prosze o prawdzenie loga, myślę że mam trojana

**Posty:** 5 · przez **bialasss** 14 Lut 2008, 15:44

witam.
jestem nowy czytałem regulamin mimo tego mogę popełnić jakiś błąd, więc proszę się nie denerwować:D

zamieszczam log z programu hijackthis, mam również log z programu Combo fix, ale nie zamieszczam chyba że się przyda, ale mam nadzieje, że dacie mi znać:D

wdarł mi się na kompa jakiś upierdliwy program którego nie mogę usunąć, włącza mi stronki i denerwuje mnie swoimi dymkami u dołu ekranu treść "system alert ... ble ble ble"

to jest log z systemu awaryjnego

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:25:02, on 2008-02-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\userinit.exe D:\WINDOWS\Explorer.EXE D:\Documents and Settings\bibek\Pulpit\Nowy folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - D:\Program Files\NetProject\sbmdl.dll O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - D:\Program Files\NetProject\wamdl.dll O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVMWlanClient] D:\Program Files\avmwlanstick\FRITZWLANMini.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\gg\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LVSrvLauncher - Labtec Inc. - D:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - D:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

**Posty:** 241 · przez **Paxo202** 14 Lut 2008, 16:57

Na loga Ci nic nie odpowiem, ale zauważyłem że popełniłeś błąd w podawaniu loga.

- wstawić loga w tagach [ code ] tutaj dajemy cały log [ /code ] , lub [ quote ] tutaj dajemy cały log [ /quote];

**Posty:** 18165 · przez **wojtas** 14 Lut 2008, 19:56

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2
(sciagasz uruchamiasz wpisujesz 2 i enter i czekasz )

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 5 · przez **bialasss** 14 Lut 2008, 20:54

wykonane i jak na moje niefachowe oko wygląda dobrze:D
tylko ostatniego polenienia do końca nie rozumiem, mam po prostu wrzucić pliki tekstowe do folderu SDFix-a, czyli logi z Combofixa i z Hijacka oraz Report.txt??

**Posty:** 18165 · przez **wojtas** 14 Lut 2008, 21:42

czyli logi z Combofixa i z Hijacka oraz Report.txt??

dokladnie tak

**Posty:** 5 · przez **bialasss** 15 Lut 2008, 00:11

dzięki wielkie za pomoc
wszystko działa jak należy, a nawet troche lepiej:D

pozdrawiam

**Posty:** 3854 · przez **Dzi@dek** 15 Lut 2008, 00:13

bialasss napisał(a):wszystko działa jak należy, a nawet troche lepiej

Miałes dać logi.

**Posty:** 5 · przez **bialasss** 15 Lut 2008, 00:20

Kod: Zaznacz wszystko: SDFix: Version 1.142 Run by bibek on 2008-02-14 at 19:23 Microsoft Windows XP [Wersja 5.1.2600] Running From: D:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: D:\Program Files\wunauclt.zip - Deleted D:\Program Files\wunauclt.tbe - Deleted Removing Temp Files... ADS Check: Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-14 19:41:09 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:e30671d9 "s2"=dword:1726c803 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="D:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:cb,25,64,09,56,bf,43,3b,e6,04,a6,b4,98,c3,45,ec,dc,b0,3c,62,c1,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,61,c3,7c,06,8e,68,f0,3d,c1,27,6c,d4,7f,9b,24,ea,e7,.. "khjeh"=hex:10,1b,05,52,f7,72,52,9e,19,13,8c,03,c9,d8,db,62,36,34,c6,47,1d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:31,be,e2,f2,2a,47,26,80,6c,22,93,c6,56,4c,ec,ff,ec,70,11,c0,59,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="D:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:cb,25,64,09,56,bf,43,3b,e6,04,a6,b4,98,c3,45,ec,dc,b0,3c,62,c1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,61,c3,7c,06,8e,68,f0,3d,c1,27,6c,d4,7f,9b,24,ea,e7,.. "khjeh"=hex:10,1b,05,52,f7,72,52,9e,19,13,8c,03,c9,d8,db,62,36,34,c6,47,1d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:31,be,e2,f2,2a,47,26,80,6c,22,93,c6,56,4c,ec,ff,ec,70,11,c0,59,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120%" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,f0,01,00,00,01,00,00,00,05,00,00,00,38,.. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c\s] "Order"=hex:08,00,00,00,02,00,00,00,f8,01,00,00,01,00,00,00,04,00,00,00,88,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "D:\\Program Files\\Skype\\Phone\\Skype.exe"="D:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - D:\SDFix\backups\backups.zip Files with Hidden Attributes: Wed 24 May 2006 4,348 ..SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 27 Oct 2007 888 ...HR --- "D:\Documents and Settings\bibek\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Finished!

Kod: Zaznacz wszystko: ComboFix 08-02-14.2 - bibek 2008-02-14 19:46:48.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.183 [GMT 1:00] Running from: D:\Documents and Settings\bibek\Pulpit\Nowy folder\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))) . 2008-02-14 19:21 . 2008-02-14 19:21 <DIR> d-------- D:\WINDOWS\ERUNT 2008-02-14 19:16 . 2008-02-14 19:43 <DIR> d-------- D:\SDFix 2008-02-14 19:13 . 2008-02-14 19:13 2,214 --a------ D:\WINDOWS\system32\tmp.reg 2008-02-14 19:05 . 2007-09-05 23:22 289,144 --a------ D:\WINDOWS\system32\VCCLSID.exe 2008-02-14 19:05 . 2006-04-27 16:49 288,417 --a------ D:\WINDOWS\system32\SrchSTS.exe 2008-02-14 19:05 . 2008-02-08 23:55 85,504 --a------ D:\WINDOWS\system32\VACFix.exe 2008-02-14 19:05 . 2008-02-08 10:37 82,432 --a------ D:\WINDOWS\system32\IEDFix.exe 2008-02-14 19:05 . 2003-06-05 20:13 53,248 --a------ D:\WINDOWS\system32\Process.exe 2008-02-14 19:05 . 2004-07-31 17:50 51,200 --a------ D:\WINDOWS\system32\dumphive.exe 2008-02-14 19:05 . 2007-10-03 23:36 25,600 --a------ D:\WINDOWS\system32\WS2Fix.exe 2008-02-14 17:43 . 2008-02-14 17:43 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-02-14 15:20 . 2007-06-05 10:56 44,928 --a------ D:\WINDOWS\system32\drivers\SDTHOOK.SYS 2008-02-14 15:04 . 2008-02-14 16:18 <DIR> d-------- D:\WINDOWS\system32\ActiveScan 2008-02-14 15:04 . 2008-02-14 15:04 30,590 --a------ D:\WINDOWS\system32\pavas.ico 2008-02-14 15:04 . 2008-02-14 15:04 1,406 --a------ D:\WINDOWS\system32\Help.ico 2008-02-14 13:45 . 2008-02-14 14:28 <DIR> d--h----- D:\Documents and Settings\Administrator\Ustawienia lokalne 2008-02-14 13:45 . 2006-05-17 19:48 <DIR> d-------- D:\Documents and Settings\Administrator\Ulubione 2008-02-14 13:45 . 2006-05-17 17:54 <DIR> d--h----- D:\Documents and Settings\Administrator\Szablony 2008-02-14 13:45 . 2006-05-17 19:48 <DIR> d-------- D:\Documents and Settings\Administrator\Pulpit 2008-02-14 13:45 . 2006-05-17 19:48 <DIR> d-------- D:\Documents and Settings\Administrator\Moje dokumenty 2008-02-14 13:45 . 2006-05-17 19:48 <DIR> dr------- D:\Documents and Settings\Administrator\Menu Start 2008-02-14 13:45 . 2006-05-17 19:48 <DIR> dr-h----- D:\Documents and Settings\Administrator\Dane aplikacji 2008-02-14 12:54 . 2008-02-14 12:57 <DIR> d-a------ D:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-02-14 11:05 . 2008-02-14 11:05 1,374 --a------ D:\WINDOWS\imsins.BAK 2008-02-13 21:42 . 2003-07-20 19:17 5,174 --a------ D:\WINDOWS\system32\nppt9x.vxd 2008-02-13 21:42 . 2005-01-04 10:43 4,682 --a------ D:\WINDOWS\system32\npptNT2.sys 2008-02-13 17:29 . 2008-02-13 17:29 <DIR> d-------- D:\Documents and Settings\bibek\Dane aplikacji\InstallShield 2008-02-13 13:28 . 2008-02-13 13:28 <DIR> d-------- D:\Program Files\jlgsolera 2008-02-12 17:20 . 2008-02-12 17:20 <DIR> d-------- D:\Program Files\CCleaner 2008-02-09 11:42 . 2008-02-14 19:48 2,967,584 --ahs---- D:\WINDOWS\system32\drivers\fidbox.dat 2008-02-09 11:42 . 2008-02-14 19:19 38,768 --ahs---- D:\WINDOWS\system32\drivers\fidbox.idx 2008-02-01 10:53 . 2008-02-01 10:59 66,872 --a------ D:\WINDOWS\system32\PnkBstrA.exe 2008-02-01 10:53 . 2008-02-01 11:48 22,328 --a------ D:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-01 10:52 . 2008-02-01 11:48 103,736 --a------ D:\WINDOWS\system32\PnkBstrB.exe 2008-02-01 10:08 . 2007-05-16 16:45 3,497,832 --a------ D:\WINDOWS\system32\d3dx9_34.dll 2008-02-01 10:08 . 2007-03-12 16:42 3,495,784 --a------ D:\WINDOWS\system32\d3dx9_33.dll 2008-02-01 10:08 . 2007-05-16 16:45 1,124,720 --a------ D:\WINDOWS\system32\D3DCompiler_34.dll 2008-02-01 10:08 . 2007-03-12 16:42 1,123,696 --a------ D:\WINDOWS\system32\D3DCompiler_33.dll 2008-02-01 10:08 . 2007-05-16 16:45 443,752 --a------ D:\WINDOWS\system32\d3dx10_34.dll 2008-02-01 10:08 . 2007-03-15 16:57 443,752 --a------ D:\WINDOWS\system32\d3dx10_33.dll 2008-02-01 10:08 . 2007-06-20 20:46 266,088 --a------ D:\WINDOWS\system32\xactengine2_8.dll 2008-02-01 10:08 . 2007-04-04 18:55 261,480 --a------ D:\WINDOWS\system32\xactengine2_7.dll 2008-02-01 10:08 . 2007-01-24 15:27 255,848 --a------ D:\WINDOWS\system32\xactengine2_6.dll 2008-02-01 10:08 . 2007-06-20 20:45 18,280 --a------ D:\WINDOWS\system32\x3daudio1_2.dll 2008-01-30 22:41 . 2008-01-30 22:41 <DIR> d--hs---- D:\WINDOWS\ftpcache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-14 18:48 --------- d-----w D:\Documents and Settings\bibek\Dane aplikacji\Skype 2008-02-14 15:05 --------- d-----w D:\Program Files\DAEMON Tools 2008-02-14 15:03 --------- d-----w D:\Program Files\avmwlanstick 2008-02-14 13:29 13,385,620 -c--a-w D:\WINDOWS\Internet Logs\tvDebug.zip 2008-02-13 18:08 --------- d-----w D:\Documents and Settings\bibek\Dane aplikacji\foobar2000 2008-02-13 16:30 --------- d--h--w D:\Program Files\InstallShield Installation Information 2008-02-12 15:57 2,828,800 ----a-w D:\WINDOWS\Internet Logs\xDB8D.tmp 2008-02-11 23:36 3,442,688 ----a-w D:\WINDOWS\Internet Logs\xDB8C.tmp 2008-02-11 14:19 --------- d-----w D:\Program Files\VS Online 2008-02-01 13:41 257,024 ----a-w D:\WINDOWS\Internet Logs\xDB8B.tmp 2008-02-01 00:13 2,951,680 ----a-w D:\WINDOWS\Internet Logs\xDB89.tmp 2008-02-01 00:13 2,512,384 ----a-w D:\WINDOWS\Internet Logs\xDB8A.tmp 2008-01-29 21:09 --------- d-----w D:\Documents and Settings\bibek\Dane aplikacji\Spik 2008-01-29 21:03 3,217,920 ----a-w D:\WINDOWS\Internet Logs\xDB88.tmp 2008-01-29 00:03 49,152 ----a-w D:\WINDOWS\Internet Logs\xDB87.tmp 2008-01-27 21:58 2,948,608 ----a-w D:\WINDOWS\Internet Logs\xDB85.tmp 2008-01-27 21:58 2,502,144 ----a-w D:\WINDOWS\Internet Logs\xDB86.tmp 2008-01-21 19:33 475,136 ----a-w D:\WINDOWS\Internet Logs\xDB83.tmp 2008-01-21 19:33 2,497,024 ----a-w D:\WINDOWS\Internet Logs\xDB84.tmp 2008-01-17 23:41 92,160 ----a-w D:\WINDOWS\Internet Logs\xDB81.tmp 2008-01-17 23:41 2,491,904 ----a-w D:\WINDOWS\Internet Logs\xDB82.tmp 2008-01-16 22:39 2,491,392 ----a-w D:\WINDOWS\Internet Logs\xDB80.tmp 2008-01-16 22:39 2,143,232 ----a-w D:\WINDOWS\Internet Logs\xDB7F.tmp 2008-01-15 21:56 3,335,680 ----a-w D:\WINDOWS\Internet Logs\xDB7E.tmp 2008-01-13 18:16 3,063,296 ----a-w D:\WINDOWS\Internet Logs\xDB7D.tmp 2008-01-12 21:59 2,016,768 ----a-w D:\WINDOWS\Internet Logs\xDB7C.tmp 2008-01-12 21:49 2,915,840 ----a-w D:\WINDOWS\Internet Logs\xDB7B.tmp 2008-01-11 16:21 2,920,960 ----a-w D:\WINDOWS\Internet Logs\xDB7A.tmp 2008-01-11 11:27 3,153,408 ----a-w D:\WINDOWS\Internet Logs\xDB78.tmp 2008-01-11 11:27 2,478,592 ----a-w D:\WINDOWS\Internet Logs\xDB79.tmp 2008-01-10 17:50 2,933,760 ----a-w D:\WINDOWS\Internet Logs\xDB77.tmp 2008-01-10 13:31 92,160 ----a-w D:\WINDOWS\Internet Logs\xDB75.tmp 2008-01-10 13:31 2,477,056 ----a-w D:\WINDOWS\Internet Logs\xDB76.tmp 2008-01-09 23:01 3,133,952 ----a-w D:\WINDOWS\Internet Logs\xDB73.tmp 2008-01-09 23:01 2,476,544 ----a-w D:\WINDOWS\Internet Logs\xDB74.tmp 2008-01-08 18:51 3,111,424 ----a-w D:\WINDOWS\Internet Logs\xDB71.tmp 2008-01-08 18:51 2,474,496 ----a-w D:\WINDOWS\Internet Logs\xDB72.tmp 2008-01-07 16:58 3,032,576 ----a-w D:\WINDOWS\Internet Logs\xDB6F.tmp 2008-01-07 16:58 2,473,472 ----a-w D:\WINDOWS\Internet Logs\xDB70.tmp 2007-12-19 21:48 2,888,704 ----a-w D:\WINDOWS\Internet Logs\xDB6E.tmp 2007-12-18 09:51 179,584 ----a-w D:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-14 20:19 --------- d-----w D:\Program Files\URUSoft 2007-12-14 19:54 2,463,232 ----a-w D:\WINDOWS\Internet Logs\xDB6D.tmp 2007-12-14 19:54 102,400 ----a-w D:\WINDOWS\Internet Logs\xDB6C.tmp 2007-12-12 22:49 3,085,824 ----a-w D:\WINDOWS\Internet Logs\xDB6B.tmp 2007-12-11 23:44 3,058,688 ----a-w D:\WINDOWS\Internet Logs\xDB69.tmp 2007-12-11 23:44 2,452,480 ----a-w D:\WINDOWS\Internet Logs\xDB6A.tmp 2007-12-08 23:46 811,520 ----a-w D:\WINDOWS\Internet Logs\xDB67.tmp 2007-12-08 23:46 2,444,288 ----a-w D:\WINDOWS\Internet Logs\xDB68.tmp 2007-12-07 01:08 662,016 ----a-w D:\WINDOWS\system32\wininet.dll 2007-12-04 18:42 550,912 ----a-w D:\WINDOWS\system32\oleaut32.dll 2007-11-27 18:12 113,664 ----a-w D:\WINDOWS\Internet Logs\xDB66.tmp 2007-11-25 22:17 3,381,760 ----a-w D:\WINDOWS\Internet Logs\xDB64.tmp 2007-11-25 22:17 2,406,400 ----a-w D:\WINDOWS\Internet Logs\xDB65.tmp 2007-11-22 18:52 2,866,176 ----a-w D:\WINDOWS\Internet Logs\xDB62.tmp 2007-11-22 18:52 2,403,328 ----a-w D:\WINDOWS\Internet Logs\xDB63.tmp 2007-11-21 22:39 1,319,936 ----a-w D:\WINDOWS\Internet Logs\xDB61.tmp 2007-11-21 22:31 2,789,888 ----a-w D:\WINDOWS\Internet Logs\xDB5F.tmp 2007-11-21 22:31 2,393,088 ----a-w D:\WINDOWS\Internet Logs\xDB60.tmp 2007-11-21 16:38 2,302,464 ----a-w D:\WINDOWS\Internet Logs\xDB5E.tmp 2007-11-20 22:15 3,277,824 ----a-w D:\WINDOWS\Internet Logs\xDB5C.tmp 2007-11-20 22:15 2,388,480 ----a-w D:\WINDOWS\Internet Logs\xDB5D.tmp 2007-11-20 14:39 2,825,216 ----a-w D:\WINDOWS\Internet Logs\xDB5B.tmp 2007-11-18 21:43 2,939,904 ----a-w D:\WINDOWS\Internet Logs\xDB59.tmp 2007-11-18 21:43 2,375,680 ----a-w D:\WINDOWS\Internet Logs\xDB5A.tmp 2007-11-15 13:10 2,907,136 ----a-w D:\WINDOWS\Internet Logs\xDB57.tmp 2007-11-15 13:10 2,360,320 ----a-w D:\WINDOWS\Internet Logs\xDB58.tmp 2007-11-14 15:05 75,248 ----a-w D:\WINDOWS\zllsputility.exe 2007-11-14 15:05 1,086,952 ----a-w D:\WINDOWS\system32\zpeng24.dll 2007-11-13 21:41 2,932,736 ----a-w D:\WINDOWS\Internet Logs\xDB55.tmp 2007-11-13 21:41 2,353,152 ----a-w D:\WINDOWS\Internet Logs\xDB56.tmp 2007-11-08 20:45 2,349,056 ----a-w D:\WINDOWS\Internet Logs\xDB54.tmp 2007-11-08 20:45 1,437,184 ----a-w D:\WINDOWS\Internet Logs\xDB53.tmp 2007-11-07 21:56 132,608 ----a-w D:\WINDOWS\Internet Logs\xDB52.tmp 2007-11-06 22:36 3,010,048 ----a-w D:\WINDOWS\Internet Logs\xDB50.tmp 2007-11-06 22:36 2,345,984 ----a-w D:\WINDOWS\Internet Logs\xDB51.tmp 2007-11-06 18:35 2,339,840 ----a-w D:\WINDOWS\Internet Logs\xDB4F.tmp 2007-11-06 18:35 161,280 ----a-w D:\WINDOWS\Internet Logs\xDB4E.tmp 2007-11-05 22:13 2,331,648 ----a-w D:\WINDOWS\Internet Logs\xDB4D.tmp 2007-11-05 22:13 1,914,368 ----a-w D:\WINDOWS\Internet Logs\xDB4C.tmp 2007-11-04 10:04 2,233,344 ----a-w D:\WINDOWS\Internet Logs\xDB4B.tmp 2007-10-31 14:25 2,873,344 ----a-w D:\WINDOWS\Internet Logs\xDB4A.tmp 2007-10-29 19:55 13,090,816 ----a-w D:\WINDOWS\Internet Logs\vsmon_on_demand_2007_10_29_20_48_59_full.dmp.zip 2007-10-29 19:49 2,249,728 ----a-w D:\WINDOWS\Internet Logs\xDB49.tmp 2007-10-27 21:51 2,899,456 ----a-w D:\WINDOWS\Internet Logs\xDB48.tmp 2007-10-27 16:29 1,720,832 ----a-w D:\WINDOWS\Internet Logs\xDB47.tmp 2007-10-26 19:30 3,576,832 ----a-w D:\WINDOWS\Internet Logs\xDB46.tmp 2007-10-25 20:47 20,402,866 ----a-w D:\WINDOWS\Internet Logs\vsmon_on_demand_2007_10_25_22_28_45_full.dmp.zip 2007-10-25 20:31 21,231,824 ----a-w D:\WINDOWS\Internet Logs\vsmon_on_demand_2007_10_25_22_27_55_full.dmp.zip 2007-10-25 20:30 106,792 ----a-w D:\WINDOWS\Internet Logs\vsmon_2nd_2007_10_25_22_27_49_small.dmp.zip 2007-10-25 20:28 2,235,392 ----a-w D:\WINDOWS\Internet Logs\xDB45.tmp 2007-10-21 21:30 2,269,696 ----a-w D:\WINDOWS\Internet Logs\xDB44.tmp 2007-10-20 21:48 84,992 ----a-w D:\WINDOWS\Internet Logs\xDB43.tmp 2007-10-19 22:23 23,040 ----a-w D:\WINDOWS\Internet Logs\xDB42.tmp 2007-10-19 19:43 2,697,728 ----a-w D:\WINDOWS\Internet Logs\xDB41.tmp 2007-10-16 16:49 2,216,448 ----a-w D:\WINDOWS\Internet Logs\xDB40.tmp 2007-10-16 16:49 120,832 ----a-w D:\WINDOWS\Internet Logs\xDB3F.tmp 2007-10-16 10:30 3,079,168 ----a-w D:\WINDOWS\Internet Logs\xDB3D.tmp 2007-10-15 21:05 3,079,168 ----a-w D:\WINDOWS\Internet Logs\xDB3E.tmp 2007-10-14 21:23 634,880 ----a-w D:\WINDOWS\Internet Logs\xDB3C.tmp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2006-05-11 16:24 18577448] "Gadu-Gadu"="E:\Programy\gg\Gadu-Gadu\gg.exe" [2006-11-14 10:12 1849032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "P17Helper"="P17.dll" [2005-05-03 18:38 64512 D:\WINDOWS\system32\P17.dll] "NeroCheck"="D:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 11:50 155648] "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2005-12-10 02:06 7311360] "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 02:06 86016] "AVMWlanClient"="D:\Program Files\avmwlanstick\FRITZWLANMini.exe" [2006-06-23 10:24 343552] "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592] "ZoneAlarm Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2004-12-28 18:02 770048 E:\Programy\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] --a------ 2006-05-11 16:24 18577448 D:\Program Files\Skype\Phone\Skype.exe R3 FWLANUSB;AVM FRITZ!WLAN;D:\WINDOWS\system32\DRIVERS\fwlanusb.sys [2006-04-06 00:00] R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;D:\WINDOWS\system32\DRIVERS\getnd5b.sys [2003-09-02 11:22] S3 MaRdPnp;MaRdPnp;D:\WINDOWS\system32\DRIVERS\MaRdP2K.sys [2005-05-03 15:20] S3 MRVW225;A/WLAN-1 Wireless LAN Dirver for Windows XP;D:\WINDOWS\system32\DRIVERS\MRVW225.sys [2005-12-21 10:44] S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys [] S3 usb2vcom;USB to Serial Bridge Controller;D:\WINDOWS\system32\Drivers\usb2vcom.sys [] S3 XDva090;XDva090;D:\WINDOWS\system32\XDva090.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19ddb918-4f4b-11dc-a173-001109272adb}] \Shell\AutoRun\command - I:\pushinst.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-14 19:48:34 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-14 19:49:18 ComboFix-quarantined-files.txt 2008-02-14 18:49:14 ComboFix2.txt 2008-02-14 13:28:04 ComboFix3.txt 2008-02-14 13:01:04 . 2008-02-14 10:06:48 --- E O F ---

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:50:11, on 2008-02-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\svchost.exe D:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe D:\WINDOWS\system32\ZoneLabs\vsmon.exe D:\WINDOWS\system32\wscntfy.exe D:\WINDOWS\system32\Rundll32.exe D:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\avmwlanstick\FRITZWLANMini.exe D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\Program Files\DAEMON Tools\daemon.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\Skype\Phone\Skype.exe E:\Programy\gg\Gadu-Gadu\gg.exe D:\WINDOWS\system32\wuauclt.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\explorer.exe D:\WINDOWS\system32\notepad.exe D:\Documents and Settings\bibek\Pulpit\Nowy folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVMWlanClient] D:\Program Files\avmwlanstick\FRITZWLANMini.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\gg\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LVSrvLauncher - Labtec Inc. - D:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - D:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

ahhh mój błąd
już są

**Posty:** 18165 · przez **wojtas** 15 Lut 2008, 18:41

Do notatnika wklej:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19ddb918-4f4b-11dc-a173-001109272adb}]

Plik > zapisz jako > zmień rozszerzenie z .txt na wszystkie pliki > zapisz pod nazwą Fix.reg np na
pulpicie > dwuklik na Fix.reg > potwierdzasz . zainstaluj antywirusa jakiegos np :

http://www.programosy.pl/program,avast-home.html

**Posty:** 5 · przez **bialasss** 17 Lut 2008, 12:44

wpis wprowadzony antywirus zainstalowany
dzięki ogromne za pomoc
czy mam jeszcze dodać logi?
i jeszcze pytanie, czy po zainstalowaniu antywirusa mam odinstalować Firewalla?

**Posty:** 18165 · przez **wojtas** 17 Lut 2008, 17:11

bialasss napisał(a):czy mam jeszcze dodać logi?

nie

bialasss napisał(a):i jeszcze pytanie, czy po zainstalowaniu antywirusa mam odinstalować Firewalla?

nie

prosze o prawdzenie loga, myślę że mam trojana

prosze o prawdzenie loga, myślę że mam trojana

Kto jest na forum