problem z virusami

**Posty:** 6 · przez **konrad567** 09 Maj 2008, 16:14

Witam
Ostatnio postanowiłm przeskanować komputer, dość długo tego nie robiłem (teraz żałuję) a jest to dość ważne.Włączyłem Avasta i już po kilku sec znalazł mi pierwsze virusy.Z ciekawośći przeskanowałem cały komputer i wykrył mi ponad 700 virusów!!! Zdziwiło mnie to i skanowałem innym antyvirem ale ciągle to samo...Nie wiedząc co robić skasowałem wszystkie zainfekowane antyvirusy jednak po tej czynności komputer się zawiesił i nic nie dało się zobić, nie mając większego wyboru przywróciłem system do poprzedniego dnia...Skasowałem część zarażonych plików, jednak jest to tylko znikomy % tego co mam na komputerze, reszty nie chcę ruszać bo albo jest potrzebna, albo boję się, że coś popsuję...
Zamieszczam log(nie wiem czy dobry, bo niezbyt się na tym znam-jeśli jest zły to przepraszam i proszę o napisanie co zrobiłem żle)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:03:16, on 2008-05-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\WINDOWS\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MU Online Toolbar Helper - {D3138B39-C8A6-440B-9D42-50F766AEA8C7} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (file missing)
O3 - Toolbar: MU Online Toolbar - {B9D1647F-A66A-4695-B249-07901A45FF59} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

Bardzo proszę o pomoc

**Posty:** 7838 · przez **Lukesh** 09 Maj 2008, 16:16

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
:arrow:

na sam koniec wstaw logi z HJ: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **konrad567** 09 Maj 2008, 21:40

Po tych czynnościach sporo plików zniknęło(razem z antyvirem xD)
Skaner ewido wykrł 1800 virusów...
log z ComboFix

ComboFix 08-05-08.1 - KONRAD 2008-05-09 21:25:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.455 [GMT 2:00]
Running from: C:\Documents and Settings\KONRAD\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\KONRAD\USTAWI~1\Temp\E_4
C:\WINDOWS\system32\mcastnet.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_POWERMANAGER

((((((((((((((((((((((((( Files Created from 2008-04-09 to 2008-05-09 )))))))))))))))))))))))))))))))
.

2008-05-09 17:23 . 2008-05-09 17:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-09 17:19 . 2008-05-09 21:18 <DIR> d-------- C:\SDFix
2008-05-09 16:03 . 2008-05-09 16:03 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-09 15:50 . 2008-05-09 15:59 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-05-09 12:12 . 2008-05-09 17:08 <DIR> d-------- C:\Program Files\Cheat Engine
2008-05-09 12:12 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-05-09 12:12 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-04-29 18:59 . 2008-05-09 21:26 <DIR> d--h----- C:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER\Ulubione
2008-04-29 18:59 . 2007-06-06 19:51 <DIR> d--h----- C:\Documents and Settings\Administrator.KOMPUTER\Szablony
2008-04-29 18:59 . 2008-02-24 20:04 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER\Pulpit
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER\Moje dokumenty
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> dr------- C:\Documents and Settings\Administrator.KOMPUTER\Menu Start
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> dr-h----- C:\Documents and Settings\Administrator.KOMPUTER\Dane aplikacji
2008-04-29 18:59 . 2008-04-29 18:59 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER
2008-04-29 18:59 . 2008-05-09 21:25 1,024 --ah----- C:\Documents and Settings\Administrator.KOMPUTER\NtUser.dat.LOG
2008-04-28 16:36 . 2008-04-28 16:53 632,609,602 --a------ C:\MHTC.rar
2008-04-26 13:20 . 2008-04-26 13:27 <DIR> d-------- C:\Program Files\SkanerOnline
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> d-------- C:\Documents and Settings\KONRAD\Dane aplikacji\AVG7
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d-------- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d-------- C:\Documents and Settings\Administrator\Szablony
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d---s---- C:\Documents and Settings\Administrator
2008-04-26 12:24 . 2008-05-09 21:25 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG
2008-04-26 12:06 . 2008-04-26 12:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-22 14:59 . 2008-04-22 15:07 <DIR> d-------- C:\Program Files\THQ
2008-04-18 17:02 . 2008-04-18 17:02 <DIR> d-------- C:\Documents and Settings\KONRAD\Dane aplikacji\OpenArena
2008-04-12 13:31 . 2008-05-09 17:08 <DIR> d-------- C:\Program Files\Metin2_PL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-09 15:09 --------- d-----w C:\Program Files\SocksCapV2
2008-05-09 15:09 --------- d-----w C:\Program Files\Silkroad
2008-05-09 15:09 --------- d-----w C:\Program Files\Quake III Arena
2008-05-09 15:08 --------- d-----w C:\Program Files\Kopia Silkroad
2008-04-27 19:28 --------- d-----w C:\Program Files\Mass Downloader
2008-04-26 12:41 --------- d-----w C:\Program Files\Hamachi
2008-04-26 12:41 --------- d-----w C:\Program Files\DivX
2008-04-26 12:39 --------- d-----w C:\Program Files\Cossacks
2008-04-26 12:39 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-04-26 12:38 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-26 10:06 --------- d-----w C:\Program Files\Eset
2008-04-22 13:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-06 10:33 --------- d-----w C:\Documents and Settings\KONRAD\Dane aplikacji\ACD Systems
2008-04-06 10:32 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-04-06 10:32 --------- d-----w C:\Program Files\ACD Systems
2008-04-06 10:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-03-29 19:32 --------- d-----w C:\Documents and Settings\KONRAD\Dane aplikacji\Hamachi
2008-02-27 15:46 3,584 ----a-w C:\WINDOWS\EAddress.dll
2008-01-04 13:33 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-16 13:52 23,184 ----a-w C:\Documents and Settings\KONRAD\Dane aplikacji\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2004-08-03 22:44 61,440 --sh--r C:\WINDOWS\system32\fsdutil.exe
2004-08-03 22:44 61,440 --sh--r C:\WINDOWS\system32\ntvdc.exe
2004-08-03 22:44 61,440 --sh--r C:\WINDOWS\system32\wingtsv.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 11:42 68856]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:34 128000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE]
"CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 04:43 53340]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 192000]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 196096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
HP Photosmart Premier - Szybkie uruchomienie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-02-24 14:33:48 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Metin2_PL\\metin2.bin"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-12-09 15:35]
R3 msloop;Sterownik karty Microsoft Loopback;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 21:53]
R3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-04-01 17:16]
S3 IlvMoneyDRIVER53;IlvMoneyDRIVER53;C:\Documents and Settings\KONRAD\Pulpit\Boty do MS\IlvMoney1083.sys []
S3 NTProcDrv;Process creation detector for NT.;C:\Documents and Settings\KONRAD\Pulpit\isro\NtProcDrv.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 XDva019;XDva019;C:\WINDOWS\system32\XDva019.sys []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-09 21:28:58
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\MICROS~3\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-05-09 21:33:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-09 19:33:10

Pre-Run: 28,220,608,512 bajtów wolnych
Post-Run: 28,943,036,416 bajt˘w wolnych

156 --- E O F --- 2008-04-12 08:12:46

log z HJ

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:38:34, on 2008-05-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MU Online Toolbar Helper - {D3138B39-C8A6-440B-9D42-50F766AEA8C7} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (file missing)
O3 - Toolbar: MU Online Toolbar - {B9D1647F-A66A-4695-B249-07901A45FF59} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 8235 bytes

**Posty:** 8001 · przez **Okocza** 09 Maj 2008, 21:46

kosmetycznie usuwasz w hijacku

konrad567 napisał(a):O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (file missing)

potem nowy log z hj i cf

**Posty:** 6 · przez **konrad567** 09 Maj 2008, 22:03

log z cf

ComboFix 08-05-08.1 - KONRAD 2008-05-09 21:52:07.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.440 [GMT 2:00]
Running from: C:\Documents and Settings\KONRAD\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-09 to 2008-05-09 )))))))))))))))))))))))))))))))
.

2008-05-09 17:23 . 2008-05-09 17:23 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-09 17:19 . 2008-05-09 21:18 <DIR> d-------- C:\SDFix
2008-05-09 16:03 . 2008-05-09 16:03 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-09 15:50 . 2008-05-09 15:59 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-05-09 12:12 . 2008-05-09 17:08 <DIR> d-------- C:\Program Files\Cheat Engine
2008-05-09 12:12 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-05-09 12:12 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-04-29 18:59 . 2008-05-09 21:52 <DIR> d--h----- C:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER\Ulubione
2008-04-29 18:59 . 2007-06-06 19:51 <DIR> d--h----- C:\Documents and Settings\Administrator.KOMPUTER\Szablony
2008-04-29 18:59 . 2008-02-24 20:04 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER\Pulpit
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER\Moje dokumenty
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> dr------- C:\Documents and Settings\Administrator.KOMPUTER\Menu Start
2008-04-29 18:59 . 2007-06-06 21:46 <DIR> dr-h----- C:\Documents and Settings\Administrator.KOMPUTER\Dane aplikacji
2008-04-29 18:59 . 2008-04-29 18:59 <DIR> d-------- C:\Documents and Settings\Administrator.KOMPUTER
2008-04-29 18:59 . 2008-05-09 21:25 1,024 --ah----- C:\Documents and Settings\Administrator.KOMPUTER\NtUser.dat.LOG
2008-04-28 16:36 . 2008-04-28 16:53 632,609,602 --a------ C:\MHTC.rar
2008-04-26 13:20 . 2008-04-26 13:27 <DIR> d-------- C:\Program Files\SkanerOnline
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> d-------- C:\Documents and Settings\KONRAD\Dane aplikacji\AVG7
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-04-26 12:28 . 2008-04-26 12:28 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-26 12:24 . 2008-05-09 21:52 <DIR> d-------- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d-------- C:\Documents and Settings\Administrator\Szablony
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji
2008-04-26 12:24 . 2008-04-26 12:27 <DIR> d---s---- C:\Documents and Settings\Administrator
2008-04-26 12:24 . 2008-05-09 21:25 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG
2008-04-26 12:06 . 2008-04-26 12:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET
2008-04-22 14:59 . 2008-04-22 15:07 <DIR> d-------- C:\Program Files\THQ
2008-04-18 17:02 . 2008-04-18 17:02 <DIR> d-------- C:\Documents and Settings\KONRAD\Dane aplikacji\OpenArena
2008-04-12 13:31 . 2008-05-09 17:08 <DIR> d-------- C:\Program Files\Metin2_PL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-09 15:09 --------- d-----w C:\Program Files\SocksCapV2
2008-05-09 15:09 --------- d-----w C:\Program Files\Silkroad
2008-05-09 15:09 --------- d-----w C:\Program Files\Quake III Arena
2008-05-09 15:08 --------- d-----w C:\Program Files\Kopia Silkroad
2008-04-27 19:28 --------- d-----w C:\Program Files\Mass Downloader
2008-04-26 12:41 --------- d-----w C:\Program Files\Hamachi
2008-04-26 12:41 --------- d-----w C:\Program Files\DivX
2008-04-26 12:39 --------- d-----w C:\Program Files\Cossacks
2008-04-26 12:39 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-04-26 12:38 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-26 10:06 --------- d-----w C:\Program Files\Eset
2008-04-22 13:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-06 10:33 --------- d-----w C:\Documents and Settings\KONRAD\Dane aplikacji\ACD Systems
2008-04-06 10:32 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-04-06 10:32 --------- d-----w C:\Program Files\ACD Systems
2008-04-06 10:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-03-29 19:32 --------- d-----w C:\Documents and Settings\KONRAD\Dane aplikacji\Hamachi
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-27 15:46 3,584 ----a-w C:\WINDOWS\EAddress.dll
2008-02-21 02:05 560,640 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-02-21 02:05 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-02-21 02:05 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 193,344 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-04 13:33 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-12-16 13:52 23,184 ----a-w C:\Documents and Settings\KONRAD\Dane aplikacji\GDIPFONTCACHEV1.DAT
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2004-08-03 22:44 61,440 --sh--r C:\WINDOWS\system32\fsdutil.exe
2004-08-03 22:44 61,440 --sh--r C:\WINDOWS\system32\ntvdc.exe
2004-08-03 22:44 61,440 --sh--r C:\WINDOWS\system32\wingtsv.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 11:42 68856]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:34 128000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE]
"CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 04:43 53340]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 192000]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 196096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
HP Photosmart Premier - Szybkie uruchomienie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-02-24 14:33:48 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Metin2_PL\\metin2.bin"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-12-09 15:35]
R3 msloop;Sterownik karty Microsoft Loopback;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 21:53]
R3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-04-01 17:16]
S3 IlvMoneyDRIVER53;IlvMoneyDRIVER53;C:\Documents and Settings\KONRAD\Pulpit\Boty do MS\IlvMoney1083.sys []
S3 NTProcDrv;Process creation detector for NT.;C:\Documents and Settings\KONRAD\Pulpit\isro\NtProcDrv.sys []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S3 XDva019;XDva019;C:\WINDOWS\system32\XDva019.sys []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-09 21:53:01
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-09 21:54:19
ComboFix-quarantined-files.txt 2008-05-09 19:54:14
ComboFix2.txt 2008-05-09 19:33:15

Pre-Run: 29,580,435,456 bajtów wolnych
Post-Run: 29,572,526,080 bajtów wolnych

153 --- E O F --- 2008-04-12 08:12:46

log z hj

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:36, on 2008-05-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MU Online Toolbar Helper - {D3138B39-C8A6-440B-9D42-50F766AEA8C7} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MU Online Toolbar - {B9D1647F-A66A-4695-B249-07901A45FF59} - C:\Program Files\MU Online Toolbar\v3.2.0.0\MU_Online_Toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7610 bytes

**Posty:** 8001 · przez **Okocza** 09 Maj 2008, 22:20

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

odinstaluj różnego rodzaju toolbary jeszcze kosmetycznie.

**Posty:** 6 · przez **konrad567** 10 Maj 2008, 13:14

Ok wszystko zrobione ;D
Mam jeszcze 2 pytania i to chyba będzie wszystko ;D
1.Niektóre pliki przestały działać, to dlatego, że znajdowały się w nich wirusy i zostały one skasowane?
2.Czy teraz na komputerze nie mam już tych wirusów?

**Posty:** 8001 · przez **Okocza** 10 Maj 2008, 13:32

konrad567 napisał(a):1.Niektóre pliki przestały działać

jaki np

2.Czy teraz na komputerze nie mam już tych wirusów?

nie powinno być - przynajmniej wg logów

**Posty:** 7956 · przez **Magik** 10 Maj 2008, 13:35

konrad567 napisał(a):2.Czy teraz na komputerze nie mam już tych wirusów?

konrad567 napisał(a):Ok wszystko zrobione ;D

jakz robiles wsio wg. instrukcji prawidlowo to nie :wink:

konrad567 napisał(a):1.Niektóre pliki przestały działać, to dlatego, że znajdowały się w nich wirusy i zostały one skasowane?

Z loga widze uzywasz avast'a. On ma taka opcje VRDB. Za pomocą VRDB można naprawić zarażone pliki (przywrócić do stanu oryginalnego......Jesli podazales za wskazowkami moich kolegow to plikow wykonywalnych etc nie usuwales......

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **konrad567** 10 Maj 2008, 13:42

Tylko, że Avasta też skasowało xD
Skasowało chyba tylko pliki z końcówka "exe" ale w nich były wirusy (zgaduje, że win32:jeefo)
Ok zainstaluje Avasta, przeskanuje jeszcze raz kompa i chba będzie ok ;D
Wielkie Dzieki za pomoc :mrgreen:

**Posty:** 8001 · przez **Okocza** 10 Maj 2008, 13:42

konrad567 napisał(a):Wielkie Dzieki za pomoc

nie ma problemu. od tego tu jesteśmy

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **konrad567** 10 Maj 2008, 14:09

Jeszcze jedno pytanie(napisze tutaj, bo nie chcę zakładać nowego tematu)
Skanowałem komputer i było czysto(no jednego wirusa znalazł a przeskanował 90% kompa i nagle w C:\WINDOWS\$hf_mig$\...\... zaczął znajdować wirusy (Win 32:jeefo) i tu jest problem, mogę to spokojnie kasować avastem(naprawić się nie da) czy coś innego z tym zrobić?

**Posty:** 7956 · przez **Magik** 10 Maj 2008, 14:13

konrad567 napisał(a):C:\WINDOWS\$hf_mig$\...\...

Katalog nazwa daleko odbiega od systemowego, zasadniczo wogole nim nie jest pewnie ze usuwaj

konrad567 napisał(a):Win 32:jeefo

a to badziewie faktycznie niszczy pliki "sterujace" avastem, WMP itd.......

**Posty:** 8001 · przez **Okocza** 10 Maj 2008, 14:13

kasuj avastem

problem z virusami

Problem z virusami

Zrobione ;]

Kto jest na forum