proszę o sprawdzenie

**Posty:** 180 · przez **VaDeMeCuM** 23 Gru 2007, 22:24

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:22:40, on 2007-12-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\system32\wpabaln.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\$aFa$eK\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 3357 bytes

Internet zaczął nieźle mulić.... i właśnie zastanawiam się przypadkiem czy to nie przez jakiegoś szkodnika :| i to na same święta

Mam Neo 512 i to już nawet przy ściąganiu z Polskich servisów leci tylko 4 kb/s

Kod: Zaznacz wszystko: ComboFix 07-12-21.4 - $aFa$eK 2007-12-23 21:36:37.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.647 [GMT 1:00] Running from: C:\Documents and Settings\$aFa$eK\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\comet C:\Program Files\comet\MCC_Install.exe . ((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 ))))))))))))))))))))))))))))))) . 2007-12-23 21:01 . 2007-12-23 21:00 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-12-23 21:01 . 2007-12-23 21:01 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-23 21:00 . 2007-12-23 21:00 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-12-23 21:00 . 2007-12-23 21:00 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-12-23 20:54 . 2007-12-23 20:54 27 --a------ C:\WINDOWS\ms2_eJay.inf 2007-12-23 20:53 . 2007-12-23 20:53 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-12-23 20:47 . 2007-12-23 20:47 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire 2007-12-23 20:32 . 2007-12-23 20:32 <DIR> d-------- C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2007-12-23 20:31 . 2007-12-23 20:47 <DIR> d-------- C:\Program Files\Xfire 2007-12-23 20:31 . 2007-12-23 21:36 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Xfire 2007-12-23 20:30 . 2007-12-23 20:30 280 --a------ C:\WINDOWS\game.ini 2007-12-23 20:25 . 2007-12-23 20:25 <DIR> d-------- C:\Program Files\Activision 2007-12-22 22:36 . 2007-12-22 22:36 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2007-12-22 21:24 . 2007-12-22 21:24 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-12-22 21:12 . 2007-12-22 21:12 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Gadu-Gadu 2007-12-22 20:51 . 2007-12-23 19:21 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\skypePM 2007-12-22 20:51 . 2007-12-22 20:51 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-22 20:50 . 2007-12-22 20:50 <DIR> d-------- C:\Program Files\Skype 2007-12-22 20:50 . 2007-12-22 20:50 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-12-22 20:50 . 2007-12-23 20:54 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Skype 2007-12-22 20:49 . 2007-12-22 20:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-22 18:06 . 2007-12-22 18:06 1,167 --a------ C:\WINDOWS\mozver.dat 2007-12-22 17:56 . 2007-12-22 17:57 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\teamspeak2 2007-12-22 17:55 . 2007-12-22 17:56 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 2007-12-22 17:55 . 2007-12-22 17:55 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2007-12-22 17:51 . 2007-12-22 17:51 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Mozilla 2007-12-22 17:51 . 2007-12-22 17:51 0 --a------ C:\WINDOWS\nsreg.dat 2007-12-22 17:34 . 2007-12-22 17:34 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-12-22 17:34 . 2007-12-22 19:20 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Gadu-Gadu 2007-12-22 17:30 . 2007-12-22 17:30 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Macromedia 2007-12-21 14:13 . 2007-12-21 14:13 <DIR> d-------- C:\Program Files\Phenomic 2007-12-21 14:13 . 2007-12-21 14:13 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\InstallShield 2007-12-20 19:13 . 2007-12-20 19:13 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-12-19 17:32 . 2007-12-19 17:32 <DIR> d-------- C:\eJay 2007-12-19 17:32 . 2000-05-01 23:02 97,280 --a------ C:\WINDOWS\system32\ccrpbds5.dll 2007-12-16 20:12 . 2007-12-20 17:24 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-12-16 20:02 . 2007-12-16 20:02 <DIR> d-------- C:\Program Files\THQ 2007-12-16 19:19 . 2007-12-23 20:56 <DIR> d-------- C:\Program Files\Encyklopedia Gier 2005 2007-12-15 21:15 . 2007-12-15 21:15 11,412,356 --a------ C:\WINDOWS\GizmoZone Screensaver.dat1 2007-12-15 21:15 . 2007-12-15 21:15 3,670,016 --a------ C:\WINDOWS\GizmoZone Screensaver.dat0 2007-12-15 21:15 . 2000-09-12 11:30 104,960 --a------ C:\WINDOWS\GizmoZone Screensaver.scr 2007-12-15 21:14 . 2004-06-10 09:11 1,771,008 --a------ C:\WINDOWS\livtyler.scr 2007-12-15 21:01 . 2001-10-09 21:25 4,358,144 -ra------ C:\WINDOWS\uncsetup.exe 2007-12-15 21:01 . 2007-12-15 21:01 53,248 --a------ C:\WINDOWS\system32\unrar.dll 2007-12-15 18:15 . 2007-12-15 18:15 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\WinRAR 2007-12-15 18:15 . 2007-12-19 19:16 69 --a------ C:\WINDOWS\NeroDigital.ini 2007-12-15 18:08 . 2007-12-15 18:08 <DIR> d-------- C:\Program Files\EA Sports 2007-12-15 18:08 . 2007-12-22 22:15 <DIR> dr------- C:\Muzyka 2007-12-15 18:07 . 2007-12-15 18:07 3,932,214 --a------ C:\WINDOWS\Xbox360-Full.bmp 2007-12-15 18:05 . 2007-12-15 18:05 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-12-15 18:04 . 2007-12-15 18:04 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-15 18:00 . 2007-12-15 18:00 3,932,214 --a------ C:\WINDOWS\Xbox360-wall.bmp 2007-12-15 17:59 . 2003-02-26 21:27 36,864 --a------ C:\WINDOWS\system32\wbsys.dll 2007-12-15 17:40 . 2007-12-15 17:40 <DIR> d-------- C:\Program Files\Common Files\Nero 2007-12-15 17:39 . 2007-12-15 17:39 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-12-15 17:39 . 2007-12-15 17:39 <DIR> d-------- C:\Program Files\Ahead 2007-12-15 17:39 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-12-15 17:39 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-12-15 17:39 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-12-15 17:39 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-12-15 17:39 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-12-15 17:39 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-12-15 17:39 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-12-14 20:06 . 2007-12-14 20:06 <DIR> d-------- C:\Program Files\A4Tech 2007-12-14 20:06 . 2007-12-14 20:06 169 --a------ C:\WINDOWS\RtlRack.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-23 20:36 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Xfire 2007-12-23 19:54 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Skype 2007-12-23 19:53 1,572,864 ---ha-w C:\Documents and Settings\$aFa$eK\NTUSER.DAT 2007-12-23 18:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-23 18:21 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\skypePM 2007-12-22 20:12 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Gadu-Gadu 2007-12-22 17:06 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Adobe 2007-12-22 16:57 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\teamspeak2 2007-12-22 16:51 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Mozilla 2007-12-22 16:34 --------- d-s---w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Microsoft 2007-12-22 16:30 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Macromedia 2007-12-21 13:13 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\InstallShield 2007-12-15 19:33 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-15 17:15 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\WinRAR 2007-12-14 17:24 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-14 17:04 --------- d-----w C:\Program Files\AMD 2007-12-14 16:47 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\InterTrust 2007-12-14 16:43 --------- d-----w C:\Program Files\Realtek Sound Manager 2007-12-14 16:43 --------- d-----w C:\Program Files\AvRack 2007-12-14 16:41 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Identities 2007-12-14 16:38 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-14 16:37 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 15:23] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2005-10-10 14:49 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 08:08] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00] C:\Documents and Settings\$aFa$eK\Menu Start\Programy\Autostart\ Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-12-05 03:25:00] R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;C:\WINDOWS\system32\Drivers\ousbehci.sys [2005-01-15 07:39] R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2005-01-15 07:39] S3 jbridgep;jbridgep;C:\DOCUME~1\$aFa$eK\USTAWI~1\Temp\jbridgep.sys [2004-08-14 13:07] *Newly Created Service* - CATCHME *Newly Created Service* - PNKBSTRA *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-23 21:37:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-23 21:37:42

**Posty:** 18165 · przez **wojtas** 23 Gru 2007, 22:58

Otworz notatnik i wklej w nim to:

File::
C:\DOCUME~1\$aFa$eK\USTAWI~1\Temp\jbridgep.sys

Driver::
jbridgep

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 180 · przez **VaDeMeCuM** 24 Gru 2007, 00:38

Kod: Zaznacz wszystko: ComboFix 07-12-21.4 - $aFa$eK 2007-12-23 23:35:06.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.593 [GMT 1:00] Running from: C:\Documents and Settings\$aFa$eK\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\$aFa$eK\Pulpit\CFScript.txt * Created a new restore point FILE C:\DOCUME~1\$aFa$eK\USTAWI~1\Temp\jbridgep.sys . ((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 ))))))))))))))))))))))))))))))) . 2007-12-23 21:01 . 2007-12-23 23:16 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-12-23 21:01 . 2007-12-23 23:16 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-23 21:00 . 2007-12-23 21:00 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-12-23 21:00 . 2007-12-23 21:00 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-12-23 20:54 . 2007-12-23 20:54 27 --a------ C:\WINDOWS\ms2_eJay.inf 2007-12-23 20:53 . 2007-12-23 20:53 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-12-23 20:47 . 2007-12-23 20:47 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Xfire 2007-12-23 20:32 . 2007-12-23 20:32 <DIR> d-------- C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2007-12-23 20:31 . 2007-12-23 20:47 <DIR> d-------- C:\Program Files\Xfire 2007-12-23 20:31 . 2007-12-23 23:07 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Xfire 2007-12-23 20:30 . 2007-12-23 20:30 280 --a------ C:\WINDOWS\game.ini 2007-12-23 20:25 . 2007-12-23 20:25 <DIR> d-------- C:\Program Files\Activision 2007-12-22 22:36 . 2007-12-22 22:36 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2007-12-22 21:24 . 2007-12-22 21:24 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-12-22 21:12 . 2007-12-22 21:12 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Gadu-Gadu 2007-12-22 20:51 . 2007-12-23 19:21 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\skypePM 2007-12-22 20:51 . 2007-12-22 20:51 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-22 20:50 . 2007-12-22 20:50 <DIR> d-------- C:\Program Files\Skype 2007-12-22 20:50 . 2007-12-22 20:50 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-12-22 20:50 . 2007-12-23 23:37 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Skype 2007-12-22 20:49 . 2007-12-22 20:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-22 18:06 . 2007-12-22 18:06 1,167 --a------ C:\WINDOWS\mozver.dat 2007-12-22 17:56 . 2007-12-22 17:57 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\teamspeak2 2007-12-22 17:55 . 2007-12-22 17:56 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 2007-12-22 17:55 . 2007-12-22 17:55 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2007-12-22 17:51 . 2007-12-22 17:51 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Mozilla 2007-12-22 17:51 . 2007-12-22 17:51 0 --a------ C:\WINDOWS\nsreg.dat 2007-12-22 17:34 . 2007-12-22 17:34 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-12-22 17:34 . 2007-12-22 19:20 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Gadu-Gadu 2007-12-22 17:30 . 2007-12-22 17:30 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\Macromedia 2007-12-21 14:13 . 2007-12-21 14:13 <DIR> d-------- C:\Program Files\Phenomic 2007-12-21 14:13 . 2007-12-21 14:13 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\InstallShield 2007-12-20 19:13 . 2007-12-20 19:13 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-12-19 17:32 . 2007-12-19 17:32 <DIR> d-------- C:\eJay 2007-12-19 17:32 . 2000-05-01 23:02 97,280 --a------ C:\WINDOWS\system32\ccrpbds5.dll 2007-12-16 20:12 . 2007-12-20 17:24 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-12-16 20:02 . 2007-12-16 20:02 <DIR> d-------- C:\Program Files\THQ 2007-12-16 19:19 . 2007-12-23 20:56 <DIR> d-------- C:\Program Files\Encyklopedia Gier 2005 2007-12-15 21:15 . 2007-12-15 21:15 11,412,356 --a------ C:\WINDOWS\GizmoZone Screensaver.dat1 2007-12-15 21:15 . 2007-12-15 21:15 3,670,016 --a------ C:\WINDOWS\GizmoZone Screensaver.dat0 2007-12-15 21:15 . 2000-09-12 11:30 104,960 --a------ C:\WINDOWS\GizmoZone Screensaver.scr 2007-12-15 21:14 . 2004-06-10 09:11 1,771,008 --a------ C:\WINDOWS\livtyler.scr 2007-12-15 21:01 . 2001-10-09 21:25 4,358,144 -ra------ C:\WINDOWS\uncsetup.exe 2007-12-15 21:01 . 2007-12-15 21:01 53,248 --a------ C:\WINDOWS\system32\unrar.dll 2007-12-15 18:15 . 2007-12-15 18:15 <DIR> d-------- C:\Documents and Settings\$aFa$eK\Dane aplikacji\WinRAR 2007-12-15 18:15 . 2007-12-19 19:16 69 --a------ C:\WINDOWS\NeroDigital.ini 2007-12-15 18:08 . 2007-12-15 18:08 <DIR> d-------- C:\Program Files\EA Sports 2007-12-15 18:08 . 2007-12-22 22:15 <DIR> dr------- C:\Muzyka 2007-12-15 18:07 . 2007-12-15 18:07 3,932,214 --a------ C:\WINDOWS\Xbox360-Full.bmp 2007-12-15 18:05 . 2007-12-15 18:05 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-12-15 18:04 . 2007-12-15 18:04 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-15 18:00 . 2007-12-15 18:00 3,932,214 --a------ C:\WINDOWS\Xbox360-wall.bmp 2007-12-15 17:59 . 2003-02-26 21:27 36,864 --a------ C:\WINDOWS\system32\wbsys.dll 2007-12-15 17:40 . 2007-12-15 17:40 <DIR> d-------- C:\Program Files\Common Files\Nero 2007-12-15 17:39 . 2007-12-15 17:39 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-12-15 17:39 . 2007-12-15 17:39 <DIR> d-------- C:\Program Files\Ahead 2007-12-15 17:39 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-12-15 17:39 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-12-15 17:39 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-12-15 17:39 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-12-15 17:39 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-12-15 17:39 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-12-15 17:39 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-12-14 20:06 . 2007-12-14 20:06 <DIR> d-------- C:\Program Files\A4Tech 2007-12-14 20:06 . 2007-12-14 20:06 169 --a------ C:\WINDOWS\RtlRack.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-23 22:37 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Skype 2007-12-23 22:35 1,572,864 ---ha-w C:\Documents and Settings\$aFa$eK\NTUSER.DAT 2007-12-23 22:07 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Xfire 2007-12-23 18:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-23 18:21 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\skypePM 2007-12-22 20:12 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Gadu-Gadu 2007-12-22 17:06 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Adobe 2007-12-22 16:57 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\teamspeak2 2007-12-22 16:51 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Mozilla 2007-12-22 16:34 --------- d-s---w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Microsoft 2007-12-22 16:30 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Macromedia 2007-12-21 13:13 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\InstallShield 2007-12-15 19:33 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-15 17:15 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\WinRAR 2007-12-14 17:24 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-14 17:04 --------- d-----w C:\Program Files\AMD 2007-12-14 16:47 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\InterTrust 2007-12-14 16:43 --------- d-----w C:\Program Files\Realtek Sound Manager 2007-12-14 16:43 --------- d-----w C:\Program Files\AvRack 2007-12-14 16:41 --------- d-----w C:\Documents and Settings\$aFa$eK\Dane aplikacji\Identities 2007-12-14 16:38 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-14 16:37 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((( snapshot@2007-12-23_21.37.22,75 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE + 2004-08-04 12:00:00 66,560 ----a-w C:\WINDOWS\LastGood.Tmp\system32\cdm.dll + 2004-08-04 12:00:00 431,616 ----a-w C:\WINDOWS\LastGood.Tmp\system32\wuapi.dll + 2004-08-04 12:00:00 112,128 ----a-w C:\WINDOWS\LastGood.Tmp\system32\wuauclt.exe + 2004-08-04 12:00:00 1,134,592 ----a-w C:\WINDOWS\LastGood.Tmp\system32\wuaueng.dll + 2004-08-04 12:00:00 113,664 ----a-w C:\WINDOWS\LastGood.Tmp\system32\wucltui.dll + 2004-08-04 12:00:00 36,864 ----a-w C:\WINDOWS\LastGood.Tmp\system32\wups.dll + 2004-08-04 12:00:00 120,320 ----a-w C:\WINDOWS\LastGood.Tmp\system32\wuweb.dll - 2004-08-04 12:00:00 66,560 ----a-w C:\WINDOWS\system32\cdm.dll + 2007-07-30 18:19:20 92,504 ----a-w C:\WINDOWS\system32\cdm.dll - 2004-08-04 12:00:00 66,560 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll + 2007-07-30 18:19:20 92,504 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll - 2004-08-04 12:00:00 431,616 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll + 2007-07-30 18:19:36 549,720 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll - 2004-08-04 12:00:00 112,128 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe + 2007-07-30 18:19:16 53,080 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe - 2004-08-04 12:00:00 1,134,592 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll + 2007-07-30 18:19:42 1,712,984 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll - 2004-08-04 12:00:00 113,664 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll + 2007-07-30 18:19:32 325,976 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll - 2004-08-04 12:00:00 120,320 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll + 2007-07-30 18:19:28 203,096 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll + 2007-07-30 18:18:40 33,624 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll - 2004-08-04 12:00:00 431,616 ----a-w C:\WINDOWS\system32\wuapi.dll + 2007-07-30 18:19:36 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll - 2004-08-04 12:00:00 112,128 ----a-w C:\WINDOWS\system32\wuauclt.exe + 2007-07-30 18:19:16 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe - 2004-08-04 12:00:00 1,134,592 ----a-w C:\WINDOWS\system32\wuaueng.dll + 2007-07-30 18:19:42 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll - 2004-08-04 12:00:00 113,664 ----a-w C:\WINDOWS\system32\wucltui.dll + 2007-07-30 18:19:32 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll - 2004-08-04 12:00:00 36,864 ----a-w C:\WINDOWS\system32\wups.dll + 2007-07-30 18:18:40 33,624 ----a-w C:\WINDOWS\system32\wups.dll + 2007-07-30 18:19:12 43,352 ----a-w C:\WINDOWS\system32\wups2.dll - 2004-08-04 12:00:00 120,320 ----a-w C:\WINDOWS\system32\wuweb.dll + 2007-07-30 18:19:28 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 15:23] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2005-10-10 14:49 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-04 13:00 C:\WINDOWS\system32\rundll32.exe] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 08:08] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00] C:\Documents and Settings\$aFa$eK\Menu Start\Programy\Autostart\ Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-12-05 03:25:00] R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;C:\WINDOWS\system32\Drivers\ousbehci.sys [2005-01-15 07:39] R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2005-01-15 07:39] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-23 23:37:18 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-23 23:37:47 - machine was rebooted C:\ComboFix2.txt ... 2007-12-23 21:37

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:38:29, on 2007-12-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Xfire\xfire.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\$aFa$eK\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 3498 bytes

**Posty:** 18165 · przez **wojtas** 24 Gru 2007, 13:46

czysto

Autor postu otrzymał pochwałę

proszę o sprawdzenie

proszę o sprawdzenie

Kto jest na forum