prosze o sprawdzenie loga - zamuła

[Squosh]

Witam. Otóż jak przyszedłem do domu zostałem uruchomiony komputer siosta na nim siedziała. Po wyskakiwały mi jakieś błędy ale je zlekceważyłem i chyba od tamtego momentu komputer straszenie wolno chodzi, internet nie otwiera wszystkich stron (na laptopie one otwierają się).

To to log z Hijacka

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:47:03, on 2008-05-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\PowerS.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Documents and Settings\Włodek\lsass.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Instalki\Bezpieczeństwo\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\Włodek\lsass.exe
O4 - HKLM\..\Run: [f8acd732] rundll32.exe "C:\WINDOWS\system32\rpsjappa.dll",b
O4 - HKLM\..\Run: [BMfb9fe4ae] Rundll32.exe "C:\WINDOWS\system32\mrvhawcm.dll",s
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: TV Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

pzdr. Adam

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

[Squosh]

Oto Logi:

Combofix:

Kod: Zaznacz wszystko

ComboFix 08-05-12.1 - Włodek 2008-05-15 16:04:28.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.182 [GMT 2:00]
Running from: C:\Documents and Settings\Włodek\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active


[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\appajspr.ini
C:\WINDOWS\system32\bJkQBcdd.ini
C:\WINDOWS\system32\bJkQBcdd.ini2
C:\WINDOWS\system32\mcrh.tmp

.
(((((((((((((((((((((((((   Files Created from 2008-04-15 to 2008-05-15  )))))))))))))))))))))))))))))))
.

2008-05-15 15:36 . 2008-05-15 15:36   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-05-15 15:33 . 2008-05-15 16:11   2,298   --a------   C:\WINDOWS\TSCTNDBG.INI
2008-05-14 22:00 . 2008-05-14 22:00   <DIR>   d--------   C:\SDFix
2008-05-14 21:54 .    <DIR>      C:\Documents and Settings\Włodek\.javaws
2008-05-14 20:38 . 2008-05-14 20:38   <DIR>   d--------   C:\Program Files\Common Files\PCSuite
2008-05-14 20:38 . 2008-05-14 20:38   <DIR>   d--------   C:\Program Files\Common Files\Nokia
2008-05-14 20:36 . 2008-05-14 20:36   <DIR>   d--------   C:\Program Files\PC Connectivity Solution
2008-05-14 20:36 . 2007-09-17 15:53   21,632   --a------   C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-14 18:46 . 2008-05-14 18:46   <DIR>   d--------   C:\Program Files\Gadu-Gadu
2008-05-14 13:54 . 2008-05-14 13:54   94,784   --a------   C:\WINDOWS\system32\rpsjappa.dll
2008-05-14 13:52 . 2008-05-15 16:12   109,803   --a------   C:\WINDOWS\BMfb9fe4ae.xml
2008-05-14 13:52 . 2008-05-14 13:52   108,096   --a------   C:\WINDOWS\system32\mrvhawcm.dll
2008-05-13 16:30 . 2008-05-13 16:30   366,592   --a------   C:\WINDOWS\system32\ddcBQkJb.dll
2008-05-13 16:25 . 2008-05-13 16:25   28,672   --a------   C:\WINDOWS\system32\jkkJbcBq.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-14 19:54   ---------   d-----w   C:\Program Files\Java Web Start
2008-05-14 18:38   ---------   d-----w   C:\Program Files\Nokia
2008-05-14 18:32   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-14 16:50   ---------   d-----w   C:\Program Files\Lx_cats
2008-05-12 18:40   ---------   d-----w   C:\Program Files\eMule
2008-05-05 19:20   22,328   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-05 19:19   107,832   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-03-20 14:17   12,464   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2008-03-19 21:35   ---------   d-----w   C:\Program Files\eTeacher 4 Niemiecki
2008-03-17 19:00   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-17 18:52   ---------   d-----w   C:\Program Files\DIFX
2001-11-23 04:08   712,704   ----a-w   C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42F5B308-3354-4CC0-BB28-DCA0F234A8F2}]
2008-05-13 16:30   366592   --a------   C:\WINDOWS\system32\ddcBQkJb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5226692D-0486-4D05-9A0D-42A9D3D36212}]
2008-05-15 16:12   373248   --a------   C:\WINDOWS\system32\nnnmlJaX.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}]
2008-05-13 16:25   28672   --a------   C:\WINDOWS\system32\jkkJbcBq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [ ]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]
"Start WingMan Profiler"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-22 21:05 344064]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-08 20:25 949376]
"PowerS"="C:\WINDOWS\PowerS.exe" [2001-08-03 18:56 159800]
"Cmaudio"="cmicnfg.cpl" []
"LXCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-07-20 15:44 73728]
"lxccmon.exe"="C:\Program Files\Lexmark 3300 Series\lxccmon.exe" [2005-07-21 02:17 192512]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2005-07-12 11:36 299008]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 09:08 196608]
"f8acd732"="C:\WINDOWS\system32\rpsjappa.dll" [2008-05-14 13:54 94784]
"BMfb9fe4ae"="C:\WINDOWS\system32\xkbtyhyn.dll" [2008-05-15 16:14 108544]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-09-05 18:24:18 113664]
Remote Controller.lnk - C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE [2007-12-05 22:13:26 106496]
TV Scheduler.lnk - C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE [2007-12-05 22:13:26 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}"= C:\WINDOWS\system32\jkkJbcBq.dll [2008-05-13 16:25 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkJbcBq]
jkkJbcBq.dll 2008-05-13 16:25 28672 C:\WINDOWS\system32\jkkJbcBq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ      msv1_0 C:\WINDOWS\system32\nnnmlJaX

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"D:\\Gry\\Colin McRae 4.0\\Colin McRae Rally 04\\cmr4.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"D:\\Gry\\Quake III Arena pr. 1.32\\quake3.exe"=
"D:\\Gry\\Quake III Arena pr. 1.31\\quake3.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"D:\\Gry\\Football Manager 2008\\fm.exe"=
"D:\\Gry\\Counter Strike Source\\hl2.exe"=
"D:\\Gry\\Counter Strike Source\\srcds.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 gagp30kx;Filtr rodzajowy AGPv3.0 firmy Microsoft dla platform procesora K8;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2004-08-04 01:07]
R1 Amfilter;A4Tech Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\Amfilter.sys [2006-12-15 17:09]
R1 nod32drv;nod32drv;C:\WINDOWS\system32\drivers\nod32drv.sys [2007-10-08 20:25]
R1 StarOpen;StarOpen;C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 17:05]
R2 BT878;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT878.SYS [2003-03-26 16:48]
R2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [2003-01-16 18:14]
R2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [2003-01-16 18:14]
R2 PnkBstrA;PnkBstrA;C:\WINDOWS\system32\PnkBstrA.exe [2007-10-19 12:45]
R2 StarWindServiceAE;StarWind AE Service;C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 18:57]
R3 cmuda;C-Media WDM Audio Interface;C:\WINDOWS\system32\drivers\cmuda.sys [2003-10-17 05:52]
R3 ServiceLayer;ServiceLayer;"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" [2008-04-07 09:17]
R3 SISNIC;Sterownik karty PCI Fast Ethernet SiS;C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-04 00:31]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys [2002-06-20 19:45]
R3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys [2002-06-20 19:45]
R3 WmHidLo;Logitech WingMan USB Filter Driver;C:\WINDOWS\system32\drivers\WmHidLo.sys [2002-06-20 19:45]
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys [2002-06-20 19:45]
S2 ADILOADER;General Purpose USB Driver (adildr.sys);C:\WINDOWS\system32\Drivers\adildr.sys []
S3 adiusbaw;USB ADSL WAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbaw.sys []
S3 Amusbprt;A4Tech HID-compliant Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2006-12-15 17:09]
S3 NdisIP;Połączenie TV/wideo firmy Microsoft;C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 00:10]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 SLIP;BDA Slip De-Framer;C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 00:10]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 18:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 18:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 18:59]
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [2002-06-20 19:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40d731ee-6479-11dc-b593-4d6564696130}]
\Shell\Auto\command - I:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76429692-5aef-11dc-b574-4d6564696130}]
\Shell\AutoRun\command - I:\xn1i9x.com
\Shell\explore\Command - I:\xn1i9x.com
\Shell\open\Command - I:\xn1i9x.com

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-15 16:11:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\TSCTNDBG.INI 2298 bytes
C:\WINDOWS\system32\XaJlmnnn.ini 347 bytes
C:\WINDOWS\system32\XaJlmnnn.ini2 347 bytes

scan completed successfully
hidden files: 3

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\jkkJbcBq.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\rpsjappa.dll
-> C:\WINDOWS\system32\xkbtyhyn.dll
-> C:\Program Files\Eset\pr_imon.dll
-> C:\WINDOWS\system32\nnnmlJaX.dll
-> ?:\WINDOWS\system32\setupapi.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-05-15 16:15:38 - machine was rebooted
ComboFix-quarantined-files.txt  2008-05-15 14:15:26

Pre-Run: 12,849,213,440 bajtów wolnych
Post-Run: 13,096,923,136 bajt˘w wolnych

190

SDfix:

Kod: Zaznacz wszystko

[b]SDFix: Version 1.182 [/b]
Run by Wˆodek on 2008-05-15 at 15:42

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\Documents and Settings\Wˆodek\lsass.exe  - Deleted
C:\Documents and Settings\Wˆodek\services.exe  - Deleted





Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-15 15:49:54
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:4f,8b,c7,0d,aa,3a,cc,40,2f,d4,4d,43,dc,2b,c8,f1,17,bf,d7,b1,80,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:cc,f1,ec,ce,d4,85,f6,2c,9a,a5,01,83,f2,8a,a9,46,95,f3,be,b6,21,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,78,a0,8a,09,b9,2f,89,c1,70,ba,e1,20,bc,a4,55,cb,5e,..
"khjeh"=hex:79,16,f5,19,4b,06,c2,44,24,6a,93,1b,84,61,00,9e,0f,0c,b8,9d,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ac,46,9b,30,cf,57,db,d8,1d,fd,07,7e,35,ec,b5,f8,b8,28,82,f9,02,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:49,a3,3c,ec,03,ae,05,4a,7f,59,8a,8b,4c,7f,e8,34,f5,8e,fd,73,52,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:4f,8b,c7,0d,aa,3a,cc,40,2f,d4,4d,43,dc,2b,c8,f1,17,bf,d7,b1,80,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:cc,f1,ec,ce,d4,85,f6,2c,9a,a5,01,83,f2,8a,a9,46,95,f3,be,b6,21,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,78,a0,8a,09,b9,2f,89,c1,70,ba,e1,20,bc,a4,55,cb,5e,..
"khjeh"=hex:79,16,f5,19,4b,06,c2,44,24,6a,93,1b,84,61,00,9e,0f,0c,b8,9d,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ac,46,9b,30,cf,57,db,d8,1d,fd,07,7e,35,ec,b5,f8,b8,28,82,f9,02,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:49,a3,3c,ec,03,ae,05,4a,7f,59,8a,8b,4c,7f,e8,34,f5,8e,fd,73,52,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule iONiX Mod"
"D:\\Gry\\Pro Evolution Soccer 6\\PES6.exe"="D:\\Gry\\Pro Evolution Soccer 6\\PES6.exe:*:Enabled:pes6.exe"
"D:\\Gry\\Quake III Arena\\quake3.exe"="D:\\Gry\\Quake III Arena\\quake3.exe:*:Enabled:quake3"
"D:\\Gry\\Colin McRae 4.0\\Colin McRae Rally 04\\cmr4.exe"="D:\\Gry\\Colin McRae 4.0\\Colin McRae Rally 04\\cmr4.exe:*:Enabled:Colin McRae Rally 04 Application"
"C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:Enabled:PPMate"
"C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:Enabled:PPMate"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"D:\\Instalki\\Uľytkowe - komunikatory itd\\uTorrent.exe"="D:\\Instalki\\Uľytkowe - komunikatory itd\\uTorrent.exe:*:Enabled:uTorrent"
"C:\\Documents and Settings\\Wˆodek\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\Wˆodek\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"D:\\Gry\\Quake III Arena pr. 1.32\\quake3.exe"="D:\\Gry\\Quake III Arena pr. 1.32\\quake3.exe:*:Enabled:quake3"
"D:\\Gry\\Quake III Arena 1.32\\quake3.exe"="D:\\Gry\\Quake III Arena 1.32\\quake3.exe:*:Enabled:quake3"
"D:\\Gry\\Quake III Arena pr. 1.31\\quake3.exe"="D:\\Gry\\Quake III Arena pr. 1.31\\quake3.exe:*:Enabled:quake3"
"D:\\Gry\\Quake III Arena pr. 132\\quake3.exe"="D:\\Gry\\Quake III Arena pr. 132\\quake3.exe:*:Enabled:quake3"
"D:\\Gry\\Kopia Quake III Arena pr. 1.31\\quake3.exe"="D:\\Gry\\Kopia Quake III Arena pr. 1.31\\quake3.exe:*:Disabled:quake3"
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"D:\\Gry\\Football Manager 2008\\fm.exe"="D:\\Gry\\Football Manager 2008\\fm.exe:*:Enabled:Football Manager 2008"
"E:\\WAG200G.exe"="E:\\WAG200G.exe:*:Enabled:WAG200G"
"D:\\Gry\\Counter Strike Source\\hl2.exe"="D:\\Gry\\Counter Strike Source\\hl2.exe:*:Enabled:hl2"
"D:\\Gry\\Counter Strike Source\\srcds.exe"="D:\\Gry\\Counter Strike Source\\srcds.exe:*:Enabled:srcds"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu  6 Sep 2007            24 ..SH. --- "C:\WINDOWS\S725D8C5B.tmp"

[b]Finished![/b]

HijackThis:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 16:55:53, on 2008-05-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\PowerS.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Instalki\Bezpieczeństwo\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [f8acd732] rundll32.exe "C:\WINDOWS\system32\fhpytoms.dll",b
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: TV Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe





Dodam, że przy uruchomieniu komputera wyskakuje mi błąd EXPLORER.exe. Brak płyty w stacji dysków.

I zawieszają mi się przeglądarki. IE i Mozilla.
pzdr. Adam

[Okocza]

otwórz notanik i wklej w nim:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\rpsjappa.dll
C:\WINDOWS\BMfb9fe4ae.xml
C:\WINDOWS\system32\nnnmlJaX.dll
C:\WINDOWS\system32\xkbtyhyn.dll
C:\WINDOWS\system32\mrvhawcm.dll
C:\WINDOWS\system32\ddcBQkJb.dll
C:\WINDOWS\system32\jkkJbcBq.dll
C:\WINDOWS\S725D8C5B.tmp

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42F5B308-3354-4CC0-BB28-DCA0F234A8F2}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5226692D-0486-4D05-9A0D-42A9D3D36212}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8691F860-96E4-4FB3-8D35-531C0D1B0AC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"f8acd732"="C:\WINDOWS\system32\rpsjappa.dll"=-
"BMfb9fe4ae"="C:\WINDOWS\system32\xkbtyhyn.dll"=-
[-hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkJbcBq]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40d731ee-6479-11dc-b593-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76429692-5aef-11dc-b574-4d6564696130}]


Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum...

Kod: Zaznacz wszystko

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O4 - HKLM\..\Run: [f8acd732] rundll32.exe "C:\WINDOWS\system32\fhpytoms.dll",b

to usuwasz w hijacku...

Autor postu otrzymał pochwałę

[Squosh]

Okocza po wykonaniu twoich poleceń komputer co się włączy to się wyłącza (mija ok. 20 sekund)...
Nie wiem czy to jest na celu ale raczej wątpie (?).

[Okocza]

nie nie jest na celu.

włóż płytkę od Windowsa - niech się zbootuje. wejdź do konsoli odzyskiwania wpisz:

chkdsk c: /p

[Squosh]

A czy wywołane jest to tym, że nie zrobiłem tego co mówiłeś w trybie awaryjnym?? Może powtórzę całą operacje w awaryjnym??

[Okocza]

Może powtórzę całą operacje w awaryjnym??

wygenerował się log jeśli nie to powtórz w awaryjnym. jeśli nie to tak jak mówiłem

chkdsk c: /p

[Squosh]

Log się chyba nie wygenerował bo nic się nie pokazało a sprawdzić nie mam jak ponieważ komp się wyłącza za szybko. Właśnie go puściłem w awaryjnym zobaczymy co i jak.

[Okocza]

to czekamy az dasz loga z awaryjnego - jak cały czas będzie to samo to

włóż płytkę od Windowsa - niech się zbootuje. wejdź do konsoli odzyskiwania wpisz:

chkdsk c: /p

[Squosh]

No komputerek uruchomił się. Ale wyskoczył jakiś błąd "dumphive.cfexe" << nie wiem co to jest. :p

O to log z Combofixa:

Kod: Zaznacz wszystko

ComboFix 08-05-12.1 - Włodek 2008-05-15 19:53:29.3 - NTFSx86 NETWORK
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.371 [GMT 2:00]
Running from: C:\Documents and Settings\Włodek\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Włodek\Pulpit\CFScript.txt

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\WINDOWS\BMfb9fe4ae.xml
C:\WINDOWS\S725D8C5B.tmp
C:\WINDOWS\system32\ddcBQkJb.dll
C:\WINDOWS\system32\jkkJbcBq.dll
C:\WINDOWS\system32\mrvhawcm.dll
C:\WINDOWS\system32\nnnmlJaX.dll
C:\WINDOWS\system32\rpsjappa.dll
C:\WINDOWS\system32\xkbtyhyn.dll
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\BMfb9fe4ae.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\S725D8C5B.tmp
C:\WINDOWS\system32\bJkQBcdd.ini
C:\WINDOWS\system32\bJkQBcdd.ini2
C:\WINDOWS\system32\ddcBQkJb.dll
C:\WINDOWS\system32\jkkJbcBq.dll
C:\WINDOWS\system32\jpkycpyk.ini
C:\WINDOWS\system32\mrvhawcm.dll
C:\WINDOWS\system32\smotyphf.ini
C:\WINDOWS\system32\xkbtyhyn.dll

.
(((((((((((((((((((((((((   Files Created from 2008-04-15 to 2008-05-15  )))))))))))))))))))))))))))))))
.

2008-05-15 19:32 . 2008-05-15 19:32   359,684   --a------   C:\Documents and Settings\Wcatchme.zip
2008-05-15 17:03 . 2008-05-15 17:03   94,272   --a------   C:\WINDOWS\system32\kypcykpj.dll
2008-05-15 16:55 . 2008-05-15 16:55   108,608   --a------   C:\WINDOWS\system32\okghdexr.dll
2008-05-15 16:26 . 2008-05-15 16:26   108,608   --a------   C:\WINDOWS\system32\csdqtsvp.dll
2008-05-15 16:23 . 2008-05-15 16:23   94,208   ---------   C:\WINDOWS\system32\fhpytoms.dll
2008-05-15 16:15 . 2008-05-15 16:15   <DIR>   d--------   C:\Documents and Settings\Włodek
2008-05-15 16:15 .    <DIR>      C:\Documents and Settings\W-odek\Ustawienia lokalne
2008-05-15 16:15 .    <DIR>      C:\Documents and Settings\W-odek\Ustawienia lokalne
2008-05-15 16:15 . 2008-05-15 16:15   294   ---hs----   C:\WINDOWS\system32\appajspr.ini
2008-05-15 15:36 . 2008-05-15 15:36   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-05-15 15:33 . 2008-05-15 19:56   2,298   --a------   C:\WINDOWS\TSCTNDBG.INI
2008-05-14 22:00 . 2008-05-14 22:00   <DIR>   d--------   C:\SDFix
2008-05-14 21:54 .    <DIR>      C:\Documents and Settings\Włodek\.javaws
2008-05-14 20:38 . 2008-05-14 20:38   <DIR>   d--------   C:\Program Files\Common Files\PCSuite
2008-05-14 20:38 . 2008-05-14 20:38   <DIR>   d--------   C:\Program Files\Common Files\Nokia
2008-05-14 20:36 . 2008-05-14 20:36   <DIR>   d--------   C:\Program Files\PC Connectivity Solution
2008-05-14 20:36 . 2007-09-17 15:53   21,632   --a------   C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-14 18:46 . 2008-05-14 18:46   <DIR>   d--------   C:\Program Files\Gadu-Gadu

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-15 17:00   ---------   d-----w   C:\Program Files\Lx_cats
2008-05-14 19:54   ---------   d-----w   C:\Program Files\Java Web Start
2008-05-14 18:38   ---------   d-----w   C:\Program Files\Nokia
2008-05-14 18:32   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-12 18:40   ---------   d-----w   C:\Program Files\eMule
2008-05-05 19:20   22,328   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-05 19:19   107,832   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-03-20 14:17   12,464   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2008-03-19 21:35   ---------   d-----w   C:\Program Files\eTeacher 4 Niemiecki
2008-03-17 19:00   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-17 18:52   ---------   d-----w   C:\Program Files\DIFX
2001-11-23 04:08   712,704   ----a-w   C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

(((((((((((((((((((((((((((((   snapshot@2008-05-15_16.14.42.82   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-15 14:10:10   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-05-15 17:55:45   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [ ]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]
"Start WingMan Profiler"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53 1079808]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-09-05 18:24:18 113664]
Remote Controller.lnk - C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE [2007-12-05 22:13:26 106496]
TV Scheduler.lnk - C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE [2007-12-05 22:13:26 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"D:\\Gry\\Colin McRae 4.0\\Colin McRae Rally 04\\cmr4.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"D:\\Gry\\Quake III Arena pr. 1.32\\quake3.exe"=
"D:\\Gry\\Quake III Arena pr. 1.31\\quake3.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"D:\\Gry\\Football Manager 2008\\fm.exe"=
"D:\\Gry\\Counter Strike Source\\hl2.exe"=
"D:\\Gry\\Counter Strike Source\\srcds.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=

R2 BT878;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT878.SYS [2003-03-26 16:48]
R2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [2003-01-16 18:14]
R2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [2003-01-16 18:14]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 18:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 18:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 18:59]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-15 19:56:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2008-05-15 19:59:50 - machine was rebooted [Wˆodek]
ComboFix-quarantined-files.txt  2008-05-15 17:59:46
ComboFix2.txt  2008-05-15 14:15:41

Pre-Run: 14,765,383,680 bajtów wolnych
Post-Run: 14,221,475,840 bajt˘w wolnych

153

Jak usuwam wpisy w hijacku to w awaryjnym z wyłączonym przywracaniem? Czy nie trzeba się w to bawić wyłącznie do usuwania wpisów?

[Okocza]

zastosuj smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

--------------------------------------------------

tak trzeba, bo będą powracać.

[Squosh]

fuck znowu nie robiłem tego w awaryjnym i komp się wyłącza.

[Okocza]

w awaryjnym... dodatkowo po wszystkich zabiegach zrób tego chkdsk c: /p

[Squosh]

Zrobiłem to odzyskiwanie. Ale teraz za każdym uruchomieniem wyskakuje mi komunikat że odzyskiwanie zakończyło się pomyślnie ile jeszcze razy??

Komputer już zachowuje się o wiele lepiej. Internet działa tak jak powinienen i nie widze na razie żadnych zwiech. xD
Łapcie po plusiku

[wojtas]

daj jeszcze raz nowy log z hijacka i combofixa

[Okocza]

le jeszcze razy??

nie powinno się już wyświetlać...

[Squosh]

Niestety dalej się wyświetla...

O to log z Combo:

Kod: Zaznacz wszystko

ComboFix 08-05-12.1 - Włodek 2008-05-15 21:14:27.4 - NTFSx86 NETWORK
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.376 [GMT 2:00]
Running from: C:\Documents and Settings\Włodek\Pulpit\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-04-15 to 2008-05-15  )))))))))))))))))))))))))))))))
.

2008-05-15 20:07 . 2008-05-15 20:18   718   --a------   C:\WINDOWS\system32\tmp.reg
2008-05-15 19:32 . 2008-05-15 19:32   359,684   --a------   C:\Documents and Settings\Wcatchme.zip
2008-05-15 17:03 . 2008-05-15 17:03   94,272   --a------   C:\WINDOWS\system32\kypcykpj.dll
2008-05-15 16:55 . 2008-05-15 16:55   108,608   --a------   C:\WINDOWS\system32\okghdexr.dll
2008-05-15 16:26 . 2008-05-15 16:26   108,608   --a------   C:\WINDOWS\system32\csdqtsvp.dll
2008-05-15 16:23 . 2008-05-15 16:23   94,208   ---------   C:\WINDOWS\system32\fhpytoms.dll
2008-05-15 16:15 .    <DIR>      C:\Documents and Settings\W-odek
2008-05-15 16:15 . 2008-05-15 16:15   294   ---hs----   C:\WINDOWS\system32\appajspr.ini
2008-05-15 15:36 . 2008-05-15 15:36   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-05-15 15:33 . 2008-05-15 20:48   2,298   --a------   C:\WINDOWS\TSCTNDBG.INI
2008-05-14 22:00 . 2008-05-14 22:00   <DIR>   d--------   C:\SDFix
2008-05-14 21:54 . 2008-05-14 21:54   <DIR>   d--------   C:\Documents and Settings\Włodek\.javaws
2008-05-14 21:54 . 2008-05-14 21:54   <DIR>   d--------   C:\Documents and Settings\Włodek\.javaws
2008-05-14 20:38 . 2008-05-14 20:38   <DIR>   d--------   C:\Program Files\Common Files\PCSuite
2008-05-14 20:38 . 2008-05-14 20:38   <DIR>   d--------   C:\Program Files\Common Files\Nokia
2008-05-14 20:36 . 2008-05-14 20:36   <DIR>   d--------   C:\Program Files\PC Connectivity Solution
2008-05-14 20:36 . 2007-09-17 15:53   21,632   --a------   C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-14 18:49 . 2008-05-14 18:49   <DIR>   d--------   C:\Documents and Settings\Włodek\Dane aplikacji\Gadu-Gadu
2008-05-14 18:49 . 2008-05-14 18:49   <DIR>   d--------   C:\Documents and Settings\Włodek\Dane aplikacji\Gadu-Gadu
2008-05-14 18:49 . 2008-05-14 18:49   <DIR>   d--------   C:\Documents and Settings\Włodek\Dane aplikacji\Gadu-Gadu
2008-05-14 18:46 . 2008-05-14 18:46   <DIR>   d--------   C:\Program Files\Gadu-Gadu

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-15 17:00   ---------   d-----w   C:\Program Files\Lx_cats
2008-05-14 19:54   ---------   d-----w   C:\Program Files\Java Web Start
2008-05-14 18:38   ---------   d-----w   C:\Program Files\Nokia
2008-05-14 18:32   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-05-12 18:40   ---------   d-----w   C:\Program Files\eMule
2008-05-05 19:20   22,328   ----a-w   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-05 19:19   107,832   ----a-w   C:\WINDOWS\system32\PnkBstrB.exe
2008-05-02 17:36   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\uTorrent
2008-05-02 17:36   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\uTorrent
2008-05-02 17:36   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\uTorrent
2008-03-20 14:17   12,464   ----a-w   C:\WINDOWS\system32\drivers\secdrv.sys
2008-03-19 21:35   ---------   d-----w   C:\Program Files\eTeacher 4 Niemiecki
2008-03-17 19:01   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\Nokia
2008-03-17 19:01   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\Nokia
2008-03-17 19:01   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\Nokia
2008-03-17 19:00   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\PC Suite
2008-03-17 19:00   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\PC Suite
2008-03-17 19:00   ---------   d-----w   C:\Documents and Settings\Włodek\Dane aplikacji\PC Suite
2008-03-17 19:00   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-17 18:52   ---------   d-----w   C:\Program Files\DIFX
2001-11-23 04:08   712,704   ----a-w   C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

(((((((((((((((((((((((((((((   snapshot@2008-05-15_16.14.42.82   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-15 14:10:10   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
+ 2008-05-15 19:09:16   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [ ]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]
"Start WingMan Profiler"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-04 00:44 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-09-05 18:24:18 113664]
Remote Controller.lnk - C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE [2007-12-05 22:13:26 106496]
TV Scheduler.lnk - C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE [2007-12-05 22:13:26 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:55 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-04-16 12:53 1079808 C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"D:\\Gry\\Colin McRae 4.0\\Colin McRae Rally 04\\cmr4.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"D:\\Gry\\Quake III Arena pr. 1.32\\quake3.exe"=
"D:\\Gry\\Quake III Arena pr. 1.31\\quake3.exe"=
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"D:\\Gry\\Football Manager 2008\\fm.exe"=
"D:\\Gry\\Counter Strike Source\\hl2.exe"=
"D:\\Gry\\Counter Strike Source\\srcds.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=

S2 BT878;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT878.SYS [2003-03-26 16:48]
S2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [2003-01-16 18:14]
S2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [2003-01-16 18:14]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 18:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 18:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 18:59]

*Newly Created Service* - BTTUNER
*Newly Created Service* - BTXBAR
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-15 21:15:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-15 21:17:13
ComboFix-quarantined-files.txt  2008-05-15 19:16:51
ComboFix2.txt  2008-05-15 17:59:52
ComboFix3.txt  2008-05-15 14:15:41

Pre-Run: 14,755,815,424 bajtów wolnych
Post-Run: 14,746,677,248 bajtów wolnych

125

A o to log z hijacka (scan robiony na normalnym trybie, myślę że nie robi to różnicy)

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:22:51, on 2008-05-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Instalki\Bezpieczeństwo\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: TV Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe



Dodam, że nie skanowałem jeszcze systemu trzema AV podanymi przez okocze.

edit: A dlaczego nie uruchamia mi się antyvirus (nod32) podczas startu komputera?

pzdr. Adam

[Magik]

A dlaczego nie uruchamia mi się antyvirus (nod32) podczas startu komputera?

Analizujac log z Hijack'a, nie ma go w kluzcach run czyli wogole w autostarcie......Sprawdz w opcjach softu or go przeinstaluj

Z poziomu HJT usuwasz jedynie

Kod: Zaznacz wszystko

   R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\tmp.reg
C:\Documents and Settings\Wcatchme.zip
C:\WINDOWS\system32\kypcykpj.dll
C:\WINDOWS\system32\okghdexr.dll
C:\WINDOWS\system32\csdqtsvp.dll
C:\WINDOWS\system32\fhpytoms.dll
C:\WINDOWS\system32\appajspr.ini

Folder::
C:\Program Files\AskTBar

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Start WingMan Profiler"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum