nie moge otworzyc menedzer zadan

**Posty:** 139 · przez **Linus** 15 Maj 2008, 20:22

otoz dzis wchodze na kompa , i nie chce mi sie otworzyc menedzer zadan, wyskakuje informacja ze zostalo zablokowane przez administratora

log

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:20:24, on 2008-05-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\soundman.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\explorer.exe C:\Program Files\VentriloMIX\Ventrilo 2.1.4.exe C:\Program Files\Steam\steam.exe c:\program files\steam\steamapps\biol190\counter-strike\hl.exe C:\Program Files\Steam\GameOverlayUI.exe C:\Documents and Settings\Gizmo\Pulpit\hijack.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe, O1 - Hosts: 89.111.184.115 wiz2wix.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll O2 - BHO: e404 helper - {c03fd59d-9104-44b7-929a-9eaa0ba05211} - C:\Program Files\Helper\1210867930.dll O2 - BHO: (no name) - {ee547f34-75f9-48b4-ad01-ec5c0b97dc19} - C:\WINDOWS\system32\ddcDvsSI.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing) O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu801.exe 61A847B5BBF7281A329A284503996897C881250221C8670836AC4FA7C8833201749139 O4 - HKLM\..\Run: [78cbe9ef] rundll32.exe "C:\WINDOWS\system32\iusyqhrr.dll",b O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Systray] rundll32.exe sockins32.dll,RunMain O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt32.dll O20 - Winlogon Notify: wvUoLdcA - C:\WINDOWS\SYSTEM32\wvUoLdcA.dll O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing) O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 7210 bytes

**Posty:** 7956 · przez **Magik** 15 Maj 2008, 20:27

Kod: Zaznacz wszystko: O1 - Hosts: 89.111.184.115 wiz2wix.com O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll O2 - BHO: e404 helper - {c03fd59d-9104-44b7-929a-9eaa0ba05211} - C:\Program Files\Helper\1210867930.dll O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing) O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu801.exe 61A847B5BBF7281A329A284503996897C881250221C8670836AC4FA7C8833201749139 O4 - HKLM\..\Run: [78cbe9ef] rundll32.exe "C:\WINDOWS\system32\iusyqhrr.dll",b O4 - HKCU\..\Run: [Systray] rundll32.exe sockins32.dll,RunMain O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O20 - Winlogon Notify: WinNt32 - C:\WINDOWS\SYSTEM32\WinNt32.dll O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing)

Wszystkow w trybie awaryjnym, wylaczone przywracanie systemu

**Posty:** 18165 · przez **wojtas** 15 Maj 2008, 20:27

Poczytaj o zasadach wstawiania logów na forum

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 139 · przez **Linus** 15 Maj 2008, 23:21

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:13, on 2008-05-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\CF25417.exe C:\WINDOWS\soundman.exe C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\ComboFix\Catchme.tmp C:\ComboFix\Catchme.tmp C:\ComboFix\Catchme.tmp C:\WINDOWS\VFind.exe C:\Documents and Settings\Gizmo\Pulpit\hijack.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe, O1 - Hosts: 89.111.184.115 wiz2wix.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 6550 bytes

combo fix

Kod: Zaznacz wszystko: ComboFix 08-05-12.1 - Gizmo 2008-05-15 22:51:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.465 [GMT 2:00] Running from: C:\Documents and Settings\Gizmo\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\d.exe C:\Documents and Settings\Gizmo\~tmp1174.exe C:\Program Files\ActivationManager C:\Program Files\ActivationManager\Uninstall.exe C:\Program Files\Helper C:\Program Files\Internet Explorer\setupapi.dll C:\WINDOWS\mrofinu801.exe C:\WINDOWS\system32\crypts.dll C:\WINDOWS\system32\ddcDvsSI.dll C:\WINDOWS\system32\drivers\tcpsr.sys C:\WINDOWS\system32\ISsvDcdd.ini C:\WINDOWS\system32\ISsvDcdd.ini2 C:\WINDOWS\system32\iusyqhrr.dll C:\WINDOWS\system32\rrhqysui.ini C:\WINDOWS\system32\sft.res C:\WINDOWS\system32\WinNt32.dll C:\WINDOWS\system32\wsnpoem\audio.dll C:\WINDOWS\system32\wvUoLdcA.dll C:\WINDOWS\system32\wsnpoem\video.dll . . . . failed to delete . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TCPSR -------\Service_tcpsr ((((((((((((((((((((((((( Files Created from 2008-04-15 to 2008-05-15 ))))))))))))))))))))))))))))))) . 2008-05-15 22:39 . 2008-05-15 22:39 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-05-15 22:31 . 2008-05-15 23:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-15 22:31 . 2008-05-15 22:31 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-15 22:27 . 2008-05-15 23:07 12,288 --a------ C:\WINDOWS\system32\WinNt32.dl_ 2008-05-15 18:11 . 2008-05-15 23:10 62,386 --a------ C:\WINDOWS\system32\nzqtegh.sys 2008-05-15 18:11 . 2008-05-15 18:11 57,624 --------- C:\d1.exe 2008-05-15 18:11 . 2008-05-15 18:11 32,768 --a------ C:\WINDOWS\system32\sockins32.dll 2008-05-15 18:11 . 2008-05-15 18:11 578 --a------ C:\WINDOWS\index.html 2008-05-15 18:10 . 2008-05-15 18:10 80,384 --a------ C:\hhownkx.exe 2008-05-15 18:10 . 2008-05-15 18:10 66,048 --a------ C:\rtmu.exe 2008-05-15 18:10 . 2008-05-15 23:07 27,136 --a------ C:\WINDOWS\system32\drivers\Swa47.sys 2008-05-15 18:10 . 2008-05-15 18:10 2 --a------ C:\2026629440 2008-05-12 20:18 . 2008-05-12 20:18 <DIR> d-------- C:\Program Files\ATITool 2008-05-12 16:54 . 2008-05-12 16:54 22,328 --a------ C:\Documents and Settings\Gizmo\Dane aplikacji\PnkBstrK.sys 2008-05-12 16:54 . 2008-05-12 16:54 319 --a------ C:\WINDOWS\game.ini 2008-05-12 16:41 . 2008-05-12 16:41 <DIR> d-------- C:\Program Files\Activision 2008-05-10 21:29 . 2008-05-10 21:30 <DIR> d-------- C:\Program Files\Headshot Player 2008-05-09 16:18 . 2008-05-09 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TrackMania 2008-05-06 19:44 . 2008-05-06 19:45 <DIR> d-------- C:\Program Files\POV-Ray for Windows v3.6 2008-05-03 16:15 . 2008-05-03 16:37 <DIR> d-------- C:\Program Files\rFactor 2008-05-02 14:33 . 2008-05-02 14:33 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2008-04-30 02:58 . 2008-04-30 02:58 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-04-29 17:57 . 2008-04-29 17:57 <DIR> d-------- C:\Deckard 2008-04-29 17:39 . 2008-04-29 17:39 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-29 17:36 . 2008-05-15 22:29 <DIR> d-------- C:\SDFix . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 19:30 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-10-02 19:30 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-10-02 19:30 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-15 19:50 --------- d-----w C:\Program Files\Steam 2008-05-15 15:32 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Skype 2008-05-15 15:13 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\mIRC 2008-05-15 15:06 --------- d-----w C:\Program Files\mIRC 2008-05-15 13:21 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\MegauploadToolbar 2008-05-14 18:20 --------- d-----w C:\Program Files\HLSW 2008-05-14 12:53 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Xfire 2008-05-14 11:33 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\teamspeak2 2008-05-13 13:25 --------- d-----w C:\Program Files\Xfire 2008-05-12 15:45 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-12 14:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-05-12 14:54 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-12 14:54 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-09 14:17 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Hamachi 2008-04-13 18:31 --------- d-----w C:\Program Files\QuickTime 2008-04-13 18:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2008-04-13 18:30 --------- d-----w C:\Program Files\Kodak 2008-04-13 18:30 --------- d-----w C:\Program Files\Common Files\Kodak 2008-04-13 18:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-04-04 17:45 --------- d-----w C:\Program Files\Notepad++ 2008-04-04 15:02 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Notepad++ 2008-04-03 15:36 --------- d-----w C:\Program Files\lg_fwupdate 2008-04-02 12:57 --------- d-----w C:\Program Files\FlashGet 2008-03-27 17:40 --------- d-----w C:\Program Files\Gadu-Gadu 2008-03-23 10:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-03-17 17:06 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-17 16:03 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Corel 2008-03-17 16:00 --------- d-----w C:\Program Files\Common Files\Protexis 2008-03-17 15:59 --------- d-----w C:\Program Files\Corel 2008-03-17 15:59 --------- d-----w C:\Program Files\Common Files\Corel 2008-03-17 15:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2008-03-15 16:19 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\MargonemMapki 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ------- Sigcheck ------- 2002-08-29 02:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2004-08-04 00:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 10:50 4112384] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-04-13 20:31 77824] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 17:15 221184] "SoundMan"="soundman.exe" [2001-12-20 03:37 124416 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2005-11-04 15:04:48 176128] KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\\WINDOWS\\SYSTEM32\\Userinit.exe,C:\\WINDOWS\\system32\\ntos.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Swa47.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-08-29 17:09 171464 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --------- 2006-11-02 08:55 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a------ 2005-04-12 11:11 229376 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] --a------ 2007-11-04 13:03 949376 C:\Program Files\Eset\nod32kui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2004-07-12 10:50 4112384 C:\WINDOWS\System32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2004-07-12 10:50 81920 C:\WINDOWS\System32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK] -ra------ 2003-12-30 11:44 24576 C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2004-07-12 10:50 843776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2007-10-23 02:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ProtexisLicensing"=2 (0x2) "PnkBstrA"=2 (0x2) "NOD32krn"=2 (0x2) "LightScribeService"=2 (0x2) "InCDsrv"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "<NO NAME>"= :svhost "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Tibia\\Tibia.exe"= "C:\\Program Files\\Steam\\steamapps\\biol190\\counter-strike\\hl.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Documents and Settings\\Gizmo\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "C:\\Program Files\\Sierra\\Empire Earth Gold\\The Art of Conquest\\EE-AOC.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "C:\\Program Files\\HLSW\\hlsw.exe"= "C:\\Program Files\\Steam\\steam.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Documents and Settings\\Gizmo\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"= "C:\\Program Files\\rFactor\\rFactor.exe"= "C:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Swa47;Swa47;C:\WINDOWS\system32\Drivers\Swa47.sys [2008-05-15 23:07] S3 XDva030;XDva030;C:\WINDOWS\system32\XDva030.sys [] S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1340441-8ac7-11dc-8f54-00304f28bfc4}] \Shell\AutoRun\command - H:\LaunchU3.exe -a *Newly Created Service* - tcpsr [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}] rundll32 sockins32.dll,InitModule . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-15 23:09:02 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\ntos.exe 395776 bytes executable C:\WINDOWS\system32\wsnpoem scan completed successfully hidden files: 2 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\WinNt32.dll -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe . ************************************************************************** . Completion time: 2008-05-15 23:20:00 - machine was rebooted [Gizmo] ComboFix-quarantined-files.txt 2008-05-15 21:19:51 Pre-Run: 11,391,164,416 bajtów wolnych Post-Run: 12,405,645,312 bajt˘w wolnych 254

**Posty:** 7956 · przez **Magik** 16 Maj 2008, 00:11

Witam
HJT

Kod: Zaznacz wszystko: O1 - Hosts: 89.111.184.115 wiz2wix.com O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

Combo, tego pliku nie mogl usunac

Kod: Zaznacz wszystko: C:\WINDOWS\system32\wsnpoem\video.dll . . . . failed to delete

zrob to recznie w trybie awaryjnym

+to co chlopacy zalecaja za akzdym razem czyli
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

powered by wojtas and okocza

Pozdro

**Posty:** 139 · przez **Linus** 16 Maj 2008, 20:59

nic nie pomoglo

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:59:06, on 2008-05-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\soundman.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\VentriloMIX\Ventrilo 2.1.4.exe C:\Program Files\Steam\steam.exe c:\program files\steam\steamapps\biol190\counter-strike\hl.exe C:\Program Files\Steam\GameOverlayUI.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Gizmo\Pulpit\hijack.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe, O1 - Hosts: 89.111.184.115 wiz2wix.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (ehttpsrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 6093 bytes

uzycie pamieci okolo 670 ramu ... scina mi komp jak...

skanowalem nodem32 usunol 11 wirow ale to co najbardziej muli kompa zostalo...

**Posty:** 8001 · przez **Okocza** 16 Maj 2008, 21:05

Linus napisał(a):F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
O1 - Hosts: 89.111.184.115 wiz2wix.com

to usuwasz w hijacku... dodatkowo daj log z combofixa...

**Posty:** 139 · przez **Linus** 16 Maj 2008, 22:45

hj nie moze tego wykasowac...

**Posty:** 8001 · przez **Okocza** 16 Maj 2008, 22:51

log z combofixa zamieść - jakiś syf musiał się poważniejszy dostać.

**Posty:** 139 · przez **Linus** 17 Maj 2008, 10:10

Kod: Zaznacz wszystko: ComboFix 08-05-12.1 - Gizmo 2008-05-17 22:51:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.465 [GMT 2:00] Running from: C:\Documents and Settings\Gizmo\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\d.exe C:\Documents and Settings\Gizmo\~tmp1174.exe C:\Program Files\ActivationManager C:\Program Files\ActivationManager\Uninstall.exe C:\Program Files\Helper C:\Program Files\Internet Explorer\setupapi.dll C:\WINDOWS\mrofinu801.exe C:\WINDOWS\system32\crypts.dll C:\WINDOWS\system32\ddcDvsSI.dll C:\WINDOWS\system32\drivers\tcpsr.sys C:\WINDOWS\system32\ISsvDcdd.ini C:\WINDOWS\system32\ISsvDcdd.ini2 C:\WINDOWS\system32\iusyqhrr.dll C:\WINDOWS\system32\rrhqysui.ini C:\WINDOWS\system32\sft.res C:\WINDOWS\system32\WinNt32.dll C:\WINDOWS\system32\wsnpoem\audio.dll C:\WINDOWS\system32\wvUoLdcA.dll C:\WINDOWS\system32\wsnpoem\video.dll . . . . failed to delete . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TCPSR -------\Service_tcpsr ((((((((((((((((((((((((( Files Created from 2008-04-15 to 2008-05-15 ))))))))))))))))))))))))))))))) . 2008-05-15 22:39 . 2008-05-15 22:39 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-05-15 22:31 . 2008-05-15 23:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-15 22:31 . 2008-05-15 22:31 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-15 22:27 . 2008-05-15 23:07 12,288 --a------ C:\WINDOWS\system32\WinNt32.dl_ 2008-05-15 18:11 . 2008-05-15 23:10 62,386 --a------ C:\WINDOWS\system32\nzqtegh.sys 2008-05-15 18:11 . 2008-05-15 18:11 57,624 --------- C:\d1.exe 2008-05-15 18:11 . 2008-05-15 18:11 32,768 --a------ C:\WINDOWS\system32\sockins32.dll 2008-05-15 18:11 . 2008-05-15 18:11 578 --a------ C:\WINDOWS\index.html 2008-05-15 18:10 . 2008-05-15 18:10 80,384 --a------ C:\hhownkx.exe 2008-05-15 18:10 . 2008-05-15 18:10 66,048 --a------ C:\rtmu.exe 2008-05-15 18:10 . 2008-05-15 23:07 27,136 --a------ C:\WINDOWS\system32\drivers\Swa47.sys 2008-05-15 18:10 . 2008-05-15 18:10 2 --a------ C:\2026629440 2008-05-12 20:18 . 2008-05-12 20:18 <DIR> d-------- C:\Program Files\ATITool 2008-05-12 16:54 . 2008-05-12 16:54 22,328 --a------ C:\Documents and Settings\Gizmo\Dane aplikacji\PnkBstrK.sys 2008-05-12 16:54 . 2008-05-12 16:54 319 --a------ C:\WINDOWS\game.ini 2008-05-12 16:41 . 2008-05-12 16:41 <DIR> d-------- C:\Program Files\Activision 2008-05-10 21:29 . 2008-05-10 21:30 <DIR> d-------- C:\Program Files\Headshot Player 2008-05-09 16:18 . 2008-05-09 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TrackMania 2008-05-06 19:44 . 2008-05-06 19:45 <DIR> d-------- C:\Program Files\POV-Ray for Windows v3.6 2008-05-03 16:15 . 2008-05-03 16:37 <DIR> d-------- C:\Program Files\rFactor 2008-05-02 14:33 . 2008-05-02 14:33 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2008-04-30 02:58 . 2008-04-30 02:58 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-04-29 17:57 . 2008-04-29 17:57 <DIR> d-------- C:\Deckard 2008-04-29 17:39 . 2008-04-29 17:39 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-29 17:36 . 2008-05-15 22:29 <DIR> d-------- C:\SDFix . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 19:30 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-10-02 19:30 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-10-02 19:30 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-15 19:50 --------- d-----w C:\Program Files\Steam 2008-05-15 15:32 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Skype 2008-05-15 15:13 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\mIRC 2008-05-15 15:06 --------- d-----w C:\Program Files\mIRC 2008-05-15 13:21 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\MegauploadToolbar 2008-05-14 18:20 --------- d-----w C:\Program Files\HLSW 2008-05-14 12:53 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Xfire 2008-05-14 11:33 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\teamspeak2 2008-05-13 13:25 --------- d-----w C:\Program Files\Xfire 2008-05-12 15:45 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-12 14:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-05-12 14:54 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-12 14:54 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-09 14:17 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Hamachi 2008-04-13 18:31 --------- d-----w C:\Program Files\QuickTime 2008-04-13 18:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2008-04-13 18:30 --------- d-----w C:\Program Files\Kodak 2008-04-13 18:30 --------- d-----w C:\Program Files\Common Files\Kodak 2008-04-13 18:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-04-04 17:45 --------- d-----w C:\Program Files\Notepad++ 2008-04-04 15:02 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Notepad++ 2008-04-03 15:36 --------- d-----w C:\Program Files\lg_fwupdate 2008-04-02 12:57 --------- d-----w C:\Program Files\FlashGet 2008-03-27 17:40 --------- d-----w C:\Program Files\Gadu-Gadu 2008-03-23 10:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-03-17 17:06 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-17 16:03 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Corel 2008-03-17 16:00 --------- d-----w C:\Program Files\Common Files\Protexis 2008-03-17 15:59 --------- d-----w C:\Program Files\Corel 2008-03-17 15:59 --------- d-----w C:\Program Files\Common Files\Corel 2008-03-17 15:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2008-03-15 16:19 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\MargonemMapki 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ------- Sigcheck ------- 2002-08-29 02:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2004-08-04 00:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 10:50 4112384] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-04-13 20:31 77824] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 17:15 221184] "SoundMan"="soundman.exe" [2001-12-20 03:37 124416 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2005-11-04 15:04:48 176128] KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\\WINDOWS\\SYSTEM32\\Userinit.exe,C:\\WINDOWS\\system32\\ntos.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Swa47.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-08-29 17:09 171464 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --------- 2006-11-02 08:55 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a------ 2005-04-12 11:11 229376 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] --a------ 2007-11-04 13:03 949376 C:\Program Files\Eset\nod32kui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2004-07-12 10:50 4112384 C:\WINDOWS\System32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2004-07-12 10:50 81920 C:\WINDOWS\System32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK] -ra------ 2003-12-30 11:44 24576 C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2004-07-12 10:50 843776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2007-10-23 02:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ProtexisLicensing"=2 (0x2) "PnkBstrA"=2 (0x2) "NOD32krn"=2 (0x2) "LightScribeService"=2 (0x2) "InCDsrv"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "<NO NAME>"= :svhost "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Tibia\\Tibia.exe"= "C:\\Program Files\\Steam\\steamapps\\biol190\\counter-strike\\hl.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Documents and Settings\\Gizmo\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "C:\\Program Files\\Sierra\\Empire Earth Gold\\The Art of Conquest\\EE-AOC.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "C:\\Program Files\\HLSW\\hlsw.exe"= "C:\\Program Files\\Steam\\steam.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Documents and Settings\\Gizmo\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"= "C:\\Program Files\\rFactor\\rFactor.exe"= "C:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Swa47;Swa47;C:\WINDOWS\system32\Drivers\Swa47.sys [2008-05-17 09:07] S3 XDva030;XDva030;C:\WINDOWS\system32\XDva030.sys [] S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1340441-8ac7-11dc-8f54-00304f28bfc4}] \Shell\AutoRun\command - H:\LaunchU3.exe -a *Newly Created Service* - tcpsr [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}] rundll32 sockins32.dll,InitModule . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-17 09:09:02 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\ntos.exe 395776 bytes executable C:\WINDOWS\system32\wsnpoem scan completed successfully hidden files: 2 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\WinNt32.dll -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe . ************************************************************************** . Completion time: 2008-05-17 9:00:12 - machine was rebooted [Gizmo] ComboFix-quarantined-files.txt 2008-05-17 8:19:51 Pre-Run: 11,391,164,416 bajtów wolnych Post-Run: 12,405,645,312 bajt˘w wolnych 254

pozatym gdy wlaczam WWDC
to wyskakuje na poczatku taki blad a pozniej sie program wlacza

[/list]

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 11:11

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\WinNt32.dl_ C:\d1.exe C:\WINDOWS\system32\sockins32.dll C:\hhownkx.exe C:\rtmu.exe Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1340441-8ac7-11dc-8f54-00304f28bfc4}] [-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66186F05-BBBB-4a39-864F-72D84615C679}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 139 · przez **Linus** 17 Maj 2008, 12:26

Kod: Zaznacz wszystko: ComboFix 08-05-15.3 - Gizmo 2008-05-17 12:06:34.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.471 [GMT 2:00] Running from: C:\Documents and Settings\Gizmo\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Gizmo\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\d1.exe C:\hhownkx.exe C:\rtmu.exe C:\WINDOWS\system32\sockins32.dll C:\WINDOWS\system32\WinNt32.dl_ . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\tcpsr.sys C:\WINDOWS\system32\sockins32.dll C:\WINDOWS\system32\wsnpoem\audio.dll C:\WINDOWS\system32\wsnpoem\audio.dll.cla C:\WINDOWS\system32\wsnpoem\video.dll C:\WINDOWS\system32\wsnpoem\video.dll . . . . failed to delete . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_tcpsr -------\Service_tcpsr ((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))) . 2008-05-17 11:34 . 2008-05-17 11:34 <DIR> d-------- C:\VundoFix Backups 2008-05-17 11:33 . 2008-05-17 12:01 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-05-17 11:22 . 2008-05-17 11:27 1,470 --a------ C:\WINDOWS\system32\tmp.reg 2008-05-17 11:21 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-17 11:21 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-17 11:21 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-17 11:21 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-17 11:20 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-17 11:20 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-17 11:20 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-05-17 11:20 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-16 15:36 . 2008-05-16 15:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-05-15 22:39 . 2008-05-15 22:39 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-05-15 18:11 . 2008-05-17 12:16 62,386 --a------ C:\WINDOWS\system32\nzqtegh.sys 2008-05-15 18:11 . 2008-05-15 18:11 578 --a------ C:\WINDOWS\index.html 2008-05-15 18:10 . 2008-05-15 18:10 2 --a------ C:\2026629440 2008-05-12 20:18 . 2008-05-12 20:18 <DIR> d-------- C:\Program Files\ATITool 2008-05-12 16:54 . 2008-05-12 16:54 22,328 --a------ C:\Documents and Settings\Gizmo\Dane aplikacji\PnkBstrK.sys 2008-05-12 16:54 . 2008-05-12 16:54 319 --a------ C:\WINDOWS\game.ini 2008-05-12 16:41 . 2008-05-12 16:41 <DIR> d-------- C:\Program Files\Activision 2008-05-10 21:29 . 2008-05-10 21:30 <DIR> d-------- C:\Program Files\Headshot Player 2008-05-09 16:18 . 2008-05-09 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TrackMania 2008-05-06 19:44 . 2008-05-06 19:45 <DIR> d-------- C:\Program Files\POV-Ray for Windows v3.6 2008-05-03 16:15 . 2008-05-03 16:37 <DIR> d-------- C:\Program Files\rFactor 2008-05-02 14:33 . 2008-05-02 14:33 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2008-04-30 02:58 . 2008-04-30 02:58 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-04-29 17:39 . 2008-04-29 17:39 <DIR> d-------- C:\WINDOWS\ERUNT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 19:30 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-10-02 19:30 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-10-02 19:30 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-17 09:19 --------- d-----w C:\Program Files\Steam 2008-05-16 13:36 --------- d-----w C:\Program Files\ESET 2008-05-16 12:23 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\mIRC 2008-05-16 12:21 --------- d-----w C:\Program Files\mIRC 2008-05-15 15:32 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Skype 2008-05-15 13:21 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\MegauploadToolbar 2008-05-14 18:20 --------- d-----w C:\Program Files\HLSW 2008-05-14 12:53 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Xfire 2008-05-14 11:33 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\teamspeak2 2008-05-13 13:25 --------- d-----w C:\Program Files\Xfire 2008-05-12 15:45 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-12 14:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-05-12 14:54 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-12 14:54 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-09 14:17 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Hamachi 2008-04-13 18:31 --------- d-----w C:\Program Files\QuickTime 2008-04-13 18:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2008-04-13 18:30 --------- d-----w C:\Program Files\Kodak 2008-04-13 18:30 --------- d-----w C:\Program Files\Common Files\Kodak 2008-04-13 18:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-04-04 17:45 --------- d-----w C:\Program Files\Notepad++ 2008-04-04 15:02 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Notepad++ 2008-04-03 15:36 --------- d-----w C:\Program Files\lg_fwupdate 2008-04-02 12:57 --------- d-----w C:\Program Files\FlashGet 2008-03-27 17:40 --------- d-----w C:\Program Files\Gadu-Gadu 2008-03-23 10:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-03-21 17:56 --------- d-----w C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2008-03-17 17:06 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-17 16:03 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Corel 2008-03-17 16:00 --------- d-----w C:\Program Files\Common Files\Protexis 2008-03-17 15:59 --------- d-----w C:\Program Files\Corel 2008-03-17 15:59 --------- d-----w C:\Program Files\Common Files\Corel 2008-03-17 15:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ------- Sigcheck ------- 2002-08-29 02:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2004-08-04 00:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 10:50 4112384] "SoundMan"="soundman.exe" [2001-12-20 03:37 124416 C:\WINDOWS\soundman.exe] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Swa47.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^KODAK Software Updater.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\KODAK Software Updater.lnk backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-08-29 17:09 171464 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --------- 2006-11-02 08:55 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-02-16 17:15 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a------ 2005-04-12 11:11 229376 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] C:\Program Files\Eset\nod32kui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2004-07-12 10:50 4112384 C:\WINDOWS\System32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2004-07-12 10:50 81920 C:\WINDOWS\System32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK] -ra------ 2003-12-30 11:44 24576 C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2004-07-12 10:50 843776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2007-10-23 02:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-04-13 20:31 77824 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ProtexisLicensing"=2 (0x2) "PnkBstrA"=2 (0x2) "NOD32krn"=2 (0x2) "LightScribeService"=2 (0x2) "InCDsrv"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "<NO NAME>"= :svhost "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Tibia\\Tibia.exe"= "C:\\Program Files\\Steam\\steamapps\\biol190\\counter-strike\\hl.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Documents and Settings\\Gizmo\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "C:\\Program Files\\Sierra\\Empire Earth Gold\\The Art of Conquest\\EE-AOC.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\HLSW\\hlsw.exe"= "C:\\Program Files\\Steam\\steam.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Documents and Settings\\Gizmo\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"= "C:\\Program Files\\rFactor\\rFactor.exe"= "C:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52] S0 Swa47;Swa47;C:\WINDOWS\system32\Drivers\Swa47.sys [] S3 XDva030;XDva030;C:\WINDOWS\system32\XDva030.sys [] S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys [] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-17 12:14:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\ntos.exe 395776 bytes executable C:\WINDOWS\system32\wsnpoem scan completed successfully hidden files: 2 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Gizmo\Pulpit\hijack.exe C:\Program Files\Mozilla Firefox\firefox.exe . ************************************************************************** . Completion time: 2008-05-17 12:24:13 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-17 10:24:05 Pre-Run: 12,276,928,512 bajtów wolnych Post-Run: 12,311,109,632 bajt˘w wolnych 245

jeszcze nod mi blokuje jakies ip
screen

hjt

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:29:33, on 2008-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\soundman.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Gizmo\Pulpit\hijack.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (ehttpsrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 5533 bytes

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 12:37

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

i tak jak poprzednio przeciągasz na CF i czekasz...

to fixujesz w hijacku - w razie gdyby plik pozostał to ręcznie z dysku pogrubiony.

Linus napisał(a):F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe

tylko uważaj żeby nic więcej nie usunać z katalogu system32...

potem świerzy log z CF + HiJacka (w tej kolejności odpalaj)

**Posty:** 139 · przez **Linus** 17 Maj 2008, 12:47

CF

Kod: Zaznacz wszystko: ComboFix 08-05-15.3 - Gizmo 2008-05-17 12:41:25.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.522 [GMT 2:00] Running from: C:\Documents and Settings\Gizmo\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\All Users\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ntos.exe C:\WINDOWS\system32\wsnpoem C:\WINDOWS\system32\wsnpoem\audio.dll C:\WINDOWS\system32\wsnpoem\video.dll . ((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))) . 2008-05-17 12:43 . 2008-05-17 12:43 <DIR> d--hs---- C:\WINDOWS\system32\wsnpoem 2008-05-17 11:34 . 2008-05-17 11:34 <DIR> d-------- C:\VundoFix Backups 2008-05-17 11:33 . 2008-05-17 12:01 0 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 2008-05-17 11:22 . 2008-05-17 11:27 1,470 --a------ C:\WINDOWS\system32\tmp.reg 2008-05-17 11:21 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-17 11:21 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-17 11:21 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-17 11:21 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-17 11:20 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-17 11:20 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-17 11:20 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-05-17 11:20 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-16 15:36 . 2008-05-16 15:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-05-15 22:39 . 2008-05-15 22:39 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-05-15 18:11 . 2008-05-17 12:43 62,386 --a------ C:\WINDOWS\system32\nzqtegh.sys 2008-05-15 18:11 . 2008-05-15 18:11 578 --a------ C:\WINDOWS\index.html 2008-05-15 18:10 . 2008-05-15 18:10 2 --a------ C:\2026629440 2008-05-12 20:18 . 2008-05-12 20:18 <DIR> d-------- C:\Program Files\ATITool 2008-05-12 16:54 . 2008-05-12 16:54 22,328 --a------ C:\Documents and Settings\Gizmo\Dane aplikacji\PnkBstrK.sys 2008-05-12 16:54 . 2008-05-12 16:54 319 --a------ C:\WINDOWS\game.ini 2008-05-12 16:41 . 2008-05-12 16:41 <DIR> d-------- C:\Program Files\Activision 2008-05-10 21:29 . 2008-05-10 21:30 <DIR> d-------- C:\Program Files\Headshot Player 2008-05-09 16:18 . 2008-05-09 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TrackMania 2008-05-06 19:44 . 2008-05-06 19:45 <DIR> d-------- C:\Program Files\POV-Ray for Windows v3.6 2008-05-03 16:15 . 2008-05-03 16:37 <DIR> d-------- C:\Program Files\rFactor 2008-05-02 14:33 . 2008-05-02 14:33 <DIR> d-------- C:\Program Files\TibiaCam TV Lite 2008-04-30 02:58 . 2008-04-30 02:58 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-04-29 17:39 . 2008-04-29 17:39 <DIR> d-------- C:\WINDOWS\ERUNT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-02 19:30 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-10-02 19:30 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-10-02 19:30 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-17 09:19 --------- d-----w C:\Program Files\Steam 2008-05-16 13:36 --------- d-----w C:\Program Files\ESET 2008-05-16 12:23 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\mIRC 2008-05-16 12:21 --------- d-----w C:\Program Files\mIRC 2008-05-15 15:32 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Skype 2008-05-15 13:21 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\MegauploadToolbar 2008-05-14 18:20 --------- d-----w C:\Program Files\HLSW 2008-05-14 12:53 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Xfire 2008-05-14 11:33 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\teamspeak2 2008-05-13 13:25 --------- d-----w C:\Program Files\Xfire 2008-05-12 15:45 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-12 14:54 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-05-12 14:54 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-12 14:54 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-09 14:17 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Hamachi 2008-04-13 18:31 --------- d-----w C:\Program Files\QuickTime 2008-04-13 18:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2008-04-13 18:30 --------- d-----w C:\Program Files\Kodak 2008-04-13 18:30 --------- d-----w C:\Program Files\Common Files\Kodak 2008-04-13 18:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-04-04 17:45 --------- d-----w C:\Program Files\Notepad++ 2008-04-04 15:02 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Notepad++ 2008-04-03 15:36 --------- d-----w C:\Program Files\lg_fwupdate 2008-04-02 12:57 --------- d-----w C:\Program Files\FlashGet 2008-03-27 17:40 --------- d-----w C:\Program Files\Gadu-Gadu 2008-03-23 10:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-03-21 17:56 --------- d-----w C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2008-03-17 17:06 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-17 16:03 --------- d-----w C:\Documents and Settings\Gizmo\Dane aplikacji\Corel 2008-03-17 16:00 --------- d-----w C:\Program Files\Common Files\Protexis 2008-03-17 15:59 --------- d-----w C:\Program Files\Corel 2008-03-17 15:59 --------- d-----w C:\Program Files\Common Files\Corel 2008-03-17 15:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ------- Sigcheck ------- 2002-08-29 02:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2004-08-04 00:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-12 10:50 4112384] "SoundMan"="soundman.exe" [2001-12-20 03:37 124416 C:\WINDOWS\soundman.exe] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Swa47.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^KODAK Software Updater.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\KODAK Software Updater.lnk backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-08-29 17:09 171464 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --------- 2006-11-02 08:55 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-02-16 17:15 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a------ 2005-04-12 11:11 229376 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] C:\Program Files\Eset\nod32kui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2004-07-12 10:50 4112384 C:\WINDOWS\System32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2004-07-12 10:50 81920 C:\WINDOWS\System32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK] -ra------ 2003-12-30 11:44 24576 C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2004-07-12 10:50 843776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2007-10-23 02:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-04-13 20:31 77824 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ProtexisLicensing"=2 (0x2) "PnkBstrA"=2 (0x2) "NOD32krn"=2 (0x2) "LightScribeService"=2 (0x2) "InCDsrv"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "<NO NAME>"= :svhost "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Tibia\\Tibia.exe"= "C:\\Program Files\\Steam\\steamapps\\biol190\\counter-strike\\hl.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Documents and Settings\\Gizmo\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "C:\\Program Files\\Sierra\\Empire Earth Gold\\The Art of Conquest\\EE-AOC.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\HLSW\\hlsw.exe"= "C:\\Program Files\\Steam\\steam.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Documents and Settings\\Gizmo\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"= "C:\\Program Files\\rFactor\\rFactor.exe"= "C:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52] S0 Swa47;Swa47;C:\WINDOWS\system32\Drivers\Swa47.sys [] S3 XDva030;XDva030;C:\WINDOWS\system32\XDva030.sys [] S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys [] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-17 12:43:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-17 12:44:44 ComboFix-quarantined-files.txt 2008-05-17 10:44:16 ComboFix2.txt 2008-05-17 10:24:16 Pre-Run: 12,298,694,656 bajtów wolnych Post-Run: 12,282,662,912 bajtów wolnych 221

hjt

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:46:11, on 2008-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\soundman.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Gizmo\Pulpit\hijack.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (ehttpsrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 5564 bytes

cos mocnego siedzi bo hjt dalej nie moze tego wpisu usunac , a info ze blokuje adres caly czas wyskakuje

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 12:50

Linus napisał(a):cos mocnego siedzi bo hjt dalej nie moze tego wpisu usunac

a robisz to w awaryjnym z wyłączonym przywracaniem ??

co do menedżera... otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=dword:00000000 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=dword:00000000 "**del.DisableTaskMgr"=" " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "DisableTaskMgr"=dword:00000000

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

**Posty:** 139 · przez **Linus** 17 Maj 2008, 12:54

spokojnie spokojnie ja juz to zrobilem dawno , odrazu jak odblokowalem sobie dostep do regedit;p , tak robie to w awaryjnym , z wylaczonym

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 12:55

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

**Posty:** 139 · przez **Linus** 17 Maj 2008, 13:19

Clear

**Posty:** 8001 · przez **Okocza** 17 Maj 2008, 13:20

okocza napisał(a):wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

nie moge otworzyc menedzer zadan

nie moge otworzyc menedzer zadan

Kto jest na forum