prosze o sprawdzenie

[kassiuniaa]

usuwała ostatnio wirusa, przez chwile było ok a teraz znow mi komuter strasznie zwalnia i do tego glosno pracuje:(

Logfile of HijackThis v1.99.1
Scan saved at 19:21:46, on 2007-07-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\activexdebugger32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Documents and Settings\kasia\Pulpit\hijackthis_199(2)\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe activexdebugger32.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: OpenOffice.ux.pl 2.0.4.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.mapa.lodz.pl/VIEWERS/mgaxctrl.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

[wojtas]

znowu ta infekcja co ostatnio:

F2 - REG:system.ini: Shell=Explorer.exe activexdebugger32.exe

skasuj wpis + pogrubiony

[kassiuniaa]

no chyba zrobiłam... log z combofixa wklejam

"kasia" - 2007-07-17 22:42:09 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-17 to 2007-07-17 )))))))))))))))))))))))))))))))


2007-07-14 14:11 19,456 --a------ C:\WINDOWS\system32\KTKBDHK3.DLL
2007-07-13 13:51 52 --a------ C:\WINDOWS\system\ACD2.CMD
2007-07-13 13:51 52 --a------ C:\WINDOWS\system\ACD.CMD
2007-07-13 13:51 20,480 --a------ C:\WINDOWS\system32\PAC.EXE
2007-07-13 13:50 24,626 --a------ C:\WINDOWS\system32\scrrntr.dll
2007-07-13 13:50 180,224 --a------ C:\WINDOWS\system32\Ijl11.dll
2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:20:04 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-15 14:25:52 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 19:24:04 376,832 --sh--w C:\WINDOWS\system32\activexdebugger32.exe
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f


Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-17 22:43:13
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [2096] 0x81D224B0


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-17 22:44:02
C:\ComboFix-quarantined-files.txt ... 2007-07-17 22:44
C:\ComboFix2.txt ... 2007-07-12 18:25
C:\ComboFix3.txt ... 2007-07-12 10:04

--- E O F ---

[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\KTKBDHK3.DLL
C:\WINDOWS\system\ACD2.CMD
C:\WINDOWS\system\ACD.CMD
C:\WINDOWS\system32\PAC.EXE
C:\WINDOWS\system32\scrrntr.dll
C:\WINDOWS\system32\Ijl11.dll
C:\WINDOWS\system32\activexdebugger32.exe

Registry keys to delete:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

[Dzi@dek]

BTW

kassiuniaa
dlaczego nie piszesz w swoim poprzednim topicu

[kassiuniaa]

bo nie wiedziałam ze to znow ten sam wirus... jak zrobie to co napisal wojtas to mam wiec wkleic logi tutaj czy w poprzednim temacie?

[Dzi@dek]

pisz już tutaj.

[kassiuniaa]

Dzieki.

I raport:

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}

i combo

"kasia" - 2007-07-18 12:51:58 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 )))))))))))))))))))))))))))))))


2007-07-14 14:11 19,456 --a------ C:\WINDOWS\system32\KTKBDHK3.DLL
2007-07-13 13:51 52 --a------ C:\WINDOWS\system\ACD2.CMD
2007-07-13 13:51 52 --a------ C:\WINDOWS\system\ACD.CMD
2007-07-13 13:51 20,480 --a------ C:\WINDOWS\system32\PAC.EXE
2007-07-13 13:50 24,626 --a------ C:\WINDOWS\system32\scrrntr.dll
2007-07-13 13:50 180,224 --a------ C:\WINDOWS\system32\Ijl11.dll
2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:20:04 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-15 14:25:52 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 19:24:04 376,832 --sh--w C:\WINDOWS\system32\activexdebugger32.exe
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f

*Newly Created Service* - WFUHKHPR

Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-18 12:53:11
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-18 12:53:49
C:\ComboFix-quarantined-files.txt ... 2007-07-18 12:53

--- E O F ---

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del file C:\WINDOWS\system32\KTKBDHK3.DLL
gmer -del file C:\WINDOWS\system\ACD2.CMD
gmer -del file C:\WINDOWS\system\ACD.CMD
gmer -del file C:\WINDOWS\system32\PAC.EXE
gmer -del file C:\WINDOWS\system32\Ijl11.dll
gmer -del file C:\WINDOWS\system32\scrrntr.dll
gmer -del file C:\WINDOWS\system32\activexdebugger32.exe
gmer –reboot

I kliknij z prawej strony na Uruchom.

start>uruchom>regedit>przejdz do klucza:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\

i skasuj :

{a28b9fe4-9e54-11db-8aa2-0013d3c81659}

[kassiuniaa]

zrobione... loga z combo wklejam

"kasia" - 2007-07-18 13:39:12 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 )))))))))))))))))))))))))))))))


2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:20:04 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-15 14:25:52 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 19:24:04 376,832 --sh--w C:\WINDOWS\system32\activexdebugger32.exe
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]

*Newly Created Service* - WFUHKHPR

Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-18 13:40:02
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-18 13:40:53
C:\ComboFix-quarantined-files.txt ... 2007-07-18 13:40
C:\ComboFix2.txt ... 2007-07-18 12:53

--- E O F ---

[wojtas]

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del file C:\WINDOWS\system32\activexdebugger32.exe
gmer –reboot

I kliknij z prawej strony na Uruchom.

[kassiuniaa]

Polecenie wykonane prawidłowo mi się pokazało...

[wojtas]

daj jeszcze loga z combo

[kassiuniaa]

heh juz:D

"kasia" - 2007-07-18 13:52:50 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 )))))))))))))))))))))))))))))))


2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:20:04 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-15 14:25:52 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 19:24:04 376,832 ----a-w C:\WINDOWS\system32\activexdebugger32.exe
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]

*Newly Created Service* - WFUHKHPR

Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-18 13:53:37
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-18 13:54:44
C:\ComboFix-quarantined-files.txt ... 2007-07-18 13:54
C:\ComboFix2.txt ... 2007-07-18 13:40
C:\ComboFix3.txt ... 2007-07-18 12:53

--- E O F ---

[wojtas]

Uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\WINDOWS\system32\activexdebugger32.exe

jesli to nie pomoze to:

Wklej do notatnika:

CD C:\WINDOWS\System32
ATTRIB -R -S -H activexdebugger32.exe
DEL activexdebugger32.exe

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT i uruchom

[kassiuniaa]

"kasia" - 2007-07-18 16:09:32 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 )))))))))))))))))))))))))))))))


2007-07-18 14:25 52 --a------ C:\WINDOWS\system\ACD2.CMD
2007-07-18 14:25 52 --a------ C:\WINDOWS\system\ACD.CMD
2007-07-18 14:25 24,626 --a------ C:\WINDOWS\system32\scrrntr.dll
2007-07-18 14:25 20,480 --a------ C:\WINDOWS\system32\PAC.EXE
2007-07-18 14:25 180,224 --a------ C:\WINDOWS\system32\Ijl11.dll
2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:20:04 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-15 14:25:52 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f


Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-18 16:10:35
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-18 16:11:10
C:\ComboFix-quarantined-files.txt ... 2007-07-18 16:11
C:\ComboFix2.txt ... 2007-07-18 13:54
C:\ComboFix3.txt ... 2007-07-18 13:40

--- E O F ---

iiiii?

[wojtas]

zaisntaluj jakiegos firewalla:

http://www.programosy.pl/program,kerio-personal-firewall.html

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

jesli nie masz to:

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\WINDOWS\system\ACD2.CMD
C:\WINDOWS\system\ACD.CMD
C:\WINDOWS\system32\scrrntr.dll
C:\WINDOWS\system32\PAC.EXE
C:\WINDOWS\system32\Ijl11.dll

start>uruchom>regedit>przjedz do klucza:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]

skasuj pogrubiony

[kassiuniaa]

"kasia" - 2007-07-19 12:48:13 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19 )))))))))))))))))))))))))))))))


2007-07-19 12:27 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:20:04 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-15 14:25:52 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]

*Newly Created Service* - SPF4

Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-19 12:50:27
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-19 12:51:57
C:\ComboFix-quarantined-files.txt ... 2007-07-19 12:51
C:\ComboFix2.txt ... 2007-07-18 16:11
C:\ComboFix3.txt ... 2007-07-18 13:54

--- E O F ---

...:|

[ Dodano: Dzisiaj o 12:56 ]
log jest chyba czysty...?:)

[ Dodano: Dzisiaj o 13:11 ]
avast mi wykrył Trojan-gen{Other} :|

[wojtas]

tak w logu jest czysto pokaz screena z tego komunikatu

[kassiuniaa]

hmm wklejam screena z okienka kwarantanny avasta