proszę o sprawdzenie loga...

[Fever]

Log z kompa kolegi, któremu tak zmula net ze nie moze strony otworzyc.
i podobniez nie jest to wina providera...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:52:17, on 2007-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\sysvx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\KB_963491.exe
C:\WINDOWS\CMIRmDriver.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\bdir\sdflkj7.exe
C:\WINDOWS\47681728.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\marek\Pulpit\hijackthis.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start24.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\sysvx.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SmartShopper - {2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: H - {83E915D4-DDDB-4450-B957-7A3240E9CE66} - zoox1.dll (file missing)
O2 - BHO: XBTP01621 - {9EBBE90B-282E-4c39-8A7E-120749169F0F} - C:\PROGRA~1\BEARSH~1\MediaBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: BearShare MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
O4 - HKLM\..\Run: [Winmplayer] "C:\WINDOWS\system32\KB_963491.exe"
O4 - HKLM\..\Run: [Uninstall Information] C:\WINDOWS\CMIRmDriver.exe
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [strkjhk] C:\WINDOWS\bdir\sdflkj7.exe
O4 - HKCU\..\Run: [tlz] C:\WINDOWS\47681728.exe
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Casino-on-Net - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://mks.com.pl
O15 - Trusted Zone: www.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{305751F0-301F-44E2-A3B1-20C58776CDB1}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B8551A0-714B-46D9-AAE6-2B59DDE624A4}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE505B49-497C-4F1A-8B5B-FEEBD82B0C40}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5EEB81F-143C-4D6F-8EA6-3E5F8B0256E2}: NameServer = 202.40.169.30
Matwiej 10:16:54
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF27D22E-9009-4D1C-BCFF-BE88CFC3DF79}: NameServer = 202.40.169.30
O17 - HKLM\System\CS1\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CS2\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O20 - AppInit_DLLs: ie4uinit.dll
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
O21 - SSODL: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\pcdpqt.dll
O21 - SSODL: AtFKtBZyMXDfEfmu - {AC49CA05-06E3-60AF-B409-C21A9FBAE7D4} - C:\WINDOWS\system32\lp.dll (file missing)
O22 - SharedTaskScheduler: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\pcdpqt.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8590 bytes
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8590 bytes

[wojtas]

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


i wroc z logiem z hijacka oraz z combofixa

[Fever]

chyba nic z tego nie bedzie, bo mu sie co chwila komp restartuje...

bez tego nic sie nie da zrobic?

po kliknieciu na link Smitfraudfixa tez reset

[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\sysvx.exe
O2 - BHO: SmartShopper - {2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
O2 - BHO: H - {83E915D4-DDDB-4450-B957-7A3240E9CE66} - zoox1.dll (file missing)
O2 - BHO: XBTP01621 - {9EBBE90B-282E-4c39-8A7E-120749169F0F} - C:\PROGRA~1\BEARSH~1\MediaBar.dll
O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: BearShare MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\BearShare MediaBar\MediaBar.dll
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
O4 - HKLM\..\Run: [Winmplayer] "C:\WINDOWS\system32\KB_963491.exe"
O4 - HKLM\..\Run: [Uninstall Information] C:\WINDOWS\CMIRmDriver.exe
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKCU\..\Run: [strkjhk] C:\WINDOWS\bdir\sdflkj7.exe
O4 - HKCU\..\Run: [tlz] C:\WINDOWS\47681728.exe
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: Casino-on-Net - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
O21 - SSODL: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\pcdpqt.dll
O21 - SSODL: AtFKtBZyMXDfEfmu - {AC49CA05-06E3-60AF-B409-C21A9FBAE7D4} - C:\WINDOWS\system32\lp.dll (file missing)
O22 - SharedTaskScheduler: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\pcdpqt.dll

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

potem nowe logi z Hijack This oraz z combofixa

[Fever]

zrobilem co trza, jest troche lepiej, ale np. przy uruchamianiu Firefoxa jest restart... i nadal dziala troche wolniej, po kilku minutach zwiecha...


Hijack:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18, on 2007-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Odkurzacz\odk_mcd.exe
C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\marek\Pulpit\hijackthis.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start24.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: (no name) - {4596013b-6c31-408b-a266-deae5c086dc2} - (no file)
O3 - Toolbar: (no name) - {b5146c40-189a-4311-bda9-fbae3e023187} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://mks.com.pl
O15 - Trusted Zone: www.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{305751F0-301F-44E2-A3B1-20C58776CDB1}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B8551A0-714B-46D9-AAE6-2B59DDE624A4}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE505B49-497C-4F1A-8B5B-FEEBD82B0C40}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5EEB81F-143C-4D6F-8EA6-3E5F8B0256E2}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF27D22E-9009-4D1C-BCFF-BE88CFC3DF79}: NameServer = 202.40.169.30
O17 - HKLM\System\CS1\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CS2\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O20 - AppInit_DLLs: ie4uinit.dll
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6641 bytes

ComboFix:

Kod: Zaznacz wszystko

"marek" - 2007-07-31 12:20:48    Dodatek Service Pack 2 
ComboFix 07-05.17.6.V - Running from: "C:\Documents and Settings\marek\Pulpit\"


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\4_exception.nls
C:\u.exe
C:\WINDOWS\101218.exe
C:\WINDOWS\system32\gmc.exe.exe
C:\Documents and Settings\marek\~tmp0.120281469511251070374.exe
C:\WINDOWS\102875.exe
C:\WINDOWS\10878703.exe
C:\WINDOWS\10935093.exe
C:\WINDOWS\115812.exe
C:\WINDOWS\117171.exe
C:\WINDOWS\12079656.exe
C:\WINDOWS\12445484.exe
C:\WINDOWS\1258968.exe
C:\WINDOWS\1269343.exe
C:\WINDOWS\1270328.exe
C:\WINDOWS\1270437.exe
C:\WINDOWS\1282578.exe
C:\WINDOWS\1287703.exe
C:\WINDOWS\129562.exe
C:\WINDOWS\130406.exe
C:\WINDOWS\13280562.exe
C:\WINDOWS\13488296.exe
C:\WINDOWS\135453.exe
C:\WINDOWS\13649406.exe
C:\WINDOWS\14481484.exe
C:\WINDOWS\1451046.exe
C:\WINDOWS\14700968.exe
C:\WINDOWS\14856921.exe
C:\WINDOWS\15685406.exe
C:\WINDOWS\15902375.exe
C:\WINDOWS\16057843.exe
C:\WINDOWS\1610734.exe
C:\WINDOWS\16886343.exe
C:\WINDOWS\17103265.exe
C:\WINDOWS\17258828.exe
C:\WINDOWS\18087328.exe
C:\WINDOWS\18128921.exe
C:\WINDOWS\1818156.exe
C:\WINDOWS\18463296.exe
C:\WINDOWS\18648000.exe
C:\WINDOWS\19288250.exe
C:\WINDOWS\19354343.exe
C:\WINDOWS\19664218.exe
C:\WINDOWS\19850500.exe
C:\WINDOWS\20489218.exe
C:\WINDOWS\20559078.exe
C:\WINDOWS\20890046.exe
C:\WINDOWS\21052562.exe
C:\WINDOWS\21690171.exe
C:\WINDOWS\21766312.exe
C:\WINDOWS\22091046.exe
C:\WINDOWS\22254531.exe
C:\WINDOWS\22974750.exe
C:\WINDOWS\23292000.exe
C:\WINDOWS\23457046.exe
C:\WINDOWS\24176671.exe
C:\WINDOWS\24501875.exe
C:\WINDOWS\2460531.exe
C:\WINDOWS\24658390.exe
C:\WINDOWS\2471718.exe
C:\WINDOWS\2478359.exe
C:\WINDOWS\247890.exe
C:\WINDOWS\2480953.exe
C:\WINDOWS\2488890.exe
C:\WINDOWS\2489218.exe
C:\WINDOWS\25379671.exe
C:\WINDOWS\25859296.exe
C:\WINDOWS\2653078.exe
C:\WINDOWS\26583000.exe
C:\WINDOWS\27785265.exe
C:\WINDOWS\28991000.exe
C:\WINDOWS\2918296.exe
C:\WINDOWS\30192609.exe
C:\WINDOWS\3033546.exe
C:\WINDOWS\3045703.exe
C:\WINDOWS\31398015.exe
C:\WINDOWS\32600828.exe
C:\WINDOWS\33802421.exe
C:\WINDOWS\342140.exe
C:\WINDOWS\348078.exe
C:\WINDOWS\348265.exe
C:\WINDOWS\35005734.exe
C:\WINDOWS\3569734.exe
C:\WINDOWS\36209546.exe
C:\WINDOWS\3661484.exe
C:\WINDOWS\3672718.exe
C:\WINDOWS\3683765.exe
C:\WINDOWS\3690140.exe
C:\WINDOWS\37413656.exe
C:\WINDOWS\38614968.exe
C:\WINDOWS\39819375.exe
C:\WINDOWS\41022687.exe
C:\WINDOWS\4195656.exe
C:\WINDOWS\42229109.exe
C:\WINDOWS\4235187.exe
C:\WINDOWS\43433625.exe
C:\WINDOWS\44636734.exe
C:\WINDOWS\44958312.exe
C:\WINDOWS\45844156.exe
C:\WINDOWS\47681728.exe
C:\WINDOWS\4862453.exe
C:\WINDOWS\4873640.exe
C:\WINDOWS\4887156.exe
C:\WINDOWS\4891218.exe
C:\WINDOWS\5436125.exe
C:\WINDOWS\6063968.exe
C:\WINDOWS\6074765.exe
C:\WINDOWS\6090906.exe
C:\WINDOWS\6093890.exe
C:\WINDOWS\615734.exe
C:\WINDOWS\63921.exe
C:\WINDOWS\64562.exe
C:\WINDOWS\65625.exe
C:\WINDOWS\6637156.exe
C:\WINDOWS\67734.exe
C:\WINDOWS\68406.exe
C:\WINDOWS\7264953.exe
C:\WINDOWS\7275875.exe
C:\WINDOWS\7294984.exe
C:\WINDOWS\7298484.exe
C:\WINDOWS\7838078.exe
C:\WINDOWS\7838515.exe
C:\WINDOWS\79968.exe
C:\WINDOWS\79984.exe
C:\WINDOWS\820531.exe
C:\WINDOWS\84718.exe
C:\WINDOWS\8476812.exe
C:\WINDOWS\84812.exe
C:\WINDOWS\8501359.exe
C:\WINDOWS\9038984.exe
C:\WINDOWS\9129837.exe
C:\WINDOWS\92218.exe
C:\WINDOWS\94843.exe
C:\WINDOWS\9677781.exe
C:\WINDOWS\98109.exe
C:\WINDOWS\system32\drivers\ip6fw.sys
C:\WINDOWS\system32\pcdpqt.dll
C:\DOCUME~1\marek\DANEAP~1\Microsoft\25319.dat
C:\Program Files\install.log
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\new_drv.sys
C:\WINDOWS\system32\m.dll
C:\WINDOWS\system32\kprof" . . . . failed to delete
C:\WINDOWS\system32\koos.exe" . . . . failed to delete
C:\WINDOWS\system32\poof" . . . . failed to delete
C:\WINDOWS\system32\drivers\runtime2.sys
C:\WINDOWS\system32\drivers\runtime2.sy_


(((((((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NEW_DRV
-------\LEGACY_POOF
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\new_drv
-------\runtime


(((((((((((((((((((((((((((((((   Files Created from 2007-06-07 to 2007-07-31  ))))))))))))))))))))))))))))))))))


2007-07-31 12:13   <DIR>   d--------   C:\Program Files\Lavasoft
2007-07-31 12:13   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 12:13   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\Lavasoft
2007-07-31 11:57   <DIR>   d--------   C:\Program Files\LimeWire
2007-07-31 11:51   <DIR>   d--------   C:\Program Files\Odkurzacz
2007-07-31 11:49   <DIR>   d--------   C:\Program Files\CCleaner
2007-07-31 11:42   51,232   --a------   C:\Program Files\wwdc.exe
2007-07-31 11:42   347,253   --a------   C:\Program Files\Silent Runners.vbs
2007-07-31 11:41   813,947   --a------   C:\hideippla.exe
2007-07-31 11:41   1,084,008   --a------   C:\ComboFix.exe
2007-07-30 18:55   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-07-29 22:00   21,376   --a------   C:\qqd.sys
2007-07-29 20:35   4,096   --a------   C:\WINDOWS\system32\ie4uinit.dll
2007-07-29 20:35   15,360   --a------   C:\WINDOWS\CMIRmDriver.exe
2007-07-29 20:34   38,968   --a------   C:\WINDOWS\system32\KB38810001.exe
2007-07-29 20:33   16,896   --a------   C:\WINDOWS\system32\KB87313428.exe
2007-07-29 20:28   1   --a------   C:\WINDOWS\system32\ps.dat
2007-07-29 20:28   1   --a------   C:\WINDOWS\system32\cookie.dat
2007-07-29 20:22   8,276   --a------   C:\WINDOWS\system32\KB83647438.exe
2007-07-29 20:22   7,968   --a------   C:\WINDOWS\system32\spooldr.sys
2007-07-29 20:22   67,936   --a------   C:\WINDOWS\system32\drivers\asc3550u.sys
2007-07-29 20:22   50,688   --a------   C:\WINDOWS\system32\zoox1.dll
2007-07-29 20:22   25,088   ---------   C:\WINDOWS\system32\koos.exe
2007-07-29 20:22   212,992   --a------   C:\WINDOWS\system32\KB73687313.exe
2007-07-29 20:22   20,992   --a------   C:\WINDOWS\system32\KB48559630.exe
2007-07-29 20:22   13,697   --a------   C:\WINDOWS\system32\KB_963491.exe
2007-07-29 20:22   113,186   --a------   C:\WINDOWS\spooldr.exe
2007-07-24 21:14   <DIR>   d--------   C:\Program Files\Konnekt
2007-07-24 21:14   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\stamina
2007-07-17 17:58   <DIR>   d--------   C:\DOCUME~1\marek\Incomplete
2007-07-17 17:58   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\FrostWire
2007-07-17 17:57   6,422,611   --a------   C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-07-16 18:21   25,088   --a------   C:\WINDOWS\sysvx.exe
2007-07-16 18:21   25,088   --a------   C:\sysvx.exe
2007-07-14 00:08   38,912   ---------   C:\WINDOWS\system32\picn20.dll
2007-07-14 00:08   106,496   ---------   C:\WINDOWS\system32\TwnLib20.dll
2007-07-13 19:42   <DIR>   d--------   C:\Program Files\Common Files\LightScribe
2007-07-13 19:38   <DIR>   d--------   C:\Program Files\Nero
2007-07-13 19:38   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-07-13 19:38   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-07-13 18:10   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-13 18:10   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-13 18:10   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-13 18:10   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-13 18:10   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-13 18:10   <DIR>   d--------   C:\WINDOWS\pss
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-12 15:19   3,072   --a------   C:\DOCUME~1\marek\keylog.dll
2007-07-08 19:42   <DIR>   d--h-----   C:\WINDOWS\bdir
2007-06-27 15:08   <DIR>   d--------   C:\Program Files\DarkSwords
2007-06-01 19:54   <DIR>   d--------   C:\Program Files\Warcraft III


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-07-31 10:00:52   --------   d-----w   C:\Program Files\Winamp
2007-07-31 09:41:26   --------   d-----w   C:\Program Files\BearShare MediaBar
2007-07-31 07:28:24   374,400   ----a-w   C:\WINDOWS\system32\drivers\tcpip.sys
2007-07-30 17:09:13   --------   d-----w   C:\Program Files\Diablo II
2007-07-29 18:22:22   283,543   ----a-w   C:\WINDOWS\system32\drivers\ndis.sys
2007-07-27 22:07:21   783,224   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-07-27 22:02:49   92,848   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-27 22:02:34   94,416   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-27 22:00:39   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-27 21:59:57   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-27 21:58:36   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-27 21:57:49   95,608   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-07-13 22:08:53   --------   d-----w   C:\Program Files\Ahead
2007-07-13 16:38:09   --------   d-----w   C:\Program Files\Messenger
2007-05-31 19:04:36   --------   d-----w   C:\DOCUME~1\marek\DANEAP~1\Media Player Classic
2007-05-24 00:05:05   --------   d-----w   C:\Program Files\CasinoOnNet
2007-05-14 17:19:14   --------   d-----w   C:\Program Files\K-Lite Codec Pack
2007-05-14 17:15:37   --------   d-----w   C:\Program Files\ACE Mega CoDecS Pack
2007-05-08 16:23:34   68,334   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-08 16:23:34   439,194   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-04-21 08:47:41   5,270   ----a-w   C:\WINDOWS\mozver.dat


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 12:02]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2006-02-14 20:05]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-24 17:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=dword:00000001
"NoSaveSettings"=hex:00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=ie4uinit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   msv1_0 
Security Packages   kerberos msv1_0 schannel wdigest 
Notification Packages   scecli 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk
backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^marek^Menu Start^Programy^Autostart^Zapu Acceleration Engine.lnk]
path=C:\Documents and Settings\marek\Menu Start\Programy\Autostart\Zapu Acceleration Engine.lnk
backup=C:\WINDOWS\pss\Zapu Acceleration Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^marek^Menu Start^Programy^Autostart^Zapu.lnk]
path=C:\Documents and Settings\marek\Menu Start\Programy\Autostart\Zapu.lnk
backup=C:\WINDOWS\pss\Zapu.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"D:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\soft2]
C:\WINDOWS\11057531.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\strkjhk]
C:\WINDOWS\bdir\sdflkj4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=dword:00000003

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter   HTTPFilter 
LocalService   Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV 
NetworkService   DnsCache 
DcomLaunch   DcomLaunch TermService 
rpcss   RpcSs 
imgsvc   StiSvc 
termsvcs   TermService 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
   

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070731-114124-415
O22 - SharedTaskScheduler: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\pcdpqt.dll
backup-20070731-114124-392
O21 - SSODL: AtFKtBZyMXDfEfmu - {AC49CA05-06E3-60AF-B409-C21A9FBAE7D4} - C:\WINDOWS\system32\lp.dll (file missing)
backup-20070731-114124-457
O21 - SSODL: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - C:\WINDOWS\system32\pcdpqt.dll
backup-20070731-114123-171
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
backup-20070731-114123-193
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
backup-20070731-114123-419
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
backup-20070731-114123-342
O9 - Extra button: Casino-on-Net  - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
backup-20070731-114123-395
O4 - HKCU\..\Run: [strkjhk] C:\WINDOWS\bdir\sdflkj7.exe
backup-20070731-114123-380
O4 - HKLM\..\Run: [Winmplayer] "C:\WINDOWS\system32\KB_963491.exe"
backup-20070731-114123-262
O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll
backup-20070731-114123-135
O4 - HKLM\..\Run: [Uninstall Information] C:\WINDOWS\CMIRmDriver.exe
backup-20070731-114123-872
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
backup-20070731-114123-825
O4 - HKCU\..\Run: [tlz] C:\WINDOWS\47681728.exe
backup-20070731-114123-466
O2 - BHO: XBTP01621 - {9EBBE90B-282E-4c39-8A7E-120749169F0F} - C:\PROGRA~1\BEARSH~1\MediaBar.dll
backup-20070731-114123-875
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
backup-20070731-114123-267
O2 - BHO: H - {83E915D4-DDDB-4450-B957-7A3240E9CE66} - zoox1.dll (file missing)
backup-20070731-114123-866
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
backup-20070731-114123-927
O2 - BHO: SmartShopper - {2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
backup-20070731-114123-897
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
backup-20070731-114123-532
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\sysvx.exe
backup-20070731-114123-752
R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 12:26:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-07-31 12:29:34 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-31 12:29


   --- E O F ---

[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\ie4uinit.dll
C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
C:\hideippla.exe
C:\WINDOWS\CMIRmDriver.exe
C:\WINDOWS\system32\KB38810001.exe
C:\WINDOWS\system32\KB87313428.exe
C:\WINDOWS\system32\ps.dat
C:\WINDOWS\system32\cookie.dat
C:\WINDOWS\system32\KB83647438.exe
C:\WINDOWS\system32\zoox1.dll
C:\WINDOWS\system32\koos.exe
C:\WINDOWS\system32\KB73687313.exe
C:\WINDOWS\system32\spooldr.sys
C:\WINDOWS\system32\KB48559630.exe
C:\WINDOWS\system32\KB_963491.exe
C:\WINDOWS\system32\drivers\asc3550u.sys
C:\WINDOWS\spooldr.exe
C:\WINDOWS\sysvx.exe
C:\sysvx.exe
C:\DOCUME~1\marek\keylog.dll

Folders to delete:

C:\WINDOWS\bdir
C:\Program Files\BearShare MediaBar
C:\Program Files\MyGlobalSearch
C:\Program Files\SmartShopper

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

Kod: Zaznacz wszystko

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: (no name) - {4596013b-6c31-408b-a266-deae5c086dc2} - (no file)
O3 - Toolbar: (no name) - {b5146c40-189a-4311-bda9-fbae3e023187} - (no file)
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dl
O20 - AppInit_DLLs: ie4uinit.dll
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa oraz hijacka

[Fever]

z Avengerem nie wyszlo, bo do gry wlaczyl sie avast- usunal kilka plikow i przez to Avenger wyswietla bledy, zrobilem tylko to w hijacku... zalaczam logi

HJ:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:11:20, on 2007-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\marek\Pulpit\hijackthis.com
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start24.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://mks.com.pl
O15 - Trusted Zone: www.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{305751F0-301F-44E2-A3B1-20C58776CDB1}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B8551A0-714B-46D9-AAE6-2B59DDE624A4}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE505B49-497C-4F1A-8B5B-FEEBD82B0C40}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5EEB81F-143C-4D6F-8EA6-3E5F8B0256E2}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF27D22E-9009-4D1C-BCFF-BE88CFC3DF79}: NameServer = 202.40.169.30
O17 - HKLM\System\CS1\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CS2\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5916 bytes

Combo:

Kod: Zaznacz wszystko

"marek" - 2007-07-31 21:03:56    Dodatek Service Pack 2 
ComboFix 07-05.17.6.V - Running from: "C:\"


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\koos.exe
C:\WINDOWS\system32\kprof
C:\WINDOWS\system32\poof


(((((((((((((((((((((((((((((((   Files Created from 2007-06-07 to 2007-07-31  ))))))))))))))))))))))))))))))))))


2007-07-31 20:44   <DIR>   d--------   C:\Avenger
2007-07-31 12:34   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\LimeWire
2007-07-31 12:29   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-07-31 12:13   <DIR>   d--------   C:\Program Files\Lavasoft
2007-07-31 12:13   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 12:13   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\Lavasoft
2007-07-31 11:57   <DIR>   d--------   C:\Program Files\LimeWire
2007-07-31 11:51   <DIR>   d--------   C:\Program Files\Odkurzacz
2007-07-31 11:49   <DIR>   d--------   C:\Program Files\CCleaner
2007-07-31 11:42   51,232   --a------   C:\Program Files\wwdc.exe
2007-07-31 11:42   347,253   --a------   C:\Program Files\Silent Runners.vbs
2007-07-31 11:41   813,947   --a------   C:\hideippla.exe
2007-07-31 11:41   1,084,008   --a------   C:\ComboFix.exe
2007-07-30 18:55   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-07-29 22:00   21,376   --a------   C:\qqd.sys
2007-07-29 20:35   4,096   --a------   C:\WINDOWS\system32\ie4uinit.dll
2007-07-29 20:35   15,360   --a------   C:\WINDOWS\CMIRmDriver.exe
2007-07-29 20:33   16,896   --a------   C:\WINDOWS\system32\KB87313428.exe
2007-07-29 20:28   1   --a------   C:\WINDOWS\system32\ps.dat
2007-07-29 20:28   1   --a------   C:\WINDOWS\system32\cookie.dat
2007-07-29 20:22   7,968   --a------   C:\WINDOWS\system32\spooldr.sys
2007-07-29 20:22   67,936   --a------   C:\WINDOWS\system32\drivers\asc3550u.sys
2007-07-29 20:22   212,992   --a------   C:\WINDOWS\system32\KB73687313.exe
2007-07-24 21:14   <DIR>   d--------   C:\Program Files\Konnekt
2007-07-24 21:14   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\stamina
2007-07-17 17:58   <DIR>   d--------   C:\DOCUME~1\marek\Incomplete
2007-07-17 17:58   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\FrostWire
2007-07-17 17:57   6,422,611   --a------   C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-07-16 18:21   25,088   --a------   C:\WINDOWS\sysvx.exe
2007-07-16 18:21   25,088   --a------   C:\sysvx.exe
2007-07-14 00:08   38,912   ---------   C:\WINDOWS\system32\picn20.dll
2007-07-14 00:08   106,496   ---------   C:\WINDOWS\system32\TwnLib20.dll
2007-07-13 19:42   <DIR>   d--------   C:\Program Files\Common Files\LightScribe
2007-07-13 19:38   <DIR>   d--------   C:\Program Files\Nero
2007-07-13 19:38   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-07-13 19:38   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-07-13 18:10   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-13 18:10   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-13 18:10   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-13 18:10   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-13 18:10   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-13 18:10   <DIR>   d--------   C:\WINDOWS\pss
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-12 15:19   3,072   --a------   C:\DOCUME~1\marek\keylog.dll
2007-07-08 19:42   <DIR>   d--h-----   C:\WINDOWS\bdir
2007-06-27 15:08   <DIR>   d--------   C:\Program Files\DarkSwords
2007-06-01 19:54   <DIR>   d--------   C:\Program Files\Warcraft III


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-07-31 11:46:40   374,400   ----a-w   C:\WINDOWS\system32\drivers\tcpip.sys
2007-07-31 10:00:52   --------   d-----w   C:\Program Files\Winamp
2007-07-31 09:41:26   --------   d-----w   C:\Program Files\BearShare MediaBar
2007-07-30 17:09:13   --------   d-----w   C:\Program Files\Diablo II
2007-07-29 18:22:22   283,543   ----a-w   C:\WINDOWS\system32\drivers\ndis.sys
2007-07-27 22:07:21   783,224   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-07-27 22:02:49   92,848   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-27 22:02:34   94,416   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-27 22:00:39   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-27 21:59:57   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-27 21:58:36   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-27 21:57:49   95,608   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-07-13 22:08:53   --------   d-----w   C:\Program Files\Ahead
2007-07-13 16:38:09   --------   d-----w   C:\Program Files\Messenger
2007-05-31 19:04:36   --------   d-----w   C:\DOCUME~1\marek\DANEAP~1\Media Player Classic
2007-05-24 00:05:05   --------   d-----w   C:\Program Files\CasinoOnNet
2007-05-14 17:19:14   --------   d-----w   C:\Program Files\K-Lite Codec Pack
2007-05-14 17:15:37   --------   d-----w   C:\Program Files\ACE Mega CoDecS Pack
2007-05-08 16:23:34   68,334   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-08 16:23:34   439,194   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-04-21 08:47:41   5,270   ----a-w   C:\WINDOWS\mozver.dat


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 12:02]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2006-02-14 20:05]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-24 17:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=dword:00000001
"NoSaveSettings"=hex:00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]


[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   msv1_0 
Security Packages   kerberos msv1_0 schannel wdigest 
Notification Packages   scecli 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk
backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^marek^Menu Start^Programy^Autostart^Zapu Acceleration Engine.lnk]
path=C:\Documents and Settings\marek\Menu Start\Programy\Autostart\Zapu Acceleration Engine.lnk
backup=C:\WINDOWS\pss\Zapu Acceleration Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^marek^Menu Start^Programy^Autostart^Zapu.lnk]
path=C:\Documents and Settings\marek\Menu Start\Programy\Autostart\Zapu.lnk
backup=C:\WINDOWS\pss\Zapu.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"D:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\soft2]
C:\WINDOWS\11057531.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\strkjhk]
C:\WINDOWS\bdir\sdflkj4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=dword:00000003

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter   HTTPFilter 
LocalService   Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV 
NetworkService   DnsCache 
DcomLaunch   DcomLaunch TermService 
rpcss   RpcSs 
imgsvc   StiSvc 
termsvcs   TermService 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
   

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 21:05:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

  cmd.exe [2288]


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-07-31 21:06:40
C:\ComboFix-quarantined-files.txt ... 2007-07-31 21:06
C:\ComboFix2.txt ... 2007-07-31 12:29

--- E O F ---

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del file C:\Program Files\SmartShopper
gmer -del file C:\hideippla.exe
gmer -del file C:\WINDOWS\system32\ie4uinit.dll
gmer -del file C:\WINDOWS\CMIRmDriver.exe
gmer -del file C:\WINDOWS\system32\ps.dat
gmer -del file C:\WINDOWS\system32\cookie.dat
gmer -del file C:\WINDOWS\system32\spooldr.sys
gmer -del file C:\qqd.sys
gmer -del file C:\WINDOWS\system32\drivers\asc3550u.sys
gmer -del file C:\WINDOWS\system32\KB73687313.exe
gmer -del file C:\WINDOWS\sysvx.exe
gmer -del file C:\sysvx.exe
gmer -del file C:\DOCUME~1\marek\keylog.dll
gmer -del file C:\Program Files\BearShare MediaBar
gmer –reboot

skasuj te wpisy

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll

potem nowe logi

[Fever]

Caly czas po kilku minutach reset, pokazuje tez wira: totour.exe w c\system32 i nie da sie go usunac

HJ:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34:57, on 2007-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvr.exe
C:\Documents and Settings\marek\Pulpit\hijackthis.com
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start24.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://mks.com.pl
O15 - Trusted Zone: www.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{305751F0-301F-44E2-A3B1-20C58776CDB1}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B8551A0-714B-46D9-AAE6-2B59DDE624A4}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE505B49-497C-4F1A-8B5B-FEEBD82B0C40}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5EEB81F-143C-4D6F-8EA6-3E5F8B0256E2}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF27D22E-9009-4D1C-BCFF-BE88CFC3DF79}: NameServer = 202.40.169.30
O17 - HKLM\System\CS1\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CS2\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5920 bytes

Combofix:

Kod: Zaznacz wszystko

"marek" - 2007-07-31 21:35:00    Dodatek Service Pack 2 
ComboFix 07-05.17.6.V - Running from: "C:\"


(((((((((((((((((((((((((((((((   Files Created from 2007-06-07 to 2007-07-31  ))))))))))))))))))))))))))))))))))


2007-07-31 20:44   <DIR>   d--------   C:\Avenger
2007-07-31 12:34   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\LimeWire
2007-07-31 12:29   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-07-31 12:13   <DIR>   d--------   C:\Program Files\Lavasoft
2007-07-31 12:13   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 12:13   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\Lavasoft
2007-07-31 11:57   <DIR>   d--------   C:\Program Files\LimeWire
2007-07-31 11:51   <DIR>   d--------   C:\Program Files\Odkurzacz
2007-07-31 11:49   <DIR>   d--------   C:\Program Files\CCleaner
2007-07-31 11:42   51,232   --a------   C:\Program Files\wwdc.exe
2007-07-31 11:42   347,253   --a------   C:\Program Files\Silent Runners.vbs
2007-07-31 11:41   813,947   --a------   C:\hideippla.exe
2007-07-31 11:41   1,084,008   --a------   C:\ComboFix.exe
2007-07-30 18:55   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-07-29 22:00   21,376   --a------   C:\qqd.sys
2007-07-29 20:35   4,096   --a------   C:\WINDOWS\system32\ie4uinit.dll
2007-07-29 20:35   15,360   --a------   C:\WINDOWS\CMIRmDriver.exe
2007-07-29 20:33   16,896   --a------   C:\WINDOWS\system32\KB87313428.exe
2007-07-29 20:28   1   --a------   C:\WINDOWS\system32\ps.dat
2007-07-29 20:28   1   --a------   C:\WINDOWS\system32\cookie.dat
2007-07-29 20:22   7,968   --a------   C:\WINDOWS\system32\spooldr.sys
2007-07-29 20:22   67,936   --a------   C:\WINDOWS\system32\drivers\asc3550u.sys
2007-07-29 20:22   212,992   --a------   C:\WINDOWS\system32\KB73687313.exe
2007-07-24 21:14   <DIR>   d--------   C:\Program Files\Konnekt
2007-07-24 21:14   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\stamina
2007-07-17 17:58   <DIR>   d--------   C:\DOCUME~1\marek\Incomplete
2007-07-17 17:58   <DIR>   d--------   C:\DOCUME~1\marek\DANEAP~1\FrostWire
2007-07-17 17:57   6,422,611   --a------   C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-07-16 18:21   25,088   --a------   C:\WINDOWS\sysvx.exe
2007-07-16 18:21   25,088   --a------   C:\sysvx.exe
2007-07-14 00:08   38,912   ---------   C:\WINDOWS\system32\picn20.dll
2007-07-14 00:08   106,496   ---------   C:\WINDOWS\system32\TwnLib20.dll
2007-07-13 19:42   <DIR>   d--------   C:\Program Files\Common Files\LightScribe
2007-07-13 19:38   <DIR>   d--------   C:\Program Files\Nero
2007-07-13 19:38   <DIR>   d--------   C:\Program Files\Common Files\Ahead
2007-07-13 19:38   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-07-13 18:10   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-13 18:10   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-07-13 18:10   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-07-13 18:10   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-07-13 18:10   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-07-13 18:10   <DIR>   d--------   C:\WINDOWS\pss
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-07-13 18:10   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-07-12 15:19   3,072   --a------   C:\DOCUME~1\marek\keylog.dll
2007-07-08 19:42   <DIR>   d--h-----   C:\WINDOWS\bdir
2007-06-27 15:08   <DIR>   d--------   C:\Program Files\DarkSwords
2007-06-01 19:54   <DIR>   d--------   C:\Program Files\Warcraft III


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-07-31 11:46:40   374,400   ----a-w   C:\WINDOWS\system32\drivers\tcpip.sys
2007-07-31 10:00:52   --------   d-----w   C:\Program Files\Winamp
2007-07-31 09:41:26   --------   d-----w   C:\Program Files\BearShare MediaBar
2007-07-30 17:09:13   --------   d-----w   C:\Program Files\Diablo II
2007-07-29 18:22:22   283,543   ----a-w   C:\WINDOWS\system32\drivers\ndis.sys
2007-07-27 22:07:21   783,224   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-07-27 22:02:49   92,848   ----a-w   C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-27 22:02:34   94,416   ----a-w   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-27 22:00:39   23,152   ----a-w   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-27 21:59:57   42,912   ----a-w   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-27 21:58:36   26,624   ----a-w   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-27 21:57:49   95,608   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-07-13 22:08:53   --------   d-----w   C:\Program Files\Ahead
2007-07-13 16:38:09   --------   d-----w   C:\Program Files\Messenger
2007-05-31 19:04:36   --------   d-----w   C:\DOCUME~1\marek\DANEAP~1\Media Player Classic
2007-05-24 00:05:05   --------   d-----w   C:\Program Files\CasinoOnNet
2007-05-14 17:19:14   --------   d-----w   C:\Program Files\K-Lite Codec Pack
2007-05-14 17:15:37   --------   d-----w   C:\Program Files\ACE Mega CoDecS Pack
2007-05-08 16:23:34   68,334   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-08 16:23:34   439,194   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-04-21 08:47:41   5,270   ----a-w   C:\WINDOWS\mozver.dat


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 12:02]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2006-02-14 20:05]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-24 17:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41]
"Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=dword:00000001
"NoSaveSettings"=hex:00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]


[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   msv1_0 
Security Packages   kerberos msv1_0 schannel wdigest 
Notification Packages   scecli 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk
backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^marek^Menu Start^Programy^Autostart^Zapu Acceleration Engine.lnk]
path=C:\Documents and Settings\marek\Menu Start\Programy\Autostart\Zapu Acceleration Engine.lnk
backup=C:\WINDOWS\pss\Zapu Acceleration Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^marek^Menu Start^Programy^Autostart^Zapu.lnk]
path=C:\Documents and Settings\marek\Menu Start\Programy\Autostart\Zapu.lnk
backup=C:\WINDOWS\pss\Zapu.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
"D:\Program Files\BearShare\BearShare.exe" /pause

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\soft2]
C:\WINDOWS\11057531.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\strkjhk]
C:\WINDOWS\bdir\sdflkj4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=dword:00000003

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter   HTTPFilter 
LocalService   Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV 
NetworkService   DnsCache 
DcomLaunch   DcomLaunch TermService 
rpcss   RpcSs 
imgsvc   StiSvc 
termsvcs   TermService 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c2a3b69-d529-11da-b32c-806d6172696f}]
Shell\AutoRun\command   F:\setup.exe /AUTORUN
Shell\configure\command   F:\setup.exe
Shell\install\command   F:\setup.exe
   

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 21:39:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

  cmd.exe [1200]


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-07-31 21:41:51
C:\ComboFix-quarantined-files.txt ... 2007-07-31 21:41
C:\ComboFix2.txt ... 2007-07-31 12:29

--- E O F ---

[ Dodano: Dzisiaj o 20:55 ]
to chyba ten Totour jest winny wszystkiego... zdazylem wyczytac ze to niezly syf... wsadzilem go do kwarantanny jak na razie. co dalej?

bo nie mam czasu tego czytac bo co chwila mam zwieche...

[wojtas]

Uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\hideippla.exe
C:\WINDOWS\system32\ie4uinit.dll
C:\WINDOWS\CMIRmDriver.exe
C:\WINDOWS\system32\ps.dat
C:\WINDOWS\system32\cookie.dat
C:\WINDOWS\system32\spooldr.sys
C:\qqd.sys
C:\WINDOWS\system32\drivers\asc3550u.sys
C:\WINDOWS\system32\KB73687313.exe
C:\WINDOWS\sysvx.exe
C:\sysvx.exe
C:\DOCUME~1\marek\keylog.dll
C:\WINDOWS\system32\totour.exe

potem sam skasuj pogrubione do kosza:

C:\Program Files\BearShare MediaBar
C:\Program Files\SmartShopper
C:\WINDOWS\bdir

jesli nie to:

Wklej do notatnika

gmer -del file C:\Program Files\SmartShopper
gmer -del file C:\hideippla.exe
gmer -del file C:\WINDOWS\system32\ie4uinit.dll
gmer -del file C:\WINDOWS\CMIRmDriver.exe
gmer -del file C:\WINDOWS\system32\ps.dat
gmer -del file C:\WINDOWS\system32\cookie.dat
gmer -del file C:\WINDOWS\system32\spooldr.sys
gmer -del file C:\qqd.sys
gmer -del file C:\WINDOWS\system32\drivers\asc3550u.sys
gmer -del file C:\WINDOWS\system32\KB73687313.exe
gmer -del file C:\WINDOWS\sysvx.exe
gmer -del file C:\sysvx.exe
gmer -del file C:\DOCUME~1\marek\keylog.dll
gmer -del file C:\Program Files\BearShare MediaBar
gmer -del file C:\WINDOWS\system32\totour.exe
gmer -del file C:\WINDOWS\bdir
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT


Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

[Fever]

z Fix.bat nie wyszlo, "nie mozna usunac pliku ble ble ble", tym drugim niby pousuwalem, ale jak kompa uruchomilem po restarcie to wyswietlil sie piekny srebrny komunikat Avasta- znaleziono wirusa- totour.exe... kumpel mowi ze jest dalej tak jak bylo. czym go dalej potraktowac? (wirusa)

jak sie uda to wrzuce logi...

[wojtas]

poczytaj ten topic:

http://www.searchengines.pl/index.php?showtopic=87534

jak sie uda to wrzuce logi...

ok czekam

[Fever]

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:00:33, on 2007-08-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Odkurzacz\odk_mcd.exe
C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvr.exe
F:\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\marek\Pulpit\hijackthis.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start24.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://mks.com.pl
O15 - Trusted Zone: www.mks.com.pl
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{305751F0-301F-44E2-A3B1-20C58776CDB1}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B8551A0-714B-46D9-AAE6-2B59DDE624A4}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE505B49-497C-4F1A-8B5B-FEEBD82B0C40}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5EEB81F-143C-4D6F-8EA6-3E5F8B0256E2}: NameServer = 202.40.169.30
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF27D22E-9009-4D1C-BCFF-BE88CFC3DF79}: NameServer = 202.40.169.30
O17 - HKLM\System\CS1\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O17 - HKLM\System\CS2\Services\Tcpip\..\{07B934DC-ADC7-4C81-8AFA-F61638116BCD}: NameServer = 202.40.169.30
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5933 bytes

z Combo bedzie ciezej, bo dluzej robi loga, ale sie postaramy...

[wojtas]

skasuj te wpisy

O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll (file missing)

daj loga z gmera z opcji

Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

oraz postaraj sie z combo lub dss

http://www.techsupportforum.com/sectools/Deckard/dss.exe

Autor postu otrzymał pochwałę

[Fever]

dzieki wielkie za zainteresowanie i porady, niestety postanowilismy sie poddac i format albo cos w tym guscie- neta nie ma juz zupelnie, po starcie od razu reset...