proszę o pomoc i sprawdzenie loga

**Posty:** 4 · przez **NaVySebaPro** 16 Kwi 2007, 03:19

Witam Wszystkich !

Od 3 dni mam problemy z internetem.. mianowicie ping mi skacze i mam packet lossy, w gry online nie da sie grac ;/ Wpisalem w uruchom cmd potem tracert wp.pl i prawie za kazdym razem juz w pierwszej linijce mam wysoki ping, czyli wynikałoby jakoby wina takiego stanu mojego łącza lezała po mojej stronie a nie TP (mam neostrade 512).. skanowalem kompa panda, ktora okazala sie zainfekowana, nastepnie spyware doctorem i mksvir-em i po usunieciu wirusow problem wystepuje nadal, wiec zamieszczam swoj log z hijackthisa i i licze na Wasza pomoc:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 03:03:30, on 2007-04-16 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvraidservice.exe C:\Program Files\Razer\razertra.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\wbem\unsecapp.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Seba\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1AE7AE46-1586-3901-A34A-66E34F9FFDEF} - C:\WINDOWS\System32\mmlx.dll (file missing) O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: VPNS System - {A5845A98-EBDA-4670-9DE6-5201C506E741} - C:\WINDOWS\iedrives.dll (file missing) O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Anti-Virus Update Scheduler] C:\DOCUME~1\Seba\USTAWI~1\Temp\E.tmp O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent O4 - HKCU\..\Run: [adirka] C:\WINDOWS\System32\adirka.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5E07FE3A-EAED-4806-B09E-B2CC9434D685}: NameServer = 194.204.159.1 217.98.63.164 O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll O23 - Service: Client IP-IPX - Unknown owner - -e,te-110-12-0000271, (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

**Posty:** 1425 · przez **Mały22222** 16 Kwi 2007, 07:28

wstaw loga w tagi( zazancz caly log i nacisnij quote)

**Posty:** 18165 · przez **wojtas** 16 Kwi 2007, 15:20

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługe DClient IP-IPX
oraz Network Windows Service
Otwórz hijackthis -> open misc tools section -> delete a NT service -> wpisz MSWindows i ok

O2 - BHO: (no name) - {1AE7AE46-1586-3901-A34A-66E34F9FFDEF} - C:\WINDOWS\System32\mmlx.dll (file missing)
O2 - BHO: VPNS System - {A5845A98-EBDA-4670-9DE6-5201C506E741} - C:\WINDOWS\iedrives.dll (file missing)
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler] C:\DOCUME~1\Seba\USTAWI~1\Temp\E.tmp
O4 - HKCU\..\Run: [adirka] C:\WINDOWS\System32\adirka.exe
O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll
O23 - Service: Client IP-IPX - Unknown owner - -e,te-110-12-0000271, (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

potem odpal":

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

potem dwa nowe logi z hj i silent runners

**Posty:** 4 · przez **NaVySebaPro** 16 Kwi 2007, 20:18

Zrobiłem tak jak napisałeś i problem nadal sie utrzymuje:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:59:40, on 2007-04-16 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Seba\Pulpit\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

nie dało się tego usunąć, nawet ręcznie: O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll
i nie znalazło mi tego:
O23 - Service: Client IP-IPX - Unknown owner - -e,te-110-12-0000271, (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)

Kod: Zaznacz wszystko: SmitFraudFix v2.168 Scan done at 19:58:23,79, 2007-04-16 Run from C:\Documents and Settings\Seba\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\msdrives\ Deleted C:\Program Files\NewMediaCodec\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 18165 · przez **wojtas** 16 Kwi 2007, 20:40

daj loga z silent runners i comboscan:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html
http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

**Posty:** 4 · przez **NaVySebaPro** 17 Kwi 2007, 01:12

Masz tutaj z silent runners, ale myśle, że i tak zrobię dzisiaj formata po południu, mam dość bawienia się z tym ;p. W każdym razie dzięki za dotychczasową pomoc.

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS] "Steam" = ""C:\Program Files\Steam\Steam.exe" -silent" ["Valve Corporation"] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "Spyware Doctor" = ""C:\Program Files\Spyware Doctor\swdoctor.exe" /Q" ["PC Tools Research Pty Ltd"] "EA Core" = ""C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent" ["Electronic Arts"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "NVRaidService" = "C:\WINDOWS\System32\nvraidservice.exe" ["NVIDIA Corporation"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS] "razertra" = "C:\Program Files\Razer\razertra.exe" ["Razer Inc."] "WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "autoclk" = "autoclk.exe" [file not found] "adiras" = "adiras.exe" [file not found] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"" ["Sun Microsystems, Inc."] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Ashampoo FireWall" = ""C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY" [null data] "FrameWork 2.5" = "FrameWork.exe" [file not found] "Microsft Security Monitor Process" = "mssmpp.exe" [file not found] "KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch5 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["FlashGet"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "gFlash Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\getflash.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{596AB062-B4D2-4215-9F74-E9109B0A8153}" = "Previous Versions Property Page" -> {HKLM...CLSID} = "Previous Versions Property Page" \InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found] "{9DB7A13C-F208-4981-8353-73CC61AE2783}" = "Previous Versions" -> {HKLM...CLSID} = "Previous Versions" \InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"stera" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> A3dxq\DLLName = "C:\WINDOWS\System32\a3dxq.dll" [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] MyPhoneExplorer\(Default) = "{2D30AAA2-9084-4686-B8B9-B9B62EEFFD4E}" -> {HKLM...CLSID} = "MyPhoneExplorer_ShellEx.ShellExt" \InProcServer32\(Default) = "C:\Program Files\MyPhoneExplorer\DLL\ShellMgr.dll" ["F.J. Wechselberger"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Documents and Settings\Seba\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Seba\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Seba" & "All Users" startup folders: ------------------------------------------------------ C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Ashampoo\Ashampoo FireWall\spi.dll [null data], 01 - 05, 18 %SystemRoot%\system32\mswsock.dll [MS], 06 - 17, 19 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 22 - 23 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_09" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_09" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll" ["Sun Microsystems, Inc."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["FlashGet.com"] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] PC Tools Spyware Doctor, SDhelper, "C:\Program Files\Spyware Doctor\sdhelp.exe" ["PC Tools Research Pty Ltd"] PnkBstrA, PnkBstrA, "C:\WINDOWS\System32\PnkBstrA.exe" [null data] PnkBstrB, PnkBstrB, "C:\WINDOWS\System32\PnkBstrB.exe" [null data] Usługa Kaspersky Anti-Virus, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 315 seconds, including 7 seconds for message boxes)

Kod: Zaznacz wszystko

**Posty:** 18165 · przez **wojtas** 17 Kwi 2007, 08:22

Ściągasz program KillBox: http://www.downloads.subratam.org/KillBox.zip zaznaczasz Delete on reboot, w polu full path of file wklej ścieżkę:
:

O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll

Klikasz X czerwony i restart kompa.

daj loga z comboscana

**Posty:** 4 · przez **NaVySebaPro** 17 Kwi 2007, 14:48

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Seba on 2007-04-17 at 14:35:15 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-04-17 12:35:17 UTC - RP1 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as Seba.exe) ------------------------------------------------ Logfile of HijackThis v1.99.1 Scan saved at 14:35:30, on 2007-04-17 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvraidservice.exe C:\Program Files\Razer\razertra.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\System32\wbem\unsecapp.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Documents and Settings\Seba\Pulpit\comboscan.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\DOCUME~1\Seba\Pulpit\HIJACK~1\Seba.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY O4 - HKLM\..\Run: [FrameWork 2.5] FrameWork.exe O4 - HKLM\..\Run: [Microsft Security Monitor Process] mssmpp.exe O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\RunServices: [FrameWork 2.5] FrameWork.exe O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] mssmpp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5E07FE3A-EAED-4806-B09E-B2CC9434D685}: NameServer = 194.204.159.1 217.98.63.164 O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa Kaspersky Anti-Virus (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe -- HijackThis Fixed Entries (C:\DOCUME~1\Seba\Pulpit\HIJACK~1\backups\) -------- backup-20070416-194646-161 O4 - HKCU\..\Run: [adirka] C:\WINDOWS\System32\adirka.exe backup-20070416-194646-642 O2 - BHO: VPNS System - {A5845A98-EBDA-4670-9DE6-5201C506E741} - C:\WINDOWS\iedrives.dll (file missing) backup-20070416-194646-725 O2 - BHO: (no name) - {1AE7AE46-1586-3901-A34A-66E34F9FFDEF} - C:\WINDOWS\System32\mmlx.dll (file missing) backup-20070416-194646-766 O4 - HKLM\..\Run: [Anti-Virus Update Scheduler] C:\DOCUME~1\Seba\USTAWI~1\Temp\E.tmp backup-20070416-194646-976 O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll backup-20070416-195345-157 O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 2S ADILOADER (General Purpose USB Driver (adildr.sys)) - C:\WINDOWS\system32\drivers\adildr.sys 3R adiusbaw (USB ADSL WAN Adapter) - C:\WINDOWS\system32\drivers\adiusbaw.sys 3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS 1R AmdK8 (Sterownik procesora AMD) - C:\WINDOWS\system32\drivers\AmdK8.sys 3R ASFWHide - C:\DOCUME~1\Seba\USTAWI~1\Temp\ASFWHide (not found) 0R d347bus - C:\WINDOWS\system32\drivers\d347bus.sys 0R d347prt - C:\WINDOWS\system32\drivers\d347prt.sys 2S driverpp (Plug and Play Support Driver) - C:\WINDOWS\system32\msdrives\driverpp.sys (not found) 3R hidusb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys 1R ikhfile (File Security Kernel Anti-Spyware Driver) - C:\WINDOWS\system32\drivers\ikhfile.sys 1R ikhlayer (Kernel Anti-Spyware Driver) - C:\WINDOWS\system32\drivers\ikhlayer.sys 0R Kl1 - C:\WINDOWS\system32\drivers\kl1.sys 1R Klif - C:\WINDOWS\system32\drivers\klif.sys 1R Klmc - C:\WINDOWS\system32\drivers\klmc.sys 3R mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 0R nvatabus - C:\WINDOWS\system32\drivers\nvatabus.sys 3R NVENETFD (NVIDIA nForce Networking Controller Driver) - C:\WINDOWS\system32\drivers\NVENETFD.sys 3R nvnetbus (NVIDIA Network Bus Enumerator) - C:\WINDOWS\system32\drivers\nvnetbus.sys 0R nvraid (NVIDIA NForce(tm) ATA RAID Class Driver) - C:\WINDOWS\system32\drivers\nvraid.sys 0R nv_agp (NVIDIA nForce AGP Bus Filter) - C:\WINDOWS\system32\drivers\nv_agp.SYS 3S PnkBstrK - C:\WINDOWS\system32\drivers\PnkBstrK.sys 0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys 3R Razerlow (Razerlow USB Filter Driver) - C:\WINDOWS\system32\drivers\razerlow.sys 3R razerusb - C:\WINDOWS\system32\drivers\razerusb.sys 3R rtl8139 (Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet) - C:\WINDOWS\system32\drivers\rtl8139.sys 3S Runtime - C:\WINDOWS\System32\drivers\runtime.sys (not found) 3R usbohci (Sterownik Miniport otwartego kontrolera hosta USB Microsoft) - C:\WINDOWS\system32\drivers\usbohci.sys 3S WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys [COLOR=red][B]pe386 driver present[/B][/COLOR] -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 4S Client IP-IPX - -e,te-110-12-0000271, 3S clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2S CLTNetCnService (Symantec Lic NetConnect service) - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon 3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" 2R kavsvc (Usługa Kaspersky Anti-Virus) - "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe" 2S msnmsgr32 (msn msgr 32-bit client process) - "C:\WINDOWS\system\msnmsgr32.exe" 2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\System32\nvsvc32.exe 2R PnkBstrA - C:\WINDOWS\System32\PnkBstrA.exe 3S PnkBstrB - C:\WINDOWS\System32\PnkBstrB.exe 2R SDhelper (PC Tools Spyware Doctor) - C:\Program Files\Spyware Doctor\sdhelp.exe 2R UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\system32\wdfmgr.exe 2R uploadmgr (Menedżer przekazywania) - C:\WINDOWS\System32\svchost.exe -k netsvcs -- Files created between 2007-03-17 and 2007-04-17 ----------------------------- 2007-04-17 14:25:12 0 d-------- C:\!KillBox 2007-04-16 22:48:30 0 d-------- C:\Program Files\Kaspersky Lab<KASPER~1> 2007-04-16 20:19:51 0 d-------- C:\Program Files\Ashampoo 2007-04-16 19:58:26 2720 --a------ C:\WINDOWS\System32\tmp.reg 2007-04-15 15:55:55 0 d-------- C:\WINDOWS\System32\URTTEMP 2007-04-15 15:38:54 0 d-------- C:\Program Files\Turbine 2007-04-08 23:47:15 0 d-------- C:\Program Files\MarBit 2007-04-07 22:44:50 0 d-------- C:\Program Files\BearShare Applications<BEARSH~2> 2007-04-04 14:03:53 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-04-04 06:31:09 2 --a------ C:\WINDOWS\System32\wintsvcc.exe 2007-04-04 06:31:08 0 d-------- C:\WINDOWS\?icrosoft 2007-04-04 06:30:19 0 d-------- C:\Program Files\S?mantec 2007-04-04 06:29:57 72831 --a------ C:\WINDOWS\System32\duo.exe 2007-04-04 06:26:20 59904 --a------ C:\WINDOWS\System32\grlib.dll 2007-04-04 06:24:14 36224 --a------ C:\WINDOWS\System32\main.sys 2007-04-04 06:19:17 3 --a------ C:\WINDOWS\System32\sfxzmtwbmail.dll<SFXZMT~3.DLL> 2007-04-04 06:19:17 3 --a------ C:\WINDOWS\System32\sfxzmtsmtspm.dll<SFXZMT~1.DLL> 2007-04-04 06:19:17 3 --a------ C:\WINDOWS\System32\sfxzmtsmt.dll<SFXZMT~2.DLL> 2007-04-04 06:19:17 3 --a------ C:\WINDOWS\System32\sfxzmtforum.dll<SFXZMT~4.DLL> 2007-04-04 06:19:17 55 --a------ C:\WINDOWS\System32\pfxzmtymsg.dll<PFXZMT~4.DLL> 2007-04-04 06:19:17 55 --a------ C:\WINDOWS\System32\pfxzmtwbmail.dll<PF9452~1.DLL> 2007-04-04 06:19:17 3 --a------ C:\WINDOWS\System32\pfxzmtsmtspm.dll<PFCA7F~1.DLL> 2007-04-04 06:19:17 3 --a------ C:\WINDOWS\System32\pfxzmtsmt.dll<PFB0E0~1.DLL> 2007-04-04 06:19:17 55 --a------ C:\WINDOWS\System32\pfxzmticq.dll<PFXZMT~1.DLL> 2007-04-04 06:19:17 55 --a------ C:\WINDOWS\System32\pfxzmtgtal.dll<PFXZMT~3.DLL> 2007-04-04 06:19:17 55 --a------ C:\WINDOWS\System32\pfxzmtforum.dll<PF5607~1.DLL> 2007-04-04 06:19:17 55 --a------ C:\WINDOWS\System32\pfxzmtaim.dll<PFXZMT~2.DLL> 2007-04-04 06:19:16 169984 --a------ C:\WINDOWS\System32\fclcfux.dll 2007-04-04 06:19:15 72831 --a------ C:\WINDOWS\duo.exe 2007-04-04 06:19:14 40575 --a------ C:\WINDOWS\pep.exe 2007-04-04 06:19:03 0 d-------- C:\Program Files\Common Files\{3006ECBD-07D9-1045-1019-051023060030}<{3006E~1> 2007-04-03 23:21:15 22584 --a------ C:\WINDOWS\System32\drivers\PnkBstrK.sys 2007-04-03 21:39:50 99904 --a------ C:\WINDOWS\System32\PnkBstrB.exe 2007-04-03 21:39:44 63040 --a------ C:\WINDOWS\System32\PnkBstrA.exe 2007-04-03 21:39:44 0 d-------- C:\WINDOWS\System32\LogFiles 2007-03-25 04:01:46 0 d-------- C:\WINDOWS\ShellNew 2007-03-17 15:24:01 0 d-------- C:\Program Files\ffdshow -- Find3M Report --------------------------------------------------------------- 2007-04-17 14:32:22 0 d-------- C:\Program Files\Neostrada TP<NEOSTR~1> 2007-04-17 14:30:30 0 d-------- C:\Program Files\Steam 2007-04-17 14:27:14 0 d-------- C:\Program Files\English Translator 3<ENGLIS~1> 2007-04-17 06:22:48 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1> 2007-04-16 19:37:18 0 d---s---- C:\Documents and Settings\Seba\Dane aplikacji\Microsoft<MICROS~1> 2007-04-16 02:06:07 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-04-15 22:31:26 0 d-------- C:\Program Files\BearShare<BEARSH~1> 2007-04-15 16:07:47 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\Turbine 2007-04-15 15:56:48 457574 --a------ C:\WINDOWS\System32\perfh015.dat 2007-04-15 15:56:48 79606 --a------ C:\WINDOWS\System32\perfc015.dat 2007-04-15 15:28:50 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\GetRightToGo<GETRIG~1> 2007-04-14 00:34:56 0 d-------- C:\Program Files\FlashGet 2007-04-10 21:10:59 0 d-------- C:\Program Files\mIRC 2007-04-09 10:10:07 0 d-------- C:\Program Files\Tibia 2007-04-07 20:28:38 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\teamspeak2<TEAMSP~1> 2007-04-06 09:30:09 0 d-------- C:\Program Files\DivX 2007-04-04 21:39:20 0 d-------- C:\Program Files\Winamp 2007-04-04 21:36:43 0 d-------- C:\Program Files\Razer 2007-04-04 21:36:39 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-04-04 21:36:21 0 d-------- C:\Program Files\PhotoFiltre<PHOTOF~1> 2007-04-04 21:36:07 0 d-------- C:\Program Files\MyPhoneExplorer<MYPHON~1> 2007-04-04 21:35:21 0 d-------- C:\Program Files\Java Web Start<JAVAWE~1> 2007-04-04 21:23:52 0 d-------- C:\Program Files\Common Files\Companion Wizard<COMPAN~1> 2007-04-04 15:04:57 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1> 2007-04-04 11:13:30 41 --a------ C:\WINDOWS\System32\cddddddde_s.dll<CDDDDD~1.DLL> 2007-04-04 06:10:25 0 --a------ C:\Documents and Settings\Seba\Dane aplikacji\Install.dat 2007-03-16 17:21:42 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\Lavasoft 2007-03-16 17:21:35 0 d-------- C:\Program Files\Lavasoft 2007-03-15 12:00:36 466432 --a------ C:\WINDOWS\System32\SkanerOnline.dll<SKANER~1.DLL> 2007-03-14 03:16:22 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-03-14 02:32:30 0 d-------- C:\Program Files\Electronic Arts<ELECTR~1> 2007-03-12 15:34:43 0 d-------- C:\Program Files\Xvid 2007-03-09 13:56:16 0 d-------- C:\Program Files\Sony Ericsson<SONYER~1> 2007-03-09 13:55:41 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1> 2007-03-09 13:50:23 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~2> 2007-03-09 13:41:56 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\MyPhoneExplorer<MYPHON~1> 2007-03-07 21:20:05 0 d-------- C:\Program Files\Spyware Doctor<SPYWAR~1> 2007-03-07 21:03:16 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\PC Tools<PCTOOL~1> 2007-03-07 19:57:23 0 d-------- C:\Program Files\Common Files\Symantec Shared<SYMANT~1> 2007-03-04 13:54:42 0 d-------- C:\Program Files\MegaSpoof<MEGASP~1> 2007-03-02 08:02:37 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\Apple Computer<APPLEC~1> 2007-03-01 17:31:59 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\Xfire 2007-03-01 17:31:50 0 d---s---- C:\Program Files\Xfire 2007-02-27 18:07:27 0 d-------- C:\Program Files\Headshot Player<HEADSH~1> 2007-02-25 18:20:04 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\AdobeUM 2007-02-25 01:00:26 1302 --a------ C:\WINDOWS\mozver.dat 2007-02-24 19:56:29 0 d-------- C:\Program Files\jv16 PowerTools 2006<JV16PO~1> 2007-02-21 20:06:51 0 d-------- C:\Documents and Settings\Seba\Dane aplikacji\Adobe 2007-02-15 01:50:32 98304 --a------ C:\WINDOWS\System32CmdLineExt.dll<SYSTEM~1.DLL> 2007-02-13 23:00:45 192000 --a------ C:\WINDOWS\citysplendor_SS.scr<CITYSP~1.SCR> 2007-02-13 23:00:39 12288 --a------ C:\WINDOWS\impborl.dll 2007-02-13 23:00:39 545280 --a------ C:\WINDOWS\flashax.exe 2007-02-12 02:32:20 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-12 00:52:03 0 -rahs---- C:\MSDOS.SYS 2007-02-12 00:52:03 0 -rahs---- C:\IO.SYS 2007-02-12 00:52:03 0 --a------ C:\CONFIG.SYS 2007-02-12 00:52:03 0 --a------ C:\AUTOEXEC.BAT 2007-02-12 00:49:44 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat<EMPTYR~1.DAT> 2007-02-12 00:28:33 62 --ahs---- C:\Documents and Settings\Seba\Dane aplikacji\desktop.ini 2007-01-19 09:40:42 89088 --a------ C:\WINDOWS\System32\SkanerOnlineUninstall.exe<SKANER~1.EXE> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "Steam"="\"C:\\Program Files\\Steam\\Steam.exe\" -silent" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" "EA Core"="\"C:\\Program Files\\Electronic Arts\\EA Link\\Core.exe\" -silent" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMan"="SOUNDMAN.EXE" "NVRaidService"="C:\\WINDOWS\\System32\\nvraidservice.exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "razertra"="C:\\Program Files\\Razer\\razertra.exe" "WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe" "autoclk"="autoclk.exe" "adiras"="adiras.exe" "WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe" "WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033" "BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "Ashampoo FireWall"="\"C:\\Program Files\\Ashampoo\\Ashampoo FireWall\\FireWall.exe\" -TRAY" "FrameWork 2.5"="FrameWork.exe" "Microsft Security Monitor Process"="mssmpp.exe" "KAVPersonal50"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe\" /minimize" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "FrameWork 2.5"="FrameWork.exe" "Microsft Security Monitor Process"="mssmpp.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run] "{3006ECBD-07D9-1045-1019-051023060030}"="\"C:\\Program Files\\Common Files\\{3006ECBD-07D9-1045-1019-051023060030}\\Update.exe\" te-110-12-0000271" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\Run] "{3006ECBD-07D9-1045-1019-051023060030}"="\"C:\\Program Files\\Common Files\\{3006ECBD-07D9-1045-1019-051023060030}\\Update.exe\" te-110-12-0000271" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\A3dxq [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 -- End of ComboScan: finished at 2007-04-17 at 14:35:53 ------------------------

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Seba on 2007-04-17 at 14:35:15 Supplementary logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 1.0 Architecture: X86; Language: Polish CPU 0: AMD Athlon(tm) 64 Processor 3000+ Percentage of Memory in Use: 30% Physical Memory (total/avail): 1023.48 MiB / 708.8 MiB Pagefile Memory (total/avail): 2462.22 MiB / 2247.38 MiB Virtual Memory (total/avail): 2047.88 MiB / 2004.2 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 31.38 GiB total, 11.11 GiB free. D: is Fixed (NTFS) - 5.88 GiB total, 0.82 GiB free. E: is CDROM (No Media) F: is CDROM (No Media) G: is CDROM (UDF) -- Security Center ------------------------------------------------------------- AUOptions is disabled. AUState says computer has updates disabled. Windows Internal Firewall is enabled. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Seba\Dane aplikacji CLASSPATH=.;C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=NAVY ComSpec=C:\WINDOWS\system32\cmd.exe HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Seba LOGONSERVER=\\NAVY NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\PROGRAM FILES\QUICKTIME\QTSYSTEM\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 44 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=2c02 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Seba\USTAWI~1\Temp TMP=C:\DOCUME~1\Seba\USTAWI~1\Temp USERDOMAIN=NAVY USERNAME=Seba USERPROFILE=C:\Documents and Settings\Seba windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Seba [I](admin)[/I] Administrator [I](new local, admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Reader 7.0.5 - Polish --> MsiExec.exe /I{AC76BA86-7AD7-1045-7B44-A70500000002} ALLPlayer V2.3.1 --> "C:\Program Files\MarBit\ALLPlayer\unins000.exe" Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe Ashampoo FireWall 1.20 --> "C:\Program Files\Ashampoo\Ashampoo FireWall\unins000.exe" Athlon 64 Processor Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x15 Battlefield 2(TM) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x15 -removeonly Battlefield 2142 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}\setup.exe" -l0x15 -removeonly BearShare --> C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG BF2142 1.20 Clan mod v 2.0 --> C:\Program Files\Electronic Arts\Battlefield 2142\Uninstall_clanmod.exe BF2142Pro 1.1 --> "C:\Program Files\Electronic Arts\Battlefield 2142\bf2142pro-uninstall.exe" citysplendor_SS Screen Saver --> C:\WINDOWS\citysplendor_SS.scr /u DAEMON Tools --> MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0} EA Link --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{F5577101-33CC-4711-8235-3A95BCD49DB0} /l1045 English Translator 3 --> C:\Program Files\English Translator 3\setup.exe -uninstall ffdshow --> "C:\Program Files\ffdshow\uninstall.exe" FlashGet(JetCar) --> C:\PROGRA~1\FlashGet\UNWISE.EXE C:\PROGRA~1\FlashGet\INSTALL.LOG Gadu-Gadu 7.6 --> C:\Program Files\Gadu-Gadu\Setup.exe Headshot Player --> C:\Program Files\Headshot Player\uninstall.exe HijackThis 1.99.1 --> C:\Documents and Settings\Seba\Pulpit\hijackthis\HijackThis.exe /uninstall J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090} Java 2 Runtime Environment, SE v1.4.0_03 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC1E4C93-C1E7-11D6-9D10-00010240CE95}\Setup.exe" Anytext Java Web Start --> "C:\Program Files\Java Web Start\uninst-javaws.exe" jv16 PowerTools 2006 --> "C:\Program Files\jv16 PowerTools 2006\unins000.exe" Kaspersky Anti-Virus Personal Pro --> "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\uninstall.exe" Microsoft Office PowerPoint Viewer 2003 --> MsiExec.exe /X{90AF0415-6000-11D3-8CFE-0150048383C9} Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9} mIRC --> "C:\Program Files\mIRC\mirc.exe" -uninstall Mozilla Firefox (2.0.0.3) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe MyPhoneExplorer --> C:\Program Files\MyPhoneExplorer\uninstall.exe Neostrada TP --> C:\PROGRA~1\NEOSTR~1\SondageDesinstallation.exe New Media Codec v3.2 --> C:\Program Files\NewMediaCodec\Uninstall.exe NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI PhotoFiltre --> "C:\Program Files\PhotoFiltre\Uninst.exe" QuickTime --> MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F} Razer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85C6CE1E-2A22-4C5A-A8A1-9DBFBEA81DE1}\Setup.exe" -l0x9 Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE REALTEK Gigabit and Fast Ethernet NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0x15 REMOVE SAGEM F@st 800-840 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe" -l0x15 Skaner on-line mks_vir --> C:\WINDOWS\System32\SkanerOnlineUninstall.exe Spyware Doctor 4.0 --> "C:\Program Files\Spyware Doctor\unins000.exe" Steam --> C:\PROGRA~1\Steam\UNWISE.EXE C:\PROGRA~1\Steam\INSTALL.LOG TeamSpeak 2 RC2 --> "C:\Program Files\Teamspeak2_RC2\unins000.exe" The Lord of the Rings Online™: Shadows of Angmar™ v07.12.30.54 --> "C:\Program Files\Turbine\The Lord of the Rings Online\unins000.exe" Total Commander (Remove or Repair) --> c:\totalcmd\tcuninst.exe Ventrilo --> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F} VentriloMIX --> C:\Program Files\VentriloMIX\Uninstal.exe Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" Xfire (remove only) --> "C:\Program Files\Xfire\uninst.exe" Xvid 1.1.2 final uninstall --> "C:\Program Files\Xvid\unins000.exe" -- End of ComboScan: finished at 2007-04-17 at 14:35:53 ------------------------

**Posty:** 18165 · przez **wojtas** 17 Kwi 2007, 15:58

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

EXAMPLE

Files to delete:

C:\WINDOWS\System32\tmp.reg
C:\WINDOWS\System32\wintsvcc.exe
C:\WINDOWS\System32\duo.exe
C:\WINDOWS\System32\grlib.dll
C:\WINDOWS\System32\main.sys
C:\WINDOWS\System32\sfxzmtwbmail.dll
C:\WINDOWS\System32\sfxzmtsmtspm.dll
C:\WINDOWS\System32\sfxzmtsmt.dll
C:\WINDOWS\System32\sfxzmtforum.dll
C:\WINDOWS\System32\pfxzmtymsg.dll
C:\WINDOWS\System32\pfxzmtwbmail.dll
C:\WINDOWS\System32\pfxzmtsmtspm.dll
C:\WINDOWS\System32\pfxzmtsmt.dll
C:\WINDOWS\System32\pfxzmticq.dll
C:\WINDOWS\System32\pfxzmtgtal.dll
C:\WINDOWS\System32\pfxzmtforum.dll
C:\WINDOWS\System32\pfxzmtaim.dll
C:\WINDOWS\System32\fclcfux.dll
C:\WINDOWS\duo.exe
C:\WINDOWS\pep.exe

Folders to delete:

C:\WINDOWS\?icrosoft
C:\Program Files\S?mantec
C:\Program Files\Common Files\{3006ECBD-07D9-1045-1019-051023060030

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip

Po restarcie w HijackThis usuwasz wpis/y

O4 - HKLM\..\Run: [FrameWork 2.5] FrameWork.exe
O4 - HKLM\..\RunServices: [FrameWork 2.5] FrameWork.exe
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] mssmpp.exe
O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe (file missing)

szukasz pogrubionych i kasujesz je

otwierasz notatnika i wklejasz:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"FrameWork 2.5"=-
"Microsft Security Monitor Process"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"{3006ECBD-07D9-1045-1019-051023060030}=-

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\Run]
"{3006ECBD-07D9-1045-1019-051023060030}=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowe logi z Silenta comboscana i 2 z gmera z opcji:

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

wrzuc na jakis serwer bo sie nie zmieszcza

proszę o pomoc i sprawdzenie loga

proszę o pomoc i sprawdzenie loga

Kto jest na forum