 2009-05-24 18:44 120832 ----a-w- c:\winnt\system32\ogm.dll 2009-05-24 18:44 . 2009-05-24 18:44 163840 ----a-w- c:\winnt\system32\ts.dll 2009-05-24 18:44 . 2009-05-24 18:44 79360 ----a-w- c:\winnt\system32\mkzlib.dll 2009-05-24 18:44 . 2009-05-24 18:44 23552 ----a-w- c:\winnt\system32\mkunicode.dll 2009-05-24 18:43 . 2009-05-24 18:43 1416015 ----a-w- c:\winnt\system32\ffmpegmt.dll 2009-05-24 18:41 . 2009-05-24 18:41 98304 ----a-w- c:\winnt\system32\ff_wmv9.dll 2009-05-24 18:41 . 2009-05-24 18:41 113152 ----a-w- c:\winnt\system32\ff_unrar.dll 2009-05-24 18:41 . 2009-05-24 18:41 183296 ----a-w- c:\winnt\system32\ff_samplerate.dll 2009-05-24 18:41 . 2009-05-24 18:41 178688 ----a-w- c:\winnt\system32\ff_libmad.dll 2009-05-24 18:41 . 2009-05-24 18:41 486400 ----a-w- c:\winnt\system32\ff_libfaad2.dll 2009-05-24 18:41 . 2009-05-24 18:41 257024 ----a-w- c:\winnt\system32\ff_libdts.dll 2009-05-24 18:41 . 2009-05-24 18:41 142848 ----a-w- c:\winnt\system32\ff_liba52.dll 2009-05-24 18:41 . 2009-05-24 18:41 2041363 ----a-w- c:\winnt\system32\x264vfw.dll 2009-05-24 18:40 . 2009-05-24 18:40 69632 ----a-w- c:\winnt\system32\divxconfig.exe 2009-05-24 18:40 . 2004-01-11 22:00 348160 ----a-w- c:\winnt\system32\msvcr71.dll 2009-05-24 18:40 . 2003-03-19 03:14 499712 ----a-w- c:\winnt\system32\msvcp71.dll 2009-05-24 18:37 . 2009-05-25 18:51 892928 ----a-w- c:\winnt\system32\iconv.dll 2009-05-24 18:37 . 2009-05-24 18:37 1415680 ----a-w- c:\winnt\system32\WMV9VCM.dll 2009-05-24 18:37 . 2009-05-24 18:37 245760 ----a-w- c:\winnt\system32\mplvpx.dll 2009-05-24 18:36 . 2009-05-24 18:36 9216 ----a-w- c:\winnt\system32\cpuinf32.dll 2009-05-24 18:36 . 2009-05-29 21:31 881664 ----a-w- c:\winnt\system32\xvidcore.dll 2009-05-24 18:36 . 2009-05-29 21:37 205824 ----a-w- c:\winnt\system32\xvidvfw.dll 2009-05-24 18:35 . 2009-05-30 14:20 -------- d-----w- c:\program files\ALLPlayer 2009-05-23 19:37 . 2009-05-23 19:42 -------- d-----w- c:\program files\FormatFactory 2009-05-23 19:36 . 2009-05-23 19:36 -------- d-----w- c:\program files\7-Zip 2009-05-23 19:30 . 2009-05-23 19:30 -------- d-----w- c:\documents and settings\xxx\dwhelper 2009-05-23 18:57 . 2009-05-23 18:57 -------- d-----w- c:\winnt\system32\Macromed 2009-05-23 17:25 . 2000-06-26 09:45 106496 ----a-w- c:\winnt\system32\TwnLib20.dll 2009-05-23 17:25 . 2004-07-26 15:16 476320 ------w- c:\winnt\system32\ImagXpr7.dll 2009-05-23 17:25 . 2004-07-26 15:16 471040 ------w- c:\winnt\system32\ImagXRA7.dll 2009-05-23 17:25 . 2004-07-26 15:16 262144 ------w- c:\winnt\system32\ImagXR7.dll 2009-05-23 17:25 . 2004-07-26 15:16 1568768 ------w- c:\winnt\system32\ImagX7.dll 2009-05-23 17:25 . 2001-07-09 09:50 155648 ----a-w- c:\winnt\system32\NeroCheck.exe 2009-05-23 17:24 . 2009-05-23 17:39 -------- d-----w- c:\program files\Dziobas Rar Player 2009-05-23 17:24 . 2009-05-23 17:24 -------- d-----w- c:\program files\Common Files\Ahead 2009-05-23 17:23 . 2009-05-23 17:26 -------- d-----w- c:\program files\Ahead 2009-05-23 17:23 . 2000-08-28 21:00 401462 ----a-r- c:\winnt\system32\msvcp60.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-20 12:13 . 2009-06-20 12:13 16384 ----atw- c:\winnt\system32\Perflib_Perfdata_2a4.dat 2009-06-20 12:11 . 2009-05-23 16:24 -------- d-----w- c:\documents and settings\xxx\Application Data\uTorrent 2009-05-29 14:13 . 2003-07-04 12:00 95024 ----a-w- c:\winnt\system32\sfc.dll 2009-05-23 16:24 . 2009-05-23 16:24 -------- d-----w- c:\program files\uTorrent 2009-05-23 16:23 . 2009-05-23 16:23 0 ----a-w- c:\winnt\nsreg.dat 2009-05-23 15:13 . 2009-05-23 15:13 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles 2009-05-23 15:06 . 2009-05-23 15:00 -------- d-----w- c:\program files\Creative 2009-05-23 14:56 . 2009-05-23 14:56 -------- d-----w- c:\program files\AMD 2009-05-23 14:56 . 2009-05-23 14:56 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-05-23 14:56 . 2009-05-23 14:54 -------- d-----w- c:\program files\Common Files\InstallShield 2009-05-23 14:50 . 2009-05-23 14:50 -------- d-----w- c:\documents and settings\xxx\Application Data\ESET 2009-05-23 14:49 . 2009-05-23 14:49 -------- d-----w- c:\program files\ESET 2009-05-23 14:49 . 2009-05-23 14:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2009-05-23 14:44 . 2009-05-23 14:44 -------- d-----w- c:\program files\microsoft frontpage 2009-05-23 14:43 . 2009-05-23 14:43 21952 ---h--w- c:\program files\folder.htt 2009-05-23 14:42 . 2009-05-23 14:42 15012 ----a-w- c:\winnt\system32\emptyregdb.dat 2009-05-23 14:41 . 2009-05-23 14:41 -------- d-----w- c:\program files\Accessories 2009-05-07 06:41 . 2003-07-04 12:00 263440 ----a-w- c:\winnt\system32\LOCALSPL.DLL 2009-04-24 09:54 . 2003-07-04 12:00 95504 ----a-w- c:\winnt\system32\WIN32SPL.DLL 2009-04-22 13:38 . 2009-04-22 13:38 437008 ----a-w- c:\winnt\system32\rpcrt4.dll 2009-04-21 13:15 . 2009-04-21 13:15 576512 ----a-w- c:\winnt\system32\WININET.DLL 2009-04-17 05:04 . 2003-07-04 12:00 1645072 ----a-w- c:\winnt\system32\WIN32K.SYS . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "internat.exe"="internat.exe" - c:\winnt\system32\internat.exe [2003-07-04 20752] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400] "Disc Detector"="c:\program files\Creative\ShareDLL\CtNotify.exe" [1999-08-29 189952] "UpdReg"="c:\winnt\Updreg.exe" [2000-05-10 90112] "Creative Launcher"="c:\program files\Creative\SBLive2k\Launcher\CTLauncher.exe" [2000-02-15 257536] "AudioHQ"="c:\program files\Creative\SBLive2k\AudioHQ\AHQTB.EXE" [2000-05-10 205312] "CTAvTray"="c:\program files\Creative\SBLive2k\Program\CTAvTray.EXE" [2000-08-31 21504] "NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2007-04-19 7700480] "NvMediaCenter"="c:\winnt\system32\NvMcTray.dll" [2007-04-19 86016] "NeroFilterCheck"="c:\winnt\system32\NeroCheck.exe" [2001-07-09 155648] "Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-07-04 111376] "nwiz"="nwiz.exe" - c:\winnt\system32\nwiz.exe [2007-04-19 1626112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" - c:\winnt\system32\internat.exe [2003-07-04 20752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-07-04 186640] c:\documents and settings\xxx\Start Menu\Programs\Startup\ hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-6-12 625952] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 R1 ehdrv;ehdrv;c:\winnt\system32\drivers\ehdrv.sys [2009-02-06 106208] R1 epfwndhk;epfwndhk;c:\winnt\system32\drivers\epfwndhk.sys [2009-02-06 35680] R1 gemwdm;AMD PowerNow! (tm) Technology;c:\winnt\system32\drivers\gemwdm.sys [2009-05-23 11776] R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-02-06 727720] R3 openhci;Microsoft USB Open Host Controller Driver;c:\winnt\system32\drivers\openhci.sys [2003-07-04 24784] R3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [2009-05-23 49776] S2 Regvi Controler;Regvi Controler;"c:\winnt\system32\drivers\Regvi.exe" --> c:\winnt\system32\drivers\Regvi.exe [?] S3 AMDMSRIO;AMDMSRIO;\??\c:\docume~1\xxx\LOCALS~1\Temp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys --> c:\docume~1\xxx\LOCALS~1\Temp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys [?] . . ------- Supplementary Scan ------- . IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm LSP: %SystemRoot%\system32\msafd.dll FF - ProfilePath - . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-20 14:16 Windows 5.0.2195 Service Pack 4 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Disc Detector = c:\program files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A?0?????B???@?$?@?? C?????U?@?????????@?B???A???????A???????B???@?????P???$?@?P???????TG?w??????????@???????????????????B???????????????????????????????????B CTAvTray = c:\program files\Creative\SBLive2k\Program\CTAvTray.EXE?TI@l????4?????;l????????????????????????`?????>l?????????????????B???@???????H@l????????T??w??????7l??Dl@???????hN/???????Dlt????????I@l????x????|;l????hN/?hN/?????x???{?;lh:/? @@????? @@?hN/???;l?? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(212) c:\winnt\system32\wzcdlg.dll c:\winnt\system32\WZCSAPI.DLL . Completion time: 2009-06-20 14:18 ComboFix-quarantined-files.txt 2009-06-20 12:17 Pre-Run: 20 480 851 968 bytes free Post-Run: 20 523 646 976 bytes free 185 --- E O F --- 2009-05-23 15:56

**Posty:** 18165 · przez **wojtas** 20 Cze 2009, 14:33

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

**Posty:** 64 · przez **tonis38** 20 Cze 2009, 19:15

Wszystko zrobione, dr. web, kasperski ani antymalware nic nie znalazl.

Coś jeszcze mam zrobic?

**Posty:** 18165 · przez **wojtas** 20 Cze 2009, 19:45

powinno byc ok

Autor postu otrzymał pochwałę

**Posty:** 64 · przez **tonis38** 20 Cze 2009, 21:39

Dziękuje.

Kto jest na forum