prosze o sprawdzenie loga

**Posty:** 4 · przez **feronek** 30 Lip 2007, 18:37

Witam!
Jak włączam komputer pojawia mi się komunikat: "Exception processing message". Wyczytałam, że to z powodu wirusa i/lub trojana.
Wykonałam spis logów Hijackiem.
Czy możecie mi powiedzieć, które logi mam błędne i jak usunąć ten "syf".
Proszę napiszcie do mnie jak do 4-latka, ktory nie miał do czynienia z komputerem - nie znam się na tym wszystkim. Wiem jak wejść w tryb awaryjny (chyba) ale później już nic nie wiem. Pomóżcie prosze!!!
Poniżej zamiesczam logi.

"Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:30:28, on 2007-07-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\D-Link AirPlus\AirPlus.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
D:\Programy\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Documents and Settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\LieDetector.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programy\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 2763 bytes"

Dzięki

Fera

**Posty:** 18165 · przez **wojtas** 30 Lip 2007, 18:40

feronek witaj daj loga wg.opisu:

musisz poczytac o tagach...

czy to jest pelny log??

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 4 · przez **feronek** 30 Lip 2007, 18:43

tak, wszystko co wyszlo z hijacka, zatem postaram sie wstawic poprawnie:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:40, on 2007-07-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\ADS.exe
C:\Program Files\D-Link AirPlus\AirPlus.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
D:\Programy\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Documents and Settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\LieDetector.exe
D:\Programy\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.poczta.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\foairueh.dll",sitypnow
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ADS] C:\Windows\ADS.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.0.5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C59480B-EE95-4936-A426-875777A089EE}: NameServer = 62.233.215.130,62.233.128.18
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D1FD46A-52C6-4D8B-8330-555B1BF4B629}: NameServer = 85.255.113.149,85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\..\{6653D0F3-F568-4F8E-BC16-979898B29215}: NameServer = 85.255.113.149,85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\..\{857621EF-AC33-44B5-9697-4267113623F3}: NameServer = 85.255.113.149,85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B222B36-8D41-4BF6-B6DA-75C9F924DE03}: NameServer = 85.255.113.149,85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF75C308-0FCB-4B66-82A9-C5626D176489}: NameServer = 85.255.113.149,85.255.112.218
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.149 85.255.112.218
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.149 85.255.112.218
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - D:\Programy\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - D:\Programy\Firebird_1_5\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 10394 bytes

Czy o to chodzilo???

**Posty:** 18165 · przez **wojtas** 30 Lip 2007, 19:01

umiesc log w tagach i daj loga z combofixa oczywiscie w tagach o ktorych mowa jest tu:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 4 · przez **feronek** 30 Lip 2007, 22:54

Ok, przeskanowałam Combofixem i umieszczam log jaki mi wyszedł (postaram się to zrobić zgodnie z zaleceniem)

ComboFix 07-07-30.2 - "Feronek" 2007-07-30 22:21:40.2 [GMT 2:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.Prawda

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\cbxusrr.dll
C:\WINDOWS\system32\oompvmjp.dll
C:\WINDOWS\system32\ssqronn.dll
C:\WINDOWS\system32\qrsut.bak1
C:\WINDOWS\system32\qrsut.bak2
C:\WINDOWS\system32\qrsut.ini
C:\WINDOWS\system32\qrsut.ini2
C:\WINDOWS\system32\qrsut.tmp
C:\WINDOWS\system32\ssqqrop.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Feronek\Pulpit.\internet explorer.lnk
C:\WINDOWS\system32\kdexd.exe

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 )))))))))))))))))))))))))))))))

2007-07-30 22:22 125,504 --a------ C:\WINDOWS\system32\khltugat.dll
2007-07-30 19:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-30 17:01 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-30 16:39 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Lavasoft
2007-07-30 16:38 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-30 16:38 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-30 16:38 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-30 16:38 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-30 16:38 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-07-30 16:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-30 16:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-30 16:38 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-30 15:36 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-07-30 15:36 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-07-30 15:36 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-07-30 15:36 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-07-30 15:36 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-07-30 15:36 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-07-30 15:36 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-07-30 15:36 <DIR> d-------- C:\DOCUME~1\Feronek\DANEAP~1\PC Tools
2007-07-29 21:57 126,016 --a------ C:\WINDOWS\system32\foairueh.dll
2007-07-29 11:40 <DIR> d-------- C:\DOCUME~1\Feronek\DANEAP~1\Bitdefender
2007-07-28 20:54 14 --a------ C:\WINDOWS\system32\getfile.dat
2007-07-28 09:50 228,960 --a------ C:\WINDOWS\system32\tusrq.dll
2007-07-28 09:31 <DIR> d-------- C:\Program Files\Yahoo!
2007-07-28 09:23 208,384 --a------ C:\WINDOWS\ADS.exe
2007-07-28 09:14 <DIR> d-------- C:\Program Files\GoD
2007-07-26 14:55 <DIR> d-------- C:\Program Files\foobar2000
2007-07-26 14:55 <DIR> d-------- C:\DOCUME~1\Feronek\DANEAP~1\foobar2000
2007-07-21 17:47 <DIR> d-------- C:\Program Files\Smart CD Ripper
2007-07-20 00:32 <DIR> d-------- C:\Program Files\AFreeConverter
2007-07-20 00:25 <DIR> d-------- C:\Program Files\EMP3
2007-07-17 23:09 <DIR> d--hs---- C:\found.000
2007-07-04 09:40 <DIR> d-------- C:\Program Files\Bobyte
2007-07-04 09:37 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-07-04 09:37 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-07-04 09:33 <DIR> d-------- C:\Program Files\t@b
2007-06-22 19:51 <DIR> d-------- C:\Program Files\Audacity
2007-06-18 02:51 299,520 --a------ C:\WINDOWS\uninst.exe
2007-06-18 02:51 <DIR> d-------- C:\Program Files\XemiComputers
2007-06-18 02:45 <DIR> d-------- C:\Program Files\Arial Sound Recorder
2007-06-18 00:50 <DIR> d-------- C:\DOCUME~1\Feronek\DANEAP~1\CyberLink
2007-06-17 02:02 <DIR> d-------- C:\YoGen
2007-06-17 01:59 <DIR> d-------- C:\Program Files\YoGen AudioMagic
2007-06-14 13:11 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-06-14 13:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\BitDefender
2007-06-12 23:25 4,096 --a------ C:\WINDOWS\d3dx.dat
2007-06-12 19:07 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-06-12 17:35 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-06-10 17:38 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-06-10 17:38 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-06-10 17:38 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-06-10 17:38 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-06-10 17:38 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-06-10 17:38 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-06-10 17:38 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-06-10 17:38 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-06-10 17:38 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-06-10 17:38 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-06-10 17:38 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-06-10 17:38 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2007-06-10 17:38 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-06-10 17:38 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-06-10 17:38 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-06-10 17:38 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-06-10 17:38 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2007-06-10 17:38 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-06-10 17:38 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-06-10 17:02 <DIR> d-------- C:\Program Files\ASUSTek
2007-06-10 17:00 <DIR> d-------- C:\Program Files\AP Tuner
2007-06-10 16:55 7,424 -ra------ C:\WINDOWS\system32\drivers\MMIOPORT.SYS
2007-06-10 16:49 <DIR> d-------- C:\Program Files\AC3Filter
2007-06-10 16:25 <DIR> d-------- C:\DOCUME~1\Feronek\DANEAP~1\Media Player Classic
2007-06-10 16:22 740,442 --a------ C:\WINDOWS\system32\divx.dll
2007-06-10 16:22 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-06-10 16:22 593,920 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-06-10 16:22 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-06-10 16:22 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-06-10 16:22 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-06-10 16:22 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-06-10 16:22 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-06-10 11:06 <DIR> d-------- C:\DOCUME~1\Feronek\DANEAP~1\MSN6
2007-06-10 11:06 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\MSN6

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-30 22:43 --------- d-------- C:\DOCUME~1\Feronek\DANEAP~1\Skype
2007-07-28 12:40 --------- d-------- C:\Program Files\eMule
2007-07-27 14:14 --------- d-------- C:\DOCUME~1\Feronek\DANEAP~1\Tlen.pl
2007-07-21 02:47 --------- d-------- C:\Program Files\English Translator 3
2007-07-11 11:11 79606 --a------ C:\WINDOWS\system32\perfc015.dat
2007-07-11 11:11 458260 --a------ C:\WINDOWS\system32\perfh015.dat
2007-06-30 19:37 --------- d-------- C:\DOCUME~1\Feronek\DANEAP~1\MegauploadToolbar
2007-06-30 19:29 --------- d-------- C:\DOCUME~1\Feronek\DANEAP~1\Download Manager
2007-06-15 09:35 --------- d-------- C:\DOCUME~1\Feronek\DANEAP~1\Cream Software
2007-06-14 14:23 --------- d-------- C:\Program Files\Common Files\Matrix.pl
2007-06-14 14:22 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-06-12 23:19 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-06-11 00:57 --------- d-------- C:\DOCUME~1\Feronek\DANEAP~1\BitTorrent
2007-06-10 16:21 --------- d-------- C:\Program Files\DivX
2007-06-10 16:13 --------- d-------- C:\Program Files\Microsoft ActiveSync
2007-05-16 17:18 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-03-19 20:13 6422611 --a------ C:\Program Files\frostwire-4.13.1.6.windows.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF2DE08D-1806-4300-96F3-9B0D86820D7A}]
2007-07-28 09:50 228960 --a------ C:\WINDOWS\system32\tusrq.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Display Settings"="C:\Program Files\HPQ\Notebook Utilities\hptasks.exe" [2002-08-15 06:26]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 18:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 18:38]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"CARPService"="carpserv.exe" [2003-05-21 15:35 C:\WINDOWS\system32\carpserv.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 19:55]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-12 07:48]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-07-29 13:51]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2006-10-11 11:48]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-27 01:54]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-05 18:49]
"ADS"="C:\Windows\ADS.exe" [2007-07-28 09:23]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\Feronek\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2006-10-09 18:20:42]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tusrq]
C:\WINDOWS\system32\tusrq.dll 2007-07-28 09:50 228960 C:\WINDOWS\system32\tusrq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys
R1 bdpredir;bdpredir;\??\C:\Program Files\Softwin\BitDefender10\bdpredir.sys
R1 IKFileFlt;File Filter Driver;C:\WINDOWS\system32\drivers\ikfileflt.sys
R1 IKFileSec;File Security Driver;C:\WINDOWS\system32\drivers\ikfilesec.sys
R1 IkSysFlt;System Filter Driver;C:\WINDOWS\system32\drivers\iksysflt.sys
R1 IKSysSec;System Security Driver;C:\WINDOWS\system32\drivers\iksyssec.sys
R2 BDRSDRV;BDRSDRV;\??\C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Programy\Firebird_1_5\bin\fbguard.exe -s
R2 ScanDrv;ScanDrv;C:\WINDOWS\system32\drivers\ScanDrv.sys
R2 StreamDispatcher;StreamDispatcher;C:\WINDOWS\system32\DRIVERS\strmdisp.sys
R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys
R3 ALiIRDA;Sterownik urzĄdzenia podczerwieni ALi;C:\WINDOWS\system32\DRIVERS\alifir.sys
R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys
R3 BlueletSCOAudio;Bluetooth SCO Audio Service;C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys
R3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys
R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys
R3 CALIAUD;Conexant AMC 3D ENVIRONMENTAL AUDIO;C:\WINDOWS\system32\drivers\caliaud.sys
R3 CALIHALA;CALIHALA;C:\WINDOWS\system32\drivers\calihal.sys
R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Programy\Firebird_1_5\bin\fbserver.exe -s
R3 HPCI;HP Configuration Interface;C:\WINDOWS\system32\DRIVERS\hpci.sys
R3 HSFHWALI;HSFHWALI;C:\WINDOWS\system32\DRIVERS\HSFHWALI.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys
R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys
S0 esff;esff;C:\WINDOWS\system32\drivers\esff.sys
S2 SCANDEV;SCANDEV;C:\WINDOWS\system32\drivers\SCANDEV.sys
S3 aliadwdm;Sterownik ALi Audio Accelerator WDM;C:\WINDOWS\system32\drivers\ac97ali.sys
S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys
S3 FA312;Sterownik karty NETGEAR FA330/FA312/FA311 Fast Ethernet;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys
S3 MMIOPORT;MMIOPORT;\??\C:\WINDOWS\system32\drivers\MMIOPORT.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 usb_rndisx;USB RNDIS Adapter;C:\WINDOWS\system32\DRIVERS\usb8023x.sys
S3 usbser;USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys
S3 wceusbsh;Windows CE USB Serial Host Driver;C:\WINDOWS\system32\DRIVERS\wceusbsh.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f7d8ed0-0082-11dc-baa7-0011670b8a05}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f7d8ed1-0082-11dc-baa7-0011670b8a05}]
AutoRun\command- H:\USBNB.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f004bf2-5dc6-11db-b823-0011670b8a05}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- H:\Recycled\ctfmon.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 22:41:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00

scanning hidden files ...

C:\WINDOWS\system32\qrsut.ini

scan completed successfully
hidden files: 1

**************************************************************************

Completion time: 2007-07-30 22:46:12 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-30 22:45

--- E O F ---

Proszę o pomoc i opies jak 4-latkowi co teraz mam z tym zrobić i gdze szukać wroga

Dzięki za pomoc. Fera

**Posty:** 18165 · przez **wojtas** 31 Lip 2007, 10:40

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go

potem

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

**Posty:** 4 · przez **feronek** 31 Lip 2007, 14:08

Juz wczoraj poczytaam, pokombinowałam i wyszło mi że mam tego vundo, więc wg zaleceń przeskanowałam Vunfofixem, a pozniej wyrzuciłam pliki i znów przeskanowałam kilkoma innymi programami, na koniec zrobiłam pełny skan Spydoktorem i poszlo sobie

))Dzięki

**Posty:** 18165 · przez **wojtas** 31 Lip 2007, 14:56

feronek daj nowe logi

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum