proszę o sprawdzenie loga - trojan

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 13:00

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:49:54, on 2007-10-03 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\WINDOWS\system32\dllcache\services.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\System32\wing32.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\mateusz\Pulpit\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Intec Service Drivers] C:\WINDOWS\System32\wing32.exe O4 - HKLM\..\Run: [mmsass] mmdmm.exe O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [wsp] C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Intec Service Drivers] C:\WINDOWS\System32\wing32.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [Intec Service Drivers] C:\WINDOWS\System32\wing32.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BA93B645-E7BA-49C2-8D2A-BB5CFCCDF446}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Mims service (Mimserv) - Unknown owner - C:\WINDOWS\system32\dllcache\services.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 4841 bytes

Nod32 cały czas pokazuje jakiegoś trojana, komp strasznie muli

. Jeśli ktoś może coś poradzić będę bardzo wdzięczny.

**Posty:** 8694 · przez **Red** 03 Paź 2007, 13:15

Do usunięcia masz:

O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [Intec Service Drivers] C:\WINDOWS\System32\wing32.exe (User '?')
O23 - Service: Mims service (Mimserv) - Unknown owner - C:\WINDOWS\system32\dllcache\services.exe

Wykonaj wcześniej:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop Mimserv

sc delete Mimserv

Daj log do kontroli.

Autor postu otrzymał pochwałę

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 13:32

Tych 3 pierwszych nie było po skanie (kompletnie się na tym nie znam więc może coś pominąłem). Teraz log wygląda tak:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:25:51, on 2007-10-03 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\WINDOWS\system32\dllcache\services.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\mateusz\Pulpit\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Intec Service Drivers] C:\WINDOWS\System32\wing32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [wsp] C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BA93B645-E7BA-49C2-8D2A-BB5CFCCDF446}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 4344 bytes

**Posty:** 8694 · przez **Red** 03 Paź 2007, 13:44

C:\WINDOWS\system32\dllcache\services.exe

Pozostaje jeszcze do usunięcia to co powyzej,tylko z tej własnie lokalizacji.

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 13:52

Sory za moją niewiedzę ale możesz mi wytłumaczyć jak to zrobić ?

**Posty:** 8694 · przez **Red** 03 Paź 2007, 14:02

Sciągnij:

http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

Do pola Paste List of Files/Folders to be Moved wklej:

C:\WINDOWS\system32\dllcache\services.exe

Następnie wciśnij przycisk MoveIt!
Pojawi się komunikat, że jest potrzebny restart do usunięcia podanych plików/folderów- wciśnij Yes.
Po restarcie usuń ręcznie folder C:\_OTMoveIt (Prawoklik >>> Usuń >>> Opróżnij Kosz).

Dodatkowo zastosuj:

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Uruchom komputer w trybie awaryjnym .

Uruchom SDFix, a jak się wypakuje do C:\SDFix dwuklik na plik RunThis.bat. Zatwierdź czyszczenie przez Y. Będzie dezynfekcja i reset kompa.

Sprawdz.

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 14:29

Zrobiłem jak mówisz, ale nod dalej coś pokazuje. Teraz log wygląda tak:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:21:54, on 2007-10-03 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Documents and Settings\mateusz\Pulpit\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [wsp] C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BA93B645-E7BA-49C2-8D2A-BB5CFCCDF446}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 3758 bytes

A wygląda to tak:

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 16:03

daj loga z combofixa

**Posty:** 8694 · przez **Red** 03 Paź 2007, 16:10

Zastosuj :

http://www.ewido.net/de/

po skanowaniu usuń wszystko co znajdzie...

Do tego programu :

http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

wklej:

C:\WINDOWS\system32\re1.exe

usuń.

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 16:30

AVG nic nie wykrył a gdy próbowałem usunąć ten plik wyskoczył komunikat że nie ma takiego pliku.

Tak wygląda log z combofixa:

Kod: Zaznacz wszystko: ComboFix 07-10-03.7 - mateusz 2007-10-03 16:18:53.1 - [color=red][b]FAT32[/b][/color]x86 Running from: C:\Documents and Settings\mateusz\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\jawdbn;waeodfa C:\WINDOWS\system32\a.exe . ((((((((((((((((((((((((( Files Created from 2007-09-03 to 2007-10-03 ))))))))))))))))))))))))))))))) . 2007-10-03 16:19 0 --ahs---- C:\WINDOWS\system32\.exe 2007-10-03 16:18 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-03 14:40 38,912 -r-hs---- C:\WINDOWS\system32\dllcache\services.exe 2007-10-03 14:40 19,170 --a------ C:\WINDOWS\system32\winshield.exe 2007-10-03 14:15 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-03 14:08 56,324 ---hs---- C:\WINDOWS\system32\mdm.exe 2007-10-03 14:08 54,788 ---hs---- C:\ntlds.exe 2007-10-03 12:19 <DIR> d--hs---- C:\FOUND.003 2007-10-03 10:23 <DIR> d--hs---- C:\FOUND.002 2007-10-03 10:20 66,048 --a------ C:\WINDOWS\system32\wing32.exe 2007-10-02 11:48 30,326 --a------ C:\dos32.exe 2007-10-02 10:25 <DIR> d--hs---- C:\FOUND.001 2007-10-02 08:52 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-02 08:41 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-10-02 08:41 <DIR> d-------- C:\Program Files\Sports Interactive 2007-10-02 08:39 <DIR> d--h----- C:\Documents and Settings\mateusz\InstallAnywhere 2007-10-02 08:14 <DIR> d-------- C:\Program Files\AutoConnect 2007-10-01 18:24 46,892 --a------ C:\WINDOWS\system32\adadix16.dll 2007-10-01 18:24 46,167 --a------ C:\WINDOWS\system32\drivers\adildr.sys 2007-10-01 18:24 4,981 --a------ C:\WINDOWS\system32\adadix2k.dll 2007-10-01 18:24 22,395 --a------ C:\WINDOWS\system32\drivers\fpga.bin 2007-10-01 18:24 155,648 --a------ C:\WINDOWS\system32\adadix32.dll 2007-10-01 18:24 135,168 --a------ C:\WINDOWS\system32\unaddrv.exe 2007-10-01 18:24 127,497 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys 2007-10-01 18:24 127,456 --a------ C:\WINDOWS\system32\ipdetect.exe 2007-10-01 18:24 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll 2007-10-01 18:24 <DIR> d-------- C:\Program Files\SAGEM 2007-09-27 09:11 86,016 --a------ C:\WINDOWS\unvise32qt.exe 2007-09-27 09:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2007-09-26 20:44 36,224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys 2007-09-26 20:44 36,224 --a------ C:\WINDOWS\system32\dllcache\isapnp.sys 2007-09-22 19:43 28,672 -ra------ C:\WINDOWS\system32\adinst32.dll 2007-09-17 15:31 <DIR> d-------- C:\Program Files\Lavasoft 2007-09-17 15:31 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-17 15:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-09-13 18:16 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 2007-09-13 18:16 <DIR> d-------- C:\Program Files\Easy CD-DA Extractor 10 2007-09-13 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-09-13 18:08 <DIR> d-------- C:\Documents and Settings\mateusz\Dane aplikacji\River Past G5 2007-09-13 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\River Past G5 2007-09-13 17:51 573,440 --a------ C:\WINDOWS\system32\NCTAudioInformation2.dll 2007-09-13 17:51 491,520 --a------ C:\WINDOWS\system32\NCTAudioFile.dll 2007-09-13 17:51 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-09-13 17:51 286,720 --a------ C:\WINDOWS\system32\NCTWMAFile2.dll 2007-09-13 17:51 168,448 --a------ C:\WINDOWS\system32\NCTAudioPlayer.dll 2007-09-13 17:51 143,872 --a------ C:\WINDOWS\system32\NCTWMAFile.dll 2007-09-13 17:51 120,832 --a------ C:\WINDOWS\system32\lame_enc.dll 2007-09-13 17:51 <DIR> d-------- C:\Program Files\4U Computing 2007-09-13 12:59 <DIR> d-------- C:\Program Files\VideoLAN 2007-09-13 12:59 <DIR> d-------- C:\Documents and Settings\mateusz\Dane aplikacji\vlc . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-01 18:25 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-09-01 07:56 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-21 07:55 --------- d-------- C:\Program Files\Usb to Serial Driver 1.12.25 2007-08-21 07:55 --------- d-------- C:\Program Files\MobTime Cell Phone Manager 2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2007-07-29 09:08 298104 --a------ C:\WINDOWS\system32\imon.dll 2001-10-26 15:29:52 70,300 --sh--r C:\WINDOWS\system32\mmdmm.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 11:02] "nwiz"="nwiz.exe" [2003-01-10 11:02 C:\WINDOWS\system32\nwiz.exe] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-29 09:08] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22] "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "mmsass"="mmdmm.exe" [2001-10-26 17:29 C:\WINDOWS\system32\mmdmm.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 17:29] "wsp"="C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe" [2006-04-14 11:07] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "mmsass"=mmdmm.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Microsoft Office"=C:\WINDOWS\System32\mdm.exe "Microsoft Windows Driver"=C:\WINDOWS\rundll32.exe C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-01 18:24:53] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-01 18:24:53] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-03 16:20:06 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-03 16:21:09 C:\ComboFix-quarantined-files.txt ... 2007-10-03 16:21 . --- E O F ---

**Posty:** 8694 · przez **Red** 03 Paź 2007, 17:01

ciągle masz (a niby usuwałeś)

C:\WINDOWS\system32\mmdmm.exe
C:\WINDOWS\system32\dllcache\services.exe

??

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 17:13

Red napisał(a):ciągle masz (a niby usuwałeś)

C:\WINDOWS\system32\mmdmm.exe
C:\WINDOWS\system32\dllcache\services.exe

??

Spróbowałem usunąć jeszcze raz programem otmoveit teraz log wygląda tak:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:07:53, on 2007-10-03 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe C:\Documents and Settings\mateusz\Pulpit\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [mmsass] mmdmm.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [wsp] C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1708537768-839522115-682003330-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BA93B645-E7BA-49C2-8D2A-BB5CFCCDF446}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Mims service (Mimserv) - Unknown owner - C:\WINDOWS\system32\dllcache\services.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 4537 bytes

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 18:09

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\.exe
C:\WINDOWS\system32\dllcache\services.exe
C:\WINDOWS\system32\winshield.exe
C:\WINDOWS\system32\mdm.exe
C:\ntlds.exe
C:\WINDOWS\system32\wing32.exe
C:\dos32.exe
C:\WINDOWS\system32\mmdmm.exe

Folder::
C:\FOUND.003
C:\FOUND.002
C:\FOUND.001

Driver::
Mimserv

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mmsass"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"mmsass"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Microsoft Office"=-
"Microsoft Windows Driver"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

potem nowy log z hijacka oraz combofixa

Autor postu otrzymał pochwałę

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 21:08

Combofix:

Kod: Zaznacz wszystko: ComboFix 07-10-03.7 - mateusz 2007-10-03 20:54:07.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.61 [GMT 2:00] Running from: C:\Documents and Settings\mateusz\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\mateusz\Pulpit\CFScript.txt * Created a new restore point FILE:: C:\dos32.exe C:\ntlds.exe C:\WINDOWS\system32\.exe C:\WINDOWS\system32\dllcache\services.exe C:\WINDOWS\system32\mdm.exe C:\WINDOWS\system32\mmdmm.exe C:\WINDOWS\system32\wing32.exe C:\WINDOWS\system32\winshield.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\dos32.exe C:\FOUND.001 C:\FOUND.001\FILE0000.CHK C:\FOUND.001\FILE0001.CHK C:\FOUND.001\FILE0002.CHK C:\FOUND.001\FILE0003.CHK C:\FOUND.001\FILE0004.CHK C:\FOUND.001\FILE0005.CHK C:\FOUND.001\FILE0006.CHK C:\FOUND.001\FILE0007.CHK C:\FOUND.001\FILE0008.CHK C:\FOUND.001\FILE0009.CHK C:\FOUND.001\FILE0010.CHK C:\FOUND.001\FILE0011.CHK C:\FOUND.001\FILE0012.CHK C:\FOUND.001\FILE0013.CHK C:\FOUND.001\FILE0014.CHK C:\FOUND.001\FILE0015.CHK C:\FOUND.001\FILE0016.CHK C:\FOUND.001\FILE0017.CHK C:\FOUND.001\FILE0018.CHK C:\FOUND.001\FILE0019.CHK C:\FOUND.001\FILE0020.CHK C:\FOUND.001\FILE0021.CHK C:\FOUND.001\FILE0022.CHK C:\FOUND.001\FILE0023.CHK C:\FOUND.001\FILE0024.CHK C:\FOUND.001\FILE0025.CHK C:\FOUND.001\FILE0026.CHK C:\FOUND.001\FILE0027.CHK C:\FOUND.001\FILE0028.CHK C:\FOUND.001\FILE0029.CHK C:\FOUND.001\FILE0030.CHK C:\FOUND.001\FILE0031.CHK C:\FOUND.001\FILE0032.CHK C:\FOUND.001\FILE0033.CHK C:\FOUND.001\FILE0034.CHK C:\FOUND.001\FILE0035.CHK C:\FOUND.001\FILE0036.CHK C:\FOUND.001\FILE0037.CHK C:\FOUND.001\FILE0038.CHK C:\FOUND.002 C:\FOUND.002\FILE0000.CHK C:\FOUND.002\FILE0001.CHK C:\FOUND.002\FILE0002.CHK C:\FOUND.002\FILE0003.CHK C:\FOUND.002\FILE0004.CHK C:\FOUND.002\FILE0005.CHK C:\FOUND.002\FILE0006.CHK C:\FOUND.002\FILE0007.CHK C:\FOUND.002\FILE0008.CHK C:\FOUND.002\FILE0009.CHK C:\FOUND.002\FILE0010.CHK C:\FOUND.002\FILE0011.CHK C:\FOUND.002\FILE0012.CHK C:\FOUND.002\FILE0013.CHK C:\FOUND.002\FILE0014.CHK C:\FOUND.002\FILE0015.CHK C:\FOUND.002\FILE0016.CHK C:\FOUND.002\FILE0017.CHK C:\FOUND.002\FILE0018.CHK C:\FOUND.002\FILE0019.CHK C:\FOUND.002\FILE0020.CHK C:\FOUND.002\FILE0021.CHK C:\FOUND.002\FILE0022.CHK C:\FOUND.002\FILE0023.CHK C:\FOUND.002\FILE0024.CHK C:\FOUND.002\FILE0025.CHK C:\FOUND.002\FILE0026.CHK C:\FOUND.002\FILE0027.CHK C:\FOUND.002\FILE0028.CHK C:\FOUND.002\FILE0029.CHK C:\FOUND.002\FILE0030.CHK C:\FOUND.002\FILE0031.CHK C:\FOUND.002\FILE0032.CHK C:\FOUND.002\FILE0033.CHK C:\FOUND.002\FILE0034.CHK C:\FOUND.002\FILE0035.CHK C:\FOUND.002\FILE0036.CHK C:\FOUND.002\FILE0037.CHK C:\FOUND.002\FILE0038.CHK C:\FOUND.002\FILE0039.CHK C:\FOUND.002\FILE0040.CHK C:\FOUND.002\FILE0041.CHK C:\FOUND.002\FILE0042.CHK C:\FOUND.002\FILE0043.CHK C:\FOUND.002\FILE0044.CHK C:\FOUND.002\FILE0045.CHK C:\FOUND.002\FILE0046.CHK C:\FOUND.002\FILE0047.CHK C:\FOUND.002\FILE0048.CHK C:\FOUND.002\FILE0049.CHK C:\FOUND.002\FILE0050.CHK C:\FOUND.002\FILE0051.CHK C:\FOUND.002\FILE0052.CHK C:\FOUND.002\FILE0053.CHK C:\FOUND.002\FILE0054.CHK C:\FOUND.002\FILE0055.CHK C:\FOUND.002\FILE0056.CHK C:\FOUND.002\FILE0057.CHK C:\FOUND.002\FILE0058.CHK C:\FOUND.002\FILE0059.CHK C:\FOUND.002\FILE0060.CHK C:\FOUND.002\FILE0061.CHK C:\FOUND.002\FILE0062.CHK C:\FOUND.002\FILE0063.CHK C:\FOUND.002\FILE0064.CHK C:\FOUND.002\FILE0065.CHK C:\FOUND.002\FILE0066.CHK C:\FOUND.002\FILE0067.CHK C:\FOUND.002\FILE0068.CHK C:\FOUND.002\FILE0069.CHK C:\FOUND.002\FILE0070.CHK C:\FOUND.002\FILE0071.CHK C:\FOUND.002\FILE0072.CHK C:\FOUND.002\FILE0073.CHK C:\FOUND.002\FILE0074.CHK C:\FOUND.002\FILE0075.CHK C:\FOUND.002\FILE0076.CHK C:\FOUND.002\FILE0077.CHK C:\FOUND.002\FILE0078.CHK C:\FOUND.002\FILE0079.CHK C:\FOUND.002\FILE0080.CHK C:\FOUND.002\FILE0081.CHK C:\FOUND.002\FILE0082.CHK C:\FOUND.002\FILE0083.CHK C:\FOUND.002\FILE0084.CHK C:\FOUND.002\FILE0085.CHK C:\FOUND.002\FILE0086.CHK C:\FOUND.002\FILE0087.CHK C:\FOUND.002\FILE0088.CHK C:\FOUND.002\FILE0089.CHK C:\FOUND.002\FILE0090.CHK C:\FOUND.003 C:\FOUND.003\FILE0000.CHK C:\FOUND.003\FILE0001.CHK C:\FOUND.003\FILE0002.CHK C:\FOUND.003\FILE0003.CHK C:\ntlds.exe C:\WINDOWS\rundll32.exe C:\WINDOWS\system32\wing32.exe C:\WINDOWS\system32\winshield.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_MIMSERV -------\Mimserv ((((((((((((((((((((((((( Files Created from 2007-09-03 to 2007-10-03 ))))))))))))))))))))))))))))))) . 2007-10-03 16:21 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-10-03 16:18 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-03 14:15 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-02 08:52 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-02 08:41 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-10-02 08:41 <DIR> d-------- C:\Program Files\Sports Interactive 2007-10-02 08:39 <DIR> d--h----- C:\Documents and Settings\mateusz\InstallAnywhere 2007-10-02 08:14 <DIR> d-------- C:\Program Files\AutoConnect 2007-10-01 18:24 46,892 --a------ C:\WINDOWS\system32\adadix16.dll 2007-10-01 18:24 46,167 --a------ C:\WINDOWS\system32\drivers\adildr.sys 2007-10-01 18:24 4,981 --a------ C:\WINDOWS\system32\adadix2k.dll 2007-10-01 18:24 22,395 --a------ C:\WINDOWS\system32\drivers\fpga.bin 2007-10-01 18:24 155,648 --a------ C:\WINDOWS\system32\adadix32.dll 2007-10-01 18:24 135,168 --a------ C:\WINDOWS\system32\unaddrv.exe 2007-10-01 18:24 127,497 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys 2007-10-01 18:24 127,456 --a------ C:\WINDOWS\system32\ipdetect.exe 2007-10-01 18:24 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll 2007-10-01 18:24 <DIR> d-------- C:\Program Files\SAGEM 2007-09-27 09:11 86,016 --a------ C:\WINDOWS\unvise32qt.exe 2007-09-27 09:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2007-09-26 20:44 36,224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys 2007-09-26 20:44 36,224 --a------ C:\WINDOWS\system32\dllcache\isapnp.sys 2007-09-22 19:43 28,672 -ra------ C:\WINDOWS\system32\adinst32.dll 2007-09-17 15:31 <DIR> d-------- C:\Program Files\Lavasoft 2007-09-17 15:31 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-17 15:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-09-13 18:16 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 2007-09-13 18:16 <DIR> d-------- C:\Program Files\Easy CD-DA Extractor 10 2007-09-13 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-09-13 18:08 <DIR> d-------- C:\Documents and Settings\mateusz\Dane aplikacji\River Past G5 2007-09-13 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\River Past G5 2007-09-13 17:51 573,440 --a------ C:\WINDOWS\system32\NCTAudioInformation2.dll 2007-09-13 17:51 491,520 --a------ C:\WINDOWS\system32\NCTAudioFile.dll 2007-09-13 17:51 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-09-13 17:51 286,720 --a------ C:\WINDOWS\system32\NCTWMAFile2.dll 2007-09-13 17:51 168,448 --a------ C:\WINDOWS\system32\NCTAudioPlayer.dll 2007-09-13 17:51 143,872 --a------ C:\WINDOWS\system32\NCTWMAFile.dll 2007-09-13 17:51 120,832 --a------ C:\WINDOWS\system32\lame_enc.dll 2007-09-13 17:51 <DIR> d-------- C:\Program Files\4U Computing 2007-09-13 12:59 <DIR> d-------- C:\Program Files\VideoLAN 2007-09-13 12:59 <DIR> d-------- C:\Documents and Settings\mateusz\Dane aplikacji\vlc . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-01 18:25 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-09-01 07:56 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-21 07:55 --------- d-------- C:\Program Files\Usb to Serial Driver 1.12.25 2007-08-21 07:55 --------- d-------- C:\Program Files\MobTime Cell Phone Manager 2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2007-07-29 09:08 298104 --a------ C:\WINDOWS\system32\imon.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-03_16.20.36,54 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 32,768 2007-10-03 15:00:42 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat ----a-w 32,768 2007-10-03 15:00:42 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat ----a-w 56,324 2007-10-03 15:00:40 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\S5MVSP2Z\mmdm2[1].exe ----a-w 54,788 2007-10-03 15:00:44 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\WL63WLQJ\db[1].exe ----a-w 3,823 2007-10-03 15:01:16 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\GNA6B9SW\mmdmm[1].exe ----a-w 16,384 2007-10-03 15:00:42 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat . ----a-w 32,768 2007-10-03 12:47:54 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat ----a-w 32,768 2007-10-03 12:47:54 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat ----a-w 56,324 2007-10-03 12:11:18 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\S5MVSP2Z\mmdm2[1].exe ----a-w 16,384 2007-10-03 12:47:54 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "@"="" [] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 11:02] "nwiz"="nwiz.exe" [2003-01-10 11:02 C:\WINDOWS\system32\nwiz.exe] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-29 09:08] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22] "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "@"="" [] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 17:29] "wsp"="C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe" [2006-04-14 11:07] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-01 18:24:53] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-01 18:24:53] R0 d346bus;d346bus;C:\WINDOWS\System32\DRIVERS\d346bus.sys R0 d346prt;d346prt;C:\WINDOWS\System32\Drivers\d346prt.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS S3 NTSIM;NTSIM;\??\C:\WINDOWS\System32\ntsim.sys S3 SER120;OTI Serial port driver;C:\WINDOWS\System32\DRIVERS\SER120.sys . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-03 20:58:13 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-03 20:59:24 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-10-03 20:59 C:\ComboFix2.txt ... 2007-10-03 16:21 . --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:02:12, on 2007-10-03 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\mateusz\Pulpit\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [wsp] C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BA93B645-E7BA-49C2-8D2A-BB5CFCCDF446}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 4127 bytes

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 21:45

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

i bedzie czysto

**Posty:** 84 · przez **łysy82** 03 Paź 2007, 22:03

Jeśli tak mówisz to bardzo dziękuje wam za pomoc. Temat do zamknięcia :wink:

[ Dodano: Dzisiaj o 22:59 ]
Jednak nie do zamknięcia, komputer strasznie mi zaczął mulić więc bardzo proszę o ponowne sprawdzenie loga. A wygląda on tak:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:51:49, on 2007-11-27 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\mateusz\Pulpit\Nowy folder\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [wsp] C:\Documents and Settings\mateusz\Pulpit\wsp_0.9.6_lakionline\wsp.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O17 - HKLM\System\CCS\Services\Tcpip\..\{BA93B645-E7BA-49C2-8D2A-BB5CFCCDF446}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 4288 bytes

proszę o sprawdzenie loga - trojan

Proszę o sprawdzenie loga - trojan

Kto jest na forum