proces zabiera 100% procesora

[emaniek]

witam, moze ktos przejrzec loga, bo mi proces zabiera 100% procesora:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:58:37, on 2007-10-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
C:\WINDOWS\perfmon.exe
C:\WINDOWS\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\system32\winn\winn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CounterPath\X-Lite\x-lite.exe
C:\Program Files\RivChat2\RivChat.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\perfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hurtownia.arti.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [winn] C:\WINDOWS\system32\winn\winn.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\CounterPath\X-Lite\x-lite.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RivChat (2).lnk = C:\Program Files\RivChat2\RivChat.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\win_m.dll
O21 - SSODL: msvcrt64.dll - {B1A5809F-7E1E-4C89-8302-8E1FE32FE81F} - msvcrt64.dll (file missing)
O21 - SSODL: VStorage - {59EAAEFC-2CD9-4C07-B15D-37535ED31146} - swmclip.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
O23 - Service: Performance Monitor - Unknown owner - C:\WINDOWS\perfmon.exe
O23 - Service: Printer Spooler Service (Spoolsv) - Unknown owner - C:\WINDOWS\spoolsv.exe
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

--
End of file - 3543 bytes

[DeadOrAlive]

ale jaki proces
uruchom menadżer zadań i sprawdź

[Dzi@dek]

Popraw loga - obejmij w tagi CODE lub QUOTE

Brak antywirusa w systemie.

[emaniek]

proces to "explorer"

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:58:37, on 2007-10-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
C:\WINDOWS\perfmon.exe
C:\WINDOWS\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\system32\winn\winn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CounterPath\X-Lite\x-lite.exe
C:\Program Files\RivChat2\RivChat.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\perfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hurtownia.arti.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [winn] C:\WINDOWS\system32\winn\winn.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\CounterPath\X-Lite\x-lite.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RivChat (2).lnk = C:\Program Files\RivChat2\RivChat.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\win_m.dll
O21 - SSODL: msvcrt64.dll - {B1A5809F-7E1E-4C89-8302-8E1FE32FE81F} - msvcrt64.dll (file missing)
O21 - SSODL: VStorage - {59EAAEFC-2CD9-4C07-B15D-37535ED31146} - swmclip.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
O23 - Service: Performance Monitor - Unknown owner - C:\WINDOWS\perfmon.exe
O23 - Service: Printer Spooler Service (Spoolsv) - Unknown owner - C:\WINDOWS\spoolsv.exe
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

zastosuj rowniez SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje


Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka oraz combofixa

[emaniek]

ComboFix 07-10-26.4 - HANDOWIEC02 2007-10-26 18:25:48.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.178 [GMT 2:00]
Running from: C:\Documents and Settings\HANDOWIEC02\Ustawienia lokalne\Temporary Internet Files\Content.IE5\YMR3S3QT\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\hosts
C:\WINDOWS\system32\scmt16.exe
C:\WINDOWS\system32\tmp_7v2.exe

.
((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 )))))))))))))))))))))))))))))))
.

2007-10-26 18:25 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-26 18:20 <DIR> d-------- C:\WINDOWS\LastGood
2007-10-26 18:15 <DIR> d-------- C:\WINDOWS\ERUNT
2007-10-26 18:08 1,744 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 15:58 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-26 14:14 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-25 15:15 <DIR> d--hs---- C:\FOUND.006
2007-10-25 13:28 6,016 --a------ C:\WINDOWS\system32\drivers\vnccom.SYS
2007-10-25 13:26 <DIR> d-------- C:\Program Files\UltraVNC
2007-10-25 13:26 12,800 --a------ C:\WINDOWS\system32\vncdrv.dll
2007-10-25 13:26 5,760 --a------ C:\WINDOWS\system32\vnchelp.dll
2007-10-25 13:26 4,736 --a------ C:\WINDOWS\system32\drivers\vncdrv.sys
2007-10-25 13:22 <DIR> d-------- C:\Program Files\CounterPath
2007-10-25 13:22 <DIR> d-------- C:\Program Files\Common Files\Intel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2006-04-05 14:52 0 ----a-w C:\Program Files\pnqcnv.exe
2005-09-09 17:55 37,766,164 ----a-w C:\Program Files\Data1.cab
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe" [2002-02-20 13:50]
"AudioDeck"="C:\Program Files\VIAudioi\SBADeck\ADeck.exe" [2004-07-13 14:43]
"winn"="C:\WINDOWS\system32\winn\winn.exe" [2006-11-27 15:50]
"WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2006-06-18 14:56]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55]
"eyeBeam SIP Client"="C:\Program Files\CounterPath\X-Lite\x-lite.exe" [2007-06-05 08:52]

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\
OpenOffice.org 2.0.2.lnk - C:\Program Files\OpenOffice.org 2.0.2\program\quickstart.exe [2006-03-12 01:12:44]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
RivChat (2).lnk - C:\Program Files\RivChat2\RivChat.exe [2006-09-21 14:30:19]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msvcrt64.dll"= {B1A5809F-7E1E-4C89-8302-8E1FE32FE81F} - msvcrt64.dll [ ]
"VStorage"= {59EAAEFC-2CD9-4C07-B15D-37535ED31146} - swmclip.dll [ ]
"msvcrt52.dll"= {B9585948-0BAF-45CD-B5D3-CD6E96CA8047} - msvcrt52.dll [ ]

R1 VFILT;Outpost Firewall Kernel Driver;\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\2000\FILTNT.SYS
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\ADBLOCK.DLL
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\CONTENT.DLL
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\DNSCACHE.DLL
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\FTPFILT.DLL
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\HTMLFILT.DLL
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\HTTPFILT.DLL
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\IMAPFILT.DLL
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\MAILFILT.DLL
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\NNTPFILT.DLL
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\POP3FILT.DLL
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\C:\PROGRA~1\AGNITUM\OUTPOS~1.0\kernel\PROTECT.DLL
R3 vncdrv;vncdrv;C:\WINDOWS\system32\DRIVERS\vncdrv.sys

*Newly Created Service* - BITS
*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-26 18:26:56
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32msvcrt52.dll 16384 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2007-10-26 18:27:28
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:19, on 2007-10-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\system32\winn\winn.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CounterPath\X-Lite\x-lite.exe
C:\Program Files\RivChat2\RivChat.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arti.home.pl/hurtownia/index.php?cPath=32&osCsid=1bdd3e74d92e34d20d46cba808eb60e6
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [winn] C:\WINDOWS\system32\winn\winn.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\CounterPath\X-Lite\x-lite.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RivChat (2).lnk = C:\Program Files\RivChat2\RivChat.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: msvcrt64.dll - {B1A5809F-7E1E-4C89-8302-8E1FE32FE81F} - msvcrt64.dll (file missing)
O21 - SSODL: VStorage - {59EAAEFC-2CD9-4C07-B15D-37535ED31146} - swmclip.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\AGNITUM\OUTPOS~1.0\outpost.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

--
End of file - 3070 bytes

SDFix: Version 1.112

Run by HANDOWIEC02 on 2007-10-26 at 18:15

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
Performance Monitor
Spoolsv
Windows Log

ImagePath:
C:\WINDOWS\perfmon.exe
C:\WINDOWS\spoolsv.exe
C:\WINDOWS\system32\nvsvcd.exe

Performance Monitor - Deleted
Spoolsv - Deleted
Windows Log - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing SharedAccess Service
Resetting AppInit_DLLs value


Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\WIN_M.DLL - Deleted
C:\Documents and Settings\HANDOWIEC02\Dane aplikacji\Install.dat - Deleted
C:\WINDOWS\csrss.exe - Deleted
C:\WINDOWS\perfmon.exe - Deleted
C:\WINDOWS\spoolsv.exe - Deleted
C:\WINDOWS\system\smss.exe - Deleted
C:\WINDOWS\system32\body.html - Deleted
C:\WINDOWS\system32\body.plain - Deleted
C:\WINDOWS\system32\dllcache\checkweb.dll - Deleted
C:\WINDOWS\system32\headers.mail - Deleted
C:\WINDOWS\system32\image.b64 - Deleted
C:\WINDOWS\system32\nvsvcd.exe - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\Explorer.EXE"="C:\\WINDOWS\\explorer.exe:*:Enabled:Explorer"
"C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\69exmodul32f.f.exe"="C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\69exmodul32f.f.exe:*:Enabled:Microsoft Update"
"C:\\WINDOWS\\TEMP\\38exmodul32f.f.exe"="C:\\WINDOWS\\TEMP\\38exmodul32f.f.exe:*:Enabled:Microsoft Update"
"C:\\WINDOWS\\TEMP\\31exmodul32f.f.exe"="C:\\WINDOWS\\TEMP\\31exmodul32f.f.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\9exmodul32f.i.exe"="C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\9exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\17exmodul32f.i.exe"="C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\17exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\57exmodul32f.i.exe"="C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\57exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\62exmodul32f.i.exe"="C:\\DOCUME~1\\HANDOW~1\\USTAWI~1\\Temp\\62exmodul32f.i.exe:*:Enabled:Microsoft Update"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 4 Dec 2006 10,561 ...HR --- "C:\WINDOWS\system32\tmp_7v2.exe"

Finished!

[wojtas]

skasuj te wpisy w hijacku:

O4 - HKLM\..\Run: [winn] C:\WINDOWS\system32\winn\winn.exe
O21 - SSODL: msvcrt64.dll - {B1A5809F-7E1E-4C89-8302-8E1FE32FE81F} - msvcrt64.dll (file missing)
O21 - SSODL: VStorage - {59EAAEFC-2CD9-4C07-B15D-37535ED31146} - swmclip.dll (file missing)

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\msvcrt52.dll
C:\Program Files\pnqcnv.exe

Folder::
C:\WINDOWS\system32\winn
C:\FOUND.006

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa