proszę o sprawdzenie loga

**Posty:** 67 · przez **Arek7777** 10 Paź 2007, 19:57

uruchamiam hijacka zaznaczam to webassist daje fix checked i niby jest ucuniete ale kiedy tylko włącze internet to znowu sie pojawia ...

to z wwdc o którem jest w temacie który podaleś już zastosowałem :

http://www.fotosik.pl/pokaz_obrazek/401320d98d0888ea.html

chyba ze sciagnąć też ten drugi program ?

reszte wykonalem dodalem do rejestru i smitfraundfix też odpaliłem z opcją 2

hijack :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:51:48, on 2007-10-10 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Arek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\3Tj18374.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

combo:

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 )))))))))))))))))))))))))))))))))) 2007-10-10 19:37 184,320 --a------ C:\WINDOWS\system32\3Tj18374.dll 2007-10-10 19:32 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\PC Suite 2007-10-10 19:16 184,320 --a------ C:\WINDOWS\system32\duF6Dv5C.dll 2007-10-10 17:06 <DIR> d-------- C:\Program Files\Sunbelt Software 2007-10-09 21:34 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-10-09 21:34 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-10-09 21:34 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-10-09 21:34 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-10-09 21:23 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-09 20:16 <DIR> d-------- C:\Avenger 2007-10-07 14:09 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-07 14:09 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:57 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:57 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:57 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:56 92,504 --a------ C:\WINDOWS\system32\cdm.dll 2007-10-03 19:56 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:56 53,080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-10-03 19:56 1,712,984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-18 18:39 <DIR> d-------- C:\Program Files\TVAnts 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-10-10 19:42 1114 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll {85589B5D-D53D-4237-A677-46B82EA275F3} C:\WINDOWS\System32\3Tj18374.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-10 19:56:42 Windows 5.1.2600 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-10 19:56:47 C:\ComboFix2.txt ... 07-10-10 17:20 C:\ComboFix3.txt ... 07-10-10 16:50 C:\ComboFix-quarantined-files.txt ... 07-10-10 19:56

**Posty:** 18165 · przez **wojtas** 10 Paź 2007, 20:51

Arek7777 napisał(a):chyba ze sciagnąć też ten drugi program ?

rowniez zastosuj bo caly czas wchodza Ci wirusy do kompa

C:\WINDOWS\system32\3Tj18374.dll
C:\WINDOWS\system32\duF6Dv5C.dll

skasuj ten pliki

jakiej uzywasz przegladarki? interner explorer? sprobuj przesiasc sie na opere lub firefoxa bo lapiesz ciagle smieci

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\3Tj18374.dll

fix ^^

zrob skana tym skanerem:

http://www.kaspersky.pl/virusscanner.html

i daj raport

**Posty:** 67 · przez **Arek7777** 10 Paź 2007, 20:56

tylko że ja nie chodze po niewiadomo jakich stronach .... wiec z kąd ten syf ?

a jaki numer ma najnowsza opera ?

**Posty:** 18165 · przez **wojtas** 10 Paź 2007, 20:56

Arek7777 napisał(a):wiec z kąd ten syf ?

nie wiem dlatego wykonaj wszystko o co prosilem

**Posty:** 67 · przez **Arek7777** 10 Paź 2007, 21:06

Kod: Zaznacz wszystko: O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\i3X1Ge8i.dll

teraz ten web assist ma inną koncówke moze dlatego nie moge znależć tego jednego pliku który kazałeś skasować ?

i mam jeszcze pytanie ... czemu nie moger usunąć folderu z program files tam gdzie jest internet explorer ..

tak samo linki które podajesz otwierją mi sie w internet explorer a nie chce juz go uzywać opera sie pytała czy ustawić ją jako głowną przeglądarke . Zgodziłem sie a i tak otwiera mi sie w IE.

kaspersky wykazał jednego wirusa

Kod: Zaznacz wszystko: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 10 październik 2007 23:19:24 System operacyjny: Microsoft Windows XP Professional, (Build 2600) Kaspersky Online Scanner wersja: 5.0.83.0 Ostatnia aktualizacja Kaspersky Anti-Virus10/10/2007 Liczba wpisów w bazie danych Kaspersky Anti-Virus404207 ------------------------------------------------------------------------------- Ustawienia skanowania: Skanowanie przy użyciu następujących baz danych: standardowe Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ Statystyki skanowania: Liczba skanowanych obiektów: 57394 Liczba wykrytych wirusów: 1 Liczba zainfekowanych obiektów: 1 / 0 Liczba podejrzanych obiektów: 0 Czas trwania skanowania: 01:42:56 Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SYSTEM Object is locked pominięty C:\WINDOWS\system32\config\SOFTWARE Object is locked pominięty C:\WINDOWS\system32\config\DEFAULT Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\Debug\oakley.log Object is locked pominięty C:\WINDOWS\Sti_Trace.log Object is locked pominięty C:\WINDOWS\wiaservc.log Object is locked pominięty C:\WINDOWS\wiadebug.log Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\SoftwareDistribution\EventCache\{CD2CAA47-3C5A-4038-A10F-8336A8704C19}.bin Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat Object is locked pominięty C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\Arek\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\Arek\NTUSER.DAT.LOG Object is locked pominięty C:\Documents and Settings\Arek\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Arek\Ustawienia lokalne\Historia\History.IE5\MSHist012007101020071011\index.dat Object is locked pominięty C:\Documents and Settings\Arek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Arek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\Arek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\Arek\Cookies\index.dat Object is locked pominięty C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe Zainfekowanych: Trojan-Downloader.Win32.Agent.awf pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\debug.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\debug.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\error.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\error.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\hips.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\hips.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\ids.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\ids.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\network.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\network.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\system.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\system.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\warning.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\warning.log.idx Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\web.log Object is locked pominięty C:\Program Files\Sunbelt Software\Personal Firewall 4\logs\web.log.idx Object is locked pominięty C:\System Volume Information\_restore{64D8D829-34B4-45CA-AAA7-83C0F857E1E8}\RP29\change.log Object is locked pominięty Proces skanowania został zakończony.

**Posty:** 18165 · przez **wojtas** 11 Paź 2007, 16:37

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

odinstaluj swojego antywirusa i zainstaluj jeszcze raz

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach po chwili wlacz

Arek7777 napisał(a):teraz ten web assist ma inną koncówke moze dlatego nie moge znależć tego jednego pliku który kazałeś skasować ?

bo caly czas lapiesz nowe wirusy... a czy usuwales killboxem ?

i mam jeszcze pytanie ... czemu nie moger usunąć folderu z program files tam gdzie jest internet explorer ..

tego nie mozna usuwac sprobuj firefoxa potem nowe logi oraz log z gmera z opcji:

Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

**Posty:** 67 · przez **Arek7777** 11 Paź 2007, 18:21

nie można usuwać internet explorera ?

zaraz wykonam reszte polecen

nie mam instalki Antyvira aktualnie ...instalowal mi to kolega kiedyś tam dawno dawno ... usunąć go poprzez dodaj usun programy ? bo to exe mi sie nie otwiera

: http://www.fotosik.pl/pokaz_obrazek/bcc52b4ab173c19a.html

**Posty:** 18165 · przez **wojtas** 11 Paź 2007, 18:56

jego .exe wg skanera jest zarazone wirusem

wiec usun go przez dodaj usun i zainstaluj jeszcze raz

(sciagajac z internetu

) oraz nowe logi

**Posty:** 67 · przez **Arek7777** 11 Paź 2007, 19:27

wiec tak ? anty vir odinstalowany ale jeszcze nie instalowalem ponownie

trick z przywracaniem systemu zastosowany :]

gmer :

Kod: Zaznacz wszystko: GMER 1.0.13.12551 - http://www.gmer.net Rootkit scan 2007-10-11 19:20:08 Windows 5.1.2600 ---- Services - GMER 1.0.13 ---- Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\System32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [AUTO] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\System32\svchost.exe [MANUAL] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service C:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\System32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub Service BattC Service [SYSTEM] Beep Service C:\WINDOWS\System32\svchost.exe [AUTO] BITS Service C:\WINDOWS\System32\svchost.exe [AUTO] Browser Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\System32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] cisvc Service C:\WINDOWS\system32\clipsrv.exe [MANUAL] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\system32\drivers\cmuda.sys [MANUAL] cmuda Service C:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\System32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\System32\DRIVERS\disk.sys [BOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\System32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service [SYSTEM] Fips Service C:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service [SYSTEM] Fs_Rec Service C:\WINDOWS\System32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service C:\WINDOWS\system32\drivers\fwdrv.sys [SYSTEM] fwdrv Service C:\WINDOWS\System32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service [DISABLED] hpn Service [DISABLED] hpt3xx Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\System32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service [SYSTEM] Imapi Service C:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\System32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service C:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\System32\DRIVERS\isapnp.sys [BOOT] isapnp Service C:\WINDOWS\System32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\khips.sys [SYSTEM] khips Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe [AUTO] KPF4 Service [BOOT] KSecDD Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\System32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\System32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service C:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\System32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service [BOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service C:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC Service [SYSTEM] Msfs Service C:\WINDOWS\System32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\drivers\msmpu401.sys [MANUAL] ms_mpu401 Service [BOOT] Mup Service [BOOT] NDIS Service C:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\System32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service C:\WINDOWS\System32\DRIVERS\netbt.sys [MANUAL] NetBT Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDE Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDEdsdm Service C:\WINDOWS\System32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\System32\svchost.exe [MANUAL] Nla Service C:\WINDOWS\system32\drivers\nmwcdc.sys [MANUAL] Nokia USB Generic Service C:\WINDOWS\system32\drivers\nmwcdcm.sys [MANUAL] Nokia USB Modem Service C:\WINDOWS\system32\drivers\nmwcd.sys [MANUAL] Nokia USB Phone Parent Service C:\WINDOWS\system32\drivers\nmwcdcj.sys [MANUAL] Nokia USB Port Service [SYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [MANUAL] nv Service C:\WINDOWS\System32\nvsvc32.exe [AUTO] NVSvc Service C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\System32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service C:\WINDOWS\System32\DRIVERS\pciide.sys [BOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\System32\lsass.exe [MANUAL] PolicyAgent Service C:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\System32\DRIVERS\processr.sys [SYSTEM] Processor Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\System32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\System32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\System32\DRIVERS\redbook.sys [SYSTEM] redbook Service C:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteRegistry Service C:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [MANUAL] rtl8139 Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardDrv Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\System32\DRIVERS\secdrv.sys [AUTO] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\System32\DRIVERS\serial.sys [SYSTEM] Serial Service C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe [MANUAL] ServiceLayer Service C:\WINDOWS\System32\drivers\sfdrv01.sys [BOOT] sfdrv01 Service C:\WINDOWS\System32\drivers\sfhlp02.sys [BOOT] sfhlp02 Service [SYSTEM] Sfloppy Service C:\WINDOWS\System32\drivers\sfvfs02.sys [BOOT] sfvfs02 Service C:\WINDOWS\system32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service C:\WINDOWS\system32\drivers\sis7012.sys [MANUAL] SiS7012 Service C:\WINDOWS\System32\DRIVERS\sisagp.sys [BOOT] sisagp Service C:\WINDOWS\System32\DRIVERS\sisnic.sys [MANUAL] SISNIC Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\System32\DRIVERS\sr.sys [BOOT] sr Service C:\WINDOWS\System32\svchost.exe [AUTO] srservice Service C:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\System32\svchost.exe [DISABLED] SSDPSRV Service C:\WINDOWS\System32\svchost.exe [AUTO] stisvc Service C:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\System32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\System32\DRIVERS\termdd.sys [SYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\System32\tlntsvr.exe [MANUAL] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\System32\wdfmgr.exe [AUTO] UMWdf Service C:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\System32\svchost.exe [AUTO] uploadmgr Service C:\WINDOWS\System32\svchost.exe [DISABLED] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\System32\DRIVERS\usbohci.sys [MANUAL] usbohci Service C:\WINDOWS\System32\DRIVERS\usbscan.sys [MANUAL] usbscan Service C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service [DISABLED] ViaIde Service [BOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\System32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service {4F842359-9D63-4915-A4C9-1EC4993E6138} Service {D55CFA50-1C40-42FA-B554-1A2AF2EE4514} ---- EOF - GMER 1.0.13 ----

logi :

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:21:57, on 2007-10-11 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Arek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\Jb5ie2Gv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-11 to 2007-10-11 )))))))))))))))))))))))))))))))))) 2007-10-11 18:50 184,320 --a------ C:\WINDOWS\system32\Jb5ie2Gv.dll 2007-10-11 18:22 184,320 --a------ C:\WINDOWS\system32\G1dP8Bk1.dll 2007-10-11 08:41 184,320 --a------ C:\WINDOWS\system32\d50U2nL1.dll 2007-10-10 23:00 184,320 --a------ C:\WINDOWS\system32\t73dQ2v5.dll 2007-10-10 21:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Opera 2007-10-10 21:14 <DIR> d-------- C:\Program Files\Opera 2007-10-10 21:07 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-10-10 20:56 184,320 --a------ C:\WINDOWS\system32\i3X1Ge8i.dll 2007-10-10 20:34 184,320 --a------ C:\WINDOWS\system32\2x33W0L1.dll 2007-10-10 19:32 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\PC Suite 2007-10-10 17:06 <DIR> d-------- C:\Program Files\Sunbelt Software 2007-10-09 21:34 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-10-09 21:34 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-10-09 21:34 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-10-09 21:34 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-10-09 21:23 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-09 20:16 <DIR> d-------- C:\Avenger 2007-10-07 14:09 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-07 14:09 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:57 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:57 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:57 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:56 92,504 --a------ C:\WINDOWS\system32\cdm.dll 2007-10-03 19:56 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:56 53,080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-10-03 19:56 1,712,984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-10-10 19:42 1114 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll {85589B5D-D53D-4237-A677-46B82EA275F3} C:\WINDOWS\System32\Jb5ie2Gv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-11 19:26:41 Windows 5.1.2600 FAT scanning hidden processes ... ? [1976] scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 1 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-11 19:26:45 C:\ComboFix2.txt ... 07-10-10 19:56 C:\ComboFix3.txt ... 07-10-10 17:20 C:\ComboFix-quarantined-files.txt ... 07-10-11 19:26

**Posty:** 18165 · przez **wojtas** 11 Paź 2007, 19:44

caly czas wpadaj Ci wirusy czy masz w wwdc wszystko na zielono? (NetBios moze byc na zolto)

skasuj te pliki : (w awaryjnym jesli nie beda chcialy sie usunac )

C:\WINDOWS\system32\Jb5ie2Gv.dll
C:\WINDOWS\system32\G1dP8Bk1.dll
C:\WINDOWS\system32\d50U2nL1.dll
C:\WINDOWS\system32\t73dQ2v5.dll
C:\WINDOWS\system32\i3X1Ge8i.dll
C:\WINDOWS\system32\2x33W0L1.dll

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\Jb5ie2Gv.dll

skasuj ten wpis

i teraz pytanie co robic ... caly czas nowe (losowe) nazwy wirusow wbijaja sie do kompa

**Posty:** 67 · przez **Arek7777** 11 Paź 2007, 19:48

web assist kasuje cały czas i cały czas sie pojawia ( daje w hijack fixchecked )

wwdc jest wszystko na zieolono i dodatkowo zainstalowałem też Seconfig Xp

usunąłem te pliki które kazałeś

edit: po skasowaniu tego pliku

Kod: Zaznacz wszystko: C:\WINDOWS\system32\Jb5ie2Gv.dll

narazie nei widze tego webassista

**Posty:** 237 · przez **Kuba1** 11 Paź 2007, 20:59

Daj nowe logi.

Czy Ty nie masz cały czas podłączonego Pen Drive 'a?

Nie podłączaj Pen Drive'a na czas usuwania, bo infekcja może być na nim

Sformatuj Pen Drive'a.

**Posty:** 67 · przez **Arek7777** 11 Paź 2007, 21:33

nie pen driva nie mam podłączonego ... chodzią ostatnio podłączała siostra chyba ale tylko na chwile ... cały czas nie jest wsadzony .

prosze powiedzieć czy coś jeszcze jest nie tak i czy cokolwiek sie poprawiło od początku tej całej akcji

Kod: Zaznacz wszystko: ogfile of HijackThis v1.99.1 Scan saved at 21:27:55, on 2007-10-11 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Arek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS3\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

Kod: Zaznacz wszystko: ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-09-11 to 2007-10-11 )))))))))))))))))))))))))))))))))) 2007-10-10 21:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Opera 2007-10-10 21:14 <DIR> d-------- C:\Program Files\Opera 2007-10-10 21:07 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-10-10 19:32 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\PC Suite 2007-10-10 17:06 <DIR> d-------- C:\Program Files\Sunbelt Software 2007-10-09 21:34 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-10-09 21:34 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-10-09 21:34 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-10-09 21:34 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-10-09 21:23 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-09 20:16 <DIR> d-------- C:\Avenger 2007-10-07 14:09 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-10-07 14:09 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-10-03 19:57 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-03 19:57 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-03 19:57 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-03 19:57 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-10-03 19:56 92,504 --a------ C:\WINDOWS\system32\cdm.dll 2007-10-03 19:56 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-03 19:56 53,080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-10-03 19:56 1,712,984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-10-03 19:55 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-03 19:55 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-03 19:48 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2007-09-30 19:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 19:49 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-09-30 19:49 <DIR> d--h----- C:\DOCUME~1\Arek\InstallAnywhere 2007-09-30 19:49 <DIR> d-------- C:\Program Files\Sports Interactive 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia 2007-09-22 15:21 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\DataLayer 2007-09-22 15:15 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Nokia Multimedia Player 2007-09-22 15:13 <DIR> d-------- C:\DOCUME~1\Arek\Phone Browser 2007-09-22 15:10 <DIR> d-------- C:\Program Files\DIFX 2007-09-22 15:09 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-09-22 15:09 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-22 15:09 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-09-22 15:09 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-09-22 15:09 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\PC Suite 2007-09-22 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-09-22 15:08 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 15:08 <DIR> d-------- C:\Program Files\Nokia 2007-09-22 15:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-09-13 01:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-09-13 01:37 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-13 01:37 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 01:37 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-10-10 19:42 1114 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa4bf344-a72e-11db-b121-806d6172696f}] Shell\AutoRun\command F:\autorun.exe ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-11 21:32:19 Windows 5.1.2600 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-10-11 21:32:24 C:\ComboFix2.txt ... 07-10-11 20:41 C:\ComboFix3.txt ... 07-10-11 19:26 C:\ComboFix-quarantined-files.txt ... 07-10-11 21:32

**Posty:** 18165 · przez **wojtas** 11 Paź 2007, 21:38

no juz jest czysto

Autor postu otrzymał pochwałę

proszę o sprawdzenie loga

Kto jest na forum