proszę o sprawdzenie loga.

**Posty:** 188 · przez **D3N** 19 Lip 2007, 22:28

Przypadkowo dałem się nabrać i chciałem zmienić wygląd kompozycji windowsa, nie wyszło mi to na dobre. Avast zaczął wariować, zrobilem jakieś wstępne zabiegi i wywaliłem "NewDotNet". Czuję jednak, że został syf ponieważ Kerio Wywala log próby ataku z pliku C:\windows\system32\rlvknlg.exe . Prosiłbym o sprawdzenie...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:18:47, on 2007-07-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\FlashGet\FlashGet.exe C:\program files\powerstrip\pstrip.exe D:\Program Files\Winamp\winampa.exe D:\PROGRA~1\WapSter\AQQ\AQQ.exe C:\windows\system32\rlvknlg.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Patryk\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb106\Dealio.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb106\Dealio.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

**Posty:** 18165 · przez **wojtas** 19 Lip 2007, 22:35

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\windows\system32\rlvknlg.exe
C:\windows\ALCMTR.EXE

Folders to delete:
C:\Program Files\Dealio

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa + hijack

combofix

**Posty:** 188 · przez **D3N** 19 Lip 2007, 22:50

Avenger:

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\kcfjptjr ******************* Script file located at: \??\C:\WINDOWS\system32\sttpmbwy.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\windows\system32\rlvknlg.exe deleted successfully. File C:\windows\ALCMTR.EXE deleted successfully. Folder C:\Program Files\Dealio deleted successfully. Completed script processing. ******************* Finished! Terminate.

Wywaliłem to co kazałeś w Avengerze.

HijackThis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:46, on 2007-07-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\FlashGet\FlashGet.exe C:\program files\powerstrip\pstrip.exe D:\Program Files\Winamp\winampa.exe D:\PROGRA~1\WapSter\AQQ\AQQ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Patryk\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Tu również.

I z góry przepraszam za możliwą pomyłkę w combofixie, operuję tym 1-szy raz. Log się generuje, najwyżej dokleje

.

**Posty:** 18165 · przez **wojtas** 19 Lip 2007, 22:55

O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb106\Dealio.dll (file missing)
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb106\res\DealioSearch.html

skasuj te 2 wpisy i daj loga z combofixa

**Posty:** 188 · przez **D3N** 19 Lip 2007, 23:00

Kod: Zaznacz wszystko: "Patryk" - 2007-07-19 22:53:49 - ComboFix 07-07-14.6 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19 ))))))))))))))))))))))))))))))) 2007-07-19 22:45 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-19 22:11 <DIR> d-------- C:\!KillBox 2007-07-19 22:05 8,464 --a------ C:\WINDOWS\system32\sporder.dll 2007-07-19 21:40 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-07-19 21:40 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-07-19 21:40 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-07-19 21:40 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-07-19 21:39 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-07-19 21:38 <DIR> d-------- C:\Program Files\Winamp 2007-07-19 21:02 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-07-19 21:02 <DIR> d-------- C:\DOCUME~1\Patryk\Gadu-Gadu 2007-07-19 20:57 <DIR> d-------- C:\DOCUME~1\Patryk\WapSter 2007-07-19 20:22 <DIR> d-------- C:\Program Files\PowerStrip 2007-07-19 20:14 172,032 --a------ C:\WINDOWS\UOUninst.exe 2007-07-19 19:44 1,156 --a------ C:\WINDOWS\mozver.dat 2007-07-19 19:23 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-07-19 19:23 <DIR> d-------- C:\ATI 2007-07-19 19:17 <DIR> d-------- C:\Program Files\Marvell 2007-07-19 10:18 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll 2007-07-19 10:18 144,357 --a------ C:\WINDOWS\system32\atiicdxx.dat 2007-07-18 23:35 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-18 23:27 6,076 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-07-18 23:25 451,072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.221 Uninstall.exe 2007-07-18 23:25 <DIR> d-------- C:\Program Files\MultiRes 2007-07-18 23:18 <DIR> d-------- C:\Direct9.0 2007-07-18 23:09 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-07-18 23:09 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-07-18 23:08 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-07-18 23:07 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll 2007-07-18 23:07 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll 2007-07-18 23:07 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll 2007-07-18 23:07 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll 2007-07-18 23:07 <DIR> dr------- C:\Program Files 2007-07-18 23:07 <DIR> d--hs---- C:\WINDOWS\Installer 2007-07-18 23:07 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-18 23:07 <DIR> d-------- C:\Program Files\Common Files\ODBC 2007-07-18 23:03 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2007-07-18 23:03 9,168 --a------ C:\WINDOWS\system\VER.DLL 2007-07-18 23:03 85,532 --a------ C:\WINDOWS\system32\dgsetup.dll 2007-07-18 23:03 83,456 --a------ C:\WINDOWS\system\OLECLI.DLL 2007-07-18 23:03 8,704 --a------ C:\WINDOWS\system32\batt.dll 2007-07-18 23:03 70,144 --a------ C:\WINDOWS\NOTEPAD.EXE 2007-07-18 23:03 70,096 --a------ C:\WINDOWS\system\AVICAP.DLL 2007-07-18 23:03 7,168 --a------ C:\WINDOWS\system32\kbdcz.dll 2007-07-18 23:03 69,552 --a------ C:\WINDOWS\system\MMSYSTEM.DLL 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdycl.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdsl1.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdsl.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdhu.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdcz2.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdcz1.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\kbdcr.dll 2007-07-18 23:03 6,656 --a------ C:\WINDOWS\system32\KBDAL.DLL 2007-07-18 23:03 5,632 --a------ C:\WINDOWS\system32\kbdro.dll 2007-07-18 23:03 5,632 --a------ C:\WINDOWS\system32\kbdhu1.dll 2007-07-18 23:03 5,120 --a------ C:\WINDOWS\system\SHELL.DLL 2007-07-18 23:03 33,376 --a------ C:\WINDOWS\system\COMMDLG.DLL 2007-07-18 23:03 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2007-07-18 23:03 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL 2007-07-18 23:03 19,200 --a------ C:\WINDOWS\system\TAPI.DLL 2007-07-18 23:03 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll 2007-07-18 23:03 15,360 --a------ C:\WINDOWS\TASKMAN.EXE 2007-07-18 23:03 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2007-07-18 23:03 127,008 --a------ C:\WINDOWS\system\MSVIDEO.DLL 2007-07-18 23:03 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys 2007-07-18 23:03 109,488 --a------ C:\WINDOWS\system\AVIFILE.DLL 2007-07-18 23:03 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll 2007-07-18 23:02 75,776 --a------ C:\WINDOWS\system32\storprop.dll 2007-07-18 23:02 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne 2007-07-18 23:02 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start 2007-07-18 23:02 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start 2007-07-18 23:02 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty 2007-07-18 23:02 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony 2007-07-18 23:02 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony 2007-07-18 23:02 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione 2007-07-18 23:02 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit 2007-07-18 23:02 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty 2007-07-18 23:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione 2007-07-18 23:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit 2007-07-18 23:01 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2007-07-18 23:01 <DIR> d-------- C:\WINDOWS\system32\CatRoot 2007-07-18 23:00 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji 2007-07-18 23:00 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji 2007-07-18 23:00 <DIR> d-------- C:\Documents and Settings 2007-07-18 22:57 <DIR> d--hs---- C:\System Volume Information 2007-07-18 22:41 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys 2007-07-18 22:41 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-19 20:53:47 131 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err 2007-07-19 19:23:45 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll 2007-07-19 18:46:46 -------- d-----w C:\DOCUME~1\Patryk\DANEAP~1\Moje pliki zapisu Bitwy o Śródziemie 2007-07-18 20:25:51 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-18 20:25:51 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-18 19:14:08 -------- d-----w C:\Program Files\Usługi online 2007-06-13 19:50:17 43,152 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp 2007-06-13 19:25:36 339,968 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2007-06-13 19:24:32 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2007-06-13 19:24:13 2,155,520 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-06-13 19:17:37 139,264 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2007-06-13 19:17:26 118,784 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2007-06-13 19:17:18 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2007-06-13 19:17:12 42,496 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2007-06-13 19:16:59 118,784 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2007-06-13 19:15:39 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2007-06-13 19:14:51 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2007-06-13 19:10:33 8,097,792 ----a-w C:\WINDOWS\system32\atioglx2.dll 2007-06-13 19:07:26 2,922,208 ----a-w C:\WINDOWS\system32\ati3duag.dll 2007-06-13 18:57:21 1,512,960 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2007-06-13 18:57:04 972,072 ----a-w C:\WINDOWS\system32\ativva6x.dat 2007-06-13 18:57:04 3,107,788 ----a-w C:\WINDOWS\system32\ativvaxx.dat 2007-06-13 18:57:04 3,107,788 ----a-w C:\WINDOWS\system32\ativva5x.dat 2007-06-13 18:46:28 5,431,296 ----a-w C:\WINDOWS\system32\atioglxx.dll 2007-06-13 18:43:53 262,144 ----a-w C:\WINDOWS\system32\atikvmag.dll 2007-06-13 18:42:29 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2007-06-13 18:41:46 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2007-06-13 18:41:06 50,176 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2007-06-13 18:36:45 368,640 ----a-w C:\WINDOWS\system32\ati2cqag.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}] 2007-06-29 13:44 94308 --a------ C:\Program Files\FlashGet\jccatch.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}] 2007-07-04 18:28 513336 --a------ D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}] 2007-05-16 07:05 163840 --a------ C:\Program Files\FlashGet\getflash.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-02-26 09:03 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 22:57] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40] "Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [2007-06-29 13:44] "PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2007-04-08 15:22] "WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AQQ"="D:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 14:18] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-19 22:56:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-19 22:57:12 C:\ComboFix-quarantined-files.txt ... 2007-07-19 22:57 --- E O F ---

Zaraz Hijack... reset compa bo coś znów sie dzieje...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:03:21, on 2007-07-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\FlashGet\FlashGet.exe C:\program files\powerstrip\pstrip.exe D:\Program Files\Winamp\winampa.exe D:\PROGRA~1\WapSter\AQQ\AQQ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Patryk\Pulpit\hijackthis\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Wszystko

Dalej syf?

**Posty:** 18165 · przez **wojtas** 19 Lip 2007, 23:05

skasuj ten folder po killboxie:

C:\!KillBox

i bedzie juz ok

Autor postu otrzymał pochwałę

**Posty:** 188 · przez **D3N** 19 Lip 2007, 23:08

Dzięki za pomoc. Avast nie wariuje. Łatwo sie nabierać niestety, nie wiedziałem, że z chęci odmienienia mojego windowsa zrobią się aż takie problemy. Wielki plus dla ciebie

.

proszę o sprawdzenie loga.

Proszę o sprawdzenie Loga.

Kto jest na forum