proszęo sprawdzenie ; problem z mp3

[sharp1]

ComboFix 08-06-15.4 - sharp 2008-06-16 15:26:11.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.952 [GMT 2:00]
Running from: E:\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-16 to 2008-06-16 )))))))))))))))))))))))))))))))
.

2008-06-16 15:06 . 2008-06-16 15:06 35,440 --a------ C:\WINDOWS\system32\sschk.trb
2008-06-16 15:05 . 2008-06-16 15:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-16 15:05 . 2008-06-16 15:05 585,296 --a------ C:\WINDOWS\system32\trupd.trb
2008-06-16 15:04 . 2008-06-02 21:22 2,486,848 --a------ C:\WINDOWS\system32\rmt.trb
2008-06-16 15:04 . 2008-05-25 18:06 983,616 --a------ C:\WINDOWS\system32\rmvtrjan.trb
2008-06-16 15:04 . 2008-06-16 15:04 878,672 --a------ C:\WINDOWS\system32\trjscan.trb
2008-06-16 15:03 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-06-16 15:03 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-06-16 15:02 . 2008-06-16 15:03 <DIR> d-------- C:\Program Files\Trojan Remover
2008-06-16 15:02 . 2008-06-16 15:03 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\Simply Super Software
2008-06-15 16:37 . 2008-06-08 16:12 276,992 --a------ C:\WINDOWS\system32\in_mp3.dll
2008-06-15 16:34 . 2006-09-24 20:37 169,472 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-06-15 16:27 . 2008-06-15 16:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 12:55 . 2008-06-15 12:55 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\AdobeUM
2008-06-15 11:57 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-06-15 10:37 . 2008-06-15 10:37 <DIR> d-------- C:\Program Files\Winamp
2008-06-15 10:15 . 2008-06-15 10:15 <DIR> d-------- C:\Program Files\RegCleaner
2008-06-15 09:46 . 1997-11-19 15:49 303,616 --a------ C:\WINDOWS\IsUninst.exe
2008-06-15 09:26 . 2008-06-15 21:17 313 --a------ C:\WINDOWS\LEXSTAT.INI
2008-06-15 09:25 . 2008-06-15 09:25 <DIR> d-------- C:\Documents and Settings\sharp\WINDOWS
2008-06-15 09:25 . 1997-04-18 11:52 298,496 --a------ C:\WINDOWS\unin0415.exe
2008-06-13 20:36 . 2008-06-13 20:36 <DIR> d---s---- C:\Documents and Settings\sharp\UserData
2008-06-13 20:34 . 2008-06-13 20:34 <DIR> d-------- C:\Documents and Settings\sharp\Gadu-Gadu
2008-06-13 20:34 . 2008-06-13 20:34 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\Gadu-Gadu
2008-06-13 20:33 . 2008-06-13 20:33 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-13 20:32 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-06-13 20:32 . 2008-06-13 20:32 421 --a------ C:\WINDOWS\ODBC.INI
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-06-13 20:28 . 2008-06-13 20:28 <DIR> dr--s---- C:\Program Files\MYIE2
2008-06-13 20:28 . 2008-06-13 20:28 <DIR> d-------- C:\Program Files\ESET
2008-06-13 20:21 . 2008-06-13 20:21 <DIR> d-------- C:\Program Files\IrfanView
2008-06-13 20:16 . 2008-06-13 20:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-13 20:10 . 2008-06-13 20:10 98,304 --a------ C:\WINDOWS\system32\qttask.exe
2008-06-13 20:09 . 2003-08-18 05:10 122,880 --a------ C:\WINDOWS\system32\directx.cpl
2008-06-13 20:09 . 2003-03-25 05:49 106,544 --a------ C:\WINDOWS\system32\tweakui.cpl
2008-06-13 20:09 . 2003-03-25 05:49 98,304 --a------ C:\WINDOWS\system32\startup.cpl
2008-06-13 20:09 . 2004-02-17 10:11 53,248 --a------ C:\WINDOWS\system32\vp6dec_settings.cpl
2008-06-13 20:09 . 2003-03-25 05:49 51,238 --a------ C:\WINDOWS\system32\tweakui.hlp
2008-06-13 20:08 . 2008-06-13 20:08 <DIR> d-------- C:\Program Files\ACE Mega CoDecS Pack
2008-06-13 20:07 . 2008-06-13 20:07 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-13 20:01 . 2008-06-13 20:01 <DIR> d--hs---- C:\Recycled
2008-06-13 20:00 . 2008-06-13 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-06-13 20:00 . 2008-06-13 20:00 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-06-13 20:00 . 2008-06-13 20:00 584 --a------ C:\WINDOWS\system32\settings.sfm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 18:28 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-06-13 18:28 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-06-13 18:28 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-06-13 17:54 --------- d-----w C:\Program Files\Creative
2008-06-13 17:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-13 17:50 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-13 17:37 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-13 17:34 --------- d-----w C:\Program Files\Usługi online
.

------- Sigcheck -------

2004-11-23 21:03 359040 a14fafd66adbd55a86f17a37e5ec4263 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51 57344]
"P17Helper"="P17.dll" [2005-05-03 13:38 64512 C:\WINDOWS\system32\P17.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"QuickTime Task"="C:\WINDOWS\system32\qttask.exe" [2008-06-13 20:10 98304]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-13 20:28 949376]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-19 11:39 35328]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-06-16 15:04 878672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iac25_32.ax
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=


*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 15:29:26
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

C:\WINDOWS\EXPLORER.EXE [1220] 0x8882F4E0

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-06-16 15:30:04
ComboFix-quarantined-files.txt 2008-06-16 13:30:00

Pre-Run: 2,047,647,744 bajtów wolnych
Post-Run: 2,051,473,408 bajtów wolnych

127

[Magik]

proszęo sprawdzenie

http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

2 gdzie tagi??

wklej jeszzce raz z HJT i combofix'a
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

[sharp1]

ComboFix 08-06-15.4 - sharp 2008-06-16 15:26:11.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.952 [GMT 2:00]
Running from: E:\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-16 to 2008-06-16 )))))))))))))))))))))))))))))))
.

2008-06-16 15:06 . 2008-06-16 15:06 35,440 --a------ C:\WINDOWS\system32\sschk.trb
2008-06-16 15:05 . 2008-06-16 15:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-16 15:05 . 2008-06-16 15:05 585,296 --a------ C:\WINDOWS\system32\trupd.trb
2008-06-16 15:04 . 2008-06-02 21:22 2,486,848 --a------ C:\WINDOWS\system32\rmt.trb
2008-06-16 15:04 . 2008-05-25 18:06 983,616 --a------ C:\WINDOWS\system32\rmvtrjan.trb
2008-06-16 15:04 . 2008-06-16 15:04 878,672 --a------ C:\WINDOWS\system32\trjscan.trb
2008-06-16 15:03 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-06-16 15:03 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-06-16 15:02 . 2008-06-16 15:03 <DIR> d-------- C:\Program Files\Trojan Remover
2008-06-16 15:02 . 2008-06-16 15:03 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\Simply Super Software
2008-06-15 16:37 . 2008-06-08 16:12 276,992 --a------ C:\WINDOWS\system32\in_mp3.dll
2008-06-15 16:34 . 2006-09-24 20:37 169,472 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-06-15 16:27 . 2008-06-15 16:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 12:55 . 2008-06-15 12:55 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\AdobeUM
2008-06-15 11:57 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-06-15 10:37 . 2008-06-15 10:37 <DIR> d-------- C:\Program Files\Winamp
2008-06-15 10:15 . 2008-06-15 10:15 <DIR> d-------- C:\Program Files\RegCleaner
2008-06-15 09:46 . 1997-11-19 15:49 303,616 --a------ C:\WINDOWS\IsUninst.exe
2008-06-15 09:26 . 2008-06-15 21:17 313 --a------ C:\WINDOWS\LEXSTAT.INI
2008-06-15 09:25 . 2008-06-15 09:25 <DIR> d-------- C:\Documents and Settings\sharp\WINDOWS
2008-06-15 09:25 . 1997-04-18 11:52 298,496 --a------ C:\WINDOWS\unin0415.exe
2008-06-13 20:36 . 2008-06-13 20:36 <DIR> d---s---- C:\Documents and Settings\sharp\UserData
2008-06-13 20:34 . 2008-06-13 20:34 <DIR> d-------- C:\Documents and Settings\sharp\Gadu-Gadu
2008-06-13 20:34 . 2008-06-13 20:34 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\Gadu-Gadu
2008-06-13 20:33 . 2008-06-13 20:33 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-13 20:32 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-06-13 20:32 . 2008-06-13 20:32 421 --a------ C:\WINDOWS\ODBC.INI
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-06-13 20:28 . 2008-06-13 20:28 <DIR> dr--s---- C:\Program Files\MYIE2
2008-06-13 20:28 . 2008-06-13 20:28 <DIR> d-------- C:\Program Files\ESET
2008-06-13 20:21 . 2008-06-13 20:21 <DIR> d-------- C:\Program Files\IrfanView
2008-06-13 20:16 . 2008-06-13 20:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-13 20:10 . 2008-06-13 20:10 98,304 --a------ C:\WINDOWS\system32\qttask.exe
2008-06-13 20:09 . 2003-08-18 05:10 122,880 --a------ C:\WINDOWS\system32\directx.cpl
2008-06-13 20:09 . 2003-03-25 05:49 106,544 --a------ C:\WINDOWS\system32\tweakui.cpl
2008-06-13 20:09 . 2003-03-25 05:49 98,304 --a------ C:\WINDOWS\system32\startup.cpl
2008-06-13 20:09 . 2004-02-17 10:11 53,248 --a------ C:\WINDOWS\system32\vp6dec_settings.cpl
2008-06-13 20:09 . 2003-03-25 05:49 51,238 --a------ C:\WINDOWS\system32\tweakui.hlp
2008-06-13 20:08 . 2008-06-13 20:08 <DIR> d-------- C:\Program Files\ACE Mega CoDecS Pack
2008-06-13 20:07 . 2008-06-13 20:07 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-13 20:01 . 2008-06-13 20:01 <DIR> d--hs---- C:\Recycled
2008-06-13 20:00 . 2008-06-13 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-06-13 20:00 . 2008-06-13 20:00 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-06-13 20:00 . 2008-06-13 20:00 584 --a------ C:\WINDOWS\system32\settings.sfm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 18:28 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-06-13 18:28 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-06-13 18:28 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-06-13 17:54 --------- d-----w C:\Program Files\Creative
2008-06-13 17:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-13 17:50 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-13 17:37 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-13 17:34 --------- d-----w C:\Program Files\Usługi online
.

------- Sigcheck -------

2004-11-23 21:03 359040 a14fafd66adbd55a86f17a37e5ec4263 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51 57344]
"P17Helper"="P17.dll" [2005-05-03 13:38 64512 C:\WINDOWS\system32\P17.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"QuickTime Task"="C:\WINDOWS\system32\qttask.exe" [2008-06-13 20:10 98304]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-13 20:28 949376]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-19 11:39 35328]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-06-16 15:04 878672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iac25_32.ax
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=


*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 15:29:26
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

C:\WINDOWS\EXPLORER.EXE [1220] 0x8882F4E0

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-06-16 15:30:04
ComboFix-quarantined-files.txt 2008-06-16 13:30:00

Pre-Run: 2,047,647,744 bajtów wolnych
Post-Run: 2,051,473,408 bajtów wolnych

127

nie wiem w czym to pomaga lae niech będzie

[wojtas]

logi nie są w tagach... poczytaj

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[sharp1]

a w czym to przeszkadza.. robiłem tak jak pisało ; widocznie coś się pokitrało; 3 raz będe loga wklejał; dajcie spokój;

[Okocza]

nie wiem w czym to pomaga lae niech będzie

bo jest wygodniej sprawdzać, nie razi w oczy tak jak bez tagów.

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[sharp1]

SDFix: Version 1.193
Run by sharp on 2008-06-17 at 13:28

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 14:37:13
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\WINDOWS\\system32\\winver.exe"="C:\\WINDOWS\\system32\\winver.exe:*:Enabled:winver"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :



Files with Hidden Attributes :

Wed 22 Aug 2007 131,584 A..H. --- "C:\Documents and Settings\sharp\Pulpit\pulpit\zdarte z pulpitau\pliki z pulpitu\~WRL1400.tmp"
Sun 14 Oct 2007 2,592,768 A..H. --- "C:\Documents and Settings\sharp\Pulpit\pulpit\zdarte z pulpitau\pliki z pulpitu\zdj©cia\p˘ˆmetek\SIV3A.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:39:51, on 2008-06-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

--
End of file - 3355 bytes

ComboFix 08-06-15.4 - sharp 2008-06-17 14:41:11.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.903 [GMT 2:00]
Running from: E:\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 )))))))))))))))))))))))))))))))
.

2008-06-17 13:25 . 2008-06-17 13:25 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-17 13:21 . 2008-06-16 03:15 <DIR> d-------- C:\SDFix
2008-06-16 18:08 . 2008-06-16 18:09 <DIR> d-------- C:\Program Files\SopCast
2008-06-16 15:06 . 2008-06-16 15:06 35,440 --a------ C:\WINDOWS\system32\sschk.trb
2008-06-16 15:05 . 2008-06-16 15:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-06-16 15:05 . 2008-06-16 15:05 585,296 --a------ C:\WINDOWS\system32\trupd.trb
2008-06-16 15:04 . 2008-06-02 21:22 2,486,848 --a------ C:\WINDOWS\system32\rmt.trb
2008-06-16 15:04 . 2008-05-25 18:06 983,616 --a------ C:\WINDOWS\system32\rmvtrjan.trb
2008-06-16 15:04 . 2008-06-16 15:04 878,672 --a------ C:\WINDOWS\system32\trjscan.trb
2008-06-16 15:03 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-06-16 15:03 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-06-16 15:02 . 2008-06-16 15:03 <DIR> d-------- C:\Program Files\Trojan Remover
2008-06-16 15:02 . 2008-06-16 15:03 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\Simply Super Software
2008-06-15 16:37 . 2008-06-08 16:12 276,992 --a------ C:\WINDOWS\system32\in_mp3.dll
2008-06-15 16:34 . 2006-09-24 20:37 169,472 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-06-15 16:27 . 2008-06-15 16:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-15 12:55 . 2008-06-15 12:55 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\AdobeUM
2008-06-15 11:57 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-06-15 10:37 . 2008-06-15 10:37 <DIR> d-------- C:\Program Files\Winamp
2008-06-15 10:15 . 2008-06-15 10:15 <DIR> d-------- C:\Program Files\RegCleaner
2008-06-15 09:46 . 1997-11-19 15:49 303,616 --a------ C:\WINDOWS\IsUninst.exe
2008-06-15 09:26 . 2008-06-16 15:49 314 --a------ C:\WINDOWS\LEXSTAT.INI
2008-06-15 09:25 . 2008-06-15 09:25 <DIR> d-------- C:\Documents and Settings\sharp\WINDOWS
2008-06-15 09:25 . 1997-04-18 11:52 298,496 --a------ C:\WINDOWS\unin0415.exe
2008-06-13 20:36 . 2008-06-13 20:36 <DIR> d---s---- C:\Documents and Settings\sharp\UserData
2008-06-13 20:34 . 2008-06-13 20:34 <DIR> d-------- C:\Documents and Settings\sharp\Gadu-Gadu
2008-06-13 20:34 . 2008-06-13 20:34 <DIR> d-------- C:\Documents and Settings\sharp\Dane aplikacji\Gadu-Gadu
2008-06-13 20:33 . 2008-06-13 20:33 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-13 20:32 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-06-13 20:32 . 2008-06-13 20:32 421 --a------ C:\WINDOWS\ODBC.INI
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-06-13 20:30 . 2008-06-13 20:30 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-06-13 20:28 . 2008-06-13 20:28 <DIR> dr--s---- C:\Program Files\MYIE2
2008-06-13 20:28 . 2008-06-13 20:28 <DIR> d-------- C:\Program Files\ESET
2008-06-13 20:21 . 2008-06-13 20:21 <DIR> d-------- C:\Program Files\IrfanView
2008-06-13 20:16 . 2008-06-13 20:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-13 20:10 . 2008-06-13 20:10 98,304 --a------ C:\WINDOWS\system32\qttask.exe
2008-06-13 20:09 . 2003-08-18 05:10 122,880 --a------ C:\WINDOWS\system32\directx.cpl
2008-06-13 20:09 . 2003-03-25 05:49 106,544 --a------ C:\WINDOWS\system32\tweakui.cpl
2008-06-13 20:09 . 2003-03-25 05:49 98,304 --a------ C:\WINDOWS\system32\startup.cpl
2008-06-13 20:09 . 2004-02-17 10:11 53,248 --a------ C:\WINDOWS\system32\vp6dec_settings.cpl
2008-06-13 20:09 . 2003-03-25 05:49 51,238 --a------ C:\WINDOWS\system32\tweakui.hlp
2008-06-13 20:08 . 2008-06-13 20:08 <DIR> d-------- C:\Program Files\ACE Mega CoDecS Pack
2008-06-13 20:07 . 2008-06-13 20:07 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-13 20:01 . 2008-06-13 20:01 <DIR> d--hs---- C:\Recycled
2008-06-13 20:00 . 2008-06-13 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Creative
2008-06-13 20:00 . 2008-06-13 20:00 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-06-13 20:00 . 2008-06-13 20:00 584 --a------ C:\WINDOWS\system32\settings.sfm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 18:28 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-06-13 18:28 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-06-13 18:28 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-06-13 17:54 --------- d-----w C:\Program Files\Creative
2008-06-13 17:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-13 17:50 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-13 17:37 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-13 17:34 --------- d-----w C:\Program Files\Usługi online
.

------- Sigcheck -------

2004-11-23 21:03 359040 a14fafd66adbd55a86f17a37e5ec4263 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-16_15.29.43,34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-16 13:19:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-17 12:36:38 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-16 01:15:06 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-17 11:26:08 1,585,152 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2008-06-17 11:26:08 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-06-16 01:15:06 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-17 11:26:00 1,585,152 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2008-06-17 11:26:00 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51 57344]
"P17Helper"="P17.dll" [2005-05-03 13:38 64512 C:\WINDOWS\system32\P17.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"QuickTime Task"="C:\WINDOWS\system32\qttask.exe" [2008-06-13 20:10 98304]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-13 20:28 949376]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-19 11:39 35328]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-06-16 15:04 878672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iac25_32.ax
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=


.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 14:44:36
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-06-17 14:45:15
ComboFix-quarantined-files.txt 2008-06-17 12:45:12
ComboFix2.txt 2008-06-16 13:30:06

Pre-Run: 1,957,371,904 bajtów wolnych
Post-Run: 1,957,044,224 bajtów wolnych

141

[Okocza]

powinno być ok - log są ok


1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem

Autor postu otrzymał pochwałę