Mpxa.exe i kek.exe ???

**Posty:** 26 · przez **dryn3k** 25 Sie 2008, 23:13

witam, doczytałem tu i tam ze to jakis syf nie wiem jak to usunac, prosze o pomoc, tutaj log z hijackthis http://wklej.org/id/991/

Dodano 25.08.2008 22:16:49:
i log z combofixa http://wklej.org/id/992/

**Posty:** 8001 · przez **Okocza** 25 Sie 2008, 23:20

dryn3k, logi wklejamy na forum - tylko w wypadku kiedy się nie mieszczą wklejamy je na wklej,org.

**Posty:** 26 · przez **dryn3k** 25 Sie 2008, 23:23

no to sorki, stwierdziłem że tak będzie "czyściej" nie przeczytałem regulaminu

**Posty:** 8001 · przez **Okocza** 25 Sie 2008, 23:42

Kod: Zaznacz wszystko: C:\WINDOWS\system32\kek.exe C:\WINDOWS\system32\mpxa.exe O4 - HKCU\..\Run: [mpt] c:\WINDOWS\system32\mpt.exe O4 - HKCU\..\Run: [kek] c:\WINDOWS\system32\kek.exe

to na fix w hj

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\system32\MSA.cpl C:\WINDOWS\system32\kek.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\mpxa.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mpt"=- "kek"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

Autor postu otrzymał pochwałę

**Posty:** 26 · przez **dryn3k** 25 Sie 2008, 23:55

no to chyba poszedł, dzięki wielkie za pomoc okocza, tutaj log

Kod: Zaznacz wszystko: ComboFix 08-08-24.03 - user 2008-08-25 23:51:26.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1597 [GMT 2:00] Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\user\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\system32\kek.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\mpxa.exe C:\WINDOWS\system32\MSA.cpl . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\MSA.cpl . ((((((((((((((((((((((((( Files Created from 2008-07-25 to 2008-08-25 ))))))))))))))))))))))))))))))) . 2008-08-25 23:33 . 2008-08-25 23:34 <DIR> d-------- C:\Program Files\PowerStrip 2008-08-25 22:47 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-25 22:47 . 2008-03-03 18:21 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Program Files\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-25 21:44 . 2008-08-25 23:51 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-08-25 21:44 . 2008-08-25 18:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-08-25 21:44 . 2008-08-25 21:44 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-25 21:35 . 2008-08-22 17:22 3,262 --a------ C:\WINDOWS\system32\2.ico 2008-08-25 21:31 . 2008-08-25 18:48 3,262 --a------ C:\WINDOWS\system32\1.ico 2008-08-25 21:30 . 2008-08-25 21:30 <DIR> d-------- C:\Program Files\7-Zip 2008-08-25 21:06 . 2008-08-25 23:21 <DIR> d-------- C:\Downloads 2008-08-25 19:35 . 2008-08-25 19:35 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-08-25 19:35 . 2008-08-25 19:35 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-08-25 19:35 . 2008-08-25 19:35 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-08-25 19:31 . 2008-08-25 19:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-08-25 19:31 . 2006-08-15 07:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-08-25 19:29 . 2008-08-25 19:31 <DIR> d-------- C:\Program Files\Realtek 2008-08-25 19:11 . 2008-08-25 19:11 <DIR> d-------- C:\WINDOWS\ASUSInstAll 2008-08-25 19:03 . 2008-08-25 19:03 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Program Files\AMD 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\InstallShield 2008-08-25 19:01 . 2006-07-01 23:32 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-08-25 19:00 . 2008-08-25 19:33 22,421 --a------ C:\WINDOWS\Ascd_log.ini 2008-08-25 19:00 . 2008-08-25 19:00 22,093 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-25 19:00 . 2007-08-01 05:39 12,536 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-25 19:00 . 2004-08-13 20:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 19:08 --------- d-----w C:\Program Files\BitComet 2008-08-25 18:20 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu 2008-08-25 18:18 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-25 18:16 --------- d-----w C:\Program Files\Winamp 2008-08-25 18:16 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Winamp 2008-08-25 17:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 17:29 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-25 17:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-25 16:56 --------- d-----w C:\Program Files\My Company Name 2008-08-25 16:49 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-25 16:47 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-11 10:25 13520896] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-03-11 10:25 86016] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072] "PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-04-03 21:30 727288] "nwiz"="nwiz.exe" [2008-03-11 10:25 1626112 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\Gry\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9206:TCP"= 9206:TCP:BitComet 9206 TCP "9206:UDP"= 9206:UDP:BitComet 9206 UDP R3 PSTRIP;PSTRIP;C:\WINDOWS\system32\DRIVERS\PSTRIP.SYS [2007-07-15 03:37] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 19:30] *Newly Created Service* - PSTRIP . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-25 23:51:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-25 23:52:14 ComboFix-quarantined-files.txt 2008-08-25 21:52:13 Pre-Run: 10,543,177,728 bajtów wolnych Post-Run: 10,543,898,624 bajtów wolnych 119

**Posty:** 8001 · przez **Okocza** 25 Sie 2008, 23:55

dryn3k, log w tagi...

**Posty:** 26 · przez **dryn3k** 25 Sie 2008, 23:57

?? nie rozumiem ....

**Posty:** 8001 · przez **Okocza** 25 Sie 2008, 23:59

dryn3k, wstaw log w tagi... zaznacz cały log w edycji posta i kliknij przycisk "code"

**Posty:** 26 · przez **dryn3k** 26 Sie 2008, 00:00

Kod: Zaznacz wszystko: ComboFix 08-08-24.03 - user 2008-08-25 23:51:26.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1597 [GMT 2:00] Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\user\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\system32\kek.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\mpxa.exe C:\WINDOWS\system32\MSA.cpl . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\MSA.cpl . ((((((((((((((((((((((((( Files Created from 2008-07-25 to 2008-08-25 ))))))))))))))))))))))))))))))) . 2008-08-25 23:33 . 2008-08-25 23:34 <DIR> d-------- C:\Program Files\PowerStrip 2008-08-25 22:47 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-25 22:47 . 2008-03-03 18:21 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Program Files\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-25 21:44 . 2008-08-25 23:51 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-08-25 21:44 . 2008-08-25 18:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-08-25 21:44 . 2008-08-25 21:44 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-25 21:35 . 2008-08-22 17:22 3,262 --a------ C:\WINDOWS\system32\2.ico 2008-08-25 21:31 . 2008-08-25 18:48 3,262 --a------ C:\WINDOWS\system32\1.ico 2008-08-25 21:30 . 2008-08-25 21:30 <DIR> d-------- C:\Program Files\7-Zip 2008-08-25 21:06 . 2008-08-25 23:21 <DIR> d-------- C:\Downloads 2008-08-25 19:35 . 2008-08-25 19:35 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-08-25 19:35 . 2008-08-25 19:35 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-08-25 19:35 . 2008-08-25 19:35 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-08-25 19:31 . 2008-08-25 19:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-08-25 19:31 . 2006-08-15 07:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-08-25 19:29 . 2008-08-25 19:31 <DIR> d-------- C:\Program Files\Realtek 2008-08-25 19:11 . 2008-08-25 19:11 <DIR> d-------- C:\WINDOWS\ASUSInstAll 2008-08-25 19:03 . 2008-08-25 19:03 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Program Files\AMD 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\InstallShield 2008-08-25 19:01 . 2006-07-01 23:32 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-08-25 19:00 . 2008-08-25 19:33 22,421 --a------ C:\WINDOWS\Ascd_log.ini 2008-08-25 19:00 . 2008-08-25 19:00 22,093 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-25 19:00 . 2007-08-01 05:39 12,536 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-25 19:00 . 2004-08-13 20:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 19:08 --------- d-----w C:\Program Files\BitComet 2008-08-25 18:20 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu 2008-08-25 18:18 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-25 18:16 --------- d-----w C:\Program Files\Winamp 2008-08-25 18:16 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Winamp 2008-08-25 17:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 17:29 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-25 17:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-25 16:56 --------- d-----w C:\Program Files\My Company Name 2008-08-25 16:49 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-25 16:47 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-11 10:25 13520896] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-03-11 10:25 86016] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072] "PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-04-03 21:30 727288] "nwiz"="nwiz.exe" [2008-03-11 10:25 1626112 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\Gry\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9206:TCP"= 9206:TCP:BitComet 9206 TCP "9206:UDP"= 9206:UDP:BitComet 9206 UDP R3 PSTRIP;PSTRIP;C:\WINDOWS\system32\DRIVERS\PSTRIP.SYS [2007-07-15 03:37] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 19:30] *Newly Created Service* - PSTRIP . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-25 23:51:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-25 23:52:14 ComboFix-quarantined-files.txt 2008-08-25 21:52:13 Pre-Run: 10,543,177,728 bajtów wolnych Post-Run: 10,543,898,624 bajtów wolnych 119

Dodano 25.08.2008 23:01:20:

Kod: Zaznacz wszystko: ComboFix 08-08-24.03 - user 2008-08-25 23:51:26.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1597 [GMT 2:00] Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\user\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\system32\kek.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\mpxa.exe C:\WINDOWS\system32\MSA.cpl . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\rodqgpvlndk.dll C:\WINDOWS\rvoelbxt.exe C:\WINDOWS\system32\mpt.exe C:\WINDOWS\system32\MSA.cpl . ((((((((((((((((((((((((( Files Created from 2008-07-25 to 2008-08-25 ))))))))))))))))))))))))))))))) . 2008-08-25 23:33 . 2008-08-25 23:34 <DIR> d-------- C:\Program Files\PowerStrip 2008-08-25 22:47 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-25 22:47 . 2008-03-03 18:21 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Program Files\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-25 21:44 . 2008-08-25 23:51 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-08-25 21:44 . 2008-08-25 18:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-08-25 21:44 . 2008-08-25 21:44 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-25 21:35 . 2008-08-22 17:22 3,262 --a------ C:\WINDOWS\system32\2.ico 2008-08-25 21:31 . 2008-08-25 18:48 3,262 --a------ C:\WINDOWS\system32\1.ico 2008-08-25 21:30 . 2008-08-25 21:30 <DIR> d-------- C:\Program Files\7-Zip 2008-08-25 21:06 . 2008-08-25 23:21 <DIR> d-------- C:\Downloads 2008-08-25 19:35 . 2008-08-25 19:35 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-08-25 19:35 . 2008-08-25 19:35 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-08-25 19:35 . 2008-08-25 19:35 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-08-25 19:31 . 2008-08-25 19:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-08-25 19:31 . 2006-08-15 07:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-08-25 19:29 . 2008-08-25 19:31 <DIR> d-------- C:\Program Files\Realtek 2008-08-25 19:11 . 2008-08-25 19:11 <DIR> d-------- C:\WINDOWS\ASUSInstAll 2008-08-25 19:03 . 2008-08-25 19:03 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Program Files\AMD 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\InstallShield 2008-08-25 19:01 . 2006-07-01 23:32 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-08-25 19:00 . 2008-08-25 19:33 22,421 --a------ C:\WINDOWS\Ascd_log.ini 2008-08-25 19:00 . 2008-08-25 19:00 22,093 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-25 19:00 . 2007-08-01 05:39 12,536 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-25 19:00 . 2004-08-13 20:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 19:08 --------- d-----w C:\Program Files\BitComet 2008-08-25 18:20 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu 2008-08-25 18:18 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-25 18:16 --------- d-----w C:\Program Files\Winamp 2008-08-25 18:16 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Winamp 2008-08-25 17:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 17:29 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-25 17:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-25 16:56 --------- d-----w C:\Program Files\My Company Name 2008-08-25 16:49 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-25 16:47 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-11 10:25 13520896] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-03-11 10:25 86016] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072] "PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-04-03 21:30 727288] "nwiz"="nwiz.exe" [2008-03-11 10:25 1626112 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\Gry\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9206:TCP"= 9206:TCP:BitComet 9206 TCP "9206:UDP"= 9206:UDP:BitComet 9206 UDP R3 PSTRIP;PSTRIP;C:\WINDOWS\system32\DRIVERS\PSTRIP.SYS [2007-07-15 03:37] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 19:30] *Newly Created Service* - PSTRIP . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-25 23:51:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-25 23:52:14 ComboFix-quarantined-files.txt 2008-08-25 21:52:13 Pre-Run: 10,543,177,728 bajtów wolnych Post-Run: 10,543,898,624 bajtów wolnych 119

Dodano 25.08.2008 23:02:03:
takie cos

) hehe nie załapałem sorki no to się czegoś nauczyłem

**Posty:** 684 · przez **djarta** 26 Sie 2008, 08:44

Jeszcze są dwie "sierotki" do usunięcia

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\2.ico C:\WINDOWS\system32\1.ico

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

====================
K.

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 09:14

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 684 · przez **djarta** 26 Sie 2008, 09:15

okocza, nie zawcześnie?To na koniec, przecież jeszcze syf jest.

================
K.

**Posty:** 26 · przez **dryn3k** 26 Sie 2008, 15:34

musiałem iść spać, robota, teraz skończe czyścić

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 15:35

dryn3k, wstaw log z CF po tym co djarta Ci kazał zrobić.

**Posty:** 26 · przez **dryn3k** 26 Sie 2008, 15:58

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - user 2008-08-26 15:56:51.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1645 [GMT 2:00] Running from: C:\Documents and Settings\user\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-26 11:45 . 2008-08-26 11:45 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-08-26 11:39 . 2008-08-26 11:44 <DIR> d-------- C:\Program Files\DivX 2008-08-26 00:51 . 2008-08-26 00:51 <DIR> d-------- C:\Program Files\Google 2008-08-25 23:33 . 2008-08-26 15:45 <DIR> d-------- C:\Program Files\PowerStrip 2008-08-25 22:47 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-25 22:47 . 2008-03-03 18:21 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Program Files\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\ESET 2008-08-25 22:46 . 2008-08-25 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-25 21:44 . 2008-08-26 15:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-08-25 21:44 . 2008-08-25 18:45 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-08-25 21:44 . 2008-08-25 20:39 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-08-25 21:44 . 2008-08-25 21:44 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-25 21:38 . 2008-08-25 21:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-25 21:30 . 2008-08-25 21:30 <DIR> d-------- C:\Program Files\7-Zip 2008-08-25 21:06 . 2008-08-26 11:36 <DIR> d-------- C:\Downloads 2008-08-25 19:35 . 2008-08-25 19:35 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-08-25 19:35 . 2008-08-25 19:35 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-08-25 19:35 . 2008-08-25 19:35 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-08-25 19:31 . 2008-08-25 19:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-08-25 19:31 . 2006-08-15 07:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-08-25 19:29 . 2008-08-25 19:31 <DIR> d-------- C:\Program Files\Realtek 2008-08-25 19:11 . 2008-08-25 19:11 <DIR> d-------- C:\WINDOWS\ASUSInstAll 2008-08-25 19:03 . 2008-08-25 19:03 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Program Files\AMD 2008-08-25 19:01 . 2008-08-25 19:01 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\InstallShield 2008-08-25 19:01 . 2006-07-01 23:32 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-08-25 19:00 . 2008-08-25 19:33 22,421 --a------ C:\WINDOWS\Ascd_log.ini 2008-08-25 19:00 . 2008-08-25 19:00 22,093 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-25 19:00 . 2007-08-01 05:39 12,536 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-25 19:00 . 2004-08-13 20:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys 2008-08-05 23:58 . 2008-08-05 23:58 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 19:08 --------- d-----w C:\Program Files\BitComet 2008-08-25 18:20 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu 2008-08-25 18:18 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-25 18:16 --------- d-----w C:\Program Files\Winamp 2008-08-25 18:16 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Winamp 2008-08-25 17:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 17:29 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-25 17:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-25 16:56 --------- d-----w C:\Program Files\My Company Name 2008-08-25 16:49 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-25 16:47 --------- d-----w C:\Program Files\Usługi online 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-11 10:25 13520896] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-03-11 10:25 86016] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip] --a------ 2008-04-03 21:30 727288 c:\Program Files\PowerStrip\PStrip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-03-11 10:25 1626112 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\Gry\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9206:TCP"= 9206:TCP:BitComet 9206 TCP "9206:UDP"= 9206:UDP:BitComet 9206 UDP R2 PStrip;PSTRIP;C:\WINDOWS\system32\DRIVERS\PSTRIP.SYS [2007-07-15 03:37] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 19:30] *Newly Created Service* - CATCHME . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\wjsbz8vh.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 15:57:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-26 15:57:48 ComboFix-quarantined-files.txt 2008-08-26 13:57:47 Pre-Run: 15,690,907,648 bajtów wolnych Post-Run: 15,680,376,832 bajtów wolnych 115

Dodano 26.08.2008 14:59:11:
aha no i nie wiem jak tego screena tutaj wstawić :oops:

Dodano 26.08.2008 15:04:04:
http://img.wklej.org/v/539275125SCREEN.JPG

**Posty:** 18165 · przez **wojtas** 26 Sie 2008, 17:18

jest ok .. mozesz odchaczyc ctfmon

**Posty:** 26 · przez **dryn3k** 26 Sie 2008, 17:55

dziękuje wszystkim za pomoc, serdecznie pozdrawiam

Kto jest na forum