proszę o sprawdzenie loga

**Posty:** 210 · przez **Komandor Brudne Gacie** 15 Paź 2007, 20:58

Witajcie.Od pewnego czasu w folderach w historią mam jakieś zdjęcia pornograficzne, wykryłem tam 2 wirusy
Log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:57:39, on 2007-10-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\program files\zte corporation\zxdsl852\CnxDslTb.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Rodzina\Pulpit\Gry i foty\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [CnxDslTaskBar] "c:\program files\zte corporation\zxdsl852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852" O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Kalendarz XP] "D:\Program Files\Kalendarz XP\Kalendarz.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [sXe Injected] C:\Program Files\sXe Injected\sXe Injected.exe O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UpdateService\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\StrongGG.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: ScreenHunter 4.0 Free.lnk = C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe O8 - Extra context menu item: Pobierz &Wszystko używając Mass Downloader'a - C:\Program Files\Mass Downloader\Add_All.htm O8 - Extra context menu item: Pobierz używając &Mass Downloader'a - C:\Program Files\Mass Downloader\Add_Url.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Mass Downloader - {0FD01980-CCCB-11D3-80D4-0000E80E2EDE} - C:\Program Files\Mass Downloader\massdown.exe O9 - Extra 'Tools' menuitem: &Mass Downloader - {0FD01980-CCCB-11D3-80D4-0000E80E2EDE} - C:\Program Files\Mass Downloader\massdown.exe O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6B88F40A-A07A-4048-8843-4D30009EDC13}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: IEAgentSvc - Unknown owner - C:\Documents and Settings\Rodzina\Pulpit\KaBOOM\IEAgentSvc.exe (file missing) O23 - Service: ipfw_helper (ipfw) - Unknown owner - C:\Program Files\MCS Studios\MCS Firewall 6\system\ipfw.exe (file missing) -- End of file - 8180 bytes

**Posty:** 18165 · przez **wojtas** 15 Paź 2007, 21:22

daj loga z combofixa

Komandor Brudne Gacie napisał(a):w historią mam jakieś zdjęcia pornograficzne, wykryłem tam 2 wirusy

jak wykryles ?? jakie wirusy ? daj wiecej info

**Posty:** 210 · przez **Komandor Brudne Gacie** 15 Paź 2007, 21:36

No avastem przeskanowałem :wink:

jakieś trojany były wypisane (niestety nie pamiętam jakie) log:
[code:cenzura!]ComboFix 07-10-12.4 - Rodzina 2007-10-15 21:25:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.188 [GMT 2:00]
Running from: C:\Documents and Settings\Rodzina\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]2530DFC
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]2531147
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]253887B.bin
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]2540462.bin
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]2540DD8.bin
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm

.
((((((((((((((((((((((((( Files Created from 2007-09-15 to 2007-10-15 )))))))))))))))))))))))))))))))
.

2007-10-15 21:24 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-15 18:19 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\vlc
2007-10-15 18:16 <DIR> d-------- C:\Program Files\VideoLAN
2007-10-12 15:02 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Nero
2007-10-12 15:01 3,036,456 --a------ C:\WINDOWS\system32\BCGCBPRO860u80.dll
2007-10-12 15:01 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2007-10-12 15:01 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2007-10-12 15:01 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2007-10-12 15:01 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2007-10-12 15:01 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2007-10-12 15:01 33,576 --a------ C:\WINDOWS\system32\BCGPOleAcc.dll
2007-10-10 17:44 <DIR> d-------- C:\Program Files\rFactor
2007-10-10 16:31 <DIR> d-------- C:\Program Files\Team17
2007-10-09 18:40 <DIR> d-------- C:\Program Files\Folder Marker
2007-10-08 19:53 <DIR> d-------- C:\Program Files\PAN Vision
2007-10-06 19:51 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\Corel
2007-10-06 10:22 <DIR> d-------- C:\Program Files\Gotham Games
2007-10-05 16:17 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Corel
2007-10-05 16:17 56 -r-hs---- C:\WINDOWS\system32\549F1AD54E.sys
2007-10-05 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2007-10-05 16:15 <DIR> d-------- C:\Program Files\Common Files\Corel
2007-10-05 16:12 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-10-05 16:10 <DIR> d-------- C:\Program Files\Corel
2007-10-05 15:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet
2007-10-05 14:58 <DIR> d-------- C:\Program Files\Bonjour
2007-10-01 17:39 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\AdobeUM
2007-09-30 16:03 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\DivX
2007-09-19 08:12 <DIR> d-------- C:\Program Files\Grupa IMAGE
2007-09-18 09:10 <DIR> d-------- C:\Program Files\Pivot Stickfigure Animator
2007-09-16 12:59 <DIR> d-------- C:\Program Files\Sega Sonic Riders
2007-09-15 14:29 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\DivX
2007-09-15 14:28 <DIR> d-------- C:\Program Files\DivX
2007-09-15 14:10 <DIR> d-------- C:\Program Files\MarBit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-15 17:13 --------- d-----w C:\Program Files\Neostrada TP
2007-10-14 15:08 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-12 19:43 --------- d-----w C:\Program Files\sXe Injected
2007-10-12 16:41 --------- d-----w C:\Program Files\Counter-Strike 1.6
2007-10-12 13:02 --------- d-----w C:\Program Files\Nero
2007-10-12 12:55 --------- d-----w C:\Program Files\Common Files\Ahead
2007-10-12 12:54 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Ahead
2007-10-11 15:17 --------- d-----w C:\Program Files\IsoBuster
2007-10-10 14:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-10 14:27 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Azureus
2007-10-06 17:51 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\Azureus
2007-10-06 16:53 --------- d-----w C:\Program Files\Azureus
2007-10-05 14:15 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-05 13:00 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-05 12:48 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2007-09-21 15:19 --------- d-----w C:\Program Files\Halflife Logo Creator
2007-09-14 15:49 --------- d-----w C:\Program Files\AMD
2007-09-12 09:59 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\GanymedeNet
2007-09-10 15:33 --------- d-----w C:\Program Files\SubEdit-Player
2007-09-09 14:07 --------- d-----w C:\Program Files\Rockstar Games
2007-09-09 13:58 --------- d-----w C:\Program Files\MagicISO
2007-09-07 13:45 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\MegauploadToolbar
2007-09-04 08:33 --------- d-----w C:\Program Files\City Interactive
2007-09-02 17:19 --------- d-----w C:\Program Files\Trabi Racer
2007-09-02 17:11 --------- d-----w C:\Program Files\Mad Tracks
2007-08-31 18:03 --------- d-----w C:\Program Files\Quake 4
2007-08-31 16:03 --------- d-----w C:\Program Files\Lavalys
2007-08-30 15:18 --------- d-----w C:\Program Files\TaXi 3 eXtreme rush
2007-08-26 07:34 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2007-08-25 17:22 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\Ahead
2007-08-25 12:05 --------- d-----w C:\Program Files\Wisdom-soft ScreenHunter
2007-08-23 18:58 --------- d-----w C:\Program Files\BearShare
2007-08-23 10:28 --------- d-----w C:\Program Files\CDex_151
2007-08-23 10:28 --------- d-----w C:\Program Files\CDex_150
2007-08-18 11:59 --------- d-----w C:\Program Files\MegauploadToolbar
2007-08-18 08:59 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-08-18 08:59 249,856 ------w C:\WINDOWS\Setup1.exe
2007-08-18 08:59 --------- d-----w C:\Program Files\HLTooLz
2007-08-17 17:14 --------- d-----w C:\Program Files\DIFX
2007-08-15 17:35 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Hamachi
2007-08-15 16:44 --------- d-----w C:\Program Files\Winamp
2007-08-15 09:02 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\XnView
2007-08-08 09:11 587,725 ----a-w C:\WINDOWS\bad_kitty.exe
2007-08-08 09:11 40,960 ----a-w C:\WINDOWS\bad_kitty.dll
2007-08-08 09:11 231,328 ----a-w C:\WINDOWS\bad_kitty.scr
2007-07-31 11:04 737,280 ----a-w C:\WINDOWS\iun6002.exe
2006-02-06 07:53:55 8 --sha-r C:\WINDOWS\neoqaz2.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 06:42 C:\WINDOWS\soundman.exe]
"CnxDslTaskBar"="c:\program files\zte corporation\zxdsl852\CnxDslTb.exe" [2005-07-21 20:52]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2005-07-21 08:33]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2005-07-21 08:33]
"Kalendarz XP"="D:\Program Files\Kalendarz XP\Kalendarz.exe" [2007-05-06 17:41]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 14:23]
"PCPerf"="" []
"avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2006-05-31 12:02]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UpdateService\ISUSPM.exe" [2004-06-16 06:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" []
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 22:29]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide3"=cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

C:\Documents and Settings\Rodzina\Menu Start\Programy\Autostart\
ScreenHunter 4.0 Free.lnk - C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe [2007-08-25 14:05:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"=0 (0x0)
"NoStrCmpLogical"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"=0 (0x0)
"NoStrCmpLogical"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCS Firewall 6]
C:\Program Files\MCS Studios\MCS Firewall 6\mcsfw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sXe Injected]
C:\Program Files\sXe Injected\sXe Injected.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

R1 papycpu2;papycpu2;C:\WINDOWS\system32\drivers\papycpu2.sys
R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys
R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys
R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys
S2 IEAgentSvc;IEAgentSvc;C:\Documents and Settings\Rodzina\Pulpit\KaBOOM\IEAgentSvc.exe
S2 ipfw;ipfw_helper;C:\Program Files\MCS Studios\MCS Firewall 6\system\ipfw.exe
S3 ip_fw;ipfw kernel-mode driver;\??\C:\Program

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService WebClient LmHosts RemoteRegistry upnphost SSDPSRV

.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 22:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 07:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 08:00:00 C:\WINDOWS\Tasks\At11.job"
"2007-10-14 09:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 10:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 11:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 12:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 13:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 14:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 15:00:00 C:\WINDOWS\Tasks\At18.job"
"2007-10-15 16:00:01 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-14 23:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 17:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 18:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 19:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-12 20:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-25 21:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-07-21 00:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-06-30 21:59:06 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-06-30 21:59:06 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-06-30 21:59:06 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-08-02 04:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-18 05:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 06:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-14 23:00:00 C:\WINDOWS\Tasks\Rodzina backup.job"
- C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe
"2007-07-20 23:20:00 C:\WINDOWS\Tasks\Rodzina scan and fix.job"
- C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-15 21:31:46
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-15 21:32:52 - machine was rebooted
.
--- E O F ---
[/code:cenzura!]

**Posty:** 18165 · przez **wojtas** 15 Paź 2007, 21:46

w panelu sterowania> zaplanowe zadania> skasuj te zadania:

Contents of the 'Scheduled Tasks' folder
"2007-09-24 22:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 07:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 08:00:00 C:\WINDOWS\Tasks\At11.job"
"2007-10-14 09:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 10:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 11:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 12:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 13:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 14:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 15:00:00 C:\WINDOWS\Tasks\At18.job"
"2007-10-15 16:00:01 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-14 23:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 17:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 18:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-15 19:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-12 20:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-25 21:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-07-21 00:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-06-30 21:59:06 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-06-30 21:59:06 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-06-30 21:59:06 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-08-02 04:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-09-18 05:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\V3w75MJ3.exe
"2007-10-14 06:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\V3w75MJ3.exe

przeskanuj ten plik:

C:\WINDOWS\system32\549F1AD54E.sys
C:\WINDOWS\bad_kitty.exe
C:\WINDOWS\neoqaz2.dll

tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

(zeby je zobaczyc musisz :przejdz do opcji: Narzedzia>>Widok>>Pokaz ukryte pliki lub foldery oraz Ukryj chronione pliki systemu operacyjnego)

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje
Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt oraz wyniki skanu oraz nowy log z combo

**Posty:** 210 · przez **Komandor Brudne Gacie** 16 Paź 2007, 11:19

Zrobiłem wsztstko.
Log z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 07-10-12.4 - Rodzina 2007-10-16 11:11:44.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.112 [GMT 2:00] Running from: C:\Documents and Settings\Rodzina\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-16 to 2007-10-16 ))))))))))))))))))))))))))))))) . 2007-10-15 23:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Eset 2007-10-15 23:13 <DIR> d-------- C:\WINDOWS\system32\xircom 2007-10-15 23:13 <DIR> d-------- C:\Program Files\microsoft frontpage 2007-10-15 23:02 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-15 21:24 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-15 18:19 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\vlc 2007-10-15 18:16 <DIR> d-------- C:\Program Files\VideoLAN 2007-10-12 15:02 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Nero 2007-10-12 15:01 3,036,456 --a------ C:\WINDOWS\system32\BCGCBPRO860u80.dll 2007-10-12 15:01 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2007-10-12 15:01 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2007-10-12 15:01 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2007-10-12 15:01 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2007-10-12 15:01 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2007-10-12 15:01 33,576 --a------ C:\WINDOWS\system32\BCGPOleAcc.dll 2007-10-10 17:44 <DIR> d-------- C:\Program Files\rFactor 2007-10-10 16:31 <DIR> d-------- C:\Program Files\Team17 2007-10-09 18:40 <DIR> d-------- C:\Program Files\Folder Marker 2007-10-08 19:53 <DIR> d-------- C:\Program Files\PAN Vision 2007-10-06 19:51 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\Corel 2007-10-06 10:22 <DIR> d-------- C:\Program Files\Gotham Games 2007-10-05 16:17 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Corel 2007-10-05 16:17 56 -r-hs---- C:\WINDOWS\system32\549F1AD54E.sys 2007-10-05 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2007-10-05 16:15 <DIR> d-------- C:\Program Files\Common Files\Corel 2007-10-05 16:12 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-10-05 16:10 <DIR> d-------- C:\Program Files\Corel 2007-10-05 15:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2007-10-05 14:58 <DIR> d-------- C:\Program Files\Bonjour 2007-10-01 17:39 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\AdobeUM 2007-09-30 16:03 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\DivX 2007-09-19 08:12 <DIR> d-------- C:\Program Files\Grupa IMAGE 2007-09-18 09:10 <DIR> d-------- C:\Program Files\Pivot Stickfigure Animator 2007-09-16 12:59 <DIR> d-------- C:\Program Files\Sega Sonic Riders . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-16 09:15 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Azureus 2007-10-16 09:02 --------- d-----w C:\Program Files\Neostrada TP 2007-10-16 08:59 --------- d-----w C:\Program Files\PowerISO 2007-10-14 15:08 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-12 19:43 --------- d-----w C:\Program Files\sXe Injected 2007-10-12 16:41 --------- d-----w C:\Program Files\Counter-Strike 1.6 2007-10-12 13:02 --------- d-----w C:\Program Files\Nero 2007-10-12 12:55 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-12 12:54 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Ahead 2007-10-11 15:17 --------- d-----w C:\Program Files\IsoBuster 2007-10-10 14:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-06 17:51 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\Azureus 2007-10-06 16:53 --------- d-----w C:\Program Files\Azureus 2007-10-05 14:15 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-05 13:00 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-05 12:48 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2007-09-30 14:05 --------- d-----w C:\Program Files\DivX 2007-09-21 15:19 --------- d-----w C:\Program Files\Halflife Logo Creator 2007-09-15 12:29 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\DivX 2007-09-15 12:10 --------- d-----w C:\Program Files\MarBit 2007-09-14 15:49 --------- d-----w C:\Program Files\AMD 2007-09-12 09:59 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\GanymedeNet 2007-09-10 15:33 --------- d-----w C:\Program Files\SubEdit-Player 2007-09-09 14:07 --------- d-----w C:\Program Files\Rockstar Games 2007-09-09 13:58 --------- d-----w C:\Program Files\MagicISO 2007-09-07 13:45 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\MegauploadToolbar 2007-09-04 08:33 --------- d-----w C:\Program Files\City Interactive 2007-09-02 17:19 --------- d-----w C:\Program Files\Trabi Racer 2007-09-02 17:11 --------- d-----w C:\Program Files\Mad Tracks 2007-08-31 18:03 --------- d-----w C:\Program Files\Quake 4 2007-08-31 16:03 --------- d-----w C:\Program Files\Lavalys 2007-08-30 15:18 --------- d-----w C:\Program Files\TaXi 3 eXtreme rush 2007-08-26 07:34 --------- d-----w C:\Program Files\TrackMania Nations ESWC 2007-08-25 17:22 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\Ahead 2007-08-25 12:05 --------- d-----w C:\Program Files\Wisdom-soft ScreenHunter 2007-08-23 18:58 --------- d-----w C:\Program Files\BearShare 2007-08-23 10:28 --------- d-----w C:\Program Files\CDex_151 2007-08-23 10:28 --------- d-----w C:\Program Files\CDex_150 2007-08-23 10:10 28,168 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys 2007-08-23 10:08 33,288 ----a-w C:\WINDOWS\system32\drivers\eamon.sys 2007-08-23 10:08 25,096 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys 2007-08-18 11:59 --------- d-----w C:\Program Files\MegauploadToolbar 2007-08-18 08:59 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-08-18 08:59 249,856 ------w C:\WINDOWS\Setup1.exe 2007-08-18 08:59 --------- d-----w C:\Program Files\HLTooLz 2007-08-17 17:14 --------- d-----w C:\Program Files\DIFX 2007-08-08 10:13 77,824 ----a-w C:\WINDOWS\system32\IESHWIZ.EXE 2007-08-08 09:11 587,725 ----a-w C:\WINDOWS\bad_kitty.exe 2007-08-08 09:11 40,960 ----a-w C:\WINDOWS\bad_kitty.dll 2007-08-08 09:11 231,328 ----a-w C:\WINDOWS\bad_kitty.scr 2007-07-31 11:04 737,280 ----a-w C:\WINDOWS\iun6002.exe 2006-02-06 07:53:55 8 --sha-r C:\WINDOWS\neoqaz2.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-15_21.32.16.93 ))))))))))))))))))))))))))))))))))))))))) . + 2007-10-15 17:33:08 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-10-15 21:03:40 708,608 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-15 21:03:40 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-15 17:33:08 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-10-15 21:03:14 708,608 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-15 21:03:15 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-15 21:20:22 22,862 ----a-r C:\WINDOWS\Installer\{45D2F05C-576F-4CE1-87D1-CA8373768505}\controlPanelIcon.exe + 2007-10-15 21:20:22 10,134 ----a-r C:\WINDOWS\Installer\{45D2F05C-576F-4CE1-87D1-CA8373768505}\SystemFolder_msiexec.exe - 2007-10-15 13:04:41 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temp\Perflib_Perfdata_5f8.dat + 2007-10-15 21:13:11 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temp\Perflib_Perfdata_5f8.dat + 2007-07-11 23:22:00 135,168 ----a-w C:\WINDOWS\system32\java.exe + 2007-07-11 23:22:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2007-07-12 00:22:38 139,264 ----a-w C:\WINDOWS\system32\javaws.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 06:42 C:\WINDOWS\soundman.exe] "CnxDslTaskBar"="c:\program files\zte corporation\zxdsl852\CnxDslTb.exe" [2005-07-21 20:52] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2005-07-21 08:33] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2005-07-21 08:33] "Kalendarz XP"="D:\Program Files\Kalendarz XP\Kalendarz.exe" [2007-05-06 17:41] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [] "PCPerf"="" [] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UpdateService\ISUSPM.exe" [2004-06-16 06:03] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "egui"="C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" [2007-08-23 12:09] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 22:29] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide3"=cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N C:\Documents and Settings\Rodzina\Menu Start\Programy\Autostart\ ScreenHunter 4.0 Free.lnk - C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe [2007-08-25 14:05:24] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "RunStartupScriptSync"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoChangeAnimation"=0 (0x0) "NoStrCmpLogical"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"=0 (0x0) "NoStrCmpLogical"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCS Firewall 6] C:\Program Files\MCS Studios\MCS Firewall 6\mcsfw.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sXe Injected] C:\Program Files\sXe Injected\sXe Injected.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe R1 easdrv;easdrv;C:\WINDOWS\system32\DRIVERS\easdrv.sys R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys R1 papycpu2;papycpu2;C:\WINDOWS\system32\drivers\papycpu2.sys R2 eamon;EAMON;C:\WINDOWS\system32\DRIVERS\eamon.sys R2 ekrn;Eset Service;"C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe" R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys S2 IEAgentSvc;IEAgentSvc;C:\Documents and Settings\Rodzina\Pulpit\KaBOOM\IEAgentSvc.exe S2 ipfw;ipfw_helper;C:\Program Files\MCS Studios\MCS Firewall 6\system\ipfw.exe S3 EhttpSrv;Eset HTTP server;"C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe" S3 ip_fw;ipfw kernel-mode driver;\??\C:\Program [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService WebClient LmHosts RemoteRegistry upnphost SSDPSRV . Contents of the 'Scheduled Tasks' folder "2007-09-14 23:00:00 C:\WINDOWS\Tasks\Rodzina backup.job" - C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe "2007-07-20 23:20:00 C:\WINDOWS\Tasks\Rodzina scan and fix.job" - C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-16 11:15:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-10-16 11:16:56 C:\ComboFix2.txt ... 2007-10-15 21:32 . --- E O F ---

Log z SDFixa:

Kod: Zaznacz wszystko: SDFix: Version 1.109 Run by Administrator on 2007-10-15 at 23:04 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS : 8 Total size: 8 bytes. WINDOWS: Odmowa dostępu. Checking for remaining Streams C:\WINDOWS : 8 Total size: 8 bytes. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "E:\\Super Gry\\Elasto Mania\\Belma 2 bez leveli\\belma.exe"="E:\\Super Gry\\Elasto Mania\\Belma 2 bez leveli\\belma.exe:*:Enabled:belma" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Mon 6 Feb 2006 8 A.SHR --- "C:\WINDOWS\neoqaz2.dll" Fri 5 Oct 2007 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Sat 19 May 2007 4,348 A..H. --- "C:\Documents and Settings\Bracia\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Sat 19 May 2007 20 A..H. --- "C:\Documents and Settings\Bracia\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Sat 19 May 2007 9,656 A.SH. --- "C:\Documents and Settings\Bracia\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" Finished!

**Posty:** 18165 · przez **wojtas** 16 Paź 2007, 19:23

przeskanuj ten plik:

C:\WINDOWS\system32\549F1AD54E.sys
C:\WINDOWS\bad_kitty.exe
C:\WINDOWS\neoqaz2.dll

tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

a gdzie sa raporty ?

**Posty:** 210 · przez **Komandor Brudne Gacie** 16 Paź 2007, 19:28

Przeskanowałem je już no i nic nie wykryło

**Posty:** 18165 · przez **wojtas** 16 Paź 2007, 19:33

nio to w logu powinno byc ok

**Posty:** 210 · przez **Komandor Brudne Gacie** 16 Paź 2007, 19:41

No to dzieki.Mam nadzieje że juz bedzie okey

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum