problem oraz log z hijack this

**Posty:** 21 · przez **Zapodawacz** 18 Lis 2007, 19:36

Mam poważny problem:/ Dzisiaj pojawił mi się jakiś komunikat WINDOWS SECURITY ALERT, pulpit zrobił się czerwony z jakimś znaczkiem oraz co najgorsze co chwile explorer.exe osiąga 100% zużycia procesora i nic sie nie da robić

gdy włączę na nowo proces explorer.exe za chwilę znów osiąga 100%

komunikat również pojawia się co chwilę:/ Proszę o pomoc.

Log z Hijack This

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:19:19, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe D:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-21-1220945662-2000478354-839522115-1003 Startup: hamachi.lnk = D:\Program Files\Hamachi\hamachi.exe (User '?') O4 - Startup: hamachi.lnk = D:\Program Files\Hamachi\hamachi.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O10 - Unknown file in Winsock LSP: prxerdrv.dll O10 - Unknown file in Winsock LSP: prxerdrv.dll O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328 O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: rmvgor - {64CA3D8C-2601-4892-9FDB-47E98DE90807} - C:\WINDOWS\rmvgor.dll O21 - SSODL: sapnet - {A0BBF5B7-B181-479C-BEB6-32B3092C475E} - C:\WINDOWS\sapnet.dll O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe -- End of file - 8349 bytes

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 19:46

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 21 · przez **Zapodawacz** 18 Lis 2007, 20:25

Kod: Zaznacz wszystko: SDFix: Version 1.114 Run by Wˆa˜ciciel on 2007-11-18 at 18:58 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\dat.txt - Deleted C:\WINDOWS\rs.txt - Deleted C:\WINDOWS\system32\tmp2.tmp - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-18 19:04:51 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:84,bf,8a,b1,4d,2e,7f,78,7b,70,97,dc,72,30,e0,0c,3b,e7,d6,71,a3,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,4d,3c,37,d1,0a,d4,38,cc,95,16,c1,4b,1b,1a,5f,d7,b3,.. "khjeh"=hex:15,ba,4c,a6,f2,3e,69,f2,99,12,57,7e,2b,b0,be,4c,e9,e0,c9,7c,e2,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:36,5d,e6,18,1e,28,3b,0c,72,da,30,cc,84,5f,29,c6,41,77,d0,4a,31,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:8b,32,a9,88,e1,2d,bf,25,dc,5b,67,f4,3d,1f,b8,72,cb,b6,06,c0,84,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:84,bf,8a,b1,4d,2e,7f,78,7b,70,97,dc,72,30,e0,0c,3b,e7,d6,71,a3,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,4d,3c,37,d1,0a,d4,38,cc,95,16,c1,4b,1b,1a,5f,d7,b3,.. "khjeh"=hex:15,ba,4c,a6,f2,3e,69,f2,99,12,57,7e,2b,b0,be,4c,e9,e0,c9,7c,e2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:36,5d,e6,18,1e,28,3b,0c,72,da,30,cc,84,5f,29,c6,41,77,d0,4a,31,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:8b,32,a9,88,e1,2d,bf,25,dc,5b,67,f4,3d,1f,b8,72,cb,b6,06,c0,84,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil" "C:\\Documents and Settings\\Wˆa˜ciciel\\Pulpit\\Java - Uploader\\Samsung Java - Uploader.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Pulpit\\Java - Uploader\\Samsung Java - Uploader.exe:*:Enabled:Samsung Java - Uploader" "C:\\Documents and Settings\\Wˆa˜ciciel\\Pulpit\\wildproxy02\\wildproxy.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Pulpit\\wildproxy02\\wildproxy.exe:*:Enabled:wildproxy" "C:\\Documents and Settings\\Wˆa˜ciciel\\Pulpit\\netsoccer\\Netsoccer\\server.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Pulpit\\netsoccer\\Netsoccer\\server.exe:*:Enabled:server" "C:\\Program Files\\DAP\\DAP.exe"="C:\\Program Files\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)" "C:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"="C:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe:*:Disabled:GunzLauncher" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\Electronic Arts\\Bitwa o —r˘dziemie II\\game.dat"="C:\\Program Files\\Electronic Arts\\Bitwa o —r˘dziemie II\\game.dat:*:Enabled:Bitwa o —r˘dziemiet II" "C:\\Program Files\\Electronic Arts\\Kr˘l Nazguli\\game.dat"="C:\\Program Files\\Electronic Arts\\Kr˘l Nazguli\\game.dat:*:Enabled:Wˆadca Pier˜cieni, Kr˘l Nazguli" "C:\\Program Files\\Ositis Software\\WinProxy 5\\WinProxy.exe"="C:\\Program Files\\Ositis Software\\WinProxy 5\\WinProxy.exe:*:Enabled:WinProxy Application" "C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsh8C.tmp\\utorrent.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsh8C.tmp\\utorrent.exe:*:Enabled:uTorrent" "C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsh91.tmp\\utorrent.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsh91.tmp\\utorrent.exe:*:Enabled:uTorrent" "C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsg120.tmp\\utorrent.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsg120.tmp\\utorrent.exe:*:Enabled:uTorrent" "C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsc14F.tmp\\utorrent.exe"="C:\\Documents and Settings\\Wˆa˜ciciel\\Ustawienia lokalne\\Temp\\nsc14F.tmp\\utorrent.exe:*:Enabled:uTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Sun 18 Nov 2007 85,946 A..H. --- "C:\Documents and Settings\Wˆa˜ciciel\Ustawienia lokalne\Temp\BIT3.tmp" Sun 18 Nov 2007 85,946 A..H. --- "C:\Documents and Settings\Wˆa˜ciciel\Ustawienia lokalne\Temp\BIT6.tmp" Sun 18 Nov 2007 85,946 A..H. --- "C:\Documents and Settings\Wˆa˜ciciel\Ustawienia lokalne\Temp\BIT94.tmp" Sun 18 Nov 2007 85,946 A..H. --- "C:\Documents and Settings\Wˆa˜ciciel\Ustawienia lokalne\Temp\BITA.tmp" Sun 18 Nov 2007 0 A..H. --- "C:\Documents and Settings\Wˆa˜ciciel\Ustawienia lokalne\Temp\BITB.tmp" Sun 18 Nov 2007 85,946 A..H. --- "C:\Documents and Settings\Wˆa˜ciciel\Ustawienia lokalne\Temp\BITBC.tmp" Wed 14 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1738c621b33e51e95e7a1d6339d42049\BIT2.tmp" Finished!

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:20:56, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe C:\PROGRA~1\OSITIS~1\WINPRO~1\WinProxy.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\FlashGet\flashget.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe D:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Winamp\winamp.exe D:\Program Files\Last.fm\LastFM.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - S-1-5-21-1220945662-2000478354-839522115-1003 Startup: hamachi.lnk = D:\Program Files\Hamachi\hamachi.exe (User '?') O4 - Startup: hamachi.lnk = D:\Program Files\Hamachi\hamachi.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O10 - Unknown file in Winsock LSP: prxerdrv.dll O10 - Unknown file in Winsock LSP: prxerdrv.dll O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328 O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: rmvgor - {64CA3D8C-2601-4892-9FDB-47E98DE90807} - C:\WINDOWS\rmvgor.dll O21 - SSODL: sapnet - {A0BBF5B7-B181-479C-BEB6-32B3092C475E} - C:\WINDOWS\sapnet.dll O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe -- End of file - 8386 bytes

Combofix'a nie mogę włączyć gdyż pojawia się komunikat

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 20:33

masz program: Proxifier ??

skasuj:

O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll
O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab
O21 - SSODL: rmvgor - {64CA3D8C-2601-4892-9FDB-47E98DE90807} - C:\WINDOWS\rmvgor.dll
O21 - SSODL: sapnet - {A0BBF5B7-B181-479C-BEB6-32B3092C475E} - C:\WINDOWS\sapnet.dll

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\popnetmtq.dll
C:\WINDOWS\jokwmp.dll
C:\WINDOWS\rmvgor.dll
C:\WINDOWS\sapnet.dll

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

jesli combo nie bedzie dzialal daj z dss'a

**Posty:** 21 · przez **Zapodawacz** 18 Lis 2007, 21:00

Nie mam Proxifier , ale mam WinProxy

Log z DSS'a (combofix nadal nie działa ;p)

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Właściciel on 2007-11-18 19:51:23 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Unable to create WMI object; Operacja ukończona pomyślnie. Backed up registry hives. Performed disk cleanup. [color=red]System Drive C: has 4.61 GiB (less than 15%) free.[/color] -- HijackThis (run as Właściciel.exe) ------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:52:22, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe C:\PROGRA~1\OSITIS~1\WINPRO~1\WinProxy.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\FlashGet\flashget.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe D:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Winamp\winamp.exe D:\Program Files\Last.fm\LastFM.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Właściciel\Pulpit\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Właściciel.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328 O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: sapnet - {CCE2311A-36AE-42DD-838D-D9A88A844F24} - C:\WINDOWS\sapnet.dll O21 - SSODL: rmvgor - {989574BC-1E51-4D95-B0FA-DA620CBD2179} - C:\WINDOWS\rmvgor.dll O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe -- End of file - 7488 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20071118-194305-166 O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll backup-20071118-194305-768 O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab backup-20071118-194305-911 O21 - SSODL: rmvgor - {64CA3D8C-2601-4892-9FDB-47E98DE90807} - C:\WINDOWS\rmvgor.dll backup-20071118-194305-975 O21 - SSODL: sapnet - {A0BBF5B7-B181-479C-BEB6-32B3092C475E} - C:\WINDOWS\sapnet.dll backup-20071118-194305-989 O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 giveio - c:\windows\system32\giveio.sys R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R1 oreans32 - c:\windows\system32\drivers\oreans32.sys R2 atksgt - c:\windows\system32\drivers\atksgt.sys R2 lirsgt - c:\windows\system32\drivers\lirsgt.sys R3 NAT (WinProxy Firewall) - c:\program files\ositis software\winproxy 5\nat.sys <Not Verified; Ositis Software, Inc.; WinProxy> S0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys (file missing) S0 VClone - c:\windows\system32\drivers\vclone.sys (file missing) S3 alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - c:\windows\system32\drivers\alcan5wn.sys <Not Verified; THOMSON; SpeedTouch USB> S3 alcaudsl (SpeedTouch ADSL Modem ATM Transport) - c:\windows\system32\drivers\alcaudsl.sys <Not Verified; THOMSON; SpeedTouch USB> S3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys (file missing) S3 BlueletSCOAudio (Bluetooth SCO Audio Service) - c:\windows\system32\drivers\blueletscoaudio.sys (file missing) S3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys (file missing) S3 Btcsrusb (Bluetooth USB For Bluetooth Service) - c:\windows\system32\drivers\btcusb.sys (file missing) S3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys (file missing) S3 SF-620 (Kingsun SF-620 USB Infrared Adapter) - c:\windows\system32\drivers\sf-620.sys <Not Verified; Kingsun Corporation; KSC Infrared Driver.> S3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys (file missing) S3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 WinProxy - c:\progra~1\ositis~1\winpro~1\wpservice.exe -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2007-10-18 and 2007-11-18 ----------------------------- 2007-11-18 18:57:46 0 d-------- C:\WINDOWS\ERUNT 2007-11-18 18:48:51 2946 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-18 18:48:24 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-18 18:48:24 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2007-11-18 18:48:24 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-11-18 18:48:24 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-11-18 18:48:24 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-18 18:16:34 200736 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-18 18:13:17 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-11-18 18:12:49 0 d-------- C:\WINDOWS\system32\ZoneLabs 2007-11-18 18:12:03 0 d-------- C:\WINDOWS\Internet Logs 2007-11-18 17:19:10 0 d-------- C:\Program Files\Trend Micro 2007-11-18 11:18:36 344064 --a------ C:\WINDOWS\sapnet.dll 2007-11-18 11:18:36 278528 --a------ C:\WINDOWS\rmvgor.dll <Not Verified; ; rmvgor> 2007-11-18 11:18:36 117760 --a------ C:\WINDOWS\nethop.exe 2007-11-18 11:18:36 188416 --a------ C:\WINDOWS\jokwmp.dll <Not Verified; ; jokwmp Module> 2007-11-17 19:01:01 0 d-------- C:\Program Files\Eudemons Online 2007-11-17 15:55:16 0 d-------- C:\Program Files\GameTribe 2007-11-16 23:53:23 0 d-------- C:\Program Files\Silkroad 2007-11-16 17:29:46 0 d-------- C:\Documents and Settings\Właściciel\Application Data\uTorrent 2007-11-12 20:41:21 0 d-------- C:\Program Files\LucasArts 2007-11-10 11:59:28 0 d-------- C:\Program Files\SubEdit-Player 2007-11-09 13:34:56 0 d-------- C:\Program Files\JoWooD 2007-10-23 16:34:50 111564 --a------ C:\WINDOWS\system32\dneinobj.dll <Not Verified; Deterministic Networks, Inc.; > 2007-10-23 16:34:44 0 d-------- C:\Program Files\Common Files\Deterministic Networks 2007-10-23 16:34:03 0 d-------- C:\Program Files\Ositis Software 2007-10-19 17:53:09 8 --a------ C:\WINDOWS\system32\nvModes.dat -- Find3M Report --------------------------------------------------------------- 2007-11-18 19:50:03 0 d-------- C:\Program Files\FlashGet 2007-11-18 19:10:56 751192 --a------ C:\WINDOWS\system32\perfh015.dat 2007-11-18 19:10:56 179268 --a------ C:\WINDOWS\system32\perfc015.dat 2007-11-18 19:10:21 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\Hamachi 2007-11-18 16:50:19 0 d-a------ C:\Program Files\Common Files 2007-11-18 11:05:49 0 d-------- C:\Program Files\AdVantage 2007-11-17 19:01:01 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-11-17 09:33:05 4000 --a------ C:\ao.dat 2007-11-16 20:37:58 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\uTorrent 2007-11-15 15:25:01 0 d-------- C:\Program Files\MoorHunt 2007-11-10 14:11:27 0 d-------- C:\Program Files\NAPI-PROJEKT 2007-10-24 17:45:31 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\BearShare 2007-10-21 11:55:36 0 d-------- C:\Program Files\Activision 2007-10-16 21:00:34 1 --a------ C:\WINDOWS\system32\SI.bin 2007-10-16 12:20:50 0 d-------- C:\Program Files\ZhyperMU 1.02K Full Client 2007-10-16 11:49:35 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; > 2007-10-16 11:32:40 0 d-------- C:\Program Files\Desp 2007-10-15 19:01:40 0 d-------- C:\Program Files\AnalogX 2007-10-15 17:54:29 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\MSN6 2007-10-14 16:59:40 1049719 --a------ C:\wrar361pl.exe 2007-10-11 18:50:15 16491 --a------ C:\WINDOWS\War3Unin.dat 2007-10-11 18:50:12 2829 --a------ C:\WINDOWS\War3Unin.pif 2007-10-11 18:50:12 126976 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller> 2007-10-06 14:44:34 0 -ra------ C:\logwmemory.bin 2007-10-06 14:43:56 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\Soldat 2007-10-03 14:41:36 0 d-------- C:\Program Files\DAEMON Tools 2007-10-03 14:41:00 0 d-------- C:\Program Files\DAEMON Tools SearchBar 2007-09-28 18:17:01 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment 2007-09-27 20:57:46 0 d-------- C:\Program Files\Acclaim 2007-09-23 15:22:08 0 d-------- C:\Program Files\e-Spiewnik 2007-09-04 18:20:27 2559 --a------ C:\WINDOWS\mozver.dat 2007-09-04 18:02:54 4 --a------ C:\WINDOWS\system32\proc1795523372.bin 2007-08-27 16:12:47 81920 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions (c) Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL(TM) Library> 2007-08-27 10:08:16 15872 -----n--- C:\WINDOWS\system32\winskfr.dll <Not Verified; Microsoft Corporation; Contrôle Microsoft Winsock> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22] "nwiz"="nwiz.exe" [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-03 23:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-06-28 14:19] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-06-05 14:25:42] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 21:31:38] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 22:06:36] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "sapnet"= {CCE2311A-36AE-42DD-838D-D9A88A844F24} - C:\WINDOWS\sapnet.dll [2007-11-17 17:32 344064] "rmvgor"= {989574BC-1E51-4D95-B0FA-DA620CBD2179} - C:\WINDOWS\rmvgor.dll [2007-11-17 17:31 278528] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP] "C:\Program Files\Softick\PPP\Bin\PPPGate.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{328f9d07-25a6-11dc-b9d3-4d6564696130}] AutoRun\command- H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0a914da-1bec-11dc-b9a8-000461537dfa}] AutoRun\command- G:\Autorun.exe *Newly Created Service* - CATCHME -- End of Deckard's System Scanner: finished at 2007-11-18 19:53:24 ------------

Nie mam Proxifier , ale mam WinProxy

-- HijackThis (run as Właściciel.exe) ------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:52:22, on 2007-11-18
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe
C:\PROGRA~1\OSITIS~1\WINPRO~1\WinProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\FlashGet\flashget.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Winamp\winamp.exe
D:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Właściciel\Pulpit\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Właściciel.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328
O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164
O21 - SSODL: sapnet - {CCE2311A-36AE-42DD-838D-D9A88A844F24} - C:\WINDOWS\sapnet.dll
O21 - SSODL: rmvgor - {989574BC-1E51-4D95-B0FA-DA620CBD2179} - C:\WINDOWS\rmvgor.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe

--
End of file - 7488 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20071118-194305-166 O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll
backup-20071118-194305-768 O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab
backup-20071118-194305-911 O21 - SSODL: rmvgor - {64CA3D8C-2601-4892-9FDB-47E98DE90807} - C:\WINDOWS\rmvgor.dll
backup-20071118-194305-975 O21 - SSODL: sapnet - {A0BBF5B7-B181-479C-BEB6-32B3092C475E} - C:\WINDOWS\sapnet.dll
backup-20071118-194305-989 O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 giveio - c:\windows\system32\giveio.sys
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R1 oreans32 - c:\windows\system32\drivers\oreans32.sys
R2 atksgt - c:\windows\system32\drivers\atksgt.sys
R2 lirsgt - c:\windows\system32\drivers\lirsgt.sys
R3 NAT (WinProxy Firewall) - c:\program files\ositis software\winproxy 5\nat.sys <Not Verified; Ositis Software, Inc.; WinProxy>

S0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys (file missing)
S0 VClone - c:\windows\system32\drivers\vclone.sys (file missing)
S3 alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - c:\windows\system32\drivers\alcan5wn.sys <Not Verified; THOMSON; SpeedTouch USB>
S3 alcaudsl (SpeedTouch ADSL Modem ATM Transport) - c:\windows\system32\drivers\alcaudsl.sys <Not Verified; THOMSON; SpeedTouch USB>
S3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys (file missing)
S3 BlueletSCOAudio (Bluetooth SCO Audio Service) - c:\windows\system32\drivers\blueletscoaudio.sys (file missing)
S3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys (file missing)
S3 Btcsrusb (Bluetooth USB For Bluetooth Service) - c:\windows\system32\drivers\btcusb.sys (file missing)
S3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys (file missing)
S3 SF-620 (Kingsun SF-620 USB Infrared Adapter) - c:\windows\system32\drivers\sf-620.sys <Not Verified; Kingsun Corporation; KSC Infrared Driver.>
S3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys (file missing)
S3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 WinProxy - c:\progra~1\ositis~1\winpro~1\wpservice.exe

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Files created between 2007-10-18 and 2007-11-18 -----------------------------

2007-11-18 18:57:46 0 d-------- C:\WINDOWS\ERUNT
2007-11-18 18:48:51 2946 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-18 18:48:24 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-18 18:48:24 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2007-11-18 18:48:24 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-11-18 18:48:24 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-11-18 18:48:24 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-18 18:16:34 200736 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-18 18:13:17 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-11-18 18:12:49 0 d-------- C:\WINDOWS\system32\ZoneLabs
2007-11-18 18:12:03 0 d-------- C:\WINDOWS\Internet Logs
2007-11-18 17:19:10 0 d-------- C:\Program Files\Trend Micro
2007-11-18 11:18:36 344064 --a------ C:\WINDOWS\sapnet.dll
2007-11-18 11:18:36 278528 --a------ C:\WINDOWS\rmvgor.dll <Not Verified; ; rmvgor>
2007-11-18 11:18:36 117760 --a------ C:\WINDOWS\nethop.exe
2007-11-18 11:18:36 188416 --a------ C:\WINDOWS\jokwmp.dll <Not Verified; ; jokwmp Module>
2007-11-17 19:01:01 0 d-------- C:\Program Files\Eudemons Online
2007-11-17 15:55:16 0 d-------- C:\Program Files\GameTribe
2007-11-16 23:53:23 0 d-------- C:\Program Files\Silkroad
2007-11-16 17:29:46 0 d-------- C:\Documents and Settings\Właściciel\Application Data\uTorrent
2007-11-12 20:41:21 0 d-------- C:\Program Files\LucasArts
2007-11-10 11:59:28 0 d-------- C:\Program Files\SubEdit-Player
2007-11-09 13:34:56 0 d-------- C:\Program Files\JoWooD
2007-10-23 16:34:50 111564 --a------ C:\WINDOWS\system32\dneinobj.dll <Not Verified; Deterministic Networks, Inc.; >
2007-10-23 16:34:44 0 d-------- C:\Program Files\Common Files\Deterministic Networks

SRY ze nie zakodowane ale cos poknocilem

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 21:31

Start => Uruchom => cmd =>

sc delete C:\WINDOWS\sapnet.dll

enter

sc delete C:\WINDOWS\rmvgor.dll

enter

sc delete C:\WINDOWS\nethop.exe

enter

sc delete C:\WINDOWS\jokwmp.dll

enter

skasuj:

O21 - SSODL: sapnet - {CCE2311A-36AE-42DD-838D-D9A88A844F24} - C:\WINDOWS\sapnet.dll
O21 - SSODL: rmvgor - {989574BC-1E51-4D95-B0FA-DA620CBD2179} - C:\WINDOWS\rmvgor.dll

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

wroc z nowym logiem z dds"a

**Posty:** 21 · przez **Zapodawacz** 18 Lis 2007, 21:41

Nowy LOG

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Właściciel on 2007-11-18 20:40:27 Computer is in Normal Mode. -------------------------------------------------------------------------------- [color=red]System Drive C: has 4.61 GiB (less than 15%) free.[/color] -- HijackThis (run as Właściciel.exe) ------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:40:29, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe C:\PROGRA~1\OSITIS~1\WINPRO~1\WinProxy.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\FlashGet\flashget.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe D:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Winamp\winamp.exe D:\Program Files\Last.fm\LastFM.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\WINDOWS\explorer.exe C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Właściciel\Pulpit\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\WACICI~1.EXE R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: MSVPS System - {88418AA3-16F5-4FC2-A9D8-90B1266DF841} - C:\WINDOWS\nsduo.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328 O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: msmdev - {98373A94-06EA-4921-ACBA-B3EE31AAC53D} - C:\WINDOWS\msmdev.dll O21 - SSODL: msmhost - {966E8012-DCBE-41AF-91CA-E4A59B881114} - C:\WINDOWS\msmhost.dll O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe -- End of file - 7576 bytes -- Files created between 2007-10-18 and 2007-11-18 ----------------------------- 2007-11-18 19:57:31 266240 --a------ C:\WINDOWS\msmdev.dll 2007-11-18 19:57:31 32256 --a------ C:\WINDOWS\main_uninstaller.exe 2007-11-18 19:57:30 172032 --a------ C:\WINDOWS\nsduo.dll <Not Verified; ; nsduo> 2007-11-18 19:57:30 233472 --a------ C:\WINDOWS\msmhost.dll <Not Verified; ; msmhost> 2007-11-18 18:57:46 0 d-------- C:\WINDOWS\ERUNT 2007-11-18 18:48:51 2946 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-18 18:48:24 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-18 18:48:24 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2007-11-18 18:48:24 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-11-18 18:48:24 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-11-18 18:48:24 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-18 18:16:34 223264 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-18 18:13:17 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-11-18 18:12:49 0 d-------- C:\WINDOWS\system32\ZoneLabs 2007-11-18 18:12:03 0 d-------- C:\WINDOWS\Internet Logs 2007-11-18 17:19:10 0 d-------- C:\Program Files\Trend Micro 2007-11-18 11:18:36 344064 --a------ C:\WINDOWS\sapnet.dll 2007-11-18 11:18:36 278528 --a------ C:\WINDOWS\rmvgor.dll <Not Verified; ; rmvgor> 2007-11-18 11:18:36 117760 --a------ C:\WINDOWS\nethop.exe 2007-11-17 19:01:01 0 d-------- C:\Program Files\Eudemons Online 2007-11-17 15:55:16 0 d-------- C:\Program Files\GameTribe 2007-11-16 23:53:23 0 d-------- C:\Program Files\Silkroad 2007-11-16 17:29:46 0 d-------- C:\Documents and Settings\Właściciel\Application Data\uTorrent 2007-11-12 20:41:21 0 d-------- C:\Program Files\LucasArts 2007-11-10 11:59:28 0 d-------- C:\Program Files\SubEdit-Player 2007-11-09 13:34:56 0 d-------- C:\Program Files\JoWooD 2007-10-23 16:34:50 111564 --a------ C:\WINDOWS\system32\dneinobj.dll <Not Verified; Deterministic Networks, Inc.; > 2007-10-23 16:34:44 0 d-------- C:\Program Files\Common Files\Deterministic Networks 2007-10-23 16:34:03 0 d-------- C:\Program Files\Ositis Software 2007-10-19 17:53:09 8 --a------ C:\WINDOWS\system32\nvModes.dat -- Find3M Report --------------------------------------------------------------- 2007-11-18 20:40:33 0 d-------- C:\Program Files\FlashGet 2007-11-18 19:10:56 751192 --a------ C:\WINDOWS\system32\perfh015.dat 2007-11-18 19:10:56 179268 --a------ C:\WINDOWS\system32\perfc015.dat 2007-11-18 19:10:21 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\Hamachi 2007-11-18 16:50:19 0 d-a------ C:\Program Files\Common Files 2007-11-18 11:05:49 0 d-------- C:\Program Files\AdVantage 2007-11-17 19:01:01 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-11-17 09:33:05 4000 --a------ C:\ao.dat 2007-11-16 20:37:58 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\uTorrent 2007-11-15 15:25:01 0 d-------- C:\Program Files\MoorHunt 2007-11-10 14:11:27 0 d-------- C:\Program Files\NAPI-PROJEKT 2007-10-24 17:45:31 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\BearShare 2007-10-21 11:55:36 0 d-------- C:\Program Files\Activision 2007-10-16 21:00:34 1 --a------ C:\WINDOWS\system32\SI.bin 2007-10-16 12:20:50 0 d-------- C:\Program Files\ZhyperMU 1.02K Full Client 2007-10-16 11:49:35 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; > 2007-10-16 11:32:40 0 d-------- C:\Program Files\Desp 2007-10-15 19:01:40 0 d-------- C:\Program Files\AnalogX 2007-10-15 17:54:29 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\MSN6 2007-10-14 16:59:40 1049719 --a------ C:\wrar361pl.exe 2007-10-11 18:50:15 16491 --a------ C:\WINDOWS\War3Unin.dat 2007-10-11 18:50:12 2829 --a------ C:\WINDOWS\War3Unin.pif 2007-10-11 18:50:12 126976 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller> 2007-10-06 14:44:34 0 -ra------ C:\logwmemory.bin 2007-10-06 14:43:56 0 d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\Soldat 2007-10-03 14:41:36 0 d-------- C:\Program Files\DAEMON Tools 2007-10-03 14:41:00 0 d-------- C:\Program Files\DAEMON Tools SearchBar 2007-09-28 18:17:01 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment 2007-09-27 20:57:46 0 d-------- C:\Program Files\Acclaim 2007-09-23 15:22:08 0 d-------- C:\Program Files\e-Spiewnik 2007-09-04 18:20:27 2559 --a------ C:\WINDOWS\mozver.dat 2007-09-04 18:02:54 4 --a------ C:\WINDOWS\system32\proc1795523372.bin 2007-08-27 16:12:47 81920 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions (c) Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL(TM) Library> 2007-08-27 10:08:16 15872 -----n--- C:\WINDOWS\system32\winskfr.dll <Not Verified; Microsoft Corporation; Contrôle Microsoft Winsock> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}] 2007-09-06 19:19 172032 --a------ C:\WINDOWS\nsduo.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22] "nwiz"="nwiz.exe" [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-03 23:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-06-28 14:19] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-06-05 14:25:42] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 21:31:38] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 22:06:36] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "msmdev"= {98373A94-06EA-4921-ACBA-B3EE31AAC53D} - C:\WINDOWS\msmdev.dll [2007-09-06 19:19 266240] "msmhost"= {966E8012-DCBE-41AF-91CA-E4A59B881114} - C:\WINDOWS\msmhost.dll [2007-09-06 19:19 233472] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP] "C:\Program Files\Softick\PPP\Bin\PPPGate.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{328f9d07-25a6-11dc-b9d3-4d6564696130}] AutoRun\command- H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0a914da-1bec-11dc-b9a8-000461537dfa}] AutoRun\command- G:\Autorun.exe *Newly Created Service* - CATCHME -- End of Deckard's System Scanner: finished at 2007-11-18 20:41:05 ------------

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 21:46

zastosuj:

smitfraudfix z opcji 2

(sciagnij, wlacz wklep 2 i enter i czekaj.. )

i daj loga z combofixa (tylko przed uzyciem go zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)

**Posty:** 21 · przez **Zapodawacz** 18 Lis 2007, 22:01

Log z combofix'a

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Właściciel 2007-11-02 20:52:45.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.508 [GMT 1:00] Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_NWSAPAGENT -------\nm -------\NwSapAgent ((((((((((((((((((((((((( Files Created from 2007-10-08 to 2007-11-08 ))))))))))))))))))))))))))))))) . 2007-11-18 19:51 <DIR> d-------- C:\Deckard 2007-11-18 19:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-18 18:57 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-18 18:48 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-18 18:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-18 18:48 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-18 18:48 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-18 18:48 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-18 18:48 2,972 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-18 18:16 249,888 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-18 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier 2007-11-18 18:13 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-11-18 18:13 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-11-18 17:19 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 11:18 344,064 --a------ C:\WINDOWS\sapnet.dll 2007-11-18 11:18 278,528 --a------ C:\WINDOWS\rmvgor.dll 2007-11-18 11:18 117,760 --a------ C:\WINDOWS\nethop.exe 2007-11-18 11:06 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione 2007-11-17 19:01 <DIR> d-------- C:\Program Files\Eudemons Online 2007-11-17 15:55 <DIR> d-------- C:\Program Files\GameTribe 2007-11-16 23:53 <DIR> d-------- C:\Program Files\Silkroad 2007-11-12 20:41 <DIR> d-------- C:\Program Files\LucasArts 2007-11-10 11:59 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-11-09 13:34 <DIR> d-------- C:\Program Files\JoWooD 2007-10-23 16:34 <DIR> d-------- C:\Program Files\Ositis Software 2007-10-23 16:34 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks 2007-10-23 16:34 139,604 --a------ C:\WINDOWS\system32\drivers\dne2000.sys 2007-10-23 16:34 111,564 --a------ C:\WINDOWS\system32\dneinobj.dll 2007-10-19 17:53 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-10-16 21:00 1 --a------ C:\WINDOWS\system32\SI.bin 2007-10-16 20:47 <DIR> d-------- C:\CRUSADER 2007-10-16 17:40 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-16 11:44 40,960 --a------ C:\WINDOWS\system32\psfind.dll 2007-10-15 19:01 <DIR> d-------- C:\Program Files\AnalogX 2007-10-15 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MSN6 2007-10-15 17:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2007-10-14 16:59 1,049,719 --a------ C:\wrar361pl.exe 2007-10-13 16:40 <DIR> d-------- C:\Program Files\Activision 2007-10-11 18:50 126,976 --a------ C:\WINDOWS\War3Unin.exe 2007-10-11 18:50 16,491 --a------ C:\WINDOWS\War3Unin.dat 2007-10-11 18:50 2,829 --a------ C:\WINDOWS\War3Unin.pif 2007-10-09 19:27 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-18 10:05 --------- d-----w C:\Program Files\AdVantage 2007-11-17 18:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-17 08:33 4,000 ----a-w C:\ao.dat 2007-11-15 14:25 --------- d-----w C:\Program Files\MoorHunt 2007-11-10 13:11 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-08 19:56 5,024 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-08 19:55 --------- d-----w C:\Program Files\FlashGet 2007-10-16 11:20 --------- d-----w C:\Program Files\ZhyperMU 1.02K Full Client 2007-10-16 10:49 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-16 10:32 --------- d-----w C:\Program Files\Desp 2007-10-06 13:44 0 ----a-r C:\logwmemory.bin 2007-10-03 13:41 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-10-03 13:41 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-03 13:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-09-28 17:17 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2007-09-27 19:57 --------- d-----w C:\Program Files\Acclaim 2007-09-23 14:22 --------- d-----w C:\Program Files\e-Spiewnik 2007-09-12 11:37 --------- d-----w C:\Program Files\vanBasco's Karaoke Player 2007-09-06 15:14 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2007-08-27 15:12 81,920 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2007-08-27 09:08 15,872 ------w C:\WINDOWS\system32\winskfr.dll 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22] "nwiz"="nwiz.exe" [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-06-28 14:19] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-06-05 14:25:42] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 21:31:38] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 22:06:36] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP] "C:\Program Files\Softick\PPP\Bin\PPPGate.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys S3 NAT;WinProxy Firewall;\??\C:\PROGRA~1\OSITIS~1\WINPRO~1\NAT.sys S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{328f9d07-25a6-11dc-b9d3-4d6564696130}] \Shell\AutoRun\command - H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0a914da-1bec-11dc-b9a8-000461537dfa}] \Shell\AutoRun\command - G:\Autorun.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-08 20:58:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-08 20:59:53 - machine was rebooted . --- E O F ---

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 22:12

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\sapnet.dll
C:\WINDOWS\rmvgor.dll
C:\WINDOWS\nethop.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 21 · przez **Zapodawacz** 19 Lis 2007, 00:10

Combofix

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Właściciel 2007-11-08 22:59:13.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.603 [GMT 1:00] Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Właściciel\Pulpit\CFScript.txt FILE C:\WINDOWS\jokwmp.dll C:\WINDOWS\popnetmtq.dll C:\WINDOWS\rmvgor.dll C:\WINDOWS\sapnet.dll . ((((((((((((((((((((((((( Files Created from 2007-10-08 to 2007-11-08 ))))))))))))))))))))))))))))))) . 2007-11-18 19:51 <DIR> d-------- C:\Deckard 2007-11-18 19:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-18 18:57 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-18 18:48 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-18 18:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-18 18:48 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-18 18:48 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-18 18:48 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-18 18:48 2,972 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-18 18:16 292,896 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-18 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier 2007-11-18 18:13 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-11-18 18:13 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-11-18 17:19 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 11:18 344,064 --a------ C:\WINDOWS\sapnet.dll 2007-11-18 11:18 278,528 --a------ C:\WINDOWS\rmvgor.dll 2007-11-18 11:18 117,760 --a------ C:\WINDOWS\nethop.exe 2007-11-18 11:06 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione 2007-11-17 19:01 <DIR> d-------- C:\Program Files\Eudemons Online 2007-11-17 15:55 <DIR> d-------- C:\Program Files\GameTribe 2007-11-16 23:53 <DIR> d-------- C:\Program Files\Silkroad 2007-11-16 17:29 <DIR> d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\uTorrent 2007-11-12 20:41 <DIR> d-------- C:\Program Files\LucasArts 2007-11-10 11:59 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-11-09 13:34 <DIR> d-------- C:\Program Files\JoWooD 2007-10-23 16:34 <DIR> d-------- C:\Program Files\Ositis Software 2007-10-23 16:34 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks 2007-10-23 16:34 139,604 --a------ C:\WINDOWS\system32\drivers\dne2000.sys 2007-10-23 16:34 111,564 --a------ C:\WINDOWS\system32\dneinobj.dll 2007-10-19 17:53 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-10-16 21:00 1 --a------ C:\WINDOWS\system32\SI.bin 2007-10-16 20:47 <DIR> d-------- C:\CRUSADER 2007-10-16 17:41 <DIR> d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\Hamachi 2007-10-16 17:40 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-16 11:44 40,960 --a------ C:\WINDOWS\system32\psfind.dll 2007-10-15 19:01 <DIR> d-------- C:\Program Files\AnalogX 2007-10-15 17:54 <DIR> d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\MSN6 2007-10-15 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MSN6 2007-10-15 17:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2007-10-14 16:59 1,049,719 --a------ C:\wrar361pl.exe 2007-10-13 16:40 <DIR> d-------- C:\Program Files\Activision 2007-10-11 18:50 126,976 --a------ C:\WINDOWS\War3Unin.exe 2007-10-11 18:50 16,491 --a------ C:\WINDOWS\War3Unin.dat 2007-10-11 18:50 2,829 --a------ C:\WINDOWS\War3Unin.pif 2007-10-09 19:27 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-18 10:05 --------- d-----w C:\Program Files\AdVantage 2007-11-17 18:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-17 08:33 4,000 ----a-w C:\ao.dat 2007-11-15 14:25 --------- d-----w C:\Program Files\MoorHunt 2007-11-10 13:11 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-08 19:56 5,024 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-08 19:55 --------- d-----w C:\Program Files\FlashGet 2007-10-24 16:45 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\BearShare 2007-10-16 11:20 --------- d-----w C:\Program Files\ZhyperMU 1.02K Full Client 2007-10-16 10:49 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-16 10:32 --------- d-----w C:\Program Files\Desp 2007-10-06 13:44 0 ----a-r C:\logwmemory.bin 2007-10-06 13:43 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\Soldat 2007-10-03 13:41 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-10-03 13:41 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-03 13:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-09-28 17:17 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2007-09-27 19:57 --------- d-----w C:\Program Files\Acclaim 2007-09-23 14:22 --------- d-----w C:\Program Files\e-Spiewnik 2007-09-12 11:37 --------- d-----w C:\Program Files\vanBasco's Karaoke Player 2007-09-06 15:14 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2007-08-27 15:12 81,920 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2007-08-27 09:08 15,872 ------w C:\WINDOWS\system32\winskfr.dll 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll . ((((((((((((((((((((((((((((( snapshot@2007-11-08_20.59.25.21 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-18 18:10:55 160,226 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-08 20:02:22 160,458 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-18 18:10:56 179,268 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-08 20:02:22 179,500 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-18 18:10:56 673,196 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-08 20:02:22 673,812 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-18 18:10:56 751,192 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-08 20:02:22 751,860 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22] "nwiz"="nwiz.exe" [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-06-28 14:19] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-06-05 14:25:42] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 21:31:38] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 22:06:36] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP] "C:\Program Files\Softick\PPP\Bin\PPPGate.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys S3 NAT;WinProxy Firewall;\??\C:\PROGRA~1\OSITIS~1\WINPRO~1\NAT.sys S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{328f9d07-25a6-11dc-b9d3-4d6564696130}] \Shell\AutoRun\command - H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0a914da-1bec-11dc-b9a8-000461537dfa}] \Shell\AutoRun\command - G:\Autorun.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-08 23:02:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-08 23:03:35 C:\ComboFix2.txt ... 2007-11-08 20:59 . --- E O F ---

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:09:52, on 2007-11-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328 O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe -- End of file - 7223 bytes

**Posty:** 18165 · przez **wojtas** 19 Lis 2007, 17:00

C:\WINDOWS\sapnet.dll
C:\WINDOWS\rmvgor.dll
C:\WINDOWS\nethop.exe

skasuj pliki

zainstaluj jakiegos antywirusa... wroc z logami

**Posty:** 21 · przez **Zapodawacz** 19 Lis 2007, 18:34

Combofix

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Właściciel 2007-11-09 17:26:09.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.448 [GMT 1:00] Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-09 to 2007-11-09 ))))))))))))))))))))))))))))))) . 2007-11-18 19:51 <DIR> d-------- C:\Deckard 2007-11-18 19:12 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-18 18:57 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-18 18:48 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-18 18:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-18 18:48 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-18 18:48 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-18 18:48 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-18 18:48 2,972 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-18 18:16 415,776 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-18 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier 2007-11-18 18:13 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-11-18 18:13 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-11-18 17:19 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-18 11:06 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione 2007-11-17 19:01 <DIR> d-------- C:\Program Files\Eudemons Online 2007-11-17 15:55 <DIR> d-------- C:\Program Files\GameTribe 2007-11-16 23:53 <DIR> d-------- C:\Program Files\Silkroad 2007-11-16 17:29 <DIR> d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\uTorrent 2007-11-12 20:41 <DIR> d-------- C:\Program Files\LucasArts 2007-11-10 11:59 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-11-09 13:34 <DIR> d-------- C:\Program Files\JoWooD 2007-10-23 16:34 <DIR> d-------- C:\Program Files\Ositis Software 2007-10-23 16:34 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks 2007-10-23 16:34 139,604 --a------ C:\WINDOWS\system32\drivers\dne2000.sys 2007-10-23 16:34 111,564 --a------ C:\WINDOWS\system32\dneinobj.dll 2007-10-19 17:53 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-10-16 21:00 1 --a------ C:\WINDOWS\system32\SI.bin 2007-10-16 20:47 <DIR> d-------- C:\CRUSADER 2007-10-16 17:41 <DIR> d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\Hamachi 2007-10-16 17:40 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-16 11:44 40,960 --a------ C:\WINDOWS\system32\psfind.dll 2007-10-15 19:01 <DIR> d-------- C:\Program Files\AnalogX 2007-10-15 17:54 <DIR> d-------- C:\Documents and Settings\Właściciel\Dane aplikacji\MSN6 2007-10-15 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MSN6 2007-10-15 17:31 <DIR> d-------- C:\WINDOWS\OPTIONS 2007-10-14 16:59 1,049,719 --a------ C:\wrar361pl.exe 2007-10-13 16:40 <DIR> d-------- C:\Program Files\Activision 2007-10-11 18:50 126,976 --a------ C:\WINDOWS\War3Unin.exe 2007-10-11 18:50 16,491 --a------ C:\WINDOWS\War3Unin.dat 2007-10-11 18:50 2,829 --a------ C:\WINDOWS\War3Unin.pif 2007-10-09 19:27 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-17 18:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-17 08:33 4,000 ----a-w C:\ao.dat 2007-11-15 14:25 --------- d-----w C:\Program Files\MoorHunt 2007-11-10 13:11 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-09 16:20 --------- d-----w C:\Program Files\FlashGet 2007-11-09 14:17 --------- d-----w C:\Program Files\AdVantage 2007-11-09 06:49 6,104 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-24 16:45 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\BearShare 2007-10-16 11:20 --------- d-----w C:\Program Files\ZhyperMU 1.02K Full Client 2007-10-16 10:49 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-10-16 10:32 --------- d-----w C:\Program Files\Desp 2007-10-06 13:44 0 ----a-r C:\logwmemory.bin 2007-10-06 13:43 --------- d-----w C:\Documents and Settings\Właściciel\Dane aplikacji\Soldat 2007-10-03 13:41 --------- d-----w C:\Program Files\DAEMON Tools SearchBar 2007-10-03 13:41 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-03 13:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-09-28 17:17 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2007-09-27 19:57 --------- d-----w C:\Program Files\Acclaim 2007-09-23 14:22 --------- d-----w C:\Program Files\e-Spiewnik 2007-09-12 11:37 --------- d-----w C:\Program Files\vanBasco's Karaoke Player 2007-09-06 15:14 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll 2007-08-27 15:12 81,920 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2007-08-27 09:08 15,872 ------w C:\WINDOWS\system32\winskfr.dll 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll . ((((((((((((((((((((((((((((( snapshot@2007-11-08_20.59.25.21 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-18 18:10:55 160,226 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-09 14:19:33 161,154 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-18 18:10:56 179,268 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-11-09 14:19:33 180,196 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-11-18 18:10:56 673,196 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-09 14:19:33 675,660 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-18 18:10:56 751,192 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-11-09 14:19:33 753,864 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 06:59 C:\WINDOWS\SOUNDMAN.EXE] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22] "nwiz"="nwiz.exe" [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 12:38] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-06-28 14:19] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-06-05 14:25:42] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 21:31:38] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 22:06:36] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Właściciel^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.lnk] path=C:\Documents and Settings\Właściciel\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\PROGRA~1\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP] "C:\Program Files\Softick\PPP\Bin\PPPGate.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys S3 NAT;WinProxy Firewall;\??\C:\PROGRA~1\OSITIS~1\WINPRO~1\NAT.sys S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{328f9d07-25a6-11dc-b9d3-4d6564696130}] \Shell\AutoRun\command - H:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0a914da-1bec-11dc-b9a8-000461537dfa}] \Shell\AutoRun\command - G:\Autorun.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-09 17:30:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-09 17:31:59 C:\ComboFix2.txt ... 2007-11-08 23:03 C:\ComboFix3.txt ... 2007-11-08 20:59 . --- E O F ---

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:33:08, on 2007-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\FlashGet\flashget.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-21-1220945662-2000478354-839522115-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180780760328 O17 - HKLM\System\CCS\Services\Tcpip\..\{5604B33E-DFB3-4926-A045-B6C6AE8E7E7B}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: WinProxy - Unknown owner - C:\PROGRA~1\OSITIS~1\WINPRO~1\WPService.exe -- End of file - 7270 bytes

Mógłbyś mi polecić jakieś antywirka co nie muli kompa a dobrze chroni?

**Posty:** 18165 · przez **wojtas** 19 Lis 2007, 18:39

C:\Program Files\DAEMON Tools SearchBar

ten folder do kosza wywal..

co do antywirusa to nod32 lub avast

problem oraz log z hijack this

Problem oraz Log z Hijack This

Kto jest na forum