proszę o sprawdzenie (svchost.exe)

[konrad7890]

Witam. Już trochę siedzę na forum i czasami poprzeglądałem parę logów i zaniepokoiło mnie w moim jedno. Otóż czy plik svchost.exe nie powinien mieć takiej lokalizacji: C:\WINDOWS\System32\svchost.exe. W moim logu co prawda 2 te procesy mają taka lokalizację ale jeden ma : C:\WINDOWS\system\svchost.exe. Czy po prostu usunąć ten wpis? Bardzo proszę o rady. Oto log:

Logfile of HijackThis v1.99.1
Scan saved at 13:30:29, on 2007-06-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Konnekt\konnekt.exe
E:\USD\USDownloader.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
E:\Programy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - C:\Program Files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://arcaonline.arcabit.com
O15 - Trusted Zone: www.arcaonline.arcabit.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{92979242-BB56-482D-AB5C-1068A4F523B1}: NameServer = 217.8.168.244 157.25.5.18
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HDDlife HDD Access service - BinarySense, Ltd. - C:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Service Host Controller (r_server) - Unknown owner - C:\WINDOWS\system\svchost.exe" /service (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

[Red]

usunac:

C:\WINDOWS\system\svchost.exe

O23 - Service: Service Host Controller (r_server) - Unknown owner - C:\WINDOWS\system\svchost.exe" /service (file missing)

[konrad7890]

Nie da rady normalnie tego usunąć. Wpis dalej powraca. Usunąć w trybie awaryjnym czy jakimś innym narzędziem??

[Red]

w awaryjnym,mozesz też usunac narzędziem:

http://www.bleepingcomputer.com/files/killbox.php

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete+all files wklej ścieżkę :
C:\WINDOWS\system\svchost.exe i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)


wykonaj jeszcze to:

Start >>> Uruchom >>> cmd i wklep komendę:


sc delete r_server

[konrad7890]

w awaryjnym,mozesz też usunac narzędziem:

http://www.bleepingcomputer.com/files/killbox.php

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete+all files wklej ścieżkę :
C:\WINDOWS\system\svchost.exe i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

Gdy daje X to wyskakuje takie coś:

wykonaj jeszcze to:

Start >>> Uruchom >>> cmd i wklep komendę:


sc delete r_server

Tutaj OK.

Proszę o rady.

[wojtas]

daj loga z hijacka oraz z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[konrad7890]

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 16:17:03, on 2007-06-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Konnekt\konnekt.exe
E:\Programy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - C:\Program Files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://arcaonline.arcabit.com
O15 - Trusted Zone: www.arcaonline.arcabit.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{92979242-BB56-482D-AB5C-1068A4F523B1}: NameServer = 217.8.168.244 157.25.5.18
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HDDlife HDD Access service - BinarySense, Ltd. - C:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

ComboFix

ComboFix 07-06-11.3 - BˆĄd CScript: Dost©p do Hosta skrypt˘w systemu Windows jest wyˆĄczony na tym komputerze. Skontaktuj si© z administratorem, aby uzyska† szczeg˘ˆowe informacje.
"Konrad" - 2007-06-11 16:18:09 - Dodatek Service Pack 2 NTFS


((((((((((((((((((((((((( Files Created from 2007-05-11 to 2007-06-11 )))))))))))))))))))))))))))))))


2007-06-11 15:43 <DIR> d-------- C:\!KillBox
2007-06-11 13:22 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-08 19:45 <DIR> d-------- C:\WINDOWS\Free Internet TV 2007
2007-06-08 19:45 <DIR> d-------- C:\Program Files\Free Internet TV 2007
2007-06-07 23:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Lavasoft
2007-06-06 22:23 <DIR> d-------- C:\Program Files\SkanerOnline
2007-06-06 22:22 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-03 17:29 <DIR> d-------- C:\Program Files\CyberLink
2007-06-03 17:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\CyberLink
2007-06-03 14:52 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-06-03 14:52 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-06-03 14:52 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-06-03 14:52 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-06-03 14:52 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-06-03 14:52 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-06-03 14:52 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-06-03 14:52 <DIR> d-------- C:\Program Files\Alwil Software
2007-06-02 16:01 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Lavasoft
2007-06-02 15:58 <DIR> d-------- C:\Program Files\Lavasoft
2007-05-31 18:39 <DIR> d-------- C:\FPC
2007-05-31 18:13 <DIR> d-------- C:\Dev-Pas
2007-05-31 09:27 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-05-30 20:30 <DIR> d-------- C:\WINDOWS\system32\oodag
2007-05-30 20:27 <DIR> d-------- C:\Program Files\OO Software
2007-05-29 17:26 <DIR> d-------- C:\Program Files\PowerQuest
2007-05-25 18:12 796,672 --a------ C:\WINDOWS\GPInstall.exe
2007-05-25 18:12 12,800 --a------ C:\WINDOWS\ioctrl.dll
2007-05-25 18:12 <DIR> d-------- C:\Program Files\FERRO Software
2007-05-21 20:07 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-05-21 20:05 <DIR> d-------- C:\WINDOWS\pss
2007-05-21 15:19 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\TVU Networks
2007-05-21 15:18 <DIR> d-------- C:\Program Files\TVUPlayer
2007-05-21 15:18 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\PPLive
2007-05-21 15:17 <DIR> d-------- C:\Program Files\PPLive
2007-05-21 15:17 <DIR> d-------- C:\Program Files\Common Files\Synacast
2007-05-21 15:14 <DIR> d-------- C:\Program Files\PPStream
2007-05-21 15:13 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\ppStream
2007-05-19 18:03 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2007-05-19 16:37 81,920 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-05-19 16:37 233,472 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-05-19 14:11 <DIR> d-------- C:\DOCUME~1\Kasia\DANEAP~1\uTorrent
2007-05-17 19:35 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\InstallShield
2007-05-16 20:18 <DIR> d-------- C:\Program Files\KeywordsAnalyzer5
2007-05-16 18:53 <DIR> d-------- C:\Program Files\Yahoo!
2007-05-15 17:10 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-05-15 17:09 86,016 --a------ C:\WINDOWS\unvise32.exe
2007-05-15 16:51 <DIR> d-------- C:\Program Files\Binboy
2007-05-12 23:27 <DIR> d-------- C:\Program Files\New Star Soccer 3
2007-05-12 15:17 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2007-05-12 15:17 <DIR> d-------- C:\Program Files\Common Files\Merge Modules
2007-05-12 15:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help
2007-05-11 19:11 <DIR> d-------- C:\Program Files\IconTweaker
2007-05-11 19:11 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\IconTweaker
2007-05-11 19:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\IconTweaker
2007-05-11 19:09 <DIR> d-------- C:\Program Files\Folderico
2007-05-11 18:21 <DIR> d-------- C:\Program Files\TGTSoft
2007-05-11 02:09 1,050,120 --a------ C:\WINDOWS\system32\oodag.exe
2007-05-11 02:08 2,512,392 --a------ C:\WINDOWS\system32\oodtray.exe
2007-05-11 02:08 194,056 --a------ C:\WINDOWS\system32\oodbs.exe
2007-05-11 02:06 202,248 --a------ C:\WINDOWS\system32\oodtrrs.dll
2007-05-11 02:06 15,880 --a------ C:\WINDOWS\system32\oodagrs.dll
2007-05-11 02:06 15,880 --a------ C:\WINDOWS\system32\oodagmg.dll
2007-05-11 02:06 10,248 --a------ C:\WINDOWS\system32\oodbsrs.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-11 13:42:28 -------- d-----w C:\Program Files\AutoConnect
2007-06-10 12:57:01 -------- d-----w C:\Program Files\FlashGet
2007-06-09 19:09:11 -------- d-----w C:\Program Files\TVAnts
2007-06-08 08:47:28 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\uTorrent
2007-06-08 08:16:03 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-07 21:55:49 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-02 18:59:08 79,408 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-06-02 18:59:08 458,022 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-05-25 15:27:02 -------- d-----w C:\Program Files\Motherboard Monitor 5
2007-05-25 15:25:57 -------- d-----w C:\Program Files\jv16 PowerTools 2006
2007-05-22 06:44:50 -------- d-----w C:\Program Files\GlobalSCAPE
2007-05-22 06:43:38 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\GlobalSCAPE
2007-05-21 18:00:45 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-05-21 13:18:33 360,576 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2007-05-14 12:15:09 -------- d-----w C:\Program Files\Winamp
2007-05-10 21:19:26 38,160 ----a-w C:\WINDOWS\system32\drivers\oobctm.sys
2007-05-10 21:18:24 15,368 ----a-w C:\WINDOWS\system32\ootmapi.dll
2007-05-10 20:30:55 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\vlc
2007-05-10 20:28:01 -------- d-----w C:\Program Files\VideoLAN
2007-05-08 19:59:25 155,648 ----a-w C:\WINDOWS\system32\libssl32.dll
2007-05-08 16:33:04 -------- d-----w C:\Program Files\PhotoFiltre
2007-05-08 15:53:06 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\BinarySense
2007-05-08 15:47:13 -------- d-----w C:\Program Files\BinarySense
2007-05-08 15:41:23 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\HDD Thermometer
2007-05-08 15:40:59 -------- d-----w C:\Program Files\FreshDevices
2007-05-08 15:40:47 -------- d-----w C:\Program Files\AIDA32 - Personal System Information
2007-05-07 20:00:17 -------- d-----w C:\Program Files\IncrediMail
2007-05-07 16:23:19 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\Talkback
2007-05-07 16:08:16 1,411 ----a-w C:\WINDOWS\mozver.dat
2007-05-07 16:02:18 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\Flock
2007-05-07 16:02:02 -------- d-----w C:\Program Files\Flock
2007-05-07 16:02:00 -------- d-----w C:\Program Files\Opera
2007-05-07 16:01:17 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\WebSpeedReader
2007-05-07 16:00:18 -------- d-----w C:\Program Files\WebSpeedReader
2007-05-07 15:59:55 249,856 ------w C:\WINDOWS\Setup1.exe
2007-05-07 15:59:53 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-05-07 14:05:37 -------- d-----w C:\Program Files\JitBit
2007-05-07 14:03:13 -------- d-----w C:\Program Files\ABBYY FineReader 8.0 Professional Edition
2007-05-06 19:44:23 -------- d-----w C:\Program Files\eMule
2007-05-06 14:56:11 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\SopCast
2007-05-04 11:12:00 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\Ahead
2007-05-02 12:27:07 -------- d-----w C:\Program Files\Total Video Converter
2007-05-01 22:26:38 -------- d-----w C:\Program Files\Gadu-Gadu
2007-05-01 19:37:52 -------- d-----w C:\Program Files\foobar2000
2007-05-01 15:41:21 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-04-30 10:09:43 0 ----a-w C:\ren
2007-04-30 09:41:02 -------- d-----w C:\Program Files\TuneUp Utilities 2007
2007-04-30 09:40:01 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\TuneUp Software
2007-04-30 09:33:13 5 --sha-w C:\WINDOWS\system32\deeccddbbc_s.dll
2007-04-28 22:06:14 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-04-28 22:06:14 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-04-28 22:06:14 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-04-28 16:38:36 91 ----a-w C:\sysrun23.dll
2007-04-27 11:13:11 -------- d-----w C:\Program Files\Kwyshell
2007-04-26 18:14:47 -------- d-----w C:\Program Files\BitComet
2007-04-26 15:38:32 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\Opera
2007-04-26 14:56:54 -------- d-----w C:\Program Files\PITy
2007-04-24 17:49:28 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\Real
2007-04-23 12:03:42 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-04-22 20:31:40 -------- d-----w C:\Program Files\SopCast
2007-04-21 16:12:56 -------- d-----w C:\Program Files\Alcohol Soft
2007-04-21 11:43:39 -------- d-----w C:\Program Files\Common Files\Ahead
2007-04-21 11:40:16 -------- d-----w C:\Program Files\Nero
2007-04-21 09:44:24 -------- d-----w C:\Program Files\Sony Ericsson
2007-04-20 13:13:31 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\FlashGet
2007-04-19 21:02:19 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\ABBYY
2007-04-19 20:08:40 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-04-19 19:57:12 -------- d-----w C:\Program Files\epson
2007-04-19 16:12:39 -------- d-----w C:\Program Files\Microsoft.NET
2007-04-19 15:15:08 -------- d-----w C:\Program Files\Lavalys
2007-04-18 20:33:55 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\Media Player Classic
2007-04-18 18:57:15 -------- d-----w C:\Program Files\uTorrent
2007-04-18 18:37:28 -------- d-----w C:\Program Files\ATITool
2007-04-18 18:00:51 -------- d-----w C:\Program Files\Common Files\ODBC
2007-04-18 18:00:47 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-04-18 17:29:24 -------- d-----w C:\Program Files\Foxit Software
2007-04-18 16:56:40 -------- d-----w C:\Program Files\D-Tools
2007-04-18 16:47:40 -------- d-----w C:\Program Files\K-Lite Codec Pack
2007-04-18 16:44:56 0 ----a-w C:\WINDOWS\nsreg.dat
2007-04-18 16:41:46 -------- d-----w C:\Program Files\MarBit
2007-04-18 16:28:07 -------- d-----w C:\DOCUME~1\Konrad\DANEAP~1\ATI
2007-04-18 16:24:57 -------- d-----w C:\Program Files\Thomson
2007-04-18 16:24:31 -------- d-----w C:\Program Files\Kaspersky Lab
2007-04-18 16:23:34 -------- d-----w C:\Program Files\Konnekt
2007-04-18 16:22:07 -------- d-----w C:\Program Files\ATI Technologies
2007-04-18 16:12:14 0 --sha-r C:\MSDOS.SYS
2007-04-18 16:12:14 0 --sha-r C:\IO.SYS
2007-04-18 16:12:14 0 ----a-w C:\CONFIG.SYS
2007-04-18 16:12:14 0 ----a-w C:\AUTOEXEC.BAT
2007-04-18 16:10:07 -------- d--h--w C:\Program Files\WindowsUpdate
2007-04-18 16:10:02 -------- d-----w C:\Program Files\Usługi online
2007-04-18 16:08:58 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-04-18 16:08:48 -------- d-----w C:\Program Files\Movie Maker
2007-04-18 16:07:26 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-04-18 16:06:54 -------- d-----w C:\Program Files\Messenger
2007-04-18 16:06:49 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-04-18 16:06:36 -------- d-----w C:\Program Files\Windows NT
2007-04-13 13:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-04-05 15:19:36 6,221,824 ----a-w C:\WINDOWS\system32\ImageMagickObject.dll
2007-03-15 10:00:36 466,432 ----a-w C:\WINDOWS\system32\SkanerOnline.dll
2005-06-21 09:45:24 90,112 --sha-r C:\WINDOWS\system\admdll.dll
2005-06-21 09:45:28 29,408 --sha-r C:\WINDOWS\system\raddrv.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=C:\Program Files\FlashGet\jccatch.dll [2007-04-13 10:34]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{C333CF63-767F-4831-94AC-E683D962C63C}=C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll [2006-05-10 01:13]
{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}=C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll [2004-12-03 05:14]
{F156768E-81EF-470C-9057-481BA8380DBA}=C:\Program Files\FlashGet\getflash.dll [2007-04-13 11:34]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"@"="" []
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-08-25 14:25]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-03-23 12:06]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 20:31]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"C:\Program Files\D-Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML]
C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
"OODefragTray"=C:\WINDOWS\system32\oodtray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
UxTuneUp


Contents of the 'Scheduled Tasks' folder
2007-06-08 15:17:04 C:\WINDOWS\tasks\1-Click Maintenance.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-11 16:20:30
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-06-11 16:21:47
C:\ComboFix-quarantined-files.txt ... 2007-06-11 16:21
C:\ComboFix2.txt ... 2007-06-11 13:26

--- E O F ---

[wojtas]

C:\sysrun23.dll

ten plik przeskanuj tutaj i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

[konrad7890]

wklej do notatnika:

Cytat:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=-


w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

To zrobiłem. OK

C:\sysrun23.dll


ten plik przeskanuj tutaj i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

Pierwsza stronka nie śmiga a w drugiej wysłałem ten plik i piszę STATUS: QUEUED czyli mam czekać z otwartą stronką aż mi ocenią ten plik?

[ Dodano: Dzisiaj o 18:15 ]

Complete scanning result of "sysrun23.dll", received in VirusTotal at 06.11.2007, 18:00:03 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.11.1 06.11.2007 no virus found
AntiVir 7.4.0.32 06.11.2007 no virus found
Authentium 4.93.8 06.11.2007 no virus found
Avast 4.7.997.0 06.09.2007 no virus found
AVG 7.5.0.467 06.10.2007 no virus found
BitDefender 7.2 06.11.2007 no virus found
CAT-QuickHeal 9.00 06.11.2007 no virus found
ClamAV devel-20070416 06.11.2007 no virus found
DrWeb 4.33 06.11.2007 no virus found
eSafe 7.0.15.0 06.10.2007 no virus found
eTrust-Vet 30.7.3710 06.11.2007 no virus found
Ewido 4.0 06.11.2007 no virus found
FileAdvisor 1 06.11.2007 no virus found
Fortinet 2.85.0.0 06.11.2007 no virus found
F-Prot 4.3.2.48 06.08.2007 no virus found
F-Secure 6.70.13030.0 06.11.2007 no virus found
Ikarus T3.1.1.8 06.11.2007 no virus found
Kaspersky 4.0.2.24 06.11.2007 no virus found
McAfee 5050 06.11.2007 no virus found
Microsoft 1.2503 06.11.2007 no virus found
NOD32v2 2323 06.11.2007 no virus found
Norman 5.80.02 06.11.2007 no virus found
Panda 9.0.0.4 06.11.2007 no virus found
Prevx1 V2 06.11.2007 no virus found
Sophos 4.18.0 06.01.2007 no virus found
Sunbelt 2.2.907.0 06.09.2007 no virus found
Symantec 10 06.11.2007 no virus found
TheHacker 6.1.6.132 06.11.2007 no virus found
VBA32 3.12.0.1 06.11.2007 no virus found
VirusBuster 4.3.23:9 06.11.2007 no virus found
Webwasher-Gateway 6.0.1 06.11.2007 no virus found

Aditional Information
File size: 91 bytes
MD5: b270d8cec27f0a49783fd64a49d690c6
SHA1: 33a6d138df9fad2d0016ef5cea80b842fe6c77db

[wojtas]

czyli jest ok zostaw plik