proszę o sprawdzenie loga

**Posty:** 47 · przez **Digital_PRo** 12 Lis 2007, 21:09

Od wczoraj non stop explorer.exe leci na 100% użycia procesora.
Poniżej log z hijack'a

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:10:01, on 2007-11-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\scyeqpen.exe F:\Programy\ProShowProducer\ScsiAccess.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe F:\Programy\BitComet\BitComet.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe F:\Programy\Registry Clean Expert\RCHelper.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\Programy\FlashGet\fgiebar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - F:\Programy\SnagIt 8\SnagItIEAddin.dll O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [AVP] "F:\Programy\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [UVS11 Preload] F:\Programy\Ulead VideoStudio 11\uvPL.exe O4 - HKLM\..\Run: [Microsoft WebServer] C:\Program Files\WebSvr\System\svctrl /init O4 - HKLM\..\Run: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKLM\..\Run: [c4e4930e] rundll32.exe "C:\WINDOWS\system32\pwicacfw.dll",b O4 - HKLM\..\RunServices: [Microsoft WebServer] C:\Program Files\WebSvr\System\inetsw95 -w3svc O4 - HKLM\..\RunServices: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKCU\..\Run: [BitComet] "F:\Programy\BitComet\BitComet.exe" O4 - HKCU\..\Run: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKCU\..\Run: [DDC] C:\WINDOWS\system32\scyeqpen.exe O4 - HKCU\..\RunServices: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Download All by FlashGet - F:\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - F:\Programy\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Programy\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Programy\FlashGet\flashget.exe O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - F:\Programy\Ghost Navigator2_8_1\Ghost (file missing) O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - F:\Programy\Ghost Navigator2_8_1\Ghost (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: F:\Programy\KASPER~1.0\adialhk.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - F:\Programy\Kaspersky Internet Security 7.0\avp.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: DomainService - - C:\WINDOWS\system32\scyeqpen.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: ScsiAccess - Unknown owner - F:\Programy\ProShowProducer\ScsiAccess.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 5253 bytes

**Posty:** 18165 · przez **wojtas** 12 Lis 2007, 21:28

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 47 · przez **Digital_PRo** 13 Lis 2007, 16:41

Nie ma już problemów z EXPLORER'em.
Ale daje logi, jakby ktoś zauważył jakiś "syf"
pozdrawiam i dzięki

RAPPORT ---->

Kod: Zaznacz wszystko: SmitFraudFix v2.252 Scan done at 14:17:22,71, 2007-11-13 Run from C:\Documents and Settings\SonyEricsson\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Motorola SURFboard SB5100 USB Cable Modem - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 192.168.1.252 DNS Server Search Order: 192.168.1.247 DNS Server Search Order: 192.168.1.250 HKLM\SYSTEM\CCS\Services\Tcpip\..\{3F02CF5B-4A43-49DB-8E08-F1FE9359DC0D}: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CS1\Services\Tcpip\..\{3F02CF5B-4A43-49DB-8E08-F1FE9359DC0D}: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CS2\Services\Tcpip\..\{3F02CF5B-4A43-49DB-8E08-F1FE9359DC0D}: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CS3\Services\Tcpip\..\{3F02CF5B-4A43-49DB-8E08-F1FE9359DC0D}: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.252 192.168.1.247 192.168.1.250 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

COMBOFIX ----->

Kod: Zaznacz wszystko: ComboFix 07-10-12.4 - SonyEricsson 2007-10-14 16:37:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.265 [GMT 2:00] Running from: C:\Documents and Settings\SonyEricsson\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\check_LSA7.txt C:\Documents and Settings\SonyEricsson\Menu Start\Programy\Outerinfo C:\Documents and Settings\SonyEricsson\Menu Start\Programy\Outerinfo\Terms.lnk C:\Documents and Settings\SonyEricsson\Menu Start\Programy\Outerinfo\Uninstall.lnk C:\Program Files\Common Files\wnsxs~1 C:\Program Files\Common Files\wnsxs~1\W?nSxS\ C:\Program Files\outerinfo C:\Program Files\outerinfo\outerinfo.ico C:\Program Files\outerinfo\Terms.rtf C:\Program Files\scurit~1 C:\Program Files\scurit~1\w?crtupd.exe C:\Program Files\WinAble C:\WINDOWS\cookies.ini C:\WINDOWS\system32\fjjypgej.exe C:\WINDOWS\system32\hbylhdui.exe C:\WINDOWS\system32\huehbuly.exe C:\WINDOWS\system32\hxpqjair.dll C:\WINDOWS\system32\hyecjnxq.dll C:\WINDOWS\system32\icfdxesv.exe C:\WINDOWS\system32\ilnmp.bak1 C:\WINDOWS\system32\ilnmp.bak1 C:\WINDOWS\system32\ilnmp.bak1 C:\WINDOWS\system32\ilnmp.bak2 C:\WINDOWS\system32\ilnmp.bak2 C:\WINDOWS\system32\ilnmp.bak2 C:\WINDOWS\system32\ilnmp.ini C:\WINDOWS\system32\ilnmp.ini C:\WINDOWS\system32\ilnmp.ini C:\WINDOWS\system32\ilnmp.ini2 C:\WINDOWS\system32\ilnmp.ini2 C:\WINDOWS\system32\ilnmp.ini2 C:\WINDOWS\system32\ilnmp.tmp C:\WINDOWS\system32\ilnmp.tmp C:\WINDOWS\system32\ilnmp.tmp C:\WINDOWS\system32\kuccvriq.ini C:\WINDOWS\system32\mhluxmme.exe C:\WINDOWS\system32\mrjhbecm.dll C:\WINDOWS\system32\pmnli.dll C:\WINDOWS\system32\qirvccuk.dll C:\WINDOWS\system32\qseaxfar.exe C:\WINDOWS\system32\qxnjceyh.ini C:\WINDOWS\system32\wburewqb.exe C:\WINDOWS\system32\xxulkxts.exe C:\WINDOWS\system32\yiofbhlk.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\DomainService ((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 ))))))))))))))))))))))))))))))) . 2007-10-14 16:36 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-14 16:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-14 15:04 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-14 14:26 <DIR> d-------- C:\WINDOWS\pss 2007-10-14 00:53 <DIR> d-------- C:\WINDOWS\Sun 2007-10-14 00:50 <DIR> d-------- C:\Program Files\Java 2007-10-14 00:48 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-13 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2007-10-13 15:00 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\DAEMON Tools Pro 2007-10-13 14:56 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-10-13 13:21 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2007-10-12 23:19 <DIR> d-------- C:\DOWNLOADS 2007-10-12 15:33 <DIR> d-------- C:\WINDOWS\system32\AdCache 2007-10-12 12:45 3,152,160 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-12 12:45 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-10-12 12:45 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-10-12 12:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-10-12 12:44 50,976 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-12 12:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-10-11 21:16 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\PhotoFrameShow 2007-10-11 21:08 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\Vso 2007-10-11 21:08 719,872 --a------ C:\WINDOWS\system32\devil.dll 2007-10-11 21:08 314,368 --a------ C:\WINDOWS\system32\avisynth.dll 2007-10-11 21:08 81,920 --a------ C:\Documents and Settings\SonyEricsson\Dane aplikacji\ezpinst.exe 2007-10-11 21:08 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-10-11 21:08 47,360 --a------ C:\Documents and Settings\SonyEricsson\Dane aplikacji\pcouffin.sys 2007-10-11 21:05 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\Ahead 2007-10-11 21:04 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-11 21:04 1,568,768 --a------ C:\WINDOWS\system32\imagX7.dll 2007-10-11 21:04 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-10-11 21:04 1,047,552 --a------ C:\WINDOWS\system32\mfc71u.dll 2007-10-11 21:04 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-10-11 21:04 476,320 --a------ C:\WINDOWS\system32\imagXpr7.dll 2007-10-11 21:04 471,040 --a------ C:\WINDOWS\system32\imagXRA7.dll 2007-10-11 21:04 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll 2007-10-11 21:04 262,144 --a------ C:\WINDOWS\system32\imagXR7.dll 2007-10-11 21:02 <DIR> d-------- C:\Program Files\Common Files\Stardock 2007-10-11 20:59 265,216 --a------ C:\WINDOWS\system32\FAXUTIL.DLL 2007-10-11 20:59 181,248 --a------ C:\WINDOWS\system32\faxzrh.DLL 2007-10-11 20:59 156,160 --a------ C:\WINDOWS\system32\unrar3.dll 2007-10-11 20:59 145,920 --a------ C:\WINDOWS\system32\wav2.dll 2007-10-11 20:59 75,264 --a------ C:\WINDOWS\system32\unacev2.dll 2007-10-11 20:59 14 --a------ C:\WINDOWS\system32\fstextv6.dll 2007-10-11 20:54 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\Photodex 2007-10-11 20:51 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-10-11 19:44 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\Media Player Classic 2007-10-11 19:43 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-10-11 19:43 1,559,040 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-10-11 19:43 740,442 --a------ C:\WINDOWS\system32\divx.dll 2007-10-11 19:43 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-10-11 19:43 282,624 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-10-11 19:43 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-10-11 19:43 163,840 --a------ C:\WINDOWS\system32\unrar.dll 2007-10-11 19:43 73,728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-10-11 19:43 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-10-11 18:14 <DIR> d-------- C:\Program Files\Opera 2007-10-11 18:07 <DIR> d---s---- C:\Documents and Settings\SonyEricsson\UserData 2007-10-11 17:07 <DIR> d-------- C:\Documents and Settings\SonyEricsson\Dane aplikacji\COWON 2007-10-11 17:04 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-10-11 17:04 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-10-11 17:03 2,676,672 --a------ C:\WINDOWS\system32\ati3duag.dll 2007-10-11 17:03 1,918,464 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-10-11 17:03 1,289,472 --a------ C:\WINDOWS\system32\ativvaxx.dll 2007-10-11 17:03 870,784 --a------ C:\WINDOWS\system32\ati3d1ag.dll 2007-10-11 17:03 315,392 --a------ C:\WINDOWS\system32\ati2cqag.dll 2007-10-11 17:03 263,168 --a------ C:\WINDOWS\system32\ati2dvag.dll 2007-10-11 17:03 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-10-11 17:03 46,464 --a------ C:\WINDOWS\system32\drivers\GAGP30KX.SYS 2007-10-11 17:03 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2007-10-11 17:02 <DIR> dr------- C:\Program Files 2007-10-11 17:01 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-10-11 17:01 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-10-11 17:01 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-10-11 17:01 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-10-11 17:01 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-10-11 17:01 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-10-11 17:01 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-10-11 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-10-11 17:01 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-10-11 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-10-11 17:01 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-10-11 17:01 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-10-11 17:01 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji 2007-10-11 17:01 <DIR> d-------- C:\Documents and Settings . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-14 14:23 7,676 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-14 14:23 45,800 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-14 11:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-12 14:55 --------- d-----w C:\Program Files\Temporary 2007-10-11 14:29 --------- d-----w C:\Program Files\Common Files\COWON 2007-10-11 14:28 32,768 ----a-w C:\WINDOWS\system32\nnnnmkh.dll 2007-10-11 14:18 --------- d-----w C:\Program Files\Ericsson 2007-10-11 14:17 --------- d-----w C:\Documents and Settings\SonyEricsson\Dane aplikacji\FMA 2007-10-11 14:16 --------- d-----w C:\Documents and Settings\SonyEricsson\Dane aplikacji\Skype 2007-10-11 14:15 --------- d-----w C:\Program Files\Skype 2007-10-11 14:15 --------- d-----w C:\Program Files\Common Files\Skype 2007-10-11 14:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-10-11 14:14 --------- d-----w C:\Documents and Settings\SonyEricsson\Dane aplikacji\Tlen.pl 2007-10-11 14:11 --------- d-----w C:\Documents and Settings\SonyEricsson\Dane aplikacji\Gadu-Gadu 2007-10-11 13:37 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-11 13:36 451,072 ----a-w C:\WINDOWS\Radeon Omega Drivers v3.8.330 Uninstall.exe 2007-10-11 13:36 --------- d-----w C:\Program Files\Radeon Omega Drivers 2007-10-11 13:34 --------- d-----w C:\Program Files\SiS7012 2007-10-11 13:32 267,136 ----a-w C:\WINDOWS\system32\drivers\sis7012.sys 2007-10-11 13:32 115,864 ----a-w C:\WINDOWS\system32\a3d.dll 2007-10-11 13:31 --------- d-----w C:\Documents and Settings\SonyEricsson\Dane aplikacji\Talkback 2007-10-11 13:15 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-11 13:13 --------- d-----w C:\Program Files\Usługi online 2007-07-19 22:57 267,112 ----a-w C:\WINDOWS\system32\xactengine2_9.dll 2007-07-19 22:54 18,280 ----a-w C:\WINDOWS\system32\x3daudio1_2.dll 2007-07-19 16:14 444,776 ----a-w C:\WINDOWS\system32\d3dx10_35.dll 2007-07-19 16:14 3,727,720 ----a-w C:\WINDOWS\system32\d3dx9_35.dll 2007-07-19 16:14 1,358,192 ----a-w C:\WINDOWS\system32\D3DCompiler_35.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}] 2007-10-11 16:28 32768 --a------ C:\WINDOWS\system32\nnnnmkh.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 C:\WINDOWS\system32\atiptaxx.exe] "AVP"="F:\Programy\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="F:\Programy\BitComet\BitComet.exe" [2006-06-23 19:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{4B9ECF81-666D-4B07-A71C-CEDCBD50B4F4}"= C:\WINDOWS\system32\nnnnmkh.dll [2007-10-11 16:28 32768] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnmkh] nnnnmkh.dll 2007-10-11 16:28 32768 C:\WINDOWS\system32\nnnnmkh.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=F:\Programy\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] "F:\Programy\Alcohol 120\axcmd.exe" /automount [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] "F:\Programy\DAEMON Tools Pro\DTProAgent.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler] "F:\Programy\Registry Clean Expert\RCHelper.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock] F:\Programy\Clock Tray Skins\ClockTraySkins.exe R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-14 16:43:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-14 16:44:39 - machine was rebooted . --- E O F ---

HIJACK THIS ---->

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:42, on 2007-11-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe F:\Programy\Kaspersky Internet Security 7.0\avp.exe F:\Programy\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe F:\Programy\ProShowProducer\ScsiAccess.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - F:\Programy\SnagIt 8\SnagItBHO.dll O2 - BHO: {8a056bfe-5ee6-1e08-c604-3da3ad8b8ec3} - {3ce8b8da-3ad3-406c-80e1-6ee5efb650a8} - C:\WINDOWS\system32\rkocmctv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - F:\Programy\FlashGet\jccatch.dll O2 - BHO: (no name) - {CDA7EE3E-3DF7-45C9-A73F-F3F4568F15E3} - C:\WINDOWS\system32\ddabb.dll (file missing) O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\Programy\FlashGet\fgiebar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - F:\Programy\SnagIt 8\SnagItIEAddin.dll O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [UVS11 Preload] F:\Programy\Ulead VideoStudio 11\uvPL.exe O4 - HKLM\..\Run: [Microsoft WebServer] C:\Program Files\WebSvr\System\svctrl /init O4 - HKLM\..\Run: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKLM\..\Run: [AVP] "F:\Programy\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [c4e4930e] rundll32.exe "C:\WINDOWS\system32\bwsdvvay.dll",b O4 - HKLM\..\RunServices: [Microsoft WebServer] C:\Program Files\WebSvr\System\inetsw95 -w3svc O4 - HKLM\..\RunServices: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKCU\..\Run: [BitComet] "F:\Programy\BitComet\BitComet.exe" O4 - HKCU\..\Run: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKCU\..\RunServices: [camtrk] C:\WINDOWS\%w\camtrk.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Dodaj do blokowanych banerów - F:\Programy\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: Download All by FlashGet - F:\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - F:\Programy\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Programy\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Programy\FlashGet\flashget.exe O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - F:\Programy\Ghost Navigator2_8_1\Ghost (file missing) O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - F:\Programy\Ghost Navigator2_8_1\Ghost (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: F:\Programy\KASPER~1.0\adialhk.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - F:\Programy\Kaspersky Internet Security 7.0\avp.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: ScsiAccess - Unknown owner - F:\Programy\ProShowProducer\ScsiAccess.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 5793 bytes

**Posty:** 18165 · przez **wojtas** 13 Lis 2007, 16:50

skasuj te wpisy:

O2 - BHO: {8a056bfe-5ee6-1e08-c604-3da3ad8b8ec3} - {3ce8b8da-3ad3-406c-80e1-6ee5efb650a8} - C:\WINDOWS\system32\rkocmctv.dll
O2 - BHO: (no name) - {CDA7EE3E-3DF7-45C9-A73F-F3F4568F15E3} - C:\WINDOWS\system32\ddabb.dll (file missing)
O4 - HKLM\..\Run: [c4e4930e] rundll32.exe "C:\WINDOWS\system32\bwsdvvay.dll",b

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\nnnnmkh.dll
C:\WINDOWS\system32\rkocmctv.dll
C:\WINDOWS\system32\bwsdvvay.dll

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

znasz to: ??

O4 - HKLM\..\Run: [camtrk] C:\WINDOWS\%w\camtrk.exe
O4 - HKLM\..\RunServices: [Microsoft WebServer] C:\Program Files\WebSvr\System\inetsw95 -w3svc
O4 - HKLM\..\RunServices: [camtrk] C:\WINDOWS\%w\camtrk.exe
O4 - HKCU\..\Run: [camtrk] C:\WINDOWS\%w\camtrk.exe
O4 - HKCU\..\RunServices: [camtrk] C:\WINDOWS\%w\camtrk.exe

jesli nie usuwasz te wpisy ^^ i pogrubiony wywalasz do kosza ....
Potem nowy log z hijacka oraz combofixa

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum