prośba o sprawdzenie loga

**Posty:** 32 · przez **Jdoom** 27 Paź 2007, 21:26

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:22:06, on 2007-10-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Agnitum\Outpost Firewall\outpost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Tlen.pl\tlen.exe E:\Download\Nowy folder\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O15 - Trusted Zone: http://www.kaspersky.pl O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9B5136B7-E44B-406D-9778-0DB51548140B}: NameServer = 85.255.114.22,85.255.112.205 O17 - HKLM\System\CCS\Services\Tcpip\..\{B883CB21-9917-41F3-B204-80AAF2025C7A}: NameServer = 85.255.114.22,85.255.112.205 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 4923 bytes

dlatego wrzuciłem loga (może robak):
http://forum.programosy.pl/internet-radiowy-zanik-netu-vt85255.html

przez **jeff** 27 Paź 2007, 21:30

napisz dlaczego wrzucasz log

**Posty:** 3854 · przez **Dzi@dek** 27 Paź 2007, 22:08

Zastosuj Fixwareout

Później skasuj w HJ te wpisy:

O17 - HKLM\System\CCS\Services\Tcpip\..\{9B5136B7-E44B-406D-9778-0DB51548140B}: NameServer = 85.255.114.22,85.255.112.205
O17 - HKLM\System\CCS\Services\Tcpip\..\{B883CB21-9917-41F3-B204-80AAF2025C7A}: NameServer = 85.255.114.22,85.255.112.205
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205

i nowy log po zabiegu.

**Posty:** 32 · przez **Jdoom** 28 Paź 2007, 09:59

hmmm.... ale coś jest nie tak?

przez **jeff** 28 Paź 2007, 10:12

Do tego adresu ip: 85.255.112.205
nie jest przyporządkowana żadna nazwa hostu.

Nazwa sieci: inhoster
Kraj: UA
Pula adresów IP: 85.255.112.0 - 85.255.127.255

Opis sieci:
Inhoster hosting company
OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine

Dane adresowe sieci:
OOO Inhoster
Poltavskij Shliax 24, Xarkov,
61000, Ukraine
OOO Inhoster,
ul.Antonova 5, Kiev,
03186, Ukraine

:mrgreen:

zrób co każe Dzi@dek

**Posty:** 32 · przez **Jdoom** 28 Paź 2007, 10:27

Tak, tak nie wiem czemu ale to już od 2 lat zmienia mi sie samo ip, i mam 4 ip
z których mogę pobierać :wink:

(rapid). Co do Fixwareout to coś tam wyczyścił. Nie wiem jak skanować konkretne wpisy więc :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:16:35, on 2007-10-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe E:\Download\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O15 - Trusted Zone: http://www.kaspersky.pl O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 3738 bytes

**Posty:** 237 · przez **Kuba1** 28 Paź 2007, 11:32

To są ukrainskie DNS-y, masz poprostu infekcje Rootkit Windows Security Center

Uruchom Hijackthis>>Do a system scan>>Zaznacz poniższy wpis i wcisnij Fix Checked

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.22 85.255.112.205

Następnie daj logi z Hijackthis,Silentrunners raport z FixWareOut (C:\fixwareout\report.txt) oraz log z ComboFix

**Posty:** 32 · przez **Jdoom** 28 Paź 2007, 12:01

Wszystkie skany robione w Trybie Awaryjnym:
Hj:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:45:45, on 2007-10-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe E:\Download\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O15 - Trusted Zone: http://www.kaspersky.pl O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 3679 bytes

combofix:

Kod: Zaznacz wszystko: ComboFix 07-10-26.4 - Administrator 2007-10-28 10:49:08.1 - [color=red][b]FAT32[/b][/color]x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2294 [GMT 1:00] Running from: E:\Download\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\Cfx32.lic C:\WINDOWS\system32\cfx32.ocx . ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-28 ))))))))))))))))))))))))))))))) . 2007-10-28 10:48 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-27 21:10 <DIR> d-------- C:\Program Files\SkanerOnline 2007-10-25 18:03 <DIR> d-------- C:\Program Files\Hamachi 2007-10-15 19:43 <DIR> d-------- C:\Program Files\DivX 2007-10-10 19:00 584,192 --------- C:\WINDOWS\system32\DllCache\rpcrt4.dll 2007-10-04 22:24 <DIR> d-------- C:\Program Files\Joost 2007-10-04 22:24 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Joost . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-27 21:31 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-27 21:31 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-25 17:40 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-24 13:51 --------- d-----w C:\Program Files\NiemPol 2007-09-17 14:07 --------- d-----w C:\Program Files\GameSpy Arcade 2007-09-12 21:54 --------- d-----w C:\Program Files\Alcohol Toolbar 2007-09-11 21:58 512 ----a-w C:\drmHeader.bin 2007-09-11 19:56 --------- d-----w C:\Program Files\MGrenda 2007-09-11 19:48 161,469 ----a-w C:\WINDOWS\EXPStudio's Audio Converter FREE Uninstaller.exe 2007-09-11 19:48 --------- d-----w C:\Program Files\EXPStudio 2007-09-10 19:53 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-09-05 15:27 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll 2007-09-05 15:27 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll 2007-09-05 15:27 167,936 ----a-w C:\WINDOWS\system32\ts.dll 2007-09-05 15:27 151,040 ----a-w C:\WINDOWS\system32\mkx.dll 2007-09-05 15:27 142,848 ----a-w C:\WINDOWS\system32\mp4.dll 2007-08-31 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-08-31 11:13 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Bioshock 2007-08-30 18:55 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-08-28 11:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Age of Empires 3 2007-08-22 14:19 96,768 ------w C:\WINDOWS\system32\DllCache\inseng.dll 2007-08-22 14:19 661,504 ------w C:\WINDOWS\system32\DllCache\wininet.dll 2007-08-22 14:19 616,448 ------w C:\WINDOWS\system32\DllCache\urlmon.dll 2007-08-22 14:19 55,808 ------w C:\WINDOWS\system32\DllCache\extmgr.dll 2007-08-22 14:19 532,480 ------w C:\WINDOWS\system32\DllCache\mstime.dll 2007-08-22 14:19 474,112 ------w C:\WINDOWS\system32\DllCache\shlwapi.dll 2007-08-22 14:19 449,024 ------w C:\WINDOWS\system32\DllCache\mshtmled.dll 2007-08-22 14:19 39,424 ------w C:\WINDOWS\system32\DllCache\pngfilt.dll 2007-08-22 14:19 357,888 ------w C:\WINDOWS\system32\DllCache\dxtmsft.dll 2007-08-22 14:19 3,079,168 ------w C:\WINDOWS\system32\DllCache\mshtml.dll 2007-08-22 14:19 251,392 ------w C:\WINDOWS\system32\DllCache\iepeers.dll 2007-08-22 14:19 205,312 ------w C:\WINDOWS\system32\DllCache\dxtrans.dll 2007-08-22 14:19 16,384 ------w C:\WINDOWS\system32\DllCache\jsproxy.dll 2007-08-22 14:19 151,552 ------w C:\WINDOWS\system32\DllCache\cdfview.dll 2007-08-22 14:19 146,432 ------w C:\WINDOWS\system32\DllCache\msrating.dll 2007-08-22 14:19 1,494,528 ------w C:\WINDOWS\system32\DllCache\shdocvw.dll 2007-08-22 14:19 1,055,744 ------w C:\WINDOWS\system32\DllCache\danim.dll 2007-08-22 14:19 1,022,976 ------w C:\WINDOWS\system32\DllCache\browseui.dll 2007-08-21 11:30 18,432 ------w C:\WINDOWS\system32\DllCache\iedw.exe 2007-08-21 07:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 07:18 683,520 ------w C:\WINDOWS\system32\DllCache\inetcomm.dll 2007-08-15 15:15 49,152 ----a-w C:\WINDOWS\system32\apache.dll 2007-08-14 18:57 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 18:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 18:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-04-07 12:18] "OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-10-30 16:07] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 17:34] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43] "nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43] "Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-10-20 14:49] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-03 23:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=01000000 "NoLogoff"=01000000 "NoRecentDocsMenu"=01000000 "NoSMMyDocs"=01000000 "NoSMMyPictures"=01000000 "NoSharedDocuments"=01000000 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "UPS"=3 (0x3) "mi-raysat_3dsmax8"=2 (0x2) "IviRegMgr"=2 (0x2) R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\drivers\lccfltr.sys R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys S1 SandBox;Outpost Firewall Sandbox Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS S1 VFILT;Outpost Firewall Kernel Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL S3 nocashio;nocashio;C:\WINDOWS\system32\drivers\nocashio.sys S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL S3 RT2400PCI;802.11b WLAN PCI;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16601a2e-1a7b-11dc-91bb-0008a16e6e3d}] AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command - [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16601a2f-1a7b-11dc-91bb-0008a16e6e3d}] AutoRun\command - [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ca5055e-e398-11db-913f-0008a16e6e3d}] AutoRun\command *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-28 10:50:15 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-28 10:50:28 . --- E O F ---

FWO:

Kod: Zaznacz wszystko: Username "Administrator" - 2007-10-28 10:47:15 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "system"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Other C:\WINDOWS\TEMP\kdqxl.ren 63968 2004-08-03 ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" "OutpostFeedBack"="C:\\Program Files\\Agnitum\\Outpost Firewall\\feedback.exe /dump:os_startup" "ISUSPM"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\ISUSPM.exe\" -scheduler" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "Outpost Firewall"="C:\\Program Files\\Agnitum\\Outpost Firewall\\outpost.exe /waitservice" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~

A tego wpisu nie było już jak tera skana zrobiłem.

[ Dodano: Dzisiaj o 15:57 ]
Chłopaki wszystko się kopie... Znaki polskie zamieniły sie na chyba czeskie w DOS. Mam coraz większe problemy z netem oraz ogólnie z kompem - on wariuje . ....Pomocy...

**Posty:** 18165 · przez **wojtas** 28 Paź 2007, 18:36

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16601a2e-1a7b-11dc-91bb-0008a16e6e3d}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16601a2f-1a7b-11dc-91bb-0008a16e6e3d}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ca5055e-e398-11db-913f-0008a16e6e3d}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje
Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 32 · przez **Jdoom** 28 Paź 2007, 20:24

Zrobiłem :

Kod: Zaznacz wszystko: SDFix: Version 1.90 Run by Todd on Tue 07/10/2007 at 03:28 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOCUME~1\Todd\Desktop\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\Documents and Settings\Todd\Start Menu\Programs\Startup\lsass.lnk - Deleted C:\WINDOWS\system32\taskkill.com - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:ćTorrent" "C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Documents and Settings\\Todd\\Desktop\\WoW-BurningCrusade-enUS-Installer-downloader.exe"="C:\\Documents and Settings\\Todd\\Desktop\\WoW-BurningCrusade-enUS-Installer-downloader.exe:*:Enabled:Blizzard Downloader" "C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET" "C:\\Program Files\\Wolfenstein - Enemy Territory\\ETDED.exe"="C:\\Program Files\\Wolfenstein - Enemy Territory\\ETDED.exe:*:Enabled:ETDED" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\Java\\jre1.6.0_01\\launch4j-tmp\\RKMediaCenter.exe"="C:\\Program Files\\Java\\jre1.6.0_01\\launch4j-tmp\\RKMediaCenter.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" Remaining Files: --------------- Backups Folder: - C:\DOCUME~1\Todd\Desktop\SDFix\backups\backups.zip Files with Hidden Attributes: C:\WINDOWS\system32\kpctecqlmh\lsass.exe C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Finished

**Posty:** 18165 · przez **wojtas** 28 Paź 2007, 23:14

Otworz notatnik i wklej w nim to:

Folder::
C:\WINDOWS\system32\kpctecqlmh

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 32 · przez **Jdoom** 29 Paź 2007, 17:12

Kod: Zaznacz wszystko: ComboFix 07-10-29.1 - Administrator 2007-10-29 16:05:00.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2056 [GMT 1:00] Running from: C:\ComboFix.exe Command switches used :: C:\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\nvrssk.dll C:\WINDOWS\system32\nvrssl.dll . ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-29 ))))))))))))))))))))))))))))))) . 2007-10-29 16:02 1,529,995 --a------ C:\ComboFix.exe 2007-10-28 18:41 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-28 13:41 <DIR> d-------- C:\Nowy folder 2007-10-28 10:48 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-27 21:10 <DIR> d-------- C:\Program Files\SkanerOnline 2007-10-25 18:03 <DIR> d-------- C:\Program Files\Hamachi 2007-10-15 19:43 <DIR> d-------- C:\Program Files\DivX 2007-10-10 19:00 584,192 --------- C:\WINDOWS\system32\DllCache\rpcrt4.dll 2007-10-04 22:24 <DIR> d-------- C:\Program Files\Joost 2007-10-04 22:24 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Joost . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-28 15:37 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-28 15:36 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-25 17:40 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-24 13:51 --------- d-----w C:\Program Files\NiemPol 2007-09-17 14:07 --------- d-----w C:\Program Files\GameSpy Arcade 2007-09-12 21:54 --------- d-----w C:\Program Files\Alcohol Toolbar 2007-09-11 21:58 512 ----a-w C:\drmHeader.bin 2007-09-11 19:56 --------- d-----w C:\Program Files\MGrenda 2007-09-11 19:48 161,469 ----a-w C:\WINDOWS\EXPStudio's Audio Converter FREE Uninstaller.exe 2007-09-11 19:48 --------- d-----w C:\Program Files\EXPStudio 2007-09-10 19:53 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-09-05 15:27 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll 2007-09-05 15:27 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll 2007-09-05 15:27 167,936 ----a-w C:\WINDOWS\system32\ts.dll 2007-09-05 15:27 151,040 ----a-w C:\WINDOWS\system32\mkx.dll 2007-09-05 15:27 142,848 ----a-w C:\WINDOWS\system32\mp4.dll 2007-08-31 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-08-31 11:13 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Bioshock 2007-08-30 18:55 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-08-28 11:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Age of Empires 3 2007-08-22 14:19 96,768 ------w C:\WINDOWS\system32\DllCache\inseng.dll 2007-08-22 14:19 661,504 ------w C:\WINDOWS\system32\DllCache\wininet.dll 2007-08-22 14:19 616,448 ------w C:\WINDOWS\system32\DllCache\urlmon.dll 2007-08-22 14:19 55,808 ------w C:\WINDOWS\system32\DllCache\extmgr.dll 2007-08-22 14:19 532,480 ------w C:\WINDOWS\system32\DllCache\mstime.dll 2007-08-22 14:19 474,112 ------w C:\WINDOWS\system32\DllCache\shlwapi.dll 2007-08-22 14:19 449,024 ------w C:\WINDOWS\system32\DllCache\mshtmled.dll 2007-08-22 14:19 39,424 ------w C:\WINDOWS\system32\DllCache\pngfilt.dll 2007-08-22 14:19 357,888 ------w C:\WINDOWS\system32\DllCache\dxtmsft.dll 2007-08-22 14:19 3,079,168 ------w C:\WINDOWS\system32\DllCache\mshtml.dll 2007-08-22 14:19 251,392 ------w C:\WINDOWS\system32\DllCache\iepeers.dll 2007-08-22 14:19 205,312 ------w C:\WINDOWS\system32\DllCache\dxtrans.dll 2007-08-22 14:19 16,384 ------w C:\WINDOWS\system32\DllCache\jsproxy.dll 2007-08-22 14:19 151,552 ------w C:\WINDOWS\system32\DllCache\cdfview.dll 2007-08-22 14:19 146,432 ------w C:\WINDOWS\system32\DllCache\msrating.dll 2007-08-22 14:19 1,494,528 ------w C:\WINDOWS\system32\DllCache\shdocvw.dll 2007-08-22 14:19 1,055,744 ------w C:\WINDOWS\system32\DllCache\danim.dll 2007-08-22 14:19 1,022,976 ------w C:\WINDOWS\system32\DllCache\browseui.dll 2007-08-21 11:30 18,432 ------w C:\WINDOWS\system32\DllCache\iedw.exe 2007-08-21 07:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 07:18 683,520 ------w C:\WINDOWS\system32\DllCache\inetcomm.dll 2007-08-15 15:15 49,152 ----a-w C:\WINDOWS\system32\apache.dll 2007-08-14 18:57 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 18:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 18:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-04-07 12:18] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 17:34] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43] "nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=01000000 "NoLogoff"=01000000 "NoRecentDocsMenu"=01000000 "NoSMMyDocs"=01000000 "NoSMMyPictures"=01000000 "NoSharedDocuments"=01000000 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "UPS"=3 (0x3) "mi-raysat_3dsmax8"=2 (0x2) "IviRegMgr"=2 (0x2) R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys R1 SandBox;Outpost Firewall Sandbox Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS R1 VFILT;Outpost Firewall Kernel Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\drivers\lccfltr.sys R3 RT2400PCI;802.11b WLAN PCI;C:\WINDOWS\system32\DRIVERS\RT2400.sys R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL S3 nocashio;nocashio;C:\WINDOWS\system32\drivers\nocashio.sys S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys . ************************************************************************** catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-29 16:07:37 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-29 16:08:25 - machine was rebooted . --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:10:36, on 2007-10-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O15 - Trusted Zone: http://www.kaspersky.pl O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE (file missing) -- End of file - 3852 bytes

no i...

[ Dodano: Dzisiaj o 16:19 ]
Aha, niech mnie ktoś proszę uświadomi co dolega mojemu kompowi..

Kuba1 napisał(a):masz poprostu infekcje Rootkit Windows Security Center

Czy tylko?

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 17:37

w logu jest czysto

**Posty:** 32 · przez **Jdoom** 29 Paź 2007, 17:42

W końcu!!! Niestety net dalej "zanika" !!! :cry:

Szczególnie Wojtas19162 - dzięki...
Aha mam jeszcze jeden problem, poza tym z powyżej netem, ale to szczegół jak zmienić znaki w DOS
te TU na polskie ( jak miałem poprzednio ). Zmieniły mi sie jak włączyłem combofixa ...

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 18:50

start>ustawienia>panel sterowania>opcje regionalne i jezykowe>jezyki>szczegoly>ustaw tam na jezyk programisty

**Posty:** 32 · przez **Jdoom** 29 Paź 2007, 19:30

Ja nie wiem - wszystko wiedzą....

A ten net przy sprawdzaniu pingu w DOS "ping wp.pl -t" przez jakiś czas wyświetla mi czas normalnie pingu ale później piszę że upłyną limit czasu żądania i po jakimś kolejnym od stępię czasu pisze że "Host docelowy jest nieosiągalny". I wtedy przy połączeniu sieciowym pisze "ograniczenie lub brak łączności z siecią". Czy to zanika sygnał?

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 19:33

u mnie sie dzieje to samo wiec jest ok

**Posty:** 32 · przez **Jdoom** 29 Paź 2007, 19:40

Jak to ok? Niedawno śmigało normalnie, czyli miałem połączenie z internetem przez cały czas, a teraz nie mogę ściągać plików większych niż 50mb, albo grać w Battlefielda 2 ,bo net przestaje później działać.,

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 19:53

czyli rozlacza sie internet? masz neostrade zapewne?

**Posty:** 32 · przez **Jdoom** 29 Paź 2007, 20:49

Net "nie działa" a nie się rozłącza, bo pokazuje że mam połączenie, przynajmniej aż do chwili gdy zobaczę komputerek z wykrzyknikiem w trójkącie w rogu...

wojtas19162 napisał(a):masz neostrade zapewne?

Nie zgadłeś mam radiówe. Prawdziwy admin siedzi w Poznaniu ( programista ) a do tego rzekomego pójdę jutro jak będzie i pogadam...

Jednak wina urządzenia... Ich wieża jest skopana...

prośba o sprawdzenie loga

prośba o sprawdzenie loga

Kto jest na forum