Powracajacy rs32net.exe

**Posty:** 3 · przez **Klaudynaaa91** 05 Sty 2009, 18:29

Nie wiem jak się tego pozbyć. oto log z hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:20:04, on 2009-01-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\rs32net.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\WINDOWS\system32\spoolsv.exe C:\Documents and Settings\Popolupo\ie_updates3r.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Crawler\CToolbar.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crawler.com/?tbid=66020 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe O1 - Hosts: 72.167.163.234 www.google-analytics.com O1 - Hosts: 72.167.163.234 ads1.msn.com O1 - Hosts: 38.113.174.32 dehp.myspace.com O1 - Hosts: 38.113.174.32 demr.myspace.com O1 - Hosts: 38.113.174.32 desk.myspace.com O1 - Hosts: 38.113.174.32 delb.myspace.com O1 - Hosts: 38.113.174.32 delb2.myspace.com O1 - Hosts: 38.113.174.32 debr.myspace.com O1 - Hosts: 68.178.151.28 view.atdmt.com O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll O2 - BHO: C:\WINDOWS\system32\ksfj83nwe.dll - {C5AF49A2-94F3-42BD-F234-3604812C897D} - C:\WINDOWS\system32\ksfj83nwe.dll (file missing) O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: Pasek &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [CM-SmWizard] C:\WINDOWS\System\SmWizard.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Crawler Search - tbr:iemenu O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing) O22 - SharedTaskScheduler: kjlsjf9843nksngfdgffn - {C5AF49A2-94F3-42BD-F234-3604812C897D} - C:\WINDOWS\system32\ksfj83nwe.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Awards Online Partners - Unknown owner - C:\Documents and Settings\Popolupo\ie_updates3r.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7236 bytes

**Posty:** 300 · przez **sgsman** 05 Sty 2009, 18:53

Zapodaj loga z Combofixa. I napisz szerzej o swym problemie.

**Posty:** 3 · przez **Klaudynaaa91** 05 Sty 2009, 19:17

Ja się za bardzo nie znam. Od 3 tygodni mniej więcej wyskakuje mi w avaście komunikat o tym wirusie. Dzisiaj się dowiedziałam że to może być coś groźnego.

oto log z combofixa. (Po uruchomieniu go pisało przez chwile że usuwa rs32net.exe więc może już po problemie?

Kod: Zaznacz wszystko: ComboFix 09-01-05.02 - Popolupo 2009-01-05 18:07:20.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1279.738 [GMT 1:00] Uruchomiony z: c:\documents and settings\Popolupo\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\phctf5j0el23.bmp c:\windows\system32\rs32net.exe c:\windows\system32\svchost.t__ c:\windows\system32\wsnpoem c:\windows\system32\wsnpoem\audio.dll c:\windows\system32\wsnpoem\video.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SYSREST.SYS ((((((((((((((((((((((((( Pliki utworzone od 2008-12-05 do 2009-01-05 ))))))))))))))))))))))))))))))) . 2009-01-05 17:19 . 2009-01-05 17:19 <DIR> d-------- c:\program files\Trend Micro 2008-12-25 12:16 . 1999-12-17 10:13 86,016 --a------ c:\windows\unvise32.exe 2008-12-25 12:14 . 2008-12-25 12:14 <DIR> d-------- c:\program files\Postal2STP 2008-12-24 10:55 . 2008-12-24 10:55 <DIR> d--hs---- C:\FOUND.005 2008-12-24 10:39 . 2008-12-24 10:39 <DIR> d--hs---- C:\FOUND.004 2008-12-21 20:20 . 2008-12-21 20:20 <DIR> d-------- c:\program files\Aspyr Media, Inc 2008-12-21 20:20 . 2008-12-21 20:20 <DIR> d-------- c:\documents and settings\Popolupo\Dane aplikacji\InstallShield 2008-12-21 14:32 . 2008-12-21 14:32 <DIR> d-------- c:\documents and settings\Popolupo\Dane aplikacji\Creative 2008-12-21 14:29 . 2000-05-22 09:58 647,872 --------- c:\windows\system32\Mscomct2.ocx 2008-12-21 14:29 . 1999-10-10 18:00 41,984 --------- c:\windows\Ctregrun.exe 2008-12-21 14:29 . 2003-06-12 23:25 7,062 --a------ c:\windows\system32\audiopid.vxd 2008-12-21 14:27 . 2008-12-21 14:27 <DIR> d-------- c:\program files\Creative 2008-12-20 20:38 . 2008-12-20 20:38 <DIR> d-------- c:\program files\GameSpy Arcade 2008-12-20 20:35 . 2008-12-21 10:02 604 --a------ c:\windows\Thps3.INI 2008-12-20 20:33 . 2008-12-20 20:33 <DIR> d-------- c:\program files\Elaborate Bytes 2008-12-11 18:43 . 2004-08-03 23:08 25,600 --a------ c:\windows\system32\drivers\usbser.sys 2008-12-11 18:43 . 2004-08-03 23:08 25,600 --a------ c:\windows\system32\dllcache\usbser.sys 2008-12-11 18:43 . 2006-10-08 21:51 23,856 --a------ c:\windows\system32\spupdsvc.exe 2008-12-11 18:43 . 2008-12-11 18:43 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-12-11 18:43 . 2008-12-11 18:43 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-12-11 18:42 . 2008-12-11 18:42 <DIR> d-------- c:\documents and settings\Popolupo\Dane aplikacji\PC Suite 2008-12-11 18:42 . 2008-12-11 18:42 <DIR> d-------- c:\documents and settings\Popolupo\Dane aplikacji\Nokia 2008-12-11 18:42 . 2008-12-11 18:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Suite 2008-12-11 18:41 . 2008-12-11 18:41 <DIR> d-------- c:\program files\Common Files\PCSuite 2008-12-11 18:40 . 2008-12-11 18:40 <DIR> d-------- c:\windows\system32\DRVSTORE 2008-12-11 18:40 . 2008-12-11 18:40 <DIR> d-------- c:\program files\PC Connectivity Solution 2008-12-11 18:40 . 2008-12-11 18:40 <DIR> d-------- c:\program files\DIFX 2008-12-11 18:40 . 2008-12-11 18:41 <DIR> d-------- c:\program files\Common Files\Nokia 2008-12-11 18:40 . 2008-05-07 07:39 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll 2008-12-11 18:40 . 2008-05-07 07:38 659,968 --a------ c:\windows\system32\nmwcdcocls.dll 2008-12-11 18:40 . 2007-09-17 15:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys 2008-12-11 18:40 . 2008-05-07 07:38 20,864 --a------ c:\windows\system32\drivers\ccdcmbo.sys 2008-12-11 18:40 . 2008-05-07 07:38 17,536 --a------ c:\windows\system32\drivers\ccdcmb.sys 2008-12-11 18:40 . 2008-05-07 07:38 8,064 --a------ c:\windows\system32\drivers\usbser_lowerfltj.sys 2008-12-11 18:40 . 2008-06-06 09:24 8,064 --a------ c:\windows\system32\drivers\usbser_lowerflt.sys 2008-12-11 18:39 . 2008-12-11 18:39 <DIR> d-------- c:\program files\Nokia 2008-12-11 18:39 . 2008-05-07 07:38 90,624 --a------ c:\windows\system32\nmwcdcls.dll 2008-12-11 18:25 . 2008-12-11 18:25 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Installations 2008-12-07 20:10 . 2008-12-26 15:08 238 --a------ c:\windows\mafosav.INI 2008-12-06 21:07 . 2008-12-06 21:07 <DIR> d-------- c:\program files\Mp3 Knife 2008-12-06 21:07 . 2008-12-06 21:07 <DIR> d-------- c:\program files\Crawler 2008-12-06 21:07 . 2004-04-12 17:27 609,584 --a------ c:\windows\system32\comctl32.ocx 2008-12-06 21:07 . 2004-04-12 17:27 152,848 --a------ c:\windows\system32\comdlg32.ocx 2008-12-06 20:52 . 2008-12-06 20:52 <DIR> d-------- c:\program files\mp3DirectCut . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-22 21:39 --------- d-----w c:\documents and settings\Popolupo\Dane aplikacji\GanymedeNet 2008-11-22 21:38 --------- d-----w c:\program files\Ganymede 2008-11-21 17:18 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2008-11-17 20:04 2,306,113 ----a-w c:\windows\system32\GPhotos.scr 2008-11-16 14:32 --------- d-----w c:\program files\GuitarFX 3 2008-11-07 22:34 --------- d-----w c:\program files\Native Instruments 2003-08-27 10:49 3,424 ----a-w c:\windows\inf\OTHER\cmiainfo.sys 2002-12-31 22:27 3,069 ----a-w c:\documents and settings\Popolupo\ie_updates3r.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-08-12 21741864] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "Creative WebCam Tray"="c:\program files\Creative\Shared Files\CamTray.exe" [2005-10-27 299008] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CM-SmWizard"="c:\windows\System\SmWizard.exe" [2003-08-29 1454080] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-29 52168] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati2glxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati3bgxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati4afxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati4fkxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq52.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winpv06.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winyf16.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-27 111184] R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\drivers\V0260Vid.sys [2008-12-21 178913] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-27 20560] R4 Google Awards Online Partners;Google Awards Online Partners;c:\documents and settings\Popolupo\ie_updates3r.exe -A --> c:\documents and settings\Popolupo\ie_updates3r.exe -A [?] S0 ati2glxx;ati2glxx;c:\windows\system32\Drivers\ati2glxx.sys --> c:\windows\system32\Drivers\ati2glxx.sys [?] S0 ati3bgxx;ati3bgxx;c:\windows\system32\Drivers\ati3bgxx.sys --> c:\windows\system32\Drivers\ati3bgxx.sys [?] S0 ati4afxx;ati4afxx;c:\windows\system32\Drivers\ati4afxx.sys --> c:\windows\system32\Drivers\ati4afxx.sys [?] S0 ati4fkxx;ati4fkxx;c:\windows\system32\Drivers\ati4fkxx.sys --> c:\windows\system32\Drivers\ati4fkxx.sys [?] S0 Winkq52;Winkq52;c:\windows\system32\Drivers\Winkq52.sys --> c:\windows\system32\Drivers\Winkq52.sys [?] S0 Winpv06;Winpv06;c:\windows\system32\Drivers\Winpv06.sys --> c:\windows\system32\Drivers\Winpv06.sys [?] S0 Winyf16;Winyf16;c:\windows\system32\Drivers\Winyf16.sys --> c:\windows\system32\Drivers\Winyf16.sys [?] S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};\??\c:\windows\TEMP\1A.tmp --> c:\windows\TEMP\1A.tmp [?] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{C5AF49A2-94F3-42BD-F234-3604812C897D} - c:\windows\system32\ksfj83nwe.dll HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe HKLM-Run-Cmaudio - cmicnfg.cpl SharedTaskScheduler-{C5AF49A2-94F3-42BD-F234-3604812C897D} - c:\windows\system32\ksfj83nwe.dll SafeBoot-Windj84.sys SafeBoot-Winqw05.sys . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.crawler.com/?tbid=66020 uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Crawler Search - tbr:iemenu Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll FF - ProfilePath - c:\documents and settings\Popolupo\Dane aplikacji\Mozilla\Firefox\Profiles\lk2lc7jw.default\ FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=66020&qkw= FF - component: c:\documents and settings\Popolupo\Dane aplikacji\Mozilla\Firefox\Profiles\lk2lc7jw.default\extensions\bkmrksync@nokia.com\components\BkMrkExt.dll FF - component: c:\program files\Crawler\firefox\components\xcomm.dll FF - component: c:\program files\Crawler\firefox\components\xshared.dll FF - component: c:\program files\Crawler\firefox\components\xsupport.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 18:10:45 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}] "ImagePath"="\??\c:\windows\TEMP\1A.tmp" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\SYSTEM32\ATI2EVXX.EXE c:\program files\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE c:\program files\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE c:\program files\ALWIL SOFTWARE\AVAST4\SETUP\AVAST.SETUP c:\documents and settings\POPOLUPO\IE_UPDATES3R.EXE c:\program files\ALWIL SOFTWARE\AVAST4\ASHDISP.EXE c:\windows\SYSTEM32\WDFMGR.EXE c:\program files\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE c:\program files\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE c:\program files\PC CONNECTIVITY SOLUTION\SERVICELAYER.EXE c:\windows\system32\wscntfy.exe c:\program files\PC CONNECTIVITY SOLUTION\TRANSPORTS\NCLUSBSRV.EXE c:\program files\PC CONNECTIVITY SOLUTION\TRANSPORTS\NCLRSSRV.EXE c:\program files\COMMON FILES\NOKIA\MPAPI\MPAPI3S.EXE c:\program files\SKYPE\PLUGIN MANAGER\SKYPEPM.EXE . ************************************************************************** . Czas ukończenia: 2009-01-05 18:12:21 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-05 17:12:18 Przed: 4 807 639 040 bajtów wolnych Po: 5,176,836,096 bajtów wolnych 198

**Posty:** 18165 · przez **wojtas** 05 Sty 2009, 19:38

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 3 · przez **Klaudynaaa91** 05 Sty 2009, 20:09

zrobione. oto kod:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2009-01-05 at 18:58 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: {DEF85C80-216A-43ab-AF70-1665EDBE2780} [b]Path [/b]: \??\C:\WINDOWS\TEMP\1A.tmp {DEF85C80-216A-43ab-AF70-1665EDBE2780} - Deleted Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\Documents and Settings\Popolupo\ie_updates3r.exe - Deleted [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/]MBR Rootkit Detector[/url] by Gmer[/color] Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 19:06:16 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Thu 11 Dec 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 1 Jan 2003 7,829,056 A..H. --- "C:\Program Files\Google\Picasa3\setup.exe" [b]Finished![/b]

**Posty:** 18165 · przez **wojtas** 05 Sty 2009, 21:34

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe
3. dajesz loga z combofixa