prosze o sprawdzenie loga

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 19:14

Ostatnio zaczely wyskakiwac mi okienka z informacja o zainfekowaniu komputera trojanami itp. i usilnie wywala mi instalke BestSellerAntivirus. Jednakze moj program antywirusowy blokuje dostep do tego pliku wykrywajac wirusa, prosze o pomoc. Log :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:11:51, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaUpdate\update.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\WINDOWS\System32\StkCSrv.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\GetRight\getright.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Żuczuś\Pulpit\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.portal24h.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\mkbgtqvp.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe" O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe O4 - HKLM\..\Run: [b8710499] rundll32.exe "C:\WINDOWS\system32\oeudqpyu.dll",b O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe -- End of file - 9233 bytes

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 19:21

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

Zastosuj nastepnie SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 20:53

Nie wiem czemu, ale combofix nie chce dzialac. Wydaje mi sie jednak, ze pozbylem sie problemu poniewaz okienka juz nie wyskakuja. Log :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:53, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaUpdate\update.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\StkCSrv.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Winamp Remote\bin\Orb.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\GetRight\getright.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Żuczuś\Pulpit\Protection\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.portal24h.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe" O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe O4 - HKLM\..\Run: [b8710499] rundll32.exe "C:\WINDOWS\system32\oeudqpyu.dll",b O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe -- End of file - 8960 bytes

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 21:04

O4 - HKLM\..\Run: [b8710499] rundll32.exe "C:\WINDOWS\system32\oeudqpyu.dll",b

skasuj ten wpis i pogrubiony plik wywal do kosza:

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z dss'a

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 21:14

Skasowalem wpis, ale pliku juz nie moge "odmowa dostepu"

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 21:15

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\oeudqpyu.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem log z dss'a

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 21:49

Oto Logi:
Report.exe z SDFix:

Kod: Zaznacz wszystko: SDFix: Version 1.114 Run by Żuczuś on 2007-11-11 at 20:35 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 20:39:35 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "F:\\BitComet\\BitComet.exe"="F:\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "D:\\Program Files\\RTL Playtainment\\RTL Beachvolleyball\\RTL Beachvolleyball.exe"="D:\\Program Files\\RTL Playtainment\\RTL Beachvolleyball\\RTL Beachvolleyball.exe:*:Enabled:Beach Volley hot Sports" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\Konnekt\\konnekt.exe"="C:\\Program Files\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"="C:\\Program Files\\NAPI-PROJEKT\\napisy.exe:*:Enabled:www.napiprojekt.pl" "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "C:\\Program Files\\eDonkey2000\\edonkey2000.exe"="C:\\Program Files\\eDonkey2000\\edonkey2000.exe:*:Enabled:edonkey2000" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp"="C:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp:*:Enabled:kazaalite" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DCPlusPlus" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- Files with Hidden Attributes: Sun 11 Nov 2007 20,640 ..SH. --- "C:\WINDOWS\system32\mkbgtqvp.dllbox" Thu 13 Sep 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 27 Aug 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f9a86bbc0294618e780cd186dcfdb1b9\BIT1.tmp" Mon 27 Aug 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f57c255e25adcef74d2dff8c5940b09c\BIT3.tmp" Mon 17 Sep 2007 20 A..H. --- "C:\Documents and Settings\˝uczu˜\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Thu 13 Sep 2007 4,348 ...H. --- "C:\Documents and Settings\˝uczu˜\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Thu 13 Sep 2007 400 A.SH. --- "C:\Documents and Settings\˝uczu˜\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" Sun 30 Sep 2007 1,776 ...HR --- "C:\Documents and Settings\˝uczu˜\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Finished!

log z dss'a:

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Żuczuś on 2007-11-11 20:41:45 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Failed to create restore point; System Restore is disabled (service is not running). Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Żuczuś.exe) ---------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:42, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaUpdate\update.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\StkCSrv.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Winamp Remote\bin\Orb.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\Documents and Settings\Żuczuś\Pulpit\dss.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\ŻUCZUŚ\Pulpit\PROTEC~1\Żuczuś.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.portal24h.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: {d9c51d4c-797e-8198-88c4-0ade15a7abb1} - {1bba7a51-eda0-4c88-8918-e797c4d15c9d} - C:\WINDOWS\system32\syvhgjgw.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E842BDC-AA4C-4EB9-BAE8-D3AA70D8A7C9} - C:\WINDOWS\system32\ddcya.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe" O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe -- End of file - 10021 bytes -- HijackThis Fixed Entries (C:\DOCUME~1\ŻUCZUŚ\Pulpit\PROTEC~1\backups\) ------ backup-20071111-200951-717 O4 - HKLM\..\Run: [b8710499] rundll32.exe "C:\WINDOWS\system32\oeudqpyu.dll",b -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 ABTDI - c:\program files\arcabit\arcavir\abtdi.sys <Not Verified; ArcaBit; ArcaVir 2007> R1 Tosrfcom (Bluetooth RFCOMM from TOSHIBA) - c:\windows\system32\drivers\tosrfcom.sys <Not Verified; TOSHIBA Corporation; Bluetooth RFCOMM Driver> R3 ABFLT (ArcaBit File Monitor Driver) - c:\program files\arcabit\arcavir\abflt.sys <Not Verified; ArcaBit; ArcaVir 2007> R3 catchme - c:\docume~1\żuczuś\ustawi~1\temp\catchme.sys (file missing) R3 StkCMini (Syntek AVStream USB2.0 2M WebCam) - c:\windows\system32\drivers\stkcmini.sys <Not Verified; Syntek; Syntek Universal Serial Bus 2.0 Video Mini Driver> R3 tosporte (Bluetooth Port Driver from Toshiba) - c:\windows\system32\drivers\tosporte.sys <Not Verified; TOSHIBA Corporation; TOSHIBA Bluetooth Port Emulation Driver> R3 Tosrfbd (Bluetooth RFBUS from TOSHIBA) - c:\windows\system32\drivers\tosrfbd.sys <Not Verified; TOSHIBA CORPORATION; Bluetooth BUS Driver(WindowsXP,Windows2000)> R3 Tosrfbnp (Bluetooth RFBNEP from TOSHIBA) - c:\windows\system32\drivers\tosrfbnp.sys <Not Verified; TOSHIBA Corporation; Bluetooth RFBNEP Driver from TOSHIBA> R3 Tosrfhid (Bluetooth RFHID from TOSHIBA) - c:\windows\system32\drivers\tosrfhid.sys <Not Verified; TOSHIBA Corporation.; Bluetooth HID Driver from TOSHIBA> R3 Tosrfusb (Bluetooth USB Controller) - c:\windows\system32\drivers\tosrfusb.sys <Not Verified; TOSHIBA CORPORATION; Microsoft(R) Windows NT(R) Operating System> R3 ZDPSp50 (ZDPSp50 NDIS Protocol Driver) - c:\windows\system32\drivers\zdpsp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> S0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys (file missing) S3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys (file missing) S3 BlueletSCOAudio (Bluetooth SCO Audio Service) - c:\windows\system32\drivers\blueletscoaudio.sys (file missing) S3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys (file missing) S3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys (file missing) S3 PCANDIS5 (PCANDIS5 Protocol Driver) - c:\windows\system32\pcandis5.sys (file missing) S3 toshidpt (TOSHIBA Bluetooth HID port driver) - c:\windows\system32\drivers\toshidpt.sys <Not Verified; TOSHIBA Corporation.; TOSHIBA Bluetooth HID Mini Port Driver> S3 tosrfnds (Bluetooth Personal Area Network from TOSHIBA) - c:\windows\system32\drivers\tosrfnds.sys <Not Verified; TOSHIBA Corporation.; Bluetooth BNEP Driver from TOSHIBA> S3 TosRfSnd (Bluetooth Audio Device (WDM) from TOSHIBA) - c:\windows\system32\drivers\tosrfsnd.sys <Not Verified; TOSHIBA Corporation; Bluetooth Audio Driver> S3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys (file missing) S3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys (file missing) S3 ZDCndis5 (ZDCndis5 Protocol Driver) - c:\windows\system32\zdcndis5.sys (file missing) S3 ZDPNDIS5 (ZDPNDIS5 NDIS Protocol Driver) - c:\windows\system32\zdpndis5.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 ABNetMon (ArcaBit NetMonitor) - c:\program files\arcabit\arcavir\netmonsv.exe <Not Verified; ArcaBit; ArcaVir 2007> R2 ArcaBit.TaskScheduler - "c:\program files\arcabit\common\taskscheduler.exe" <Not Verified; ArcaBit sp. z o.o.; ArcaVir> R2 AVUpdate (ArcaBit Update Service) - c:\program files\arcabit\arcaupdate\update.exe <Not Verified; ArcaBit; ArcaVir 2007> R2 StarWindServiceAE (StarWind AE Service) - c:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition> R2 StkSSrv (Syntek AVStream USB2.0 WebCam Service) - c:\windows\system32\stkcsrv.exe <Not Verified; Syntek America Inc.; Syntek Hardware Snapshot Launch Application Services> R3 ArcaBit.Core.Configurator - "c:\program files\arcabit\common\arcabit.core.configurator2.exe" <Not Verified; ArcaBit; ArcaVir 2007> S3 ArcaBit.Core.LoggingService - "c:\program files\arcabit\common\arcabit.core.loggingservice.exe" <Not Verified; ArcaBit; ArcaVir 2007> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Intel(R) PRO/Wireless 3945ABG Network Connection Device ID: PCI\VEN_8086&DEV_4222&SUBSYS_10008086&REV_02\4&256298FB&0&00E1 Manufacturer: Intel Corporation Name: Intel(R) PRO/Wireless 3945ABG Network Connection PNP Device ID: PCI\VEN_8086&DEV_4222&SUBSYS_10008086&REV_02\4&256298FB&0&00E1 Service: NETw4x32 Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Bluetooth Personal Area Network Device ID: BLUETOOTH\0004&0007\0000 Manufacturer: Toshiba Name: Bluetooth Personal Area Network PNP Device ID: BLUETOOTH\0004&0007\0000 Service: tosrfnds Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Kontroler Ethernet Device ID: PCI\VEN_10EC&DEV_8167&SUBSYS_13451043&REV_10\4&2BF9155E&0&38F0 Manufacturer: Name: Kontroler Ethernet PNP Device ID: PCI\VEN_10EC&DEV_8167&SUBSYS_13451043&REV_10\4&2BF9155E&0&38F0 Service: Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318} Description: Device ID: ACPI\IFX0102\1 Manufacturer: Infineon Technologies AG Name: Infineon Trusted Platform Module PNP Device ID: ACPI\IFX0102\1 Service: -- Files created between 2007-10-11 and 2007-11-11 ----------------------------- 2007-11-11 20:15:46 0 d-------- C:\!KillBox 2007-11-11 19:37:27 0 d-------- C:\WINDOWS\ERUNT 2007-11-11 18:48:18 0 d-------- C:\VundoFix Backups 2007-11-11 18:39:55 2228 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-11 18:38:12 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-11 18:38:12 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2007-11-11 18:38:11 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-11-11 18:38:11 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-11 18:38:10 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-11-11 15:23:54 0 d--hs---- C:\FOUND.001 2007-11-11 14:38:53 0 d-------- C:\WINDOWS\system32\pl-pl 2007-11-11 14:32:49 0 d-------- C:\WINDOWS\network diagnostic 2007-11-11 10:40:49 36352 --a------ C:\WINDOWS\system32\urqpmmm.dll 2007-11-11 10:38:50 44551 --ahs---- C:\WINDOWS\system32\aycdd.ini2 2007-11-10 16:04:31 0 d--hs---- C:\UGA6P 2007-11-10 16:04:16 0 dr------- C:\Documents and Settings\All Users\Application Data 2007-11-10 16:04:16 0 dr------- C:\Documents and Settings\All Users\Application Data\SalesMonitor 2007-11-10 11:44:15 36352 --a------ C:\WINDOWS\system32\efcywuu.dll 2007-11-10 11:19:27 79424 --a------ C:\WINDOWS\system32\syvhgjgw.dll 2007-11-10 11:16:27 152672 --a------ C:\WINDOWS\system32\wchpwogc.dll 2007-11-09 22:35:23 322144 -----n--- C:\WINDOWS\system32\ddcya.dll 2007-11-09 22:33:33 147456 --a------ C:\WINDOWS\system32\vbzip10.dll <Not Verified; Info-ZIP; Info-ZIP's WiZ> 2007-11-09 21:40:41 0 d-------- C:\Program Files\DC++ 2007-11-09 21:32:07 0 d-------- C:\My Shared Folder 2007-11-09 21:32:06 0 d-------- C:\Program Files\Kazaa Lite Rewolucja 2007-10-27 14:23:39 0 d-------- C:\Program Files\Alcohol Soft 2007-10-23 15:04:35 0 d-------- C:\Program Files\GameVicio 2007-10-23 12:05:19 0 d-------- C:\Program Files\eMule 2007-10-23 11:55:09 1 --a------ C:\WINDOWS\HOSTS 2007-10-21 16:27:37 0 d-------- C:\Program Files\Winamp Toolbar 2007-10-21 16:27:31 0 d-------- C:\Program Files\Winamp Remote 2007-10-18 23:10:12 0 d-------- C:\WINDOWS\system32\PreInstall 2007-10-13 19:56:00 0 d--hs---- C:\FOUND.000 -- Find3M Report --------------------------------------------------------------- 2007-11-11 19:45:32 0 d-------- C:\Documents and Settings\Żuczuś\Dane aplikacji\Talkback 2007-11-11 15:12:10 359416 --a------ C:\WINDOWS\system32\perfh015.dat 2007-11-11 15:12:10 51166 --a------ C:\WINDOWS\system32\perfc015.dat 2007-11-10 16:04:18 0 d-------- C:\Documents and Settings\Żuczuś\Dane aplikacji\BestsellerAntivirus 2007-10-31 11:31:52 0 d-------- C:\Documents and Settings\Żuczuś\Dane aplikacji\Help 2007-10-25 20:04:14 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-10-19 16:27:02 0 d-------- C:\Documents and Settings\Żuczuś\Dane aplikacji\Toshiba 2007-10-09 22:34:56 0 d-------- C:\Program Files\Winamp 2007-10-05 21:37:30 0 d-------- C:\Program Files\illiminable 2007-09-30 20:50:54 0 d-------- C:\Program Files\MultiRes 2007-09-30 20:50:36 0 d-------- C:\Program Files\Nvidia Omega Drivers 2007-09-30 20:50:26 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2007-09-26 22:07:00 0 d-------- C:\Documents and Settings\Żuczuś\Dane aplikacji\Disney Interactive Studios 2007-09-18 12:53:10 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-09-18 12:45:38 0 d-------- C:\Program Files\MarBit 2007-09-17 21:50:58 0 d-------- C:\Program Files\Common Files\DirectX 2007-09-17 15:07:18 0 d-------- C:\Program Files\NAPI-PROJEKT 2007-09-12 17:06:42 0 dr-h----- C:\Documents and Settings\Żuczuś\Dane aplikacji\SecuROM 2007-09-08 22:43:40 1277 --a------ C:\WINDOWS\mozver.dat 2007-08-27 16:22:10 0 --a------ C:\WINDOWS\nsreg.dat 2007-08-24 00:42:16 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2007-08-23 23:37:10 0 -rahs---- C:\MSDOS.SYS 2007-08-23 23:37:10 0 -rahs---- C:\IO.SYS 2007-08-23 23:37:10 0 --a------ C:\CONFIG.SYS 2007-08-23 23:37:10 0 --a------ C:\AUTOEXEC.BAT 2007-08-23 23:34:18 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-08-23 23:27:58 62 --ahs---- C:\Documents and Settings\Żuczuś\Dane aplikacji\desktop.ini -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1bba7a51-eda0-4c88-8918-e797c4d15c9d}] 2007-11-10 11:19 79424 --a------ C:\WINDOWS\system32\syvhgjgw.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E842BDC-AA4C-4EB9-BAE8-D3AA70D8A7C9}] 2007-11-09 22:35 322144 --------- C:\WINDOWS\system32\ddcya.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-14 23:38] "nwiz"="nwiz.exe" [2007-05-14 23:38 C:\WINDOWS\system32\nwiz.exe] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 17:37] "RTHDCPL"="RTHDCPL.EXE" [2007-03-08 16:21 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-29 12:22] "ATKHOTKEY"="C:\Program Files\ATK Hotkey\Hcontrol.exe" [2007-05-24 11:32] "ABRegmon"="C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe" [2007-07-12 10:40] "ArcaCheck"="C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe" [2007-07-27 13:57] "AvMenu"="C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe" [2007-10-22 15:51] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-14 23:38] "WinampAgent"="C:\Program Files\Winamp\wianmpa.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44] "DAEMON Tools"="d:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-10-08 02:18] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2006-05-24 14:16:14] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-08-27 15:51:08] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00] GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2007-09-03 17:00:14] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener] TS_LogonListener.dll 2007-01-12 16:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddcya.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{01c1d97e-52f5-11dc-82c1-80a9f52f717c}] AutoRun\command- H:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52671f38-51ce-11dc-82bc-001b7742d9a8}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe -- End of Deckard's System Scanner: finished at 2007-11-11 20:43:39 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Polish CPU 0: Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz CPU 1: Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz Percentage of Memory in Use: 59% Physical Memory (total/avail): 1023.11 MiB / 414.46 MiB Pagefile Memory (total/avail): 2459.98 MiB / 1921.21 MiB Virtual Memory (total/avail): 2047.88 MiB / 1923.27 MiB C: is Fixed (FAT32) - 24.4 GiB total, 4.23 GiB free. D: is Fixed (NTFS) - 62.96 GiB total, 2.71 GiB free. E: is CDROM (No Media) F: is Fixed (FAT32) - 24.4 GiB total, 4.57 GiB free. G: is CDROM (No Media) H: is CDROM (No Media) \\.\PHYSICALDRIVE0 - WDC WD1200BEVS-00RST0 - 111.79 GiB - 3 partitions \PARTITION0 - Rozszerzona z rozszerzonym przerwaniem 13 - 48.83 GiB - C: - F: \PARTITION1 (bootable) - Instalowalny system plików - 62.96 GiB - D: -- Security Center ------------------------------------------------------------- AUOptions is set to notify before download. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Żuczuś\Dane aplikacji CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=PPP-685AD18BEE6 ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Żuczuś LOGONSERVER=\\PPP-685AD18BEE6 NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\ArcaBit\Common PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0f0d ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\ŻUCZUŚ\USTAWI~1\Temp TMP=C:\DOCUME~1\ŻUCZUŚ\USTAWI~1\Temp USERDOMAIN=PPP-685AD18BEE6 USERNAME=Żuczuś USERPROFILE=C:\Documents and Settings\Żuczuś windir=C:\WINDOWS __COMPAT_LAYER=EnableNXShowUI -- User Profiles --------------------------------------------------------------- Żuczuś [I](admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL --> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL --> C:\WINDOWS\UNRecode.exe /UNINSTALL --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E47302B-8081-46D3-9FEA-BEB2E5F5C3EC}\setup.exe" -l0x9 anything --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 8 - Polish --> MsiExec.exe /I{AC76BA86-7AD7-1045-7B44-A80000000000} Adobe Shockwave Player --> C:\WINDOWS\system32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~1\Install.log Aktualizacja dla systemu Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" ALLPlayer V3.X --> "C:\Program Files\MarBit\ALLPlayer\unins000.exe" ArcaBit Prerequistes 2007 Final --> MsiExec.exe /I{25A57349-5C6B-45DC-A891-52FD59493EE5} ArcaVir 2007 --> MsiExec.exe /I{252168E2-FC44-4BC4-A713-76F3C4FFB5AA} Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe ATK Hotkey --> C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\setup.exe -runfromtemp -l0x0015 -removeonly ATK0100 ACPI UTILITY --> C:\WINDOWS\ATK0100\XPunin.exe µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL BearShare --> C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG Bluetooth Stack for Windows --> MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6} DC++ 0.000 --> "C:\Program Files\DC++\uninstall.exe" FIFA 08 --> MsiExec.exe /X{0A2A5039-B37F-489D-B1DC-A5258DF9E697} Gadu-Gadu 7.7 --> C:\Program Files\Gadu-Gadu\Setup.exe GetRight --> C:\Program Files\GetRight\GETRIGHT.EXE /UNINSTALL High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" HijackThis 2.0.2 --> "C:\Documents and Settings\Żuczuś\Pulpit\HijackThis.exe" /uninstall Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} K-Lite Codec Pack 3.4.5 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe" livebox tp --> C:\Program Files\InstallShield Installation Information\{FC7DDAAE-7F2B-4270-9BFD-5A130B667E9E}\Setup.exe -runfromtemp -l0x0015 -removeonly Megaupload Toolbar --> C:\Program Files\MegauploadToolbar\uninstall.exe Microsoft Office Access MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0015-0415-0000-0000000FF1CE} Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0016-0415-0000-0000000FF1CE} Microsoft Office Groove MUI (Polish) 2007 --> MsiExec.exe /X{90120000-00BA-0415-0000-0000000FF1CE} Microsoft Office InfoPath MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0044-0415-0000-0000000FF1CE} Microsoft Office OneNote MUI (Polish) 2007 --> MsiExec.exe /X{90120000-00A1-0415-0000-0000000FF1CE} Microsoft Office Outlook MUI (Polish) 2007 --> MsiExec.exe /X{90120000-001A-0415-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0018-0415-0000-0000000FF1CE} Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (German) 2007 --> MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE} Microsoft Office Proof (Polish) 2007 --> MsiExec.exe /X{90120000-001F-0415-0000-0000000FF1CE} Microsoft Office Proofing (Polish) 2007 --> MsiExec.exe /X{90120000-002C-0415-0000-0000000FF1CE} Microsoft Office Publisher MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0019-0415-0000-0000000FF1CE} Microsoft Office Shared MUI (Polish) 2007 --> MsiExec.exe /X{90120000-006E-0415-0000-0000000FF1CE} Microsoft Office Word MUI (Polish) 2007 --> MsiExec.exe /X{90120000-001B-0415-0000-0000000FF1CE} Motorola SM56 Speakerphone Modem --> rundll32.exe sm56co6a.dll,SM56UnInstaller Mozilla Firefox (2.0.0.9) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSXML 6.0 Parser --> MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE} MultiRes (remove only) --> C:\Program Files\MultiRes\uninstal.exe Nero 7 Ultra Edition --> MsiExec.exe /I{4F2CE68F-EDBB-4592-BF07-5AC930A51045} neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI Nvidia Omega Drivers Setup Files --> C:\WINDOWS\iun6002.exe "C:\Program Files\Nvidia Omega Drivers\v1.6693\Omega.ini" oggcodecs 0.71.0946 --> C:\Program Files\illiminable\oggcodecs\uninst.exe Poprawka dla systemu Windows XP (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe" Real Alternative 1.52 --> "C:\Program Files\Real Alternative\unins000.exe" Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x15 -removeonly Sagem Wi-Fi 11g USB adapter (driver) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2ED60C17-4568-4CD5-830A-03C4688B09A1}\setup.exe" -l0x15 Sagem Wi-Fi 11g USB adapter (utility) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAFD22B6-A6C7-4134-AF4E-080BCBCD3493}\Setup.exe" -l0x15 USB2.0 2M WebCam --> C:\WINDOWS\StkUnist.exe VideoLAN VLC media player 0.8.6c --> C:\Program Files\VideoLAN\VLC\uninstall.exe Winamp --> "C:\Program Files\Winamp\UninstWA.exe" Winamp Remote --> "C:\Program Files\Winamp Remote\uninstall.exe" Winamp Toolbar --> "C:\Program Files\Winamp Toolbar\uninstall.exe" Winamp5PL --> "C:\Program Files\Winamp\Uninstall_PL" -- Application Event Log ------------------------------------------------------- Event Record #/Type1104 / Error Event Submitted/Written: 11/11/2007 06:43:39 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd fixvundo.exe, wersja 1.5.0.0, moduł powodujący błąd fixvundo.exe, wersja 1.5.0.0, adres błędu 0x0000904e. Przetwarzanie zdarzenia określonego nośnika dla [fixvundo.exe!ws!] Event Record #/Type1083 / Error Event Submitted/Written: 11/11/2007 03:25:25 PM / 11/11/2007 03:25:26 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd ctfmon.exe, wersja 5.1.2600.2180, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x636f1dfa. Przetwarzanie zdarzenia określonego nośnika dla [ctfmon.exe!ws!] Event Record #/Type1036 / Error Event Submitted/Written: 11/10/2007 11:24:03 AM Event ID/Source: 1002 / Application Hang Event Description: Aplikacja zawieszająca arcavir.exe, wersja 2007.9.0.4, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Event Record #/Type1017 / Error Event Submitted/Written: 11/07/2007 09:29:45 PM Event ID/Source: 1002 / Application Hang Event Description: Aplikacja zawieszająca vlc.exe, wersja 0.8.6.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Event Record #/Type998 / Error Event Submitted/Written: 11/06/2007 05:29:00 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.2180, moduł powodujący błąd msvcr71.dll, wersja 7.10.3052.4, adres błędu 0x00010582. Przetwarzanie zdarzenia określonego nośnika dla [explorer.exe!ws!] -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type5121 / Warning Event Submitted/Written: 11/11/2007 08:41:34 PM Event ID/Source: 1003 / Dhcp Event Description: Komputer nie mógł odnowić swojego adresu z sieci (z serwera DHCP) dla karty sieciowej o adresie 0060B3048EFB. Wystąpił następujący błąd: %%121. Komputer będzie dalej próbował sam uzyskać adres z serwera adresów sieciowych (DHCP). Event Record #/Type5098 / Error Event Submitted/Written: 11/11/2007 08:39:15 PM Event ID/Source: 7023 / Service Control Manager Event Description: Usługa Usługa przywracania systemu zakończyła działanie; wystąpił następujący błąd: %%2 Event Record #/Type5097 / Error Event Submitted/Written: 11/11/2007 08:39:12 PM Event ID/Source: 104 / SRService Event Description: Proces inicjalizacji Przywracania systemu nie powiódł się. Event Record #/Type5094 / Error Event Submitted/Written: 11/11/2007 08:35:09 PM Event ID/Source: 10005 / DCOM Event Description: Model DCOM odebrał błąd „%%1084” podczas próby uruchomienia usługi StiSvc z argumentami „” w celu uruchomienia serwera: {A1F4E726-8CF1-11D1-BF92-0060081ED811} Event Record #/Type5093 / Error Event Submitted/Written: 11/11/2007 08:34:47 PM Event ID/Source: 7026 / Service Control Manager Event Description: Nie można załadować następujących sterowników startu rozruchowego lub systemowego: ABTDI AFD Fips intelppm IPSec MRxSmb NetBIOS RasAcd Rdbss Tcpip Tosrfcom -- End of Deckard's System Scanner: finished at 2007-11-11 20:43:39 ------------

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 21:59

masz w WWDC wszystkie porty na zielono??

O2 - BHO: {d9c51d4c-797e-8198-88c4-0ade15a7abb1} - {1bba7a51-eda0-4c88-8918-e797c4d15c9d} - C:\WINDOWS\system32\syvhgjgw.dll
O2 - BHO: (no name) - {7E842BDC-AA4C-4EB9-BAE8-D3AA70D8A7C9} - C:\WINDOWS\system32\ddcya.dll

skasuj te wpisy

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\urqpmmm.dll
C:\WINDOWS\system32\ddcya.dll
C:\WINDOWS\system32\syvhgjgw.dll
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\wchpwogc.dll
C:\WINDOWS\system32\efcywuu.dll
C:\WINDOWS\system32\mkbgtqvp.dll

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{01c1d97e-52f5-11dc-82c1-80a9f52f717c}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52671f38-51ce-11dc-82bc-001b7742d9a8}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa lub dss"a

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 22:07

Wszystko oprocz NetBIOS

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 22:07

to wykonaj to o co prosilem i wroc z logami

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 22:09

Czym mam je skasowac skoro Hijack This ich nie wykrywa?

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 22:12

jesli hijack ich nie wykrywa to przejdz do kolejnego punktu usuwania

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 22:25

Kolejne logi:

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Żuczuś 2007-11-11 21:15:38.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.401 [GMT 1:00] Running from: C:\Documents and Settings\Żuczuś\Pulpit\Protection\ComboFix.exe Command switches used :: C:\Documents and Settings\Żuczuś\Pulpit\Protection\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\aycdd.ini2 C:\WINDOWS\system32\ddcya.dll C:\WINDOWS\system32\efcywuu.dll C:\WINDOWS\system32\mkbgtqvp.dll C:\WINDOWS\system32\syvhgjgw.dll C:\WINDOWS\system32\urqpmmm.dll C:\WINDOWS\system32\wchpwogc.dll . Unable to gain System Privileges ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\Documents and Settings\Żuczuś\Dane aplikacji\BestsellerAntivirus C:\Documents and Settings\Żuczuś\Dane aplikacji\BestsellerAntivirus\avtasks.dat C:\Documents and Settings\Żuczuś\Dane aplikacji\BestsellerAntivirus\Logs\av.log C:\Documents and Settings\Żuczuś\Dane aplikacji\BestsellerAntivirus\Logs\ga6Support.log C:\Documents and Settings\Żuczuś\Dane aplikacji\BestsellerAntivirus\Logs\update.log C:\Documents and Settings\Żuczuś\Ulubione\Online Security Guide.lnk C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search C:\UGA6P C:\WINDOWS\autorun.inf C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\Quarantine C:\WINDOWS\hosts C:\WINDOWS\system32\aycdd.ini C:\WINDOWS\system32\aycdd.ini2 C:\WINDOWS\system32\ddcya.dll C:\WINDOWS\system32\efcywuu.dll C:\WINDOWS\system32\mkbgtqvp.dllbox C:\WINDOWS\system32\syvhgjgw.dll C:\WINDOWS\system32\urqpmmm.dll C:\WINDOWS\system32\wchpwogc.dll D:\autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_FMTR ((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 ))))))))))))))))))))))))))))))) . 2007-11-11 20:19 <DIR> d-------- C:\Deckard 2007-11-11 20:15 <DIR> d-------- C:\!KillBox 2007-11-11 19:47 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-11 19:37 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-11 18:48 <DIR> d-------- C:\VundoFix Backups 2007-11-11 18:39 2,228 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-11 18:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-11 18:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-11 18:38 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-11 18:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-11 18:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-11 15:23 <DIR> d--hs---- C:\FOUND.001 2007-11-11 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-11 15:09 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-11 14:38 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2007-11-10 16:04 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-11-10 16:04 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-10 16:04 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-11-10 11:16 152,672 --a------ C:\WINDOWS\system32\mkbgtqvp.dll.vir 2007-11-09 22:33 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-11-09 22:30 36,352 --a------ C:\WINDOWS\system32\rqrrqom.dll.vir 2007-11-09 21:40 <DIR> d-------- C:\Program Files\DC++ 2007-11-09 21:32 <DIR> d-------- C:\Program Files\Kazaa Lite Rewolucja 2007-11-09 21:32 <DIR> d-------- C:\My Shared Folder 2007-11-09 21:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kazaa Lite 2007-11-06 13:18 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-06 13:18 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-11-06 13:18 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-11-06 13:18 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-11-06 13:18 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-06 13:18 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-11-06 13:18 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-06 13:18 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-11-06 13:18 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-10-27 14:23 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-10-23 15:04 <DIR> d-------- C:\Program Files\GameVicio 2007-10-23 12:05 <DIR> d-------- C:\Program Files\eMule 2007-10-21 16:27 <DIR> d-------- C:\Program Files\Winamp Toolbar 2007-10-21 16:27 <DIR> d-------- C:\Program Files\Winamp Remote 2007-10-21 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2007-10-21 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2007-10-19 17:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2007-10-19 17:37 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll 2007-10-13 19:56 <DIR> d--hs---- C:\FOUND.000 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-09 21:33 278,544 ----a-w C:\WINDOWS\Fonts\Setup.exe 2007-10-25 19:04 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2007-10-09 21:34 --------- d-----w C:\Program Files\Winamp 2007-10-05 20:37 --------- d-----w C:\Program Files\illiminable 2007-09-30 20:58 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:50 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-09-30 19:50 --------- d-----w C:\Program Files\Nvidia Omega Drivers 2007-09-30 19:50 --------- d-----w C:\Program Files\MultiRes 2007-09-30 19:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-09-18 11:53 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-09-18 11:45 --------- d-----w C:\Program Files\MarBit 2007-09-17 20:50 --------- d-----w C:\Program Files\Common Files\DirectX 2007-09-17 14:07 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-08-23 23:42 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-08-20 14:31 3,584,512 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 10:01 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-20 10:01 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 10:01 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-08-20 10:01 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-08-20 10:01 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-08-20 10:01 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 10:01 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-08-20 10:01 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 10:01 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 10:01 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-08-20 10:01 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 10:01 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-08-20 10:01 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-08-20 10:01 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 10:01 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 10:01 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 10:01 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 10:01 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 10:01 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-20 10:01 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-08-20 10:01 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-08-20 10:01 1,152,000 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-17 10:24 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:24 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 10:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-08-17 07:34 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-08-13 17:54 765,952 ----a-w C:\WINDOWS\system32\dllcache\VGX.dll 2007-08-13 17:54 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll 2007-08-13 17:54 413,696 ----a-w C:\WINDOWS\system32\dllcache\vbscript.dll 2007-08-13 17:54 33,792 ----a-w C:\WINDOWS\system32\dllcache\custsat.dll 2007-08-13 17:54 191,488 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-13 17:54 156,160 ----a-w C:\WINDOWS\system32\msls31.dll 2007-08-13 17:54 156,160 ----a-w C:\WINDOWS\system32\dllcache\msls31.dll 2007-08-13 17:45 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll 2007-08-13 17:45 78,336 ----a-w C:\WINDOWS\system32\dllcache\ieencode.dll 2007-08-13 17:44 69,120 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-13 17:44 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll 2007-08-13 17:44 40,960 ----a-w C:\WINDOWS\system32\dllcache\licmgr10.dll 2007-08-13 17:39 92,672 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-13 17:39 71,680 ----a-w C:\WINDOWS\system32\dllcache\admparse.dll 2007-08-13 17:39 71,680 ----a-w C:\WINDOWS\system32\admparse.dll 2007-08-13 17:39 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll 2007-08-13 17:39 55,296 ----a-w C:\WINDOWS\system32\dllcache\iesetup.dll 2007-08-13 17:38 491,520 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll 2007-08-13 17:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-13 17:36 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll 2007-08-13 17:36 36,352 ----a-w C:\WINDOWS\system32\dllcache\imgutil.dll 2007-08-13 17:35 346,624 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-13 17:32 45,568 ----a-w C:\WINDOWS\system32\mshta.exe 2007-08-13 17:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\mshta.exe 2007-08-13 17:18 60,416 ----a-w C:\WINDOWS\system32\dllcache\hmmapi.dll 2007-08-13 17:01 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll 2007-08-13 17:01 48,128 ----a-w C:\WINDOWS\system32\dllcache\mshtmler.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-14 23:38] "nwiz"="nwiz.exe" [2007-05-14 23:38 C:\WINDOWS\system32\nwiz.exe] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 17:37] "RTHDCPL"="RTHDCPL.EXE" [2007-03-08 16:21 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-29 12:22] "ATKHOTKEY"="C:\Program Files\ATK Hotkey\Hcontrol.exe" [2007-05-24 11:32] "ABRegmon"="C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe" [2007-07-12 10:40] "ArcaCheck"="C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe" [2007-07-27 13:57] "AvMenu"="C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe" [2007-10-22 15:51] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-14 23:38] "WinampAgent"="C:\Program Files\Winamp\wianmpa.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44] "DAEMON Tools"="d:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-10-08 02:18] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2006-05-24 14:16:14] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-08-27 15:51:08] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00] GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2007-09-03 17:00:14] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener] TS_LogonListener.dll 2007-01-12 16:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddcya.dll R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys R1 ABTDI;ABTDI;\??\C:\Program Files\ArcaBit\ArcaVir\ABTDI.sys R2 ABFileMon;ArcaBit FileMonitor;"C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe" R2 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;"C:\Program Files\ArcaBit\Common\TaskScheduler.exe" R2 AVUpdate;ArcaBit Update Service;C:\Program Files\ArcaBit\ArcaUpdate\update.exe R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\System32\StkCSrv.exe R3 ABFLT;ArcaBit File Monitor Driver;\??\C:\PROGRA~1\ARCABIT\ARCAVIR\ABFLT.sys R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;"C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe" R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;"C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe" R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys R3 StkCMini;Syntek AVStream USB2.0 2M WebCam;C:\WINDOWS\system32\Drivers\StkCMini.sys S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\ZDPNDIS5.SYS . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 21:21:47 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-11 21:22:23 - machine was rebooted . --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:23:55, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ArcaBit\ArcaUpdate\update.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\StkCSrv.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Winamp Remote\bin\Orb.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Żuczuś\Pulpit\Protection\HiJackThis.exe C:\Program Files\Mozilla Firefox\firefox.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.portal24h.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe" O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe -- End of file - 9873 bytes

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 22:38

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\rqrrqom.dll.vir
C:\WINDOWS\system32\mkbgtqvp.dll.vir

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 102 · przez **Krzaczek** 11 Lis 2007, 22:52

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Żuczuś 2007-11-11 21:45:35.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.387 [GMT 1:00] Running from: C:\Documents and Settings\Żuczuś\Pulpit\Protection\ComboFix.exe Command switches used :: C:\Documents and Settings\Żuczuś\Pulpit\Protection\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\mkbgtqvp.dll.vir C:\WINDOWS\system32\rqrrqom.dll.vir . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\mkbgtqvp.dll.vir . ((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 ))))))))))))))))))))))))))))))) . 2007-11-11 21:22 <DIR> C:\Documents and Settings\»uczuť\Ustawienia lokalne 2007-11-11 21:22 <DIR> C:\Documents and Settings\»uczuť\Ustawienia lokalne 2007-11-11 20:19 <DIR> d-------- C:\Deckard 2007-11-11 20:15 <DIR> d-------- C:\!KillBox 2007-11-11 19:47 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-11 19:37 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-11 18:48 <DIR> d-------- C:\VundoFix Backups 2007-11-11 18:39 2,228 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-11 18:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-11 18:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-11 18:38 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-11 18:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-11 18:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-11 15:23 <DIR> d--hs---- C:\FOUND.001 2007-11-11 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-11 15:09 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-11 14:38 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2007-11-10 16:04 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-11-10 16:04 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-11-10 16:04 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-11-09 22:33 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-11-09 21:40 <DIR> d-------- C:\Program Files\DC++ 2007-11-09 21:32 <DIR> d-------- C:\Program Files\Kazaa Lite Rewolucja 2007-11-09 21:32 <DIR> d-------- C:\My Shared Folder 2007-11-09 21:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kazaa Lite 2007-11-06 13:18 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-06 13:18 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-11-06 13:18 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-11-06 13:18 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-11-06 13:18 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-06 13:18 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-11-06 13:18 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-06 13:18 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-11-06 13:18 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-10-27 14:23 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-10-23 15:04 <DIR> d-------- C:\Program Files\GameVicio 2007-10-23 12:05 <DIR> d-------- C:\Program Files\eMule 2007-10-21 16:27 <DIR> d-------- C:\Program Files\Winamp Toolbar 2007-10-21 16:27 <DIR> d-------- C:\Program Files\Winamp Remote 2007-10-21 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2007-10-21 16:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2007-10-19 17:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2007-10-19 17:37 54,784 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll 2007-10-13 19:56 <DIR> d--hs---- C:\FOUND.000 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-09 21:33 278,544 ----a-w C:\WINDOWS\Fonts\Setup.exe 2007-10-25 19:04 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2007-10-09 21:34 --------- d-----w C:\Program Files\Winamp 2007-10-05 20:37 --------- d-----w C:\Program Files\illiminable 2007-09-30 20:58 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:50 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-09-30 19:50 --------- d-----w C:\Program Files\Nvidia Omega Drivers 2007-09-30 19:50 --------- d-----w C:\Program Files\MultiRes 2007-09-30 19:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-09-18 11:53 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-09-18 11:45 --------- d-----w C:\Program Files\MarBit 2007-09-17 20:50 --------- d-----w C:\Program Files\Common Files\DirectX 2007-09-17 14:07 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-08-23 23:42 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-08-20 14:31 3,584,512 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 10:01 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-20 10:01 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 10:01 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-08-20 10:01 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-08-20 10:01 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-08-20 10:01 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 10:01 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-08-20 10:01 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 10:01 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 10:01 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-08-20 10:01 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 10:01 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-08-20 10:01 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-08-20 10:01 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 10:01 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 10:01 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 10:01 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 10:01 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 10:01 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-20 10:01 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-08-20 10:01 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-08-20 10:01 1,152,000 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-17 10:24 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:24 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 10:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-08-17 07:34 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-08-13 17:54 765,952 ----a-w C:\WINDOWS\system32\dllcache\VGX.dll 2007-08-13 17:54 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll 2007-08-13 17:54 413,696 ----a-w C:\WINDOWS\system32\dllcache\vbscript.dll 2007-08-13 17:54 33,792 ----a-w C:\WINDOWS\system32\dllcache\custsat.dll 2007-08-13 17:54 191,488 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-13 17:54 156,160 ----a-w C:\WINDOWS\system32\msls31.dll 2007-08-13 17:54 156,160 ----a-w C:\WINDOWS\system32\dllcache\msls31.dll 2007-08-13 17:45 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll 2007-08-13 17:45 78,336 ----a-w C:\WINDOWS\system32\dllcache\ieencode.dll 2007-08-13 17:44 69,120 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-13 17:44 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll 2007-08-13 17:44 40,960 ----a-w C:\WINDOWS\system32\dllcache\licmgr10.dll 2007-08-13 17:39 92,672 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-13 17:39 71,680 ----a-w C:\WINDOWS\system32\dllcache\admparse.dll 2007-08-13 17:39 71,680 ----a-w C:\WINDOWS\system32\admparse.dll 2007-08-13 17:39 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll 2007-08-13 17:39 55,296 ----a-w C:\WINDOWS\system32\dllcache\iesetup.dll 2007-08-13 17:38 491,520 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll 2007-08-13 17:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-13 17:36 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll 2007-08-13 17:36 36,352 ----a-w C:\WINDOWS\system32\dllcache\imgutil.dll 2007-08-13 17:35 346,624 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-13 17:32 45,568 ----a-w C:\WINDOWS\system32\mshta.exe 2007-08-13 17:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\mshta.exe 2007-08-13 17:18 60,416 ----a-w C:\WINDOWS\system32\dllcache\hmmapi.dll 2007-08-13 17:01 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll 2007-08-13 17:01 48,128 ----a-w C:\WINDOWS\system32\dllcache\mshtmler.dll . ((((((((((((((((((((((((((((( snapshot@2007-11-11_21.21.57.01 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\ERDNT\subs\F3M\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-14 23:38] "nwiz"="nwiz.exe" [2007-05-14 23:38 C:\WINDOWS\system32\nwiz.exe] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 17:37] "RTHDCPL"="RTHDCPL.EXE" [2007-03-08 16:21 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-29 12:22] "ATKHOTKEY"="C:\Program Files\ATK Hotkey\Hcontrol.exe" [2007-05-24 11:32] "ABRegmon"="C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe" [2007-07-12 10:40] "ArcaCheck"="C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe" [2007-07-27 13:57] "AvMenu"="C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe" [2007-10-22 15:51] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-14 23:38] "WinampAgent"="C:\Program Files\Winamp\wianmpa.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44] "DAEMON Tools"="d:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-10-08 02:18] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2006-05-24 14:16:14] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-08-27 15:51:08] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00] GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2007-09-03 17:00:14] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener] TS_LogonListener.dll 2007-01-12 16:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys R1 ABTDI;ABTDI;\??\C:\Program Files\ArcaBit\ArcaVir\ABTDI.sys R2 ABFileMon;ArcaBit FileMonitor;"C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe" R2 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;"C:\Program Files\ArcaBit\Common\TaskScheduler.exe" R2 AVUpdate;ArcaBit Update Service;C:\Program Files\ArcaBit\ArcaUpdate\update.exe R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\System32\StkCSrv.exe R3 ABFLT;ArcaBit File Monitor Driver;\??\C:\PROGRA~1\ARCABIT\ARCAVIR\ABFLT.sys R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;"C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe" R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;"C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe" R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys R3 StkCMini;Syntek AVStream USB2.0 2M WebCam;C:\WINDOWS\system32\Drivers\StkCMini.sys S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\ZDPNDIS5.SYS . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 21:49:17 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-11 21:49:37 - machine was rebooted C:\ComboFix2.txt ... 2007-11-11 21:22 . --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:51:22, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ArcaBit\ArcaUpdate\update.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\StkCSrv.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Winamp Remote\bin\Orb.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Żuczuś\Pulpit\Protection\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.portal24h.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe" O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe -- End of file - 9873 bytes

**Posty:** 18165 · przez **wojtas** 12 Lis 2007, 18:54

czysto

Autor postu otrzymał pochwałę

**Posty:** 102 · przez **Krzaczek** 12 Lis 2007, 19:46

Dzieki wielkie

prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum