problem z windowsem

[alex11]

mam problem z windowsem. podejrzewam ze to jakis wirus. jakies 15min temu gdy chcialem wlaczyc komputer pojawil mi sie komunikat z windowsa i wybralem tryb awaryjny . oczywiscie wylaczylem komputer ( nie wiedzialem w czym tkwi problem, dlatego go wylaczylem). i po chwili znow wlaczylem,(nie wiem jaki cudem )komputer mi sie normalnie wlaczyl

prosze o pomoc

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 19:17:41, on 2007-11-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Konnekt\konnekt.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Programy\log\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1045
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [KAVWks50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 5.0 for Windows Workstations\kav.exe" /minimize /chkas
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{778CCA48-6144-4F35-9A86-3734CE15C217}: NameServer = 212.85.112.32,193.110.121.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C0A38B2-C721-4524-83CD-CF5A8CF14734}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Usługa Kaspersky Anti-Virus (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 5.0 for Windows Workstations\kavsvc.exe



[wojtas]

czysto daj loga z combofixa

[alex11]

Kod: Zaznacz wszystko

ComboFix 07-11-08.1 - Dominik 2007-11-15 19:56:04.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.165 [GMT 1:00]
Running from: C:\Documents and Settings\Dominik\Pulpit\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2007-10-15 to 2007-11-15  )))))))))))))))))))))))))))))))
.

2007-11-15 19:55   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-11-15 07:20   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-11-14 16:08   <DIR>   d--------   C:\Program Files\CApack
2007-11-10 12:01   <DIR>   d--------   C:\Program Files\BearShare
2007-11-10 12:01   <DIR>   d--------   C:\My Downloads
2007-10-31 13:18   <DIR>   d--------   C:\spoolerlogs
2007-10-28 18:06   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Anti-Virus for Windows Workstations

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-15 18:00   ---------   d-----w   C:\Program Files\neostrada tp
2007-11-15 06:12   ---------   d-----w   C:\Program Files\SokkerViewer
2007-11-14 16:58   ---------   d-----w   C:\Documents and Settings\Dominik\Dane aplikacji\Hamachi
2007-11-13 18:53   ---------   d-----w   C:\Documents and Settings\Dominik\Dane aplikacji\Skype
2007-10-15 18:25   ---------   d-----w   C:\Program Files\Winamp
2007-10-06 12:46   ---------   d-----w   C:\Program Files\Hamachi
2007-10-06 12:45   25,544   ----a-w   C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-01 14:22   60,416   ----a-w   C:\WINDOWS\ALCFDRTM.EXE
2007-09-30 18:38   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-09-30 18:38   ---------   d-----w   C:\Program Files\ATI Technologies
2007-09-30 14:50   107,888   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2007-09-30 14:50   ---------   d--h--r   C:\Documents and Settings\Dominik\Dane aplikacji\SecuROM
2007-09-29 08:16   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-09-28 14:31   43,520   ----a-w   C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-25 16:04   451,072   ----a-w   C:\WINDOWS\Radeon Omega Drivers v3.8.221 Uninstall.exe
2007-09-25 16:04   ---------   d-----w   C:\Program Files\MultiRes
2007-09-24 17:37   ---------   d-----w   C:\Program Files\Real Alternative
2007-09-24 17:37   ---------   d-----w   C:\Program Files\Media Player Classic
2007-09-24 17:37   ---------   d-----w   C:\Documents and Settings\Dominik\Dane aplikacji\Media Player Classic
2007-09-24 15:17   ---------   d-----w   C:\Program Files\DirectShow Pack
2007-09-24 14:01   ---------   d-----w   C:\Program Files\ACE Mega CoDecS Pack
2007-09-24 14:00   ---------   d-----w   C:\Program Files\DivX
2007-09-24 13:58   ---------   d-----w   C:\Program Files\ffdshow
2007-09-24 13:54   ---------   d-----w   C:\Program Files\NimoCodec Pack
2007-09-24 13:51   ---------   d-----w   C:\Program Files\AC3Filter
2007-09-22 17:00   ---------   d-----w   C:\Program Files\Mistrz Klawiatury II Demo
2007-09-22 16:37   ---------   d-----w   C:\Program Files\Yahoo!
2007-09-22 07:51   ---------   d-----w   C:\Program Files\MarBit
2007-09-21 15:27   ---------   d-----w   C:\Program Files\AMR Converter Pro
2007-09-20 15:36   ---------   d-----w   C:\Program Files\Common Files\Adobe
2007-09-16 19:28   ---------   d-----w   C:\Program Files\TVAnts
2007-09-16 15:02   ---------   d-----w   C:\Program Files\SopCast
2007-09-16 15:02   ---------   d-----w   C:\Documents and Settings\Dominik\Dane aplikacji\SopCast
2007-09-16 09:18   ---------   d-----w   C:\Program Files\HyCam2
2007-09-15 15:14   ---------   d-----w   C:\Documents and Settings\Dominik\Dane aplikacji\The Bat!
2007-09-15 12:42   ---------   d-----w   C:\Program Files\Gadu-Gadu
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 08:34 C:\WINDOWS\SOUNDMAN.EXE]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"autoclk"="autoclk.exe" []
"adiras"="adiras.exe" []
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 15:55]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 16:05]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 20:10]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22]
"KAVWks50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 5.0 for Windows Workstations\kav.exe" [2006-07-12 19:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 22:41]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-09-04 19:24:57]

R1 klmc;Sterownik KLMC;C:\WINDOWS\system32\drivers\klmc.sys
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff81006d-5a07-11dc-8e1e-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 19:58:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-11-15 19:59:25
.
   --- E O F ---


[wojtas]

czysto

Autor postu otrzymał pochwałę

[alex11]

ok, dziex