Prosze o sprawdzenie tego ciagle mi sie trony otwieraja

[jarosan24]

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:40, on 2009-01-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\Mixer.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINNT\runservice.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\jarosan\Pulpit\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [2cb185ae] rundll32.exe "C:\WINNT\system32\sfdnqlrt.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [ITD7] "C:\Program Files\Steganos Internet Trace Destructor 7\ITD7.exe" -firstboot (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EABE649-734B-46E5-81EB-0B64C488A0F3}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{4EABE649-734B-46E5-81EB-0B64C488A0F3}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{4EABE649-734B-46E5-81EB-0B64C488A0F3}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: addfau.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe

--
End of file - 5543 bytes

[sgsman]

1. Wstaw loga w tagi code.
2. Wstaw loga z ComboFixa.
3. Opisz w temacie swój problem.
4. Czekaj na pomoc

[jarosan24]

Kod: Zaznacz wszystko

ComboFix 09-01-02.01 - jarosan 2009-01-04 13:00:45.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.511.162 [GMT 1:00]
Uruchomiony z: c:\documents and settings\jarosan\Pulpit\ComboFix.exe
U¬yto nastŕpuj¦cych komend :: c:\documents and settings\jarosan\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania

[color=RED][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\system32\addfau.dll
c:\winnt\system32\dkjqinef.dll
c:\winnt\system32\gowtlpgq.ini
c:\winnt\system32\mvigiunv.dll
c:\winnt\system32\piiddhqs.dll
c:\winnt\system32\posnuoki.dll
c:\winnt\system32\qebofnvd.dll
c:\winnt\system32\qgpltwog.dll
c:\winnt\system32\qsixupgw.dll
c:\winnt\system32\sfdnqlrt.dll
c:\winnt\system32\slpjogud.dll
c:\winnt\system32\sqhddiip.ini
c:\winnt\system32\sytdfi.dll
c:\winnt\system32\trlqndfs.ini
c:\winnt\system32\uwmsmu.dll
c:\winnt\system32\vnuigivm.ini
c:\winnt\system32\wjpypk.dll
c:\winnt\system32\xIlVyyxx.ini
c:\winnt\system32\xIlVyyxx.ini2
c:\winnt\system32\xxyyVlIx.dll
c:\winnt\system32\ypwoioco.ini
c:\winnt\system32\zfiwhf.dll

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-12-04 do 2009-01-04  )))))))))))))))))))))))))))))))
.

2009-01-03 20:24 . 2009-01-03 20:24   <DIR>   d--------   c:\winnt\system32\xircom
2009-01-03 20:24 . 2009-01-03 20:24   <DIR>   d--------   c:\program files\microsoft frontpage
2009-01-03 20:11 . 2009-01-03 20:11   578,560   --a--c---   c:\winnt\system32\dllcache\user32.dll
2009-01-03 20:08 . 2009-01-03 20:08   <DIR>   d--------   c:\winnt\ERUNT
2009-01-03 20:07 . 2009-01-04 13:07   <DIR>   d--h-----   c:\documents and settings\Administrator\Ustawienia lokalne
2009-01-03 20:07 . 2008-10-05 18:50   <DIR>   d--------   c:\documents and settings\Administrator\Ulubione
2009-01-03 20:07 . 2008-10-05 16:59   <DIR>   d--------   c:\documents and settings\Administrator\Szablony
2009-01-03 20:07 . 2009-01-03 20:11   <DIR>   d--------   c:\documents and settings\Administrator\Pulpit
2009-01-03 20:07 . 2008-10-05 18:50   <DIR>   d--------   c:\documents and settings\Administrator\Moje dokumenty
2009-01-03 20:07 . 2008-10-05 18:50   <DIR>   dr-------   c:\documents and settings\Administrator\Menu Start
2009-01-03 20:07 . 2008-10-05 18:50   <DIR>   dr-------   c:\documents and settings\Administrator\Dane aplikacji
2009-01-03 20:07 . 2009-01-03 20:07   <DIR>   d--------   c:\documents and settings\Administrator
2009-01-03 19:01 . 2009-01-03 20:54   <DIR>   d--------   C:\SDFix
2009-01-03 18:16 . 2009-01-03 18:16   533   --a------   c:\winnt\eReg.dat
2009-01-03 17:19 . 2009-01-03 17:19   <DIR>   d--------   c:\program files\Steganos Internet Trace Destructor 7
2009-01-01 19:29 . 2009-01-01 19:32   <DIR>   d--------   c:\program files\Km TPR
2009-01-01 12:34 . 2009-01-01 12:34   <DIR>   d--------   c:\program files\Matrix Games
2009-01-01 12:28 . 2009-01-01 12:29   <DIR>   d--------   c:\program files\Spybot - Search & Destroy
2009-01-01 12:28 . 2009-01-01 13:46   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-12-31 20:04 . 2008-12-31 20:04   <DIR>   d--------   c:\program files\Paradox Interactive
2008-12-31 18:06 . 2008-12-31 18:06   122,880   --a------   c:\winnt\lcmmfu.cpl
2008-12-31 18:06 . 2008-12-31 18:06   48,640   --a------   c:\winnt\mmfs.dll
2008-12-31 18:06 . 2008-12-31 18:06   2,560   --a------   c:\winnt\Runservice.exe
2008-12-31 18:06 . 2009-01-04 13:11   1,217   --ahs----   c:\winnt\system32\mmf.sys
2008-12-31 17:33 . 2008-12-31 17:33   <DIR>   d--------   c:\documents and settings\jarosan\Dane aplikacji\Babylon
2008-12-31 17:33 . 2008-12-31 17:33   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Babylon
2008-12-31 17:33 . 2008-12-31 17:33   72,192   --a------   c:\winnt\system32\qoMcDSlK.dll
2008-12-31 16:40 . 2008-12-31 19:17   <DIR>   d--------   c:\program files\Battlefront
2008-12-30 22:19 . 2008-12-30 22:19   <DIR>   d--------   c:\program files\Common Files\Idu
2008-12-30 22:18 . 2008-12-30 22:19   <DIR>   d--------   c:\program files\WarZone
2008-12-30 21:49 . 2008-12-30 22:36   <DIR>   d--------   C:\panzer2
2008-12-28 22:15 . 2008-12-28 22:42   20,480   --a------   C:\player0.rep
2008-12-28 22:15 . 2008-12-28 22:39   8   --a------   C:\player1.rep
2008-12-28 22:13 . 2008-12-28 22:13   <DIR>   d--------   C:\generalsguild
2008-12-25 10:31 . 2008-12-27 23:17   <DIR>   d--------   c:\program files\Metin2_PL
2008-12-20 18:33 . 2002-09-10 14:22   40,960   --a------   c:\winnt\enigma.dll
2008-12-20 18:33 . 2008-12-20 18:33   9   --a------   c:\winnt\system.snk
2008-12-14 20:58 . 2008-12-14 20:58   239   --a------   c:\winnt\RomeTW.ini
2008-12-07 14:03 . 2008-12-31 20:09   <DIR>   d--------   c:\program files\OpenAL
2008-12-07 14:03 . 2008-12-31 20:09   409,600   --a------   c:\winnt\system32\wrap_oal.dll
2008-12-07 14:03 . 2008-12-31 20:09   114,688   --a------   c:\winnt\system32\OpenAL32.dll
2008-12-07 14:00 . 2008-12-07 14:00   <DIR>   d--------   C:\Games

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 19:56   ---------   d-----w   c:\program files\GameSpy Arcade
2009-01-03 18:42   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-01-03 17:08   ---------   d-----w   c:\program files\EA GAMES
2009-01-03 16:41   ---------   d-----w   c:\program files\eMule
2009-01-03 16:41   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\QuickTime
2009-01-01 17:34   ---------   d-----w   c:\documents and settings\jarosan\Dane aplikacji\GanymedeNet
2008-12-25 20:13   ---------   d-----w   c:\program files\PokerStars

Edit by Mike013
Następnym razem wstawiaj logi w tagi [code]

[wojtas]

c:\winnt\system32\qoMcDSlK.dll

ten pogrubiony wywal do kosza i daj całego loga z combofixa



te plik/i :

c:\winnt\enigma.dll

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow