Problem z win32/heur.dropper

**Posty:** 6 · przez **hofander** 19 Lip 2009, 12:54

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:42:39, on 2009-07-19 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\wltrysvc.exe C:\WINNT\System32\bcmwltry.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\acs.exe C:\WINNT\system32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\wdfmgr.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINNT\System32\alg.exe C:\WINNT\system32\wbem\wmiapsrv.exe C:\WINNT\system32\wbem\wmiprvse.exe C:\WINNT\system32\igfxtray.exe C:\WINNT\system32\hkcmd.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\OSDCtrl.exe C:\Program Files\Launch Manager\Wbutton.exe C:\WINNT\SOUNDMAN.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINNT\system32\WLTRAY.exe C:\Program Files\Atheros\ACU.exe C:\Program Files\Google\Google Talk\googletalk.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe C:\WINNT\system32\wuauclt.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\utr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\NoAdware\NoAdware5.exe C:\Documents and Settings\Tysia\Moje dokumenty\Pobieranie\HiJackThis.exe C:\WINNT\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pajacyk.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\Documents and Settings\Tysia\yksqq.exe \s O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe" O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe" O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe" O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe" O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINNT\system32\WLTRAY O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [utr] C:\WINNT\system32\utr.exe \u O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll O23 - Service: Usługa konfiguracji Atheros (ACS) - Unknown owner - C:\WINNT\system32\acs.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINNT\System32\wltrysvc.exe -- End of file - 7907 bytes

**Posty:** 8001 · przez **Okocza** 19 Lip 2009, 13:08

hofander, a gdzie jakiś opis problemu? wróżkami nie jesteśmy jeszcze.

**Posty:** 6 · przez **hofander** 19 Lip 2009, 13:30

słuszna uwaga. przepraszam.
zostałem obdarzony wirusem, który jak mniemam infekuje pliki exe. AVG przenosi go do kwarantanny. Jak mogę pozbyć się tego trojana???
AVG nazywa go trojan horse generic14.EYB
komentarze na różnych forach napędziły mi strach, proszę o pomoc w pozbyciu się tego trojana

**Posty:** 8001 · przez **Okocza** 19 Lip 2009, 15:04

hofander, daj log z combofixa, bo w przypadku usuwania w hj wpisy dalej beda powracac

**Posty:** 6 · przez **hofander** 19 Lip 2009, 18:15

Kod: Zaznacz wszystko: ComboFix 09-07-19.01 - Tysia 2009-07-19 17:54.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.502.302 [GMT 2:00] Uruchomiony z: c:\documents and settings\Tysia\Moje dokumenty\Pobieranie\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\winnt\system32\kr_done1 . ((((((((((((((((((((((((( Pliki utworzone od 2009-06-19 do 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-19 11:56 . 2009-07-19 12:02 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-07-19 11:53 . 2009-07-19 12:03 -------- d-----w- c:\program files\Trojan Remover 2009-07-19 11:53 . 2009-07-19 11:53 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Simply Super Software 2009-07-19 11:51 . 2009-07-19 11:51 -------- d-----w- c:\program files\NCH Swift Sound 2009-07-19 10:27 . 2009-07-19 11:40 -------- d-----w- c:\program files\Ahead 2009-07-19 10:05 . 2009-07-19 11:02 -------- d-----w- c:\program files\NoAdware 2009-07-17 14:56 . 2009-02-06 10:10 227840 -c----w- c:\winnt\system32\dllcache\wmiprvse.exe 2009-07-17 14:56 . 2009-03-06 14:22 285696 -c----w- c:\winnt\system32\dllcache\pdh.dll 2009-07-17 14:56 . 2009-02-09 11:25 111104 -c----w- c:\winnt\system32\dllcache\services.exe 2009-07-17 14:56 . 2009-02-09 10:53 401408 -c----w- c:\winnt\system32\dllcache\rpcss.dll 2009-07-17 14:56 . 2009-02-09 10:53 473600 -c----w- c:\winnt\system32\dllcache\fastprox.dll 2009-07-17 14:56 . 2009-02-06 10:39 35328 -c----w- c:\winnt\system32\dllcache\sc.exe 2009-07-17 14:56 . 2009-02-09 10:53 686592 -c----w- c:\winnt\system32\dllcache\advapi32.dll 2009-07-17 14:56 . 2009-02-09 10:53 731136 -c----w- c:\winnt\system32\dllcache\lsasrv.dll 2009-07-17 14:55 . 2009-02-09 10:53 453120 -c----w- c:\winnt\system32\dllcache\wmiprvsd.dll 2009-07-17 14:55 . 2009-02-09 10:53 722944 -c----w- c:\winnt\system32\dllcache\ntdll.dll 2009-07-17 14:45 . 2008-10-03 10:04 247326 -c----w- c:\winnt\system32\dllcache\strmdll.dll 2009-07-17 14:44 . 2008-04-21 21:16 218112 -c----w- c:\winnt\system32\dllcache\wordpad.exe 2009-06-26 13:10 . 2009-06-26 13:10 -------- d-----w- c:\documents and settings\Tysia\Ustawienia lokalne\Dane aplikacji\AVG Security Toolbar 2009-06-26 09:34 . 2009-06-26 09:34 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\AVG Security Toolbar 2009-06-26 09:34 . 2009-06-26 09:34 -------- d-----w- c:\documents and settings\LocalService\Menu Start 2009-06-26 09:34 . 2009-06-26 09:34 -------- d-----w- c:\documents and settings\LocalService\Dane aplikacji\AVGTOOLBAR . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 11:23 . 2001-10-26 18:15 49910 ----a-w- c:\winnt\system32\perfc015.dat 2009-07-19 11:23 . 2001-10-26 18:15 356068 ----a-w- c:\winnt\system32\perfh015.dat 2009-07-19 11:22 . 2008-11-08 11:54 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\avg8 2009-07-19 09:02 . 2008-11-08 07:51 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-19 09:01 . 2008-12-31 17:19 -------- d-----w- c:\program files\NewTech Infosystems 2009-07-19 08:47 . 2008-12-31 17:18 1024 ------w- c:\winnt\system32\NTICDMK7.dll 2009-07-19 08:38 . 2008-12-31 17:18 1024 ------w- c:\winnt\system32\NTIMPEG2.dll 2009-07-19 08:38 . 2008-12-31 17:18 1024 ------w- c:\winnt\system32\NTIFCD3.dll 2009-07-19 08:38 . 2008-12-31 17:18 1024 ------w- c:\winnt\system32\NTIMP3.dll 2009-07-19 08:38 . 2008-12-31 17:17 6144 ------w- c:\winnt\system32\drivers\NTIDrvr.sys 2009-07-14 07:05 . 2008-11-08 17:39 -------- d-----w- c:\documents and settings\Tysia\Dane aplikacji\Winamp 2009-06-26 09:32 . 2008-11-08 11:54 11952 ------w- c:\winnt\system32\avgrsstx.dll 2009-06-26 09:32 . 2008-11-08 11:54 327688 ------w- c:\winnt\system32\drivers\avgldx86.sys 2009-06-26 09:32 . 2008-11-08 11:54 27784 ------w- c:\winnt\system32\drivers\avgmfx86.sys 2009-06-16 14:40 . 2006-05-13 14:26 119808 ------w- c:\winnt\system32\t2embed.dll 2009-06-16 14:40 . 2006-05-13 14:26 81920 ------w- c:\winnt\system32\fontsub.dll 2009-06-10 12:50 . 2008-11-08 07:54 -------- d-----w- c:\program files\Launch Manager 2009-06-03 19:11 . 2006-05-13 14:26 1294848 ------w- c:\winnt\system32\quartz.dll 2009-05-12 09:22 . 2008-11-08 11:54 108552 ------w- c:\winnt\system32\drivers\avgtdix.sys 2009-05-07 15:34 . 2004-08-04 00:44 347648 ------w- c:\winnt\system32\localspl.dll 2009-05-01 18:30 . 2009-05-01 18:30 3366912 ------w- c:\winnt\system32\GPhotos.scr 2009-07-16 01:02 . 2008-11-08 09:24 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-14 14:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\ctfmon.exe" [2008-04-14 15360] "Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-02-16 9302632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\winnt\system32\WLTRAY" [X] "IgfxTray"="c:\winnt\system32\igfxtray.exe" [2005-01-23 155648] "HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2005-01-23 126976] "LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-03-30 32768] "PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208] "LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-06-06 69632] "CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480] "LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2005-06-06 241664] "Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-06-21 81920] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 102490] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 708698] "ACU"="c:\program files\Atheros\ACU.exe" [2005-01-31 253952] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-26 1948440] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-20 148888] "SoundMan"="SOUNDMAN.EXE" - c:\winnt\SOUNDMAN.EXE [2005-04-15 77824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-06-26 09:32 11952 ------w- c:\winnt\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= R1 AvgLdx86;AVG AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [2008-11-08 327688] R1 AvgTdiX;AVG8 Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [2008-11-08 108552] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-06-26 906520] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-06-26 298776] R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-11-08 2343] S1 mailKmd;mailKmd; [x] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe HKLM-Run-utr - c:\winnt\system32\utr.exe . ------- Skan uzupełniający ------- . uLocal Page = \blank.htm uStart Page = hxxp://www.pajacyk.pl/ uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\winnt\system32\GPhotos.scr/200 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Tysia\Dane aplikacji\Mozilla\Firefox\Profiles\95trg8bt.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - www.pajacyk.pl FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 18:00 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(672) c:\winnt\System32\BCMLogon.dll . Czas ukończenia: 2009-07-19 18:02 ComboFix-quarantined-files.txt 2009-07-19 16:02 Przed: 791 896 064 bajtów wolnych Po: 846 778 368 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINNT [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINNT="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 211 --- E O F --- 2009-07-17 15:37

teraz już będzie ok ?

**Posty:** 18165 · przez **wojtas** 19 Lip 2009, 18:39

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **hofander** 19 Lip 2009, 18:47

dzięki

**Posty:** 5 · przez **WojaS_PL** 21 Lip 2009, 23:17

Witam. Mam dokładnie ten sam problem co hofander więc uznałem że zakładanie tego samego tematu będzie bez sensu. Moje pytanie : Czy mam postępować dokładnie tak samo jak poradził wojtas czy też mam dać do okazania log np. z ComboFix'a ?? Moimi objawami są długie oczekiwania na uruchomienie się niektórych programów np. FireFox'a, i non-stop AVG wyświetla mi jakiś komunikat z E-mail Scanner że łączy się z jakimiś IP. Wyskakuje : Connecting to "IP" i tak w kółko. Proszę pomóżcie mi. Z góry dziękuję.

Pozdrawiam !!

**Posty:** 8001 · przez **Okocza** 22 Lip 2009, 10:07

WojaS_PL, załóż swój temat i daj log z RSIT w nim.