poproszę o sprawdzenie loga [złośliwy trojan]

**Posty:** 23 · przez **Adam_15** 05 Sty 2008, 10:59

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:57:53, on 2008-01-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://bezpieczne.gadu-gadu.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: BDEX System - {D10CD11A-4CA6-453A-ABE5-71EA37E1BC45} - C:\WINDOWS\domnftwvmd.dll O2 - BHO: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file) O3 - Toolbar: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file) O3 - Toolbar: The emlkdvo - {8F96EAED-F89E-4B56-89C7-9B9F9C9F3A36} - C:\WINDOWS\emlkdvo.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F4B6C6DF-3CFE-49D2-B781-90E7916921F4}: NameServer = 194.204.152.34,217.98.63.194 O21 - SSODL: alxvdvm - {724F6FC6-A2E4-4023-83D0-21BD0486895D} - C:\WINDOWS\alxvdvm.dll O21 - SSODL: bvtqfvx - {B6C26652-228E-4541-BE9D-EA8E993C5D07} - C:\WINDOWS\bvtqfvx.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4737 bytes

**Posty:** 18165 · przez **wojtas** 05 Sty 2008, 11:01

co sie z kompem dzieje?

**Posty:** 23 · przez **Adam_15** 05 Sty 2008, 11:02

ustawił mi się pulpit na okienko że jak chce oczyścić komputer to muszę wejść na stronę programu antywirusowego. No i włącza się czasem okienko że muszę ten program kupić...

O i jeszcze mi się muli strasznie komputer....

**Posty:** 18165 · przez **wojtas** 05 Sty 2008, 11:04

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 23 · przez **Adam_15** 05 Sty 2008, 15:43

Kod: Zaznacz wszystko: Log z SD SDFix: Version 1.124 Run by Marek on 2008-01-05 at 10:34 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\alxvdvm.dll - Deleted C:\WINDOWS\dat.txt - Deleted C:\WINDOWS\domnftwvmd.dll - Deleted C:\WINDOWS\emlkdvo.dll - Deleted C:\WINDOWS\fvkwdrt.exe - Deleted C:\WINDOWS\rs.txt - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-05 10:49:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:52c666cc "s2"=dword:8c1b21eb "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:cf,1d,42,c7,23,13,20,31,03,93,66,69,60,81,fb,d8,ec,49,db,2b,e3,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000001 "khjeh"=hex:75,1f,e4,c7,c3,ac,0d,92,26,9f,26,27,9f,2a,e1,f8,99,7d,d1,c5,de,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,ef,a8,28,3e,14,9f,64,8c,03,83,9c,94,91,28,28,88,71,.. "khjeh"=hex:be,4c,75,eb,c1,af,3a,dc,c1,e0,30,d7,a7,e3,9e,f0,e7,36,43,8e,1f,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:9b,65,bd,38,0b,72,39,72,7b,ea,91,28,8b,c7,07,3d,78,5a,da,5c,4a,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e5,21,ac,20,d5,9a,94,84,03,f7,30,03,37,51,78,0a,60,c0,fc,84,c2,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:55,13,27,bc,61,5e,02,4a,c9,8e,18,a7,bb,a5,21,6e,b3,42,51,03,f8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:cf,1d,42,c7,23,13,20,31,03,93,66,69,60,81,fb,d8,ec,49,db,2b,e3,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000001 "khjeh"=hex:75,1f,e4,c7,c3,ac,0d,92,26,9f,26,27,9f,2a,e1,f8,99,7d,d1,c5,de,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,ef,a8,28,3e,14,9f,64,8c,03,83,9c,94,91,28,28,88,71,.. "khjeh"=hex:be,4c,75,eb,c1,af,3a,dc,c1,e0,30,d7,a7,e3,9e,f0,e7,36,43,8e,1f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:9b,65,bd,38,0b,72,39,72,7b,ea,91,28,8b,c7,07,3d,78,5a,da,5c,4a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e5,21,ac,20,d5,9a,94,84,03,f7,30,03,37,51,78,0a,60,c0,fc,84,c2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:55,13,27,bc,61,5e,02,4a,c9,8e,18,a7,bb,a5,21,6e,b3,42,51,03,f8,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\\Program Files\\eMule\\eMule.exe"="C:\\Program Files\\eMule\\eMule.exe:*:Enabled:eMule Plus" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent" "D:\\Counter - Strike\\Hl.exe"="D:\\Counter - Strike\\Hl.exe:*:Enabled:CounterStrike Launcher" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "D:\\Program Files\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe"="D:\\Program Files\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe:*:Enabled:Dungeon Siege 2 Game Executable" "C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server" "C:\\Program Files\\eMule2\\emule.exe"="C:\\Program Files\\eMule2\\emule.exe:*:Enabled:eMule" "D:\\Dungeon Siege 2\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe"="D:\\Dungeon Siege 2\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe:*:Enabled:Plik wsadowy Dungeon Siege II" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "D:\\EE2\\EE2.exe"="D:\\EE2\\EE2.exe:*:Enabled:Empire Earth II" "C:\\Documents and Settings\\Marek\\Pulpit\\MAREK\\xchat\\xchat.exe"="C:\\Documents and Settings\\Marek\\Pulpit\\MAREK\\xchat\\xchat.exe:*:Enabled:XChat IRC Client" "D:\\Starcraft\\StarCraft.exe"="D:\\Starcraft\\StarCraft.exe:*:Enabled:Starcraft" "D:\\Battlefield 1942\\BF1942.exe"="D:\\Battlefield 1942\\BF1942.exe:*:Enabled:BF1942" "D:\\CS\\hl.exe"="D:\\CS\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\CS\\hlds.exe"="D:\\CS\\hlds.exe:*:Enabled:HLDS Launcher" "D:\\CS\\hltv.exe"="D:\\CS\\hltv.exe:*:Enabled:HLTV Launcher" "D:\\PacSteam\\SteamApps\\marekzezgierza\\counter-strike\\hl.exe"="D:\\PacSteam\\SteamApps\\marekzezgierza\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\WINDOWS\\system32\\SolidStateNetworks\\SolidStateION\\solidnm.exe"="C:\\WINDOWS\\system32\\SolidStateNetworks\\SolidStateION\\solidnm.exe:*:Enabled:Solid State Networks Browser Plugin" "E:\\Gadu-Gadu\\gg.exe"="E:\\Gadu-Gadu\\gg.exe:*:Disabled:Gadu-Gadu - program główny" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Disabled:Uruchamia plik DLL jako aplikację" "E:\\eMule\\emule.exe"="E:\\eMule\\emule.exe:*:Enabled:eMule" "D:\\NWN\\nwmain.exe"="D:\\NWN\\nwmain.exe:*:Enabled:Neverwinter Nights" "E:\\Sacred\\Sacred.exe"="E:\\Sacred\\Sacred.exe:*:Enabled:Sacred" "E:\\Sacred\\GameServer.exe"="E:\\Sacred\\GameServer.exe:*:Enabled:Sacred Gameserver" "E:\\Hamachi\\hamachi.exe"="E:\\Hamachi\\hamachi.exe:*:Disabled:Hamachi Client" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Sat 23 Jun 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 17 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Sun 15 Jul 2007 34,304 A..H. --- "C:\Documents and Settings\Dzieci\Moje dokumenty\RO—LINY OZDOBNE\~WRL1466.tmp" Sun 27 May 2007 169,472 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL0316.tmp" Wed 27 Jun 2007 24,576 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL0350.tmp" Wed 27 Jun 2007 26,112 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL0662.tmp" Sun 27 May 2007 172,544 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL1074.tmp" Sun 27 May 2007 170,496 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL1878.tmp" Sun 27 May 2007 166,400 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL2094.tmp" Sun 27 May 2007 166,912 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL2332.tmp" Sun 27 May 2007 170,496 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL2558.tmp" Sun 27 May 2007 168,960 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL3413.tmp" Sun 27 May 2007 169,984 A..H. --- "C:\Documents and Settings\Dzieci\Pulpit\awans zawodowy\~WRL3580.tmp" Sat 17 Mar 2007 164,864 ...H. --- "C:\Documents and Settings\Dzieci\Ustawienia lokalne\Temp\~WRL3987.tmp" Sat 5 Jan 2008 85,946 A..H. --- "C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\BIT7.tmp" Sat 5 Jan 2008 85,946 A..H. --- "C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\BIT8.tmp" Sat 5 Jan 2008 85,946 A..H. --- "C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\BITBA.tmp" teraz log z hijack'a Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:31:08, on 2008-01-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://bezpieczne.gadu-gadu.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file) O3 - Toolbar: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F4B6C6DF-3CFE-49D2-B781-90E7916921F4}: NameServer = 194.204.152.34,217.98.63.194 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4315 bytes a teraz z combo ComboFix 08-01-04.1 - Marek 2008-01-05 10:56:35.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.90 [GMT 1:00] Running from: C:\Documents and Settings\Marek\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 ))))))))))))))))))))))))))))))) . 2008-01-05 10:32 . 2008-01-05 10:33 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-05 10:11 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-05 09:41 . 2007-02-23 14:10 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-01-05 09:41 . 2007-02-23 14:10 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-01-05 09:41 . 2007-02-23 13:19 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-01-05 09:41 . 2008-01-05 09:42 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-01-05 09:41 . 2007-02-23 14:10 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-01-05 09:41 . 2007-02-23 14:10 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-01-05 09:41 . 2007-02-23 14:10 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-27 17:47 . 2007-12-27 17:47 <DIR> d-------- C:\Program Files\Google 2007-12-27 15:02 . 2007-12-27 15:10 <DIR> d-------- C:\Program Files\MediaSupplyCodec 2007-12-21 22:49 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2007-12-17 10:51 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-12-17 10:51 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-12-17 10:50 . 2001-10-26 17:29 99,328 --a------ C:\WINDOWS\system32\srusd.dll 2007-12-17 10:50 . 2001-10-26 17:29 99,328 --a--c--- C:\WINDOWS\system32\dllcache\srusd.dll 2007-12-17 10:50 . 2001-10-26 17:29 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll 2007-12-17 10:50 . 2001-10-26 17:29 71,680 --a--c--- C:\WINDOWS\system32\dllcache\fnfilter.dll 2007-12-17 10:50 . 2001-10-26 17:05 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys 2007-12-17 10:50 . 2001-10-26 17:05 6,912 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys 2007-12-15 17:20 . 2007-12-18 22:12 <DIR> d-------- C:\Documents and Settings\Ogólny\Dane aplikacji\Hamachi 2007-12-15 17:20 . 2007-12-18 22:12 <DIR> d-------- C:\Documents and Settings\Ogólny\Dane aplikacji\Hamachi 2007-12-15 14:48 . 2008-01-02 13:47 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Hamachi 2007-12-15 14:48 . 2007-12-15 14:48 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-12-14 16:38 . 2007-12-14 16:38 <DIR> d-------- C:\Program Files\Common Files\PocketSoft 2007-12-07 20:24 . 2007-12-07 20:24 <DIR> d-------- C:\Program Files\Alcohol Soft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-04 14:04 --------- d-----w C:\Documents and Settings\Ogólny\Dane aplikacji\uTorrent 2008-01-04 14:04 --------- d-----w C:\Documents and Settings\Ogólny\Dane aplikacji\uTorrent 2008-01-01 17:44 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-27 22:27 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\gtk-2.0 2007-12-27 14:10 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-12-12 20:14 --------- d-----w C:\Program Files\eMule 2007-12-07 19:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-12-07 19:19 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-12-07 16:39 --------- d-----w C:\Program Files\Winamp 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-24 15:07 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-22 15:47 22,440 ----a-w C:\Documents and Settings\Ogólny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-10-22 15:47 22,440 ----a-w C:\Documents and Settings\Ogólny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-10-18 18:15 128 --sha-w C:\Program Files\desktop.ini 2007-09-22 17:53 22,440 -c--a-w C:\Documents and Settings\Dzieci\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-04-28 15:00 32 -c--a-r C:\Documents and Settings\All Users\hash.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480] "nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00 90112] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoStartMenuMyMusic"= 1 (0x1) "NoToolbarsOnTaskbar"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\DOCUME~1\ALLUSE~1\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\DOCUME~1\ALLUSE~1\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] 2003-12-22 08:38 241664 --a--c--- C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2004-02-18 18:55 49152 --a--c--- C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] 2004-03-04 16:46 172032 --a--c--- C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe S2 BulkUsb;Plustek USB Scanner;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 dump_wmimmc;dump_wmimmc;D:\9D\9Dragons\GameGuard\dump_wmimmc.sys [] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 09:06] *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder "2007-12-26 23:16:00 C:\WINDOWS\Tasks\WebReg 20071220001612.job" - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exeQ/TaskName 20071220001612 /N . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-05 10:59:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-05 11:01:14 . 2007-10-09 19:14:48 --- E O F ---

**Posty:** 18165 · przez **wojtas** 05 Sty 2008, 15:58

skasuj te wpisy w hijacku:

O2 - BHO: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file)
O3 - Toolbar: (no name) - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - (no file)
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab

Otworz notatnik i wklej w nim to:

Folder::
C:\Program Files\MediaSupplyCodec

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

poproszę o sprawdzenie loga [złośliwy trojan]

Poproszę o sprawdzenie loga [złośliwy trojan]

Kto jest na forum