proszę o sprawdzenie loga

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 15:54

logo zamieszczam ponieważ mks wykrywa trojana którego nie moge skasować ....

hijack:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:50:48, on 2007-10-09 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\internet explorer\iexplore.exe C:\Documents and Settings\Arek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\0CEt1mu8.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

combofix:

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))))) 2007-10-09 12:36 184,320 --a------ C:\WINDOWS\system32\0CEt1mu8.dll 2007-10-08 16:45 184,320 --a------ C:\WINDOWS\system32\A6LPvN8h.dll 2007-10-05 10:35 184,320 --a------ C:\WINDOWS\system32\b33r06hF.dll 2007-10-04 21:32 184,320 --a------ C:\WINDOWS\system32\8r2Eavgm.dll 2007-10-04 11:21 184,320 --a------ C:\WINDOWS\system32\j7bkiYL0.dll 2007-10-03 20:41 184,320 --a------ C:\WINDOWS\system32\3m5708j2.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:55 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:55 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:55 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-10-03 19:45 184,320 --a------ C:\WINDOWS\system32\c4jY5rB0.dll 2007-10-03 12:42 184,320 --a------ C:\WINDOWS\system32\t5713e3Y.dll 2007-10-03 10:38 184,320 --a------ C:\WINDOWS\system32\25CNw8x6.dll 2007-10-02 16:07 184,320 --a------ C:\WINDOWS\system32\081puuCX.dll 2007-10-02 15:29 184,320 --a------ C:\WINDOWS\system32\50X6sBX6.dll 2007-10-01 17:18 184,320 --a------ C:\WINDOWS\system32\G1dP8Bk1.dll 2007-10-01 12:18 184,320 --a------ C:\WINDOWS\system32\FGJ1Yi0w.dll 2007-10-01 10:13 184,320 --a------ C:\WINDOWS\system32\3Tj18374.dll 2007-09-30 23:26 184,320 --a------ C:\WINDOWS\system32\J8pSqb50.dll 2007-09-30 21:22 184,320 --a------ C:\WINDOWS\system32\f5k8CdAF.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-30 18:57 184,320 --a------ C:\WINDOWS\system32\Xx1PVyMr.dll 2007-09-28 22:14 184,320 --a------ C:\WINDOWS\system32\d50U2nL1.dll 2007-09-28 16:29 184,320 --a------ C:\WINDOWS\system32\7VxicUXK.dll 2007-09-27 21:33 184,320 --a------ C:\WINDOWS\system32\o28G5nOd.dll 2007-09-27 18:15 184,320 --a------ C:\WINDOWS\system32\3tYM35I4.dll 2007-09-27 16:11 184,320 --a------ C:\WINDOWS\system32\WBvKa4B1.dll 2007-09-27 06:38 184,320 --a------ C:\WINDOWS\system32\AKF61FIW.dll 2007-09-26 16:40 184,320 --a------ C:\WINDOWS\system32\FREn7u05.dll 2007-09-26 15:07 184,320 --a------ C:\WINDOWS\system32\e7ww3THw.dll 2007-09-25 18:14 184,320 --a------ C:\WINDOWS\system32\PJr7k0HC.dll 2007-09-25 16:10 184,320 --a------ C:\WINDOWS\system32\J102G333.dll 2007-09-24 23:37 184,320 --a------ C:\WINDOWS\system32\hGxw782b.dll 2007-09-24 21:33 184,320 --a------ C:\WINDOWS\system32\diH5s011.dll 2007-09-24 19:55 184,320 --a------ C:\WINDOWS\system32\3nSkUVW3.dll 2007-09-24 17:51 184,320 --a------ C:\WINDOWS\system32\W10G4INq.dll 2007-09-24 15:47 184,320 --a------ C:\WINDOWS\system32\qiSUvF4C.dll 2007-09-24 13:42 184,320 --a------ C:\WINDOWS\system32\NXSomOKW.dll 2007-09-24 11:38 184,320 --a------ C:\WINDOWS\system32\6AdBbC1h.dll 2007-09-24 09:34 184,320 --a------ C:\WINDOWS\system32\rlqcTE5g.dll 2007-09-23 23:01 184,320 --a------ C:\WINDOWS\system32\nfR4O3XQ.dll 2007-09-23 20:56 184,320 --a------ C:\WINDOWS\system32\4PTthX2g.dll 2007-09-23 18:52 184,320 --a------ C:\WINDOWS\system32\TwjyuT36.dll 2007-09-23 13:32 184,320 --a------ C:\WINDOWS\system32\X4Mmxh36.dll 2007-09-23 11:28 184,320 --a------ C:\WINDOWS\system32\TPdURLMj.dll 2007-09-22 22:54 184,320 --a------ C:\WINDOWS\system32\x67YVx1B.dll 2007-09-22 21:03 184,320 --a------ C:\WINDOWS\system32\bj64f7AP.dll 2007-09-22 18:59 184,320 --a------ C:\WINDOWS\system32\8c0j5g8o.dll 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-22 08:54 184,320 --a------ C:\WINDOWS\system32\0A52po01.dll 2007-09-20 12:39 184,320 --a------ C:\WINDOWS\system32\Qw11on46.dll 2007-09-18 18:39 <DIR> d-------- C:\Program Files\TVAnts 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-09-13 01:37 <DIR> d-------- C:\Program Files\Common Files\DriveCleaner Free (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-08 11:37 184320 --a------ C:\WINDOWS\system32\2nfgqi4n.dll 2007-09-08 10:05 184320 --a------ C:\WINDOWS\system32\hxa1x43i.dll 2007-09-08 10:01 184320 --a------ C:\WINDOWS\system32\tnnrawds.dll 2007-09-08 09:59 184320 --a------ C:\WINDOWS\system32\8eg8cru8.dll 2007-09-07 15:02 184320 --a------ C:\WINDOWS\system32\j47lvx6m.dll 2007-09-07 14:15 184320 --a------ C:\WINDOWS\system32\v521p76o.dll 2007-09-06 06:39 184320 --a------ C:\WINDOWS\system32\id4uuvqv.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll {85589B5D-D53D-4237-A677-46B82EA275F3} C:\WINDOWS\System32\0CEt1mu8.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}] Shell\AutoRun\command F:\autorun.exe ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-09 15:53:28 Windows 5.1.2600 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-09 15:53:33 C:\ComboFix2.txt ... 07-09-06 12:59 C:\ComboFix-quarantined-files.txt ... 07-10-09 15:53 C:\ComboFix3.txt ... 07-06-19 23:03

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 18:15

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

skasuj ten wpis w hijacku:

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\0CEt1mu8.dll

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\0CEt1mu8.dll
C:\WINDOWS\system32\A6LPvN8h.dll
C:\WINDOWS\system32\b33r06hF.dll
C:\WINDOWS\system32\8r2Eavgm.dll
C:\WINDOWS\system32\j7bkiYL0.dll
C:\WINDOWS\system32\3m5708j2.dll
C:\WINDOWS\system32\c4jY5rB0.dll
C:\WINDOWS\system32\t5713e3Y.dll
C:\WINDOWS\system32\25CNw8x6.dll
C:\WINDOWS\system32\081puuCX.dll
C:\WINDOWS\system32\50X6sBX6.dll
C:\WINDOWS\system32\G1dP8Bk1.dll
C:\WINDOWS\system32\FGJ1Yi0w.dll
C:\WINDOWS\system32\3Tj18374.dll
C:\WINDOWS\system32\J8pSqb50.dll
C:\WINDOWS\system32\f5k8CdAF.dll
C:\WINDOWS\system32\Xx1PVyMr.dll
C:\WINDOWS\system32\d50U2nL1.dll
C:\WINDOWS\system32\2nfgqi4n.dll
C:\WINDOWS\system32\hxa1x43i.dll
C:\WINDOWS\system32\tnnrawds.dll
C:\WINDOWS\system32\8eg8cru8.dll
C:\WINDOWS\system32\j47lvx6m.dll
C:\WINDOWS\system32\v521p76o.dll
C:\WINDOWS\system32\id4uuvqv.dll
C:\WINDOWS\system32\7VxicUXK.dll
C:\WINDOWS\system32\o28G5nOd.dll
C:\WINDOWS\system32\3tYM35I4.dll
C:\WINDOWS\system32\WBvKa4B1.dll
C:\WINDOWS\system32\Qw11on46.dll
C:\WINDOWS\system32\AKF61FIW.dll
C:\WINDOWS\system32\FREn7u05.dll
C:\WINDOWS\system32\e7ww3THw.dll
C:\WINDOWS\system32\PJr7k0HC.dll
C:\WINDOWS\system32\0A52po01.dll
C:\WINDOWS\system32\J102G333.dll
C:\WINDOWS\system32\hGxw782b.dll
C:\WINDOWS\system32\diH5s011.dll
C:\WINDOWS\system32\3nSkUVW3.dll
C:\WINDOWS\system32\W10G4INq.dll
C:\WINDOWS\system32\qiSUvF4C.dll
C:\WINDOWS\system32\NXSomOKW.dll
C:\WINDOWS\system32\6AdBbC1h.dll
C:\WINDOWS\system32\rlqcTE5g.dll
C:\WINDOWS\system32\nfR4O3XQ.dll
C:\WINDOWS\system32\4PTthX2g.dll
C:\WINDOWS\system32\TwjyuT36.dll
C:\WINDOWS\system32\X4Mmxh36.dll
C:\WINDOWS\system32\TPdURLMj.dll
C:\WINDOWS\system32\x67YVx1B.dll
C:\WINDOWS\system32\bj64f7AP.dll
C:\WINDOWS\system32\8c0j5g8o.dll

Folder::
C:\Program Files\Common Files\DriveCleaner Free

Registry::
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem nowy log z hijacka oraz combofixa oraz wejdz do folderu SDFixa wrzuc zawartość pliku Report.txt oraz log z L2MFIX z opcji 1

http://www.atribune.org/downloads/l2mfix.exe

jesli logi sie nie zmieszcza (co jest bardzo prawdopodobne ) wrzuc na jakis serwer np www.rapidshare.com

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 19:52

przy przenoszeniu tego pliku tekstowego CFScript jest coś takiego :

http://www.fotosik.pl/pokaz_obrazek/5297043b9a675e9b.html

daje 3 razy ignore i poprostu wchodzi do combo fixa robi skan i tyle .... nie ma rastartu ... hmm

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 19:54

wylacz na czas usuwania swojego antywirusa

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 19:57

nadal włącza sie autoscan tylko bez informacji z antywira ... nie kapuje może coś zle zrobiłem ?

patrze na ten wwdc ... były wszystkie zielone oprocz net biosa a teraz zrobił sie tez zołty upnp

Cfscript wygląda tak : http://www.fotosik.pl/usun_zdjecie.php?dCode=f1d4317421804596d5137b59d2a776

chyba ok

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 20:03

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\0CEt1mu8.dll
C:\WINDOWS\system32\A6LPvN8h.dll
C:\WINDOWS\system32\b33r06hF.dll
C:\WINDOWS\system32\8r2Eavgm.dll
C:\WINDOWS\system32\j7bkiYL0.dll
C:\WINDOWS\system32\3m5708j2.dll
C:\WINDOWS\system32\c4jY5rB0.dll
C:\WINDOWS\system32\t5713e3Y.dll
C:\WINDOWS\system32\25CNw8x6.dll
C:\WINDOWS\system32\081puuCX.dll
C:\WINDOWS\system32\50X6sBX6.dll
C:\WINDOWS\system32\G1dP8Bk1.dll
C:\WINDOWS\system32\FGJ1Yi0w.dll
C:\WINDOWS\system32\3Tj18374.dll
C:\WINDOWS\system32\J8pSqb50.dll
C:\WINDOWS\system32\f5k8CdAF.dll
C:\WINDOWS\system32\Xx1PVyMr.dll
C:\WINDOWS\system32\d50U2nL1.dll
C:\WINDOWS\system32\2nfgqi4n.dll
C:\WINDOWS\system32\hxa1x43i.dll
C:\WINDOWS\system32\tnnrawds.dll
C:\WINDOWS\system32\8eg8cru8.dll
C:\WINDOWS\system32\j47lvx6m.dll
C:\WINDOWS\system32\v521p76o.dll
C:\WINDOWS\system32\id4uuvqv.dll
C:\WINDOWS\system32\7VxicUXK.dll
C:\WINDOWS\system32\o28G5nOd.dll
C:\WINDOWS\system32\3tYM35I4.dll
C:\WINDOWS\system32\WBvKa4B1.dll
C:\WINDOWS\system32\Qw11on46.dll
C:\WINDOWS\system32\AKF61FIW.dll
C:\WINDOWS\system32\FREn7u05.dll
C:\WINDOWS\system32\e7ww3THw.dll
C:\WINDOWS\system32\PJr7k0HC.dll
C:\WINDOWS\system32\0A52po01.dll
C:\WINDOWS\system32\J102G333.dll
C:\WINDOWS\system32\hGxw782b.dll
C:\WINDOWS\system32\diH5s011.dll
C:\WINDOWS\system32\3nSkUVW3.dll
C:\WINDOWS\system32\W10G4INq.dll
C:\WINDOWS\system32\qiSUvF4C.dll
C:\WINDOWS\system32\NXSomOKW.dll
C:\WINDOWS\system32\6AdBbC1h.dll
C:\WINDOWS\system32\rlqcTE5g.dll
C:\WINDOWS\system32\nfR4O3XQ.dll
C:\WINDOWS\system32\4PTthX2g.dll
C:\WINDOWS\system32\TwjyuT36.dll
C:\WINDOWS\system32\X4Mmxh36.dll
C:\WINDOWS\system32\TPdURLMj.dll
C:\WINDOWS\system32\x67YVx1B.dll
C:\WINDOWS\system32\bj64f7AP.dll
C:\WINDOWS\system32\8c0j5g8o.dll

Folders to delete:

C:\Program Files\Common Files\DriveCleaner Free

Registry keys to delete:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

potem wykonujesz wszystko o co prosilem w poprzednim poscie

i wracasz raportem z SDFixa + logiem z L2Mfixa z opcji 1 + combofixa + hijacka

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 20:11

wszystko wszyściutko ?

razem z przenoszeniem tego CFS Scripta ?

no bo z hijacka skasowałem ten plik wwdc poustawiałem wiec zostało tylko sdfix ?

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 20:14

Arek7777 napisał(a):razem z przenoszeniem tego CFS Scripta ?

nie bez tego

zostal sdfix i wszystkie nowe logi

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 20:21

niestety ale pojawia sie błąd :

http://www.fotosik.pl/pokaz_obrazek/32740fcb698ba1aa.html

a nastepnie :

http://www.fotosik.pl/pokaz_obrazek/4315cd8ea86a5106.html

ok czy anuluj ?

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 20:37

no to inaczej:

sciagnij gmera

wklej do notatnika:

gmer -del file C:\WINDOWS\system32\0CEt1mu8.dll
gmer -del file C:\WINDOWS\system32\A6LPvN8h.dll
gmer -del file C:\WINDOWS\system32\b33r06hF.dll
gmer -del file C:\WINDOWS\system32\8r2Eavgm.dll
gmer -del file C:\WINDOWS\system32\j7bkiYL0.dll
gmer -del file C:\WINDOWS\system32\3m5708j2.dll
gmer -del file C:\WINDOWS\system32\c4jY5rB0.dll
gmer -del file C:\WINDOWS\system32\t5713e3Y.dll
gmer -del file C:\WINDOWS\system32\25CNw8x6.dll
gmer -del file C:\WINDOWS\system32\081puuCX.dll
gmer -del file C:\WINDOWS\system32\50X6sBX6.dll
gmer -del file C:\WINDOWS\system32\G1dP8Bk1.dll
gmer -del file C:\WINDOWS\system32\FGJ1Yi0w.dll
gmer -del file C:\WINDOWS\system32\3Tj18374.dll
gmer -del file C:\WINDOWS\system32\J8pSqb50.dll
gmer -del file C:\WINDOWS\system32\f5k8CdAF.dll
gmer -del file C:\WINDOWS\system32\Xx1PVyMr.dll
gmer -del file C:\WINDOWS\system32\d50U2nL1.dll
gmer -del file C:\WINDOWS\system32\2nfgqi4n.dll
gmer -del file C:\WINDOWS\system32\hxa1x43i.dll
gmer -del file C:\WINDOWS\system32\tnnrawds.dll
gmer -del file C:\WINDOWS\system32\8eg8cru8.dll
gmer -del file C:\WINDOWS\system32\j47lvx6m.dll
gmer -del file C:\WINDOWS\system32\v521p76o.dll
gmer -del file C:\WINDOWS\system32\id4uuvqv.dll
gmer -del file C:\WINDOWS\system32\7VxicUXK.dll
gmer -del file C:\WINDOWS\system32\o28G5nOd.dll
gmer -del file C:\WINDOWS\system32\3tYM35I4.dll
gmer -del file C:\WINDOWS\system32\WBvKa4B1.dll
gmer -del file C:\WINDOWS\system32\Qw11on46.dll
gmer -del file C:\WINDOWS\system32\AKF61FIW.dll
gmer -del file C:\WINDOWS\system32\FREn7u05.dll
gmer -del file C:\WINDOWS\system32\e7ww3THw.dll
gmer -del file C:\WINDOWS\system32\PJr7k0HC.dll
gmer -del file C:\WINDOWS\system32\0A52po01.dll
gmer -del file C:\WINDOWS\system32\J102G333.dll
gmer -del file C:\WINDOWS\system32\hGxw782b.dll
gmer -del file C:\WINDOWS\system32\diH5s011.dll
gmer -del file C:\WINDOWS\system32\3nSkUVW3.dll
gmer -del file C:\WINDOWS\system32\W10G4INq.dll
gmer -del file C:\WINDOWS\system32\qiSUvF4C.dll
gmer -del file C:\WINDOWS\system32\NXSomOKW.dll
gmer -del file C:\WINDOWS\system32\6AdBbC1h.dll
gmer -del file C:\WINDOWS\system32\rlqcTE5g.dll
gmer -del file C:\WINDOWS\system32\nfR4O3XQ.dll
gmer -del file C:\WINDOWS\system32\4PTthX2g.dll
gmer -del file C:\WINDOWS\system32\TwjyuT36.dll
gmer -del file C:\WINDOWS\system32\X4Mmxh36.dll
gmer -del file C:\WINDOWS\system32\TPdURLMj.dll
gmer -del file C:\WINDOWS\system32\x67YVx1B.dll
gmer -del file C:\WINDOWS\system32\bj64f7AP.dll
gmer -del file C:\WINDOWS\system32\8c0j5g8o.dll
gmer -del file C:\Program Files\Common Files\DriveCleaner Free
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT

Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

potem wszystko o co prosilem dajesz

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 20:56

same błedy przy usuwaniu plików ... w tym gmerze znaczy na poczatku coś usuwał a potem kapa ...

jeszcze sie meczyłem zeby z tego wyjść bo przy kazdym starcie systemu sie włączał .... dałem oststnią działającą konfiguracje ...

nie wiem o co już z tym chodzi

co to za wirus czy trojan ?

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 21:00

daj wszystkie nowe logi zobaczymy co zostalo jeszcze oraz raporty

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 21:04

hijack :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:01:52, on 2007-10-09 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Arek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\FREn7u05.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

combofix

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-09 to 2007-10-09 )))))))))))))))))))))))))))))))))) 2007-10-09 20:59 184,320 --a------ C:\WINDOWS\system32\FREn7u05.dll 2007-10-09 20:16 <DIR> d-------- C:\Avenger 2007-10-07 14:09 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-07 14:09 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:57 39,704 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:57 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-03 19:57 119,576 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:56 71,448 --a------ C:\WINDOWS\system32\cdm.dll 2007-10-03 19:56 421,656 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:56 114,968 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-10-03 19:56 1,081,112 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-18 18:39 <DIR> d-------- C:\Program Files\TVAnts 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-09-13 01:37 <DIR> d-------- C:\Program Files\Common Files\DriveCleaner Free (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll {85589B5D-D53D-4237-A677-46B82EA275F3} C:\WINDOWS\System32\FREn7u05.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-09 21:04:13 Windows 5.1.2600 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-09 21:04:17 C:\ComboFix3.txt ... 07-10-09 19:43 C:\ComboFix2.txt ... 07-10-09 19:56 C:\ComboFix-quarantined-files.txt ... 07-10-09 21:04

**Posty:** 18165 · przez **wojtas** 09 Paź 2007, 21:10

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\System32\FREn7u05.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się

skasuj:

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\FREn7u05.dll

gdzie raport z sdfixa oraz log z L2mfixa

**Posty:** 67 · przez **Arek7777** 09 Paź 2007, 21:34

sory zapomniałem

Kod: Zaznacz wszystko: SDFix: Version 1.107 Run by Arek on 2007-10-09 at 21:24 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\DOCUME~1\Arek\USTAWI~1\Temp\abc123.pid - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Wed 21 Feb 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Finished!

Kod: Zaznacz wszystko: These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Karta waciwoci pliku multimedialnego" "{176d6597-26d3-11d1-b350-080036a75b03}"="ZarzĄdzanie skanerem ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Strona zabezpieczeä NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Strona waciwoci OLE Docfile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Rozszerzenia powoki dla udost©pniania zasob˘w" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL karty graficznej" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL monitora wywietlania" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL kadrowania wywietlania" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Strona zabezpieczeä usugi DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Strona zgodnoci" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Program obsugi danych wycinkowych powoki" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Rozszerzenie Disc Copy" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Rozszerzenia powoki dla obiekt˘w Microsoft Windows Network" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ZarzĄdzanie monitorem ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ZarzĄdzanie drukarkĄ ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Rozszerzenia powoki dla kompresji plik˘w" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Rozszerzenie powoki drukarek sieci Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu kontekstowe szyfrowania" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Akt˘wka" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Rozszerzenie ikony HyperTerminalu" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Strona zabezpieczeä drukarek" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Rozszerzenia powoki dla udost©pniania zasob˘w" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="PoĄczenia sieciowe" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="PoĄczenia sieciowe" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Skanery i aparaty fotograficzne" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Skanery i aparaty fotograficzne" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Skanery i aparaty fotograficzne" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Skanery i aparaty fotograficzne" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Skanery i aparaty fotograficzne" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Rozszerzenia powoki dla hosta skrypt˘w systemu Windows" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Zaplanowane zadania" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Pasek zadaä i menu Start" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Wyszukaj" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsuga techniczna" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsuga techniczna" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uruchom..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Czcionki" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Narz©dzia administracyjne" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Pasek narz©dzi programu Microsoft Internet" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Stan pobierania" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Folder powoki zwi©kszonej" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Folder powoki zwi©kszonej 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Pasek przeglĄdarki Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Pasek wyszukiwania" "{32683183-48a0-441b-a342-7c2a440a9478}"="Pasek multimedi˘w" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Wyszukiwanie w okienku" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Wyszukiwanie w sieci Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Narz©dzie opcji drzewa rejestru" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Pole edycji adresu" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autouzupenianie Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="Wyodr©bnianie obraz˘w Trident" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autouzupeniania MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Niestandardowa lista autouzupeniania MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Dost©pny" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Pasek podr©czny ledzenia" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analizator paska adresu" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autouzupeniania historii Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autouzupeniania folderu powoki Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Kontener wielu list autouzupeniania Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu witryny paska powoki" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Pasek pulpitu powoki" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Pomoc dla uľytkownika" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globalne ustawienia folder˘w" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historia" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ekran powitalny pakietu IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Pasek eksploratora" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Folder pami©ci podr©cznej ActiveX" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Folder subskrypcji" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Menedľer aplikacji powoki" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Wyliczanie zainstalowanych aplikacji" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publikator aplikacji Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+program wyodr©bniajĄcy miniatury plik˘w" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informacje podsumowujĄce obsugi miniatur (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Wyodr©bnianie miniatur HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Kreator publikacji w sieci Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Zamawianie odbitek w sieci Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Obiekt powoki kreatora publikacji" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Kreator uzyskiwania profilu usugi Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Konta uľytkownik˘w" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Plik kanau" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Skr˘t kanau" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Obiekt obsugi kanau" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Folder plik˘w trybu offline" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Do os˘b..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"="Shell Extension for Malware scanning" "{E0D79300-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79301-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79302-84BE-11CE-9641-444553540000}"="WinZip" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}"="PhoneBrowser" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ xx1pvymr.dll Tue 2007-10-09 21:20:38 A.... 184 320 180,00 K cmdlin~1.dll Sun 2007-09-30 19:51:22 A.... 107 888 105,36 K wups2.dll Mon 2007-07-30 19:19:12 A.... 43 352 42,34 K 3 items found: 3 files, 0 directories. Total of file sizes: 335 560 bytes 327,70 K Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: F4E9-4D76 Katalog: C:\WINDOWS\System32 2007-01-18 20:55 <DIR> dllcache 0 plik(˘w) 0 bajt˘w 1 katalog(˘w) 4˙225˙908˙736 bajt˘w wolnych

a co do wwdc to tylko rpc locator i messenger są zielone a reszta zolta to ma jeszcze jakis znaczenie ?

widze że dziś już Cie nie bedzie

tak wiec dziekuje za dotychczasową pomoc i myśle że jutro zajmniesz sie jeszcze moją sprawą

**Posty:** 18165 · przez **wojtas** 10 Paź 2007, 15:44

ten plik:

C:\WINDOWS\system32\Xx1PVyMr.dll

przeskanuj tu i daj raporty

http://virusscan.jotti.org/
http://www.virustotal.com/

oraz nowy log z combofixa

**Posty:** 67 · przez **Arek7777** 10 Paź 2007, 16:52

Kod: Zaznacz wszystko: File: Xx1PVyMr.dll Status: INFECTED/MALWARE MD5: 9c81a47d05527477bf8ef71d3dfed742 Packers detected: - Bit9 reports: File not found Scanner results Scan taken on 10 Oct 2007 14:41:00 (GMT) A-Squared Found nothing AntiVir Found TR/BHO.Agent.mio ArcaVir Found Adware.Bho.Gw Avast Found nothing AVG Antivirus Found Generic2.RFJ BitDefender Found Trojan.Downloader.Bho.NXQ ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.BHO.gw (4, 1, 400) Fortinet Found Adware/BHO Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.BHO.gw NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found Trj/BHO.O Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found AdWare.Win32.BHO.gw

Kod: Zaznacz wszystko: Plik Xx1PVyMr.dll otrzymany 2007.10.10 16:42:10 (CET) Obecny status: Ładowanie ... w kolejce oczekuje skanowanie zakończono NIE ZNALEZIONO ZATRZYMANE Wynik: 14/32 (43.75%) Ładowanie informacji serwera... Twój plik czeka w kolejce na pozycji: ___. Oczekiwany czas rozpoczęcia zawiera się między ___ i ___ . Nie zamykaj tego okna, dopóki skanowanie nie zostanie ukończone. Skaner nie odpowiada, trwają próby odzyskania wyników skanowania. Jeśli potrwa to dłużej niż 5 minut, wyślik plik ponownie. Twój plik jest obecnie skanowany, wyniki będą pojawiać się stopniowo. Zwięzły Drukuj wyniki Twój plik wygasł lub nie istnieje. Usługa została wstrzymana. Twój plik będzie czekać na skanowanie (na pozycji: ) przez nieokreślony czas. Możesz czekać na odpowiedź (automatyczne przeładowanie) lub podać swój email poniżej i kliknąć "przypomnij", wtedy system poinformuje Cię o zakończeniu skanowania wysyłając email. Przypomnij: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2007.10.10.1 2007.10.10 - AntiVir 7.6.0.20 2007.10.10 TR/BHO.Agent.mio Authentium 4.93.8 2007.10.09 - Avast 4.7.1051.0 2007.10.09 - AVG 7.5.0.488 2007.10.10 Adware Generic2.RFJ BitDefender 7.2 2007.10.10 Trojan.Downloader.Bho.NXQ CAT-QuickHeal 9.00 2007.10.09 - ClamAV 0.91.2 2007.10.10 - DrWeb 4.44.0.09170 2007.10.10 - eSafe 7.0.15.0 2007.10.09 Win32.Adclicker eTrust-Vet 31.2.5201 2007.10.10 - Ewido 4.0 2007.10.10 - FileAdvisor 1 2007.10.10 - Fortinet 3.11.0.0 2007.10.10 Adware/BHO F-Prot 4.3.2.48 2007.10.09 - F-Secure 6.70.13030.0 2007.10.10 - Ikarus T3.1.1.12 2007.10.10 Trojan-Downloader.Bho.NXQ Kaspersky 7.0.0.125 2007.10.10 not-a-virus:AdWare.Win32.BHO.gw McAfee 5137 2007.10.09 potentially unwanted program Adware-BHO Microsoft 1.2908 2007.10.10 Adware:Win32/180SolutionsNCase NOD32v2 2584 2007.10.10 - Norman 5.80.02 2007.10.10 - Panda 9.0.0.4 2007.10.10 Trj/BHO.O Prevx1 V2 2007.10.10 - Rising 19.44.22.00 2007.10.10 - Sophos 4.22.0 2007.10.10 - Sunbelt 2.2.907.0 2007.10.10 Trojan-Downloader.Bho.NXQ Symantec 10 2007.10.10 Trojan.Adclicker TheHacker 6.2.6.082 2007.10.10 - VBA32 3.12.2.4 2007.10.10 AdWare.Win32.BHO.gw VirusBuster 4.3.26:9 2007.10.10 - Webwasher-Gateway 6.0.1 2007.10.10 Trojan.BHO.Agent.mio Dodatkowe informacje File size: 184320 bytes MD5: 9c81a47d05527477bf8ef71d3dfed742 SHA1: 1c5ed3af0bf5fc77d4b6fa2eb0b06ed25fd20d1f

combo :

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 )))))))))))))))))))))))))))))))))) 2007-10-10 16:48 184,320 --a------ C:\WINDOWS\system32\X4Mmxh36.dll 2007-10-10 14:44 184,320 --a------ C:\WINDOWS\system32\TPdURLMj.dll 2007-10-10 10:14 184,320 --a------ C:\WINDOWS\system32\e7ww3THw.dll 2007-10-09 21:34 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-10-09 21:34 184,320 --a------ C:\WINDOWS\system32\Geu5uGA0.dll 2007-10-09 21:34 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-10-09 21:34 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-10-09 21:34 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-10-09 21:23 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-09 21:20 184,320 --a------ C:\WINDOWS\system32\Xx1PVyMr.dll 2007-10-09 20:16 <DIR> d-------- C:\Avenger 2007-10-07 14:09 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-07 14:09 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:57 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:57 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:57 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:56 92,504 --a------ C:\WINDOWS\system32\cdm.dll 2007-10-03 19:56 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:56 53,080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-10-03 19:56 1,712,984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-18 18:39 <DIR> d-------- C:\Program Files\TVAnts 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-09-13 01:37 <DIR> d-------- C:\Program Files\Common Files\DriveCleaner Free (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll {85589B5D-D53D-4237-A677-46B82EA275F3} C:\WINDOWS\System32\X4Mmxh36.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}] Shell\AutoRun\command F:\autorun.exe ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-10 16:50:42 Windows 5.1.2600 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-10 16:50:46 C:\ComboFix2.txt ... 07-10-09 21:06 C:\ComboFix3.txt ... 07-10-09 21:04 C:\ComboFix-quarantined-files.txt ... 07-10-10 16:50

**Posty:** 18165 · przez **wojtas** 10 Paź 2007, 16:58

zainstaluj:

http://www.programosy.pl/program,kerio-personal-firewall.html

wklej do notatnika:

DEL C:\WINDOWS\system32\Xx1PVyMr.dll
DEL C:\WINDOWS\system32\X4Mmxh36.dll
DEL C:\WINDOWS\system32\TPdURLMj.dll
DEL C:\WINDOWS\system32\e7ww3THw.dll
DEL C:\WINDOWS\system32\Geu5uGA0.dll
DEL C:\Program Files\Common Files\DriveCleaner Free

Plik >>> zapisz jako >>> zmień rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwą FIX.BAT i uruchom plik:

potem nowe logi

**Posty:** 67 · przez **Arek7777** 10 Paź 2007, 17:21

wykonane to co zaleciłeś

przed logami tylko zapytam czemu to coś cały czas powraca :

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\0CEt1mu8.dll

hijack :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:15:17, on 2007-10-10 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\internet explorer\iexplore.exe C:\Documents and Settings\Arek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\8c0j5g8o.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

combo:

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 )))))))))))))))))))))))))))))))))) 2007-10-10 17:12 184,320 --a------ C:\WINDOWS\system32\8c0j5g8o.dll 2007-10-10 17:06 <DIR> d-------- C:\Program Files\Sunbelt Software 2007-10-09 21:34 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-10-09 21:34 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-10-09 21:34 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-10-09 21:34 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-10-09 21:23 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-09 20:16 <DIR> d-------- C:\Avenger 2007-10-07 14:09 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-07 14:09 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:57 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:57 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:57 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:56 92,504 --a------ C:\WINDOWS\system32\cdm.dll 2007-10-03 19:56 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:56 53,080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-10-03 19:56 1,712,984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-18 18:39 <DIR> d-------- C:\Program Files\TVAnts 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-09-13 01:37 <DIR> d-------- C:\Program Files\Common Files\DriveCleaner Free (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll {85589B5D-D53D-4237-A677-46B82EA275F3} C:\WINDOWS\System32\8c0j5g8o.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}] Shell\AutoRun\command F:\autorun.exe *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_FWDRV *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_KHIPS *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_KPF4 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-10 17:20:28 Windows 5.1.2600 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-10 17:20:33 C:\ComboFix3.txt ... 07-10-09 21:06 C:\ComboFix2.txt ... 07-10-10 16:50 C:\ComboFix-quarantined-files.txt ... 07-10-10 17:20

**Posty:** 18165 · przez **wojtas** 10 Paź 2007, 19:10

zastosuj sie do tych postow w tym temacie:

http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\8c0j5g8o.dll
C:\Program Files\Common Files\DriveCleaner Free

skasuj ten wpis w hijacku oraz pogrubione wywal do kosza (jesli beda problemy wywal w awaryjnym F8 przy starcie kompa)

potem wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

potem nowe logi

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum