nowy system ... kupa śmieci

**Posty:** 9 · przez **s_poon** 11 Cze 2007, 20:34

witam

ostanio trzeba bylo odswiezyc system ... jednak nie zdazylem poinstalowac wszystkiego
co trzeba zeby bezpiecznie korzystac z kompa

na golasa wrzucilem SP2 i instal noda32

jakis syf pojawil sie nawet w pamieci operacyjnej

pozostalo mi tylko wkleic loga i prosiac o analize wzglednie czynnosci jakie nalezy wykonac aby bylo wszystko dobrze

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:44:58, on 2007-06-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cisvc.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\j3221438.exe C:\Program Files\Mozilla Firefox 2 Beta 1\firefox.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\spoon\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\jdlfodsb.dll",realset O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181160956531 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181160849718 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j3221438.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

**Posty:** 18165 · przez **wojtas** 11 Cze 2007, 22:35

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy w awaryjnym

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem nowe logi z silenta oraz hijacka

Autor postu otrzymał pochwałę

**Posty:** 9 · przez **s_poon** 12 Cze 2007, 23:48

wszystko wykonane zgodnie z zaleceniami oraz wspomniane logi

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AtiTrayTools" = "C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe" ["Ray Adams"] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "AtiPTA" = "atiptaxx.exe" ["ATI Technologies, Inc."] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HEBT Agent" = "C:\WINDOWS\system32\Sys32\HEBT.exe" [null data] "GPLv3" = "rundll32.exe "C:\WINDOWS\system32\tkuavqxj.dll",realset" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll" ["BitComet"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real Alternative\rpshell.dll" ["RealNetworks, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager" -> {HKLM...CLSID} = "Sony Ericsson File Manager" \InProcServer32\(Default) = "C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}" = "Autodesk Drawing Preview" -> {HKLM...CLSID} = "ACTHUMBNAIL" \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll" ["Autodesk"] "{36A21736-36C2-4C11-8ACB-D4136F2B57BD}" = "Uchwyt nakładania ikony podpisu cyfrowego" -> {HKLM...CLSID} = "AcSignIcon" \InProcServer32\(Default) = "C:\WINDOWS\system32\AcSignIcon.dll" ["Autodesk"] "{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview" -> {HKLM...CLSID} = "ACDWFTHMBPRXY" \InProcServer32\(Default) = "C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcDwfThmbPrxy16.dll" ["Autodesk"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."] Default executables: -------------------- HKCU\Software\Classes\.scr\(Default) = "AutoCADScriptFile" <<!>> HKCU\Software\Classes\AutoCADScriptFile\shell\open\command\(Default) = ""C:\WINDOWS\system32\notepad.exe" "%1"" [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 17 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] PDFCreator\Driver = "pdfcmnnt.dll" [null data] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 111 seconds. ---------- (total run time: 185 seconds)

oraz:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:26:47, on 2007-06-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cisvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Mozilla Firefox 2 Beta 1\firefox.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\spoon\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: (no name) - {92A444D2-F945-4dd9-89A1-896A6C2D8D22} - (no file) O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\tkuavqxj.dll",realset O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181160956531 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181160849718 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j3221438.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

**Posty:** 18165 · przez **wojtas** 13 Cze 2007, 14:55

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

start>uruchom>cmd> wpisz:

sc stop DNSCacheReader

enter

sc delete DNSCacheReader

enter

O2 - BHO: (no name) - {92A444D2-F945-4dd9-89A1-896A6C2D8D22} - (no file)
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\tkuavqxj.dll",realset
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j3221438.exe (file missing)

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

potem nowy log z hijacka oraz z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 9 · przez **s_poon** 13 Cze 2007, 18:02

done ... i co dalej

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:17:57, on 2007-06-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe C:\WINDOWS\system32\devldr32.exe C:\Documents and Settings\spoon\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181160956531 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181160849718 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

Kod: Zaznacz wszystko: ComboFix 07-06-13.3 - C:\Documents and Settings\spoon\Pulpit\ComboFix.exe "spoon" - 2007-06-13 17:20:17 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\xpdx.sys ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\xpdx ((((((((((((((((((((((((( Files Created from 2007-05-13 to 2007-06-13 ))))))))))))))))))))))))))))))) 2007-06-13 17:19 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-12 21:08 <DIR> d-------- C:\VundoFix Backups 2007-06-12 20:36 1,690 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-11 19:38 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-06-11 19:38 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-06-11 19:38 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-06-11 19:24 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-06-10 22:19 <DIR> d-------- C:\Program Files\SkanerOnline 2007-06-08 15:00 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Pulpit 2007-06-08 14:28 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll 2007-06-08 14:28 <DIR> d-------- C:\Program Files\Athenasoft 2007-06-08 14:26 95,484 --a------ C:\WINDOWS\system32\drivers\KMM4XNT.SYS 2007-06-08 14:26 24,576 --a------ C:\WINDOWS\system32\KMM4XNTD.DLL 2007-06-08 12:01 <DIR> d-------- C:\Program Files\AnswerWorks 4.0 2007-06-08 11:58 <DIR> d-------- C:\Program Files\AutoCAD 2006 2007-06-08 11:58 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\Autodesk 2007-06-08 11:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Autodesk 2007-06-08 11:52 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared 2007-06-08 11:52 <DIR> d-------- C:\Program Files\Autodesk 2007-06-08 11:42 <DIR> d-------- C:\WINDOWS\system32\URTTemp 2007-06-08 11:41 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2007-06-08 11:27 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\ACD Systems 2007-06-08 11:26 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-06-08 11:26 <DIR> d-------- C:\Program Files\ACD Systems 2007-06-08 11:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ACD Systems 2007-06-08 08:55 <DIR> d-------- C:\Program Files\WinXP Manager 2007-06-08 01:23 <DIR> d-------- C:\Program Files\CWK 2007-06-08 01:11 <DIR> d--hs---- C:\WINDOWS\system32\Sys32 2007-06-08 00:56 <DIR> d-------- C:\Program Files\ToSearch 2007-06-07 18:46 <DIR> d-------- C:\Program Files\X Codec Pack 2007-06-07 17:52 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\AdobeUM 2007-06-07 13:06 90,800 -ra------ C:\WINDOWS\system32\drivers\se2Eunic.sys 2007-06-07 13:06 4,128 -ra------ C:\WINDOWS\system32\drivers\se2Ecr.sys 2007-06-07 11:23 88,688 -ra------ C:\WINDOWS\system32\drivers\SE2Emgmt.sys 2007-06-07 11:20 86,560 -ra------ C:\WINDOWS\system32\drivers\SE2Eobex.sys 2007-06-07 11:16 97,184 -ra------ C:\WINDOWS\system32\drivers\SE2Emdm.sys 2007-06-07 11:16 9,360 -ra------ C:\WINDOWS\system32\drivers\SE2Emdfl.sys 2007-06-07 11:16 6,240 -ra------ C:\WINDOWS\system32\drivers\SE2Ecmnt.sys 2007-06-07 11:16 6,240 -ra------ C:\WINDOWS\system32\drivers\SE2Ecm.sys 2007-06-07 11:14 61,600 -ra------ C:\WINDOWS\system32\drivers\SE2Ebus.sys 2007-06-07 11:14 5,872 -ra------ C:\WINDOWS\system32\drivers\SE2Ewhnt.sys 2007-06-07 11:14 5,872 -ra------ C:\WINDOWS\system32\drivers\se2Ewh.sys 2007-06-07 10:54 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-06-07 10:47 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\Gadu-Gadu 2007-06-07 10:44 <DIR> d-------- C:\DOCUME~1\spoon\Gadu-Gadu 2007-06-07 09:05 <DIR> d-------- C:\Program Files\Torrent Master 2007-06-07 09:03 <DIR> d-------- C:\Program Files\PDFCreator 2007-06-07 09:02 <DIR> d-------- C:\Program Files\Arjaloc 2007-06-07 08:56 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\GlarySoft 2007-06-07 08:55 <DIR> d-------- C:\Program Files\Registry Repair 2007-06-07 08:45 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-06-07 08:37 <DIR> d-------- C:\WINDOWS\Cache 2007-06-07 08:36 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-06-07 08:36 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-06-07 08:32 <DIR> dr-h----- C:\MSOCache 2007-06-07 08:24 <DIR> d-------- C:\Program Files\Winamp3 2007-06-07 08:19 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\Teleca 2007-06-07 08:14 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-06-07 08:13 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-06-07 08:13 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-06-07 08:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Documents 2007-06-07 08:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca 2007-06-07 08:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson 2007-06-07 07:40 <DIR> d-------- C:\WINDOWS\CSC 2007-06-07 00:50 <DIR> d-------- C:\!torrent 2007-06-07 00:48 <DIR> d-------- C:\Program Files\BitComet 2007-06-07 00:47 <DIR> d-------- C:\Program Files\Mozilla Firefox 2 Beta 1 2007-06-06 23:48 <DIR> d-------- C:\DOCUME~1\spoon\DANEAP~1\The Bat! 2007-06-06 23:47 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache 2007-06-06 23:47 <DIR> dr--s---- C:\WINDOWS\Fonts 2007-06-06 23:47 <DIR> dr------- C:\WINDOWS\Web 2007-06-06 23:47 <DIR> d--h----- C:\WINDOWS\inf 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\WinSxS 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\twain_32 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\wins 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\wbem 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\usmt 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\spool 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\ShellExt 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\Setup 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\ras 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\oobe 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\npp 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\mui 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\inetsrv 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\IME 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\icsxml 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\ias 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\export 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\drivers\etc 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\drivers 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\dhcp 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\config 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\3com_dmi 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\3076 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\2052 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\1054 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\1045 2007-06-06 23:47 <DIR> d-------- C:\WINDOWS\system32\1042 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-13 15:26:26 77,108 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-13 15:26:26 454,200 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-07 23:01:49 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll 2007-06-06 19:59:52 -------- d-----w C:\Program Files\Usługi online 2007-03-15 10:00:36 466,432 ----a-w C:\WINDOWS\system32\SkanerOnline.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-05-12 00:47] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll [2007-05-18 20:17] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-06-06 22:49] "AtiPTA"="atiptaxx.exe" [2005-06-29 03:05 C:\WINDOWS\system32\atiptaxx.exe] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AtiTrayTools"="C:\Program Files\Radeon Omega Drivers\v2.6.61\ATI Tray Tools\atitray.exe" [2005-08-17 23:06] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApachInc] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ipmon] ipmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "C:\Program Files\Winamp3\winampa.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Update Firewall System] winmsfw.exe ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-13 17:38:46 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-13 17:39:21 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-06-13 17:39 --- E O F ---

**Posty:** 18165 · przez **wojtas** 13 Cze 2007, 21:17

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ipmon]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Update Firewall System]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

skasuj plik:

C:\WINDOWS\system32\tmp.reg

**Posty:** 9 · przez **s_poon** 13 Cze 2007, 21:50

wszystko zrobione jak nalezy
czy cos dalej nalezy zrobic czy to juz final??

**Posty:** 18165 · przez **wojtas** 13 Cze 2007, 21:52

tak sadze ze jest ok

**Posty:** 9 · przez **s_poon** 13 Cze 2007, 21:59

pozostaje mi tylko serdecznie podziekowac ...
jak na razie nie zauwazylem zeby dzialo sie cos zlego no moze poza
kasowaniem backup'ów od tych programow wymienionych wyzej wtedy tez pojwil sie monit NOD'a ze cos co sie kasuje to ma wira

Kod: Zaznacz wszystko: 2007-06-13 21:27:36 AMON plik C:\RECYCLER\S-1-5-21-1078081533-1580436667-725345543-1003\Dc11.bad prawdopodobnie odmiana Win32/TrojanDownloader.ConHook trojan Kwarantanna - usunięty S-POON\spoon Zdarzenie miało miejsce w trakcie modyfikowania pliku przez aplikację: C:\Program Files\totalcmd\TOTALCMD.EXE. Plik został przeniesiony do kwarantanny.

aha ... czy moge znow wlaczyc przywracanie systemu czy tak jak teraz bedzie bezpieczniej (wolalbym miec mozliwosc przywracania)

**Posty:** 18165 · przez **wojtas** 13 Cze 2007, 22:18

tak wlacz juz przywracanie

nowy system ... kupa śmieci

nowy system ... kupa śmieci

Kto jest na forum