problem z google - nie wyszukuje, wirus/trojan

**Posty:** 3 · przez **sirK** 27 Cze 2008, 12:44

Witam. Mam następujący problem: Od kilku dni nie mogę wyszukiwać stron przez żadną wyszukiwarkę (google, yahoo), ponadto niektóre strony nie chcą się uruchamiać a inne uruchamiają się same. Niedawno avast wykrył mi jakiegoś trojana, ale z usunięciem sobie nie poradził, podobnie jak ad-aware. Poniżej wklejam logi z Combofix i Hijackthis, bardzo proszę o sprawdzenie. Z góry dziękuję.
Pozdrawiam.

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Administrator 2008-06-27 10:16:14.4 - NTFSx86 MINIMAL Running from: D:\Instalki\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM136e5a21.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\GQBcdfii.ini C:\WINDOWS\system32\GQBcdfii.ini2 C:\WINDOWS\system32\iifdcBQG.dll C:\WINDOWS\system32\wnjhmcfs.ini . ((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 ))))))))))))))))))))))))))))))) . 2008-06-27 10:45 . 2008-06-27 10:45 122,687 --a------ C:\WINDOWS\BM136e5a21.xml 2008-06-26 23:49 . 2008-06-26 23:49 80,896 --a------ C:\WINDOWS\system32\sfcmhjnw.dll 2008-06-26 23:48 . 2008-06-26 23:48 91,648 --a------ C:\WINDOWS\system32\ajtpjwhw.dll 2008-06-26 23:35 . 2008-06-26 23:35 294 --ahs---- C:\WINDOWS\system32\akwqlanh.ini 2008-06-26 23:00 . 2008-06-26 23:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback 2008-06-26 22:59 . 2008-06-26 22:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DivX 2008-06-26 22:57 . 2008-06-26 22:57 <DIR> d-------- C:\Documents and Settings\Administrator 2008-06-26 17:55 . 2008-06-26 17:55 91,648 --a------ C:\WINDOWS\system32\lrheibit.dll 2008-06-26 16:33 . 2008-06-26 16:33 91,648 --a------ C:\WINDOWS\system32\jjhttdve.dll 2008-06-26 12:01 . 2008-06-26 12:01 91,648 --a------ C:\WINDOWS\system32\ngppodme.dll 2008-06-24 17:26 . 2008-06-24 17:26 25,600 --a------ C:\WINDOWS\system32\nnnmkLDv.dll 2008-06-24 17:25 . 2008-06-24 17:25 25,600 --a------ C:\WINDOWS\system32\geBqOfge.dll 2008-06-16 12:05 . 2008-06-16 12:05 <DIR> d-------- C:\Program Files\Lonely Cat Games 2008-06-13 17:07 . 2008-06-13 17:07 <DIR> d-------- C:\Documents and Settings\Kszysztoff\Application Data\Nokia Multimedia Player 2008-06-13 16:52 . 2008-06-13 16:52 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-06-13 16:52 . 2008-06-13 16:52 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-06-13 14:06 . 2004-08-04 08:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-06-13 14:06 . 2004-08-04 08:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-06-13 14:05 . 2008-06-13 14:05 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-06-13 14:05 . 2008-06-13 14:05 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-06-13 14:02 . 2008-06-13 14:06 <DIR> d-------- C:\Documents and Settings\Kszysztoff\Application Data\PC Suite 2008-06-13 14:02 . 2008-06-17 11:03 <DIR> d-------- C:\Documents and Settings\Kszysztoff\Application Data\Nokia 2008-06-13 14:02 . 2008-06-13 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2008-06-13 13:58 . 2008-06-13 13:58 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-06-13 13:58 . 2008-06-13 13:58 <DIR> d-------- C:\Program Files\DIFX 2008-06-13 13:58 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-06-13 13:58 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-06-13 13:58 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-06-13 13:57 . 2008-06-13 16:52 <DIR> d-------- C:\Program Files\Nokia 2008-06-13 13:57 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-06-13 13:57 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-06-13 13:57 . 2007-11-29 10:32 48,128 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-06-13 13:57 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-06-13 13:57 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-06-13 13:53 . 2008-06-13 13:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-06-09 19:43 . 2008-06-09 19:43 <DIR> d-------- C:\Program Files\Motherboard Monitor 5 2008-06-09 19:43 . 2004-04-10 09:42 2,944 --a------ C:\WINDOWS\system32\mbmiodrvr.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 22:01 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\uTorrent 2008-06-26 10:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-26 10:13 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-06-26 05:49 --------- d-----w C:\Program Files\MegauploadToolbar 2008-06-24 16:40 --------- d-----w C:\Program Files\eMule 2008-06-24 15:26 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\Orbit 2008-06-24 15:25 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\MegauploadToolbar 2008-06-18 11:31 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\Any Video Converter 2008-06-16 12:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-15 10:41 --------- d-----w C:\Program Files\Fma 2008-06-05 18:36 --------- d-----w C:\Program Files\SubEdit-Player 2008-05-30 11:27 --------- d-----w C:\Program Files\Orbitdownloader 2008-05-17 13:49 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\ContentGuard 2008-05-16 22:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-16 22:37 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2008-05-14 12:49 --------- d-----w C:\Program Files\directx 2008-04-27 17:23 --------- d-----w C:\Program Files\uTorrent 2007-06-06 01:37 108,326 ----a-w C:\Program Files\xpy.exe 2007-03-11 19:59 1,999,360 ----a-w C:\Program Files\sdsecure.exe 2006-01-29 16:51 1,150,976 ----a-w C:\Program Files\GGPR.exe 2006-01-29 16:36 21,249 ----a-w C:\Program Files\Readme.htm 2004-03-15 16:51 114,688 ----a-w C:\Program Files\internet explorer\plugins\LV71ActiveXControl.dll 2007-02-08 09:48 133,920 ----a-w C:\Program Files\internet explorer\plugins\LV82ActiveXControl.dll . ------- Sigcheck ------- 2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$hf_mig$\KB917953\SP2GDR\tcpip.sys 2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys 2004-08-04 08:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\dllcache\tcpip.sys 2006-04-20 13:51 359808 b4e29943b4b04bd5e7381546848e6669 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{500DBD6E-6D95-4106-B9A2-DDDCCB2B30D1}] 2008-06-24 17:25 25600 --a------ C:\WINDOWS\system32\geBqOfge.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53BC9710-ECB1-4E25-B352-BC3F2C45F8B5}] 2008-06-27 10:48 319488 --a------ C:\WINDOWS\system32\opnolIBt.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4720D3F-8611-40DD-88D2-A5330E2EB163}] C:\WINDOWS\system32\yayxxyAr.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18 2351864] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "MBM 5"="C:\Program Files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 09:40 594944] "BM136e5a21"="C:\WINDOWS\system32\fusufnpp.dll" [2008-06-27 10:52 91648] "105d69bd"="C:\WINDOWS\system32\ofrkbvqg.dll" [2008-06-27 10:53 81408] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:56 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{500DBD6E-6D95-4106-B9A2-DDDCCB2B30D1}"= C:\WINDOWS\system32\geBqOfge.dll [2008-06-24 17:25 25600] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBqOfge] geBqOfge.dll 2008-06-24 17:25 25600 C:\WINDOWS\system32\geBqOfge.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wincni32] wincni32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\opnolIBt [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\WINDOWS\\system32\\ti_targetserver_manager.exe"= "C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\tools\\gdb\\gdb430.exe"= "C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\eclipse\\jre\\bin\\javaw.exe"= "C:\\Program Files\\eMule\\emule.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R1 H-JTAG;H-JTAG;C:\Program Files\H-JTAG\H-JTAG.sys [2005-12-07 11:10] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R2 BT848;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.SYS [2001-07-03 04:02] R2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [2001-07-03 04:02] R2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [2001-07-03 04:02] R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2007-10-23 11:00] R2 DriverX;DriverX;C:\WINDOWS\system32\drivers\DRIVERX.SYS [2003-11-16 19:08] R2 drpkiont;drpkiont;C:\WINDOWS\system32\drivers\drpkiont.sys [2003-10-13 14:07] R2 Matrox Centering Service;Matrox Centering Service;"C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe" [2007-09-11 15:17] R2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;"C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe" [2007-09-11 15:16] R2 xdsfast1;XDSFast1 ISA Bus Driver;C:\WINDOWS\system32\drivers\xdsfast1.sys [2003-10-13 14:08] S2 evm6x;C6xxx EVM PCI Driver;C:\WINDOWS\system32\drivers\evm6x.sys [2003-10-13 14:08] S3 DLPortIO;DriverLINX Port I/O Driver;C:\WINDOWS\system32\DRIVERS\DLPortIO.SYS [2000-06-29 18:24] S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{226bc150-1ced-11dc-89ab-00e04c4687a5}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE . Contents of the 'Scheduled Tasks' folder "2007-12-14 19:09:36 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-27 10:44:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\opnolIBt.dll 319488 bytes executable C:\WINDOWS\system32\tBIlonpo.ini 345 bytes C:\WINDOWS\system32\tBIlonpo.ini2 345 bytes scan completed successfully hidden files: 3 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\geBqOfge.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\ofrkbvqg.dll -> C:\WINDOWS\system32\fusufnpp.dll -> C:\WINDOWS\system32\opnolIBt.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\nisvcloc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe . ************************************************************************** . Completion time: 2008-06-27 10:57:36 - machine was rebooted [Kszysztoff] ComboFix-quarantined-files.txt 2008-06-27 08:57:04 Pre-Run: 1,717,428,224 bytes free Post-Run: 1,299,271,680 bytes free 200 --- E O F --- 2007-11-30 09:09:26

Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:33, on 2008-06-27 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\niSvcLoc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Motherboard Monitor 5\MBM5.EXE C:\PROGRA~1\Wapster\AQQ\AQQ.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\TC PowerPack\totalcmd.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - URLSearchHook: (no name) - {CFBFAEA6-B9D4-11D0-9C78-00C04FD64497} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE" O4 - HKLM\..\Run: [BM136e5a21] Rundll32.exe "C:\WINDOWS\system32\fusufnpp.dll",s O4 - HKLM\..\Run: [105d69bd] rundll32.exe "C:\WINDOWS\system32\ofrkbvqg.dll",b O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLABR11\webserver\bin\matlabserver.exe (file missing) O23 - Service: Matrox Centering Service - Matrox Graphics Inc. - C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe O23 - Service: Matrox.Pdesk.ServicesHost - Unknown owner - C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NILM License manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\niSvcLoc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 5783 bytes

**Posty:** 7956 · przez **Magik** 27 Cze 2008, 12:56

na fix w trybie awaryjnym

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {CFBFAEA6-B9D4-11D0-9C78-00C04FD64497} - (no file) Unknown O4 - HKLM\..\Run: [BM136e5a21] Rundll32.exe "C:\WINDOWS\system32\fusufnpp.dll",s O4 - HKLM\..\Run: [105d69bd] rundll32.exe "C:\WINDOWS\system32\ofrkbvqg.dll",b

by mario
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 3 · przez **sirK** 27 Cze 2008, 15:39

Pomogło coś takiego w Combofix:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\BM136e5a21.xml C:\WINDOWS\system32\sfcmhjnw.dll C:\WINDOWS\system32\ajtpjwhw.dll C:\WINDOWS\system32\akwqlanh.ini C:\WINDOWS\system32\lrheibit.dll C:\WINDOWS\system32\jjhttdve.dll C:\WINDOWS\system32\ngppodme.dll C:\WINDOWS\system32\nnnmkLDv.dll C:\WINDOWS\system32\geBqOfge.dll Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{500DBD6E-6D95-4106-B9A2-DDDCCB2B30D1}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53BC9710-ECB1-4E25-B352-BC3F2C45F8B5}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4720D3F-8611-40DD-88D2-A5330E2EB163}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BM136e5a21"=- "105d69bd"=- [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{500DBD6E-6D95-4106-B9A2-DDDCCB2B30D1}"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wincni32] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{226bc150-1ced-11dc-89ab-00e04c4687a5}]

Na wszelki wypadek użyłem jeszcze sdfixa.

Tu są logi:

Combofix

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Kszysztoff 2008-06-27 13:02:17.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.136 [GMT 2:00] Running from: D:\Instalki\ComboFix.exe Command switches used :: D:\Instalki\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\BM136e5a21.xml C:\WINDOWS\system32\ajtpjwhw.dll C:\WINDOWS\system32\akwqlanh.ini C:\WINDOWS\system32\geBqOfge.dll C:\WINDOWS\system32\jjhttdve.dll C:\WINDOWS\system32\lrheibit.dll C:\WINDOWS\system32\ngppodme.dll C:\WINDOWS\system32\nnnmkLDv.dll C:\WINDOWS\system32\sfcmhjnw.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM136e5a21.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\ajtpjwhw.dll C:\WINDOWS\system32\akwqlanh.ini C:\WINDOWS\system32\geBqOfge.dll C:\WINDOWS\system32\gqvbkrfo.ini C:\WINDOWS\system32\jjhttdve.dll C:\WINDOWS\system32\lrheibit.dll C:\WINDOWS\system32\ngppodme.dll C:\WINDOWS\system32\nnnmkLDv.dll C:\WINDOWS\system32\opnolIBt.dll C:\WINDOWS\system32\tBIlonpo.ini C:\WINDOWS\system32\tBIlonpo.ini2 . ((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 ))))))))))))))))))))))))))))))) . 2008-06-27 11:32 . 2008-06-27 11:32 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-27 10:53 . 2008-06-27 10:53 81,408 --a------ C:\WINDOWS\system32\ofrkbvqg.dll 2008-06-27 10:52 . 2008-06-27 10:52 91,648 --a------ C:\WINDOWS\system32\fusufnpp.dll 2008-06-27 10:52 . 2008-06-27 10:52 294 --ahs---- C:\WINDOWS\system32\wnjhmcfs.ini 2008-06-26 23:00 . 2008-06-26 23:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback 2008-06-26 22:59 . 2008-06-26 22:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DivX 2008-06-26 22:57 . 2008-06-26 22:57 <DIR> d-------- C:\Documents and Settings\Administrator 2008-06-16 12:05 . 2008-06-16 12:05 <DIR> d-------- C:\Program Files\Lonely Cat Games 2008-06-13 17:07 . 2008-06-13 17:07 <DIR> d-------- C:\Documents and Settings\Kszysztoff\Application Data\Nokia Multimedia Player 2008-06-13 16:52 . 2008-06-13 16:52 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-06-13 16:52 . 2008-06-13 16:52 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-06-13 14:06 . 2004-08-04 08:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-06-13 14:06 . 2004-08-04 08:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-06-13 14:05 . 2008-06-13 14:05 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-06-13 14:05 . 2008-06-13 14:05 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-06-13 14:02 . 2008-06-13 14:06 <DIR> d-------- C:\Documents and Settings\Kszysztoff\Application Data\PC Suite 2008-06-13 14:02 . 2008-06-17 11:03 <DIR> d-------- C:\Documents and Settings\Kszysztoff\Application Data\Nokia 2008-06-13 14:02 . 2008-06-13 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2008-06-13 13:58 . 2008-06-13 13:58 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-06-13 13:58 . 2008-06-13 13:58 <DIR> d-------- C:\Program Files\DIFX 2008-06-13 13:58 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-06-13 13:58 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-06-13 13:58 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-06-13 13:57 . 2008-06-13 16:52 <DIR> d-------- C:\Program Files\Nokia 2008-06-13 13:57 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-06-13 13:57 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-06-13 13:57 . 2007-11-29 10:32 48,128 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-06-13 13:57 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-06-13 13:57 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-06-13 13:53 . 2008-06-13 13:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-06-09 19:43 . 2008-06-09 19:43 <DIR> d-------- C:\Program Files\Motherboard Monitor 5 2008-06-09 19:43 . 2004-04-10 09:42 2,944 --a------ C:\WINDOWS\system32\mbmiodrvr.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 22:01 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\uTorrent 2008-06-26 10:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-26 05:49 --------- d-----w C:\Program Files\MegauploadToolbar 2008-06-24 16:40 --------- d-----w C:\Program Files\eMule 2008-06-24 15:26 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\Orbit 2008-06-24 15:25 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\MegauploadToolbar 2008-06-18 11:31 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\Any Video Converter 2008-06-16 12:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-15 10:41 --------- d-----w C:\Program Files\Fma 2008-06-05 18:36 --------- d-----w C:\Program Files\SubEdit-Player 2008-05-30 11:27 --------- d-----w C:\Program Files\Orbitdownloader 2008-05-17 13:49 --------- d-----w C:\Documents and Settings\Kszysztoff\Application Data\ContentGuard 2008-05-16 22:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-16 22:37 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2008-05-14 12:49 --------- d-----w C:\Program Files\directx 2008-04-27 17:23 --------- d-----w C:\Program Files\uTorrent 2007-06-06 01:37 108,326 ----a-w C:\Program Files\xpy.exe 2007-03-11 19:59 1,999,360 ----a-w C:\Program Files\sdsecure.exe 2006-01-29 16:51 1,150,976 ----a-w C:\Program Files\GGPR.exe 2006-01-29 16:36 21,249 ----a-w C:\Program Files\Readme.htm 2004-03-15 16:51 114,688 ----a-w C:\Program Files\internet explorer\plugins\LV71ActiveXControl.dll 2007-02-08 09:48 133,920 ----a-w C:\Program Files\internet explorer\plugins\LV82ActiveXControl.dll . ------- Sigcheck ------- 2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$hf_mig$\KB917953\SP2GDR\tcpip.sys 2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys 2004-08-04 08:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\dllcache\tcpip.sys 2006-04-20 13:51 359808 b4e29943b4b04bd5e7381546848e6669 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18 2351864] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "MBM 5"="C:\Program Files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 09:40 594944] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:56 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBqOfge] geBqOfge.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\WINDOWS\\system32\\ti_targetserver_manager.exe"= "C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\tools\\gdb\\gdb430.exe"= "C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\eclipse\\jre\\bin\\javaw.exe"= "C:\\Program Files\\eMule\\emule.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R1 H-JTAG;H-JTAG;C:\Program Files\H-JTAG\H-JTAG.sys [2005-12-07 11:10] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R2 BT848;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.SYS [2001-07-03 04:02] R2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [2001-07-03 04:02] R2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [2001-07-03 04:02] R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2007-10-23 11:00] R2 DriverX;DriverX;C:\WINDOWS\system32\drivers\DRIVERX.SYS [2003-11-16 19:08] R2 drpkiont;drpkiont;C:\WINDOWS\system32\drivers\drpkiont.sys [2003-10-13 14:07] R2 Matrox Centering Service;Matrox Centering Service;"C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe" [2007-09-11 15:17] R2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;"C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe" [2007-09-11 15:16] R2 xdsfast1;XDSFast1 ISA Bus Driver;C:\WINDOWS\system32\drivers\xdsfast1.sys [2003-10-13 14:08] S2 evm6x;C6xxx EVM PCI Driver;C:\WINDOWS\system32\drivers\evm6x.sys [2003-10-13 14:08] S3 DLPortIO;DriverLINX Port I/O Driver;C:\WINDOWS\system32\DRIVERS\DLPortIO.SYS [2000-06-29 18:24] S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 [] . Contents of the 'Scheduled Tasks' folder "2007-12-14 19:09:36 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-27 13:28:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\nisvcloc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Completion time: 2008-06-27 13:39:15 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-27 11:39:00 ComboFix2.txt 2008-06-27 08:57:37 Pre-Run: 1,331,122,176 bytes free Post-Run: 1,325,232,128 bytes free 183 --- E O F --- 2007-11-30 09:09:26

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:30, on 2008-06-27 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe C:\WINDOWS\system32\mgabg.exe C:\WINDOWS\system32\niSvcLoc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Motherboard Monitor 5\MBM5.EXE C:\PROGRA~1\Wapster\AQQ\AQQ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE" O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O20 - Winlogon Notify: geBqOfge - geBqOfge.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLABR11\webserver\bin\matlabserver.exe (file missing) O23 - Service: Matrox Centering Service - Matrox Graphics Inc. - C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe O23 - Service: Matrox.Pdesk.ServicesHost - Unknown owner - C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe O23 - Service: NILM License manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\niSvcLoc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 5822 bytes

i SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.197 [/b] Run by Administrator on 2008-06-27 at 14:38 Microsoft Windows XP [Version 5.1.2600] Running From: c:\sdfix\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-27 14:52:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:9f,49,3d,c8,7a,28,43,8d,8a,31,50,cc,29,24,8f,f7,58,04,12,d2,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,46,b5,bf,12,0f,e8,e3,db,f2,36,0b,0b,16,12,3b,cb,28,.. "khjeh"=hex:6f,69,28,b4,37,b1,af,56,35,54,c0,9f,2f,2a,b9,b5,0b,ba,86,b6,94,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:9e,56,86,03,bc,5a,0a,4f,30,b2,03,84,87,c6,e4,e4,28,78,96,67,23,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:9f,49,3d,c8,7a,28,43,8d,8a,31,50,cc,29,24,8f,f7,58,04,12,d2,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,46,b5,bf,12,0f,e8,e3,db,f2,36,0b,0b,16,12,3b,cb,28,.. "khjeh"=hex:6f,69,28,b4,37,b1,af,56,35,54,c0,9f,2f,2a,b9,b5,0b,ba,86,b6,94,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:22,99,f2,19,9e,d9,1d,0c,17,5a,4c,f7,ff,68,b9,4a,ac,17,8b,17,71,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:65d3f0bb "s2"=dword:89d4b9a5 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:9f,49,3d,c8,7a,28,43,8d,8a,31,50,cc,29,24,8f,f7,58,04,12,d2,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,46,b5,bf,12,0f,e8,e3,db,f2,36,0b,0b,16,12,3b,cb,28,.. "khjeh"=hex:6f,69,28,b4,37,b1,af,56,35,54,c0,9f,2f,2a,b9,b5,0b,ba,86,b6,94,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:30,62,9f,c0,a1,94,43,9d,fa,e4,93,87,67,57,6d,0c,73,d8,4a,e4,c5,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:9f,49,3d,c8,7a,28,43,8d,8a,31,50,cc,29,24,8f,f7,58,04,12,d2,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,46,b5,bf,12,0f,e8,e3,db,f2,36,0b,0b,16,12,3b,cb,28,.. "khjeh"=hex:6f,69,28,b4,37,b1,af,56,35,54,c0,9f,2f,2a,b9,b5,0b,ba,86,b6,94,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:30,62,9f,c0,a1,94,43,9d,fa,e4,93,87,67,57,6d,0c,73,d8,4a,e4,c5,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"="C:\\Program Files\\Wapster\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:uTorrent" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\WINDOWS\\system32\\ti_targetserver_manager.exe"="C:\\WINDOWS\\system32\\ti_targetserver_manager.exe:*:Enabled:TSM Service provider" "C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\tools\\gdb\\gdb430.exe"="C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\tools\\gdb\\gdb430.exe:*:Enabled:gdb430" "C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\eclipse\\jre\\bin\\javaw.exe"="C:\\Program Files\\Texas Instruments\\CC Essentials 2.0\\eclipse\\jre\\bin\\javaw.exe:*:Enabled:javaw" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Thu 20 Dec 2007 1 A..H. --- "C:\WINDOWS\system32\m3.dll" Wed 28 Feb 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 18 Dec 2007 12,392 A..H. --- "C:\Program Files\National Instruments\NI Spy\NiSpy.exe" Thu 10 Apr 2008 130,560 ...H. --- "C:\Documents and Settings\Kszysztoff\Application Data\Microsoft\Word\~WRL1194.tmp" Thu 10 Apr 2008 129,536 ...H. --- "C:\Documents and Settings\Kszysztoff\Application Data\Microsoft\Word\~WRL1205.tmp" [b]Finished![/b]

**Posty:** 7956 · przez **Magik** 27 Cze 2008, 15:48

siema

HJT masz czysty :arrow:

dla kosmetyki

Kod: Zaznacz wszystko: O20 - Winlogon Notify: geBqOfge - geBqOfge.dll (file missing)

Sdfix nie wykryl juz nic :arrow:

co do combofix-->wklejasz do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\ofrkbvqg.dll C:\WINDOWS\system32\wnjhmcfs.ini C:\WINDOWS\system32\fusufnpp.dll REGISTRY:: [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBqOfge]

a dalesz juz wiesz co robic :wink:

Autor postu otrzymał pochwałę

**Posty:** 3 · przez **sirK** 27 Cze 2008, 22:40

Wielkie dzięki

Pozdrawiam.

problem z google - nie wyszukuje, wirus/trojan

Problem z google - nie wyszukuje, wirus/trojan

Kto jest na forum