rjump-b [wrm] - pomocy!

[kassiuniaa]

Uruchamiasz hijackthis'a >> Naciskasz na "Do a system scan only" >> zaznaczasz podany przez Tomka wpis i naciskasz Fix checked >> pojawi sie okienko, klikasz na TAK.

nie ma juz w hijacku tego wpisu podanego przez Tomka.

[ Dodano: Dzisiaj o 11:17 ]
mam wkleic kontrolnie jakiegos loga, zebyscie sprawdzili czy wszystko ok??

[Lukesh]

Daj nowy log z hijackthis'a oraz z
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[kassiuniaa]

Logfile of HijackThis v1.99.1
Scan saved at 11:09:06, on 2007-07-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Documents and Settings\kasia\Pulpit\hijackthis_199(2)\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: OpenOffice.ux.pl 2.0.4.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"kasia" - 2007-07-10 11:11:59 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\kasia\Pulpit\internet.lnk


((((((((((((((((((((((((( Files Created from 2007-06-10 to 2007-07-10 )))))))))))))))))))))))))))))))


2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 10:28 <DIR> d-------- C:\!KillBox
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu
2007-06-21 15:33 52 --a------ C:\WINDOWS\system\ACD2.CMD
2007-06-21 15:33 52 --a------ C:\WINDOWS\system\ACD.CMD
2007-06-21 15:33 24,626 --a------ C:\WINDOWS\system32\scrrntr.dll
2007-06-21 15:33 20,480 --a------ C:\WINDOWS\system32\PAC.EXE
2007-06-21 15:33 180,224 --a------ C:\WINDOWS\system32\Ijl11.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-09 20:45:31 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-24 23:02:22 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- F:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2f0e606-fcb7-11db-8be5-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f


Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 11:12:58
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-10 11:13:26
C:\ComboFix-quarantined-files.txt ... 2007-07-10 11:13

--- E O F ---

[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz

Files to delete:

C:\WINDOWS\system\ACD2.CMD
C:\WINDOWS\system\ACD.CMD
C:\WINDOWS\system32\scrrntr.dll
C:\WINDOWS\system32\PAC.EXE
C:\WINDOWS\system32\Ijl11.dll

Folders to delete:

C:\!KillBox

Registry keys to delete:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2f0e606-fcb7-11db-8be5-0013d3c81659}

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.


Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

[kassiuniaa]

nie proponuje restarta kompa tylko jakies bledy wyskakuje m.in. error 1813

[wojtas]

daj log z combo nowy

[kassiuniaa]

"kasia" - 2007-07-11 10:30:26 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 )))))))))))))))))))))))))))))))


2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 10:28 <DIR> d-------- C:\!KillBox
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu
2007-06-21 15:33 52 --a------ C:\WINDOWS\system\ACD2.CMD
2007-06-21 15:33 52 --a------ C:\WINDOWS\system\ACD.CMD
2007-06-21 15:33 24,626 --a------ C:\WINDOWS\system32\scrrntr.dll
2007-06-21 15:33 20,480 --a------ C:\WINDOWS\system32\PAC.EXE
2007-06-21 15:33 180,224 --a------ C:\WINDOWS\system32\Ijl11.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-10 15:02:12 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-24 23:02:22 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- F:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2f0e606-fcb7-11db-8be5-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f


Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 10:31:31
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-11 10:32:00
C:\ComboFix-quarantined-files.txt ... 2007-07-11 10:31
C:\ComboFix2.txt ... 2007-07-10 11:13

--- E O F ---

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

Wklej do notatnika

gmer -del file C:\!KillBox
gmer -del file C:\WINDOWS\system\ACD2.CMD
gmer -del file C:\WINDOWS\system\ACD.CMD
gmer -del file C:\WINDOWS\system32\Ijl11.dll
gmer -del file C:\WINDOWS\system32\PAC.EXE
gmer -del file C:\WINDOWS\system32\scrrntr.dll
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT


Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

potem wklejasz do notatnika;

REGEDIT 4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2f0e606-fcb7-11db-8be5-0013d3c81659}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowy combo

[kassiuniaa]

error 87 :|

[ Dodano: Dzisiaj o 11:35 ]
albo ja cos psuje albooooo ten error przeszkadza, w ogole fix.reg nie chce sie w tym trybie awaryjnym uruchomic niestety:/

[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\WINDOWS\system\ACD2.CMD
C:\WINDOWS\system\ACD.CMD
C:\WINDOWS\system32\Ijl11.dll
C:\WINDOWS\system32\PAC.EXE
C:\WINDOWS\system32\scrrntr.dll

[kassiuniaa]

ale lipa... przez moment wszystko laacznie z dostepem do internetu mi sie zablokowalo przez to WWDC, a plikow w gmerze

C:\WINDOWS\system\ACD2.CMD
C:\WINDOWS\system\ACD.CMD
C:\WINDOWS\system32\Ijl11.dll
C:\WINDOWS\system32\PAC.EXE
C:\WINDOWS\system32\scrrntr.dll

i tak nie znalazlam!:|

czy ja aby sobie szybciej kompa nie zepsuje niz naprawie jak tak mi to idzie?;|

[ Dodano: Dzisiaj o 1:11 ]
avast juz mi zadnych zarazonych plikow nie wykrywa...ale czuc ze cos nie tak z kompem nadal, pfff:/

[wojtas]

odpal gmera i daj z niego loga:

Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta[/quote]

oraz nowy log z combofixa

[kassiuniaa]

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-07-12 10:01:37
Windows 5.1.2600 Dodatek Service Pack 2


---- Services - GMER 1.0.13 ----

Service [AUTO] aswMon2
Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [AUTO] aswUpdSv
Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv
Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [AUTO] avast! Antivirus
Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser
Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc
Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache
Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc
Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog
Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc
Service C:\WINDOWS\System32\svchost.exe [AUTO] HidServ
Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver
Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation
Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts
Service C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [AUTO] MDM
Service C:\WINDOWS\system32\DRIVERS\netbt.sys [AUTO] NetBT
Service [AUTO] ParVdm
Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay
Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent
Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage
Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs
Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs
Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule
Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon
Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS
Service C:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess
Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection
Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler
Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice
Service C:\WINDOWS\system32\svchost.exe [AUTO] SSDPSRV
Service C:\WINDOWS\system32\svchost.exe [AUTO] stisvc
Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes
Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks
Service C:\WINDOWS\system32\wdfmgr.exe [AUTO] UMWdf
Service C:\WINDOWS\system32\svchost.exe [AUTO] upnphost
Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time
Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient
Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt
Service C:\WINDOWS\System32\svchost.exe [AUTO] wscsvc
Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv
Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC
Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI
Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi
Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk
Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr
Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk
Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [BOOT] isapnp
Service [BOOT] KSecDD
Service [BOOT] MountMgr
Service [BOOT] Mup
Service [BOOT] NDIS
Service [BOOT] PartMgr
Service C:\WINDOWS\system32\DRIVERS\pci.sys [BOOT] PCI
Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20
Service C:\WINDOWS\system32\DRIVERS\sr.sys [BOOT] sr
Service C:\WINDOWS\system32\DRIVERS\viaagp1.sys [BOOT] viaagp1
Service C:\WINDOWS\system32\DRIVERS\viaidexp.sys [BOOT] ViaIde
Service C:\WINDOWS\system32\DRIVERS\viamraid.sys [BOOT] viamraid
Service [BOOT] VolSnap
Service [DISABLED] Abiosdsk
Service [DISABLED] abp480n5
Service [DISABLED] ACPIEC
Service [DISABLED] adpu160m
Service [DISABLED] Aha154x
Service [DISABLED] aic78u2
Service [DISABLED] aic78xx
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter
Service [DISABLED] AliIde
Service [DISABLED] amsint
Service [DISABLED] asc
Service [DISABLED] asc3350p
Service [DISABLED] asc3550
Service [DISABLED] Atdisk
Service [DISABLED] cbidf2k
Service [DISABLED] cd20xrnt
Service [DISABLED] Cdfs
Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv
Service [DISABLED] CmdIde
Service [DISABLED] Cpqarray
Service [DISABLED] dac2w2k
Service [DISABLED] dac960nt
Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot
Service C:\WINDOWS\System32\drivers\dmio.sys [DISABLED] dmio
Service C:\WINDOWS\System32\drivers\dmload.sys [DISABLED] dmload
Service [DISABLED] dpti2o
Service [DISABLED] Fastfat
Service [DISABLED] hpn
Service [DISABLED] i2omp
Service [DISABLED] ini910u
Service [DISABLED] IntelIde
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger
Service [DISABLED] mraid35x
Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE
Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm
Service [DISABLED] Ntfs
Service [DISABLED] PCIIde
Service [DISABLED] Pcmcia
Service [DISABLED] perc2
Service [DISABLED] perc2hib
Service [DISABLED] ql1080
Service [DISABLED] Ql10wnt
Service [DISABLED] ql12160
Service [DISABLED] ql1240
Service [DISABLED] ql1280
Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess
Service [DISABLED] Simbad
Service [DISABLED] Sparrow
Service [DISABLED] sym_hi
Service [DISABLED] sym_u3
Service [DISABLED] symc810
Service [DISABLED] symc8xx
Service [DISABLED] TosIde
Service [DISABLED] Udfs
Service [DISABLED] ultra
Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec
Service C:\WINDOWS\system32\drivers\ALCXWDM.SYS [MANUAL] ALCXWDM
Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG
Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt
Service [MANUAL] aswRdr
Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac
Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc
Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub
Service C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [MANUAL] avast! Mail Scanner
Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [MANUAL] avast! Web Scanner
Service C:\WINDOWS\system32\svchost.exe [MANUAL] BITS
Service C:\DOCUME~1\kasia\USTAWI~1\Temp\catchme.sys [MANUAL] catchme
Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp
Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin
Service C:\WINDOWS\System32\svchost.exe [MANUAL] dmserver
Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic
Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud
Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem
Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility
Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc
Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk
Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer
Service E:\INSTALL\GMSIPCI.SYS [MANUAL] GMSIPCI
Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc
Service C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [MANUAL] gusvc
Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [MANUAL] HidUsb
Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP
Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter
Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService
Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw
Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver
Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp
Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat
Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM
Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer
Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc
Service [MANUAL] Modem
Service C:\WINDOWS\system32\DRIVERS\mouhid.sys [MANUAL] mouhid
Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV
Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC
Service E:\install4\MSICPL.sys [MANUAL] MSICPL
Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer
Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV
Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK
Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM
Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios
Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi
Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio
Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan
Service [MANUAL] NDProxy
Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon
Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman
Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla
Service E:\NTACCESS.sys [MANUAL] NTACCESS
Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp
Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc
Service C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [MANUAL] nv
Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt
Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd
Service C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [MANUAL] ose
Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport
Service [MANUAL] PDCOMP
Service [MANUAL] PDFRAME
Service [MANUAL] PDRELI
Service [MANUAL] PDRFRAME
Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport
Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched
Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink
Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto
Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp
Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan
Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe
Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti
Service [MANUAL] RDPWD
Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr
Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator
Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP
Service C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [MANUAL] rtl8139
Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr
Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv
Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum
Service E:\NTGLM7X.sys [MANUAL] SetupNTGLM7X
Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter
Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv
Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum
Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv
Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio
Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog
Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv
Service [MANUAL] TDPIPE
Service [MANUAL] TDTCP
Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService
Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update
Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS
Service C:\WINDOWS\system32\DRIVERS\usbccgp.sys [MANUAL] usbccgp
Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci
Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub
Service C:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint
Service C:\WINDOWS\system32\DRIVERS\usbscan.sys [MANUAL] usbscan
Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR
Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci
Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS
Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp
Service [MANUAL] WDICA
Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud
Service [MANUAL] Winsock
Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN
Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv
Service C:\WINDOWS\System32\Drivers\wpdusb.sys [MANUAL] WpdUsb
Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov
Service [SYSTEM] Aavmker4
Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD
Service [SYSTEM] aswTdi
Service [SYSTEM] Beep
Service [SYSTEM] Cdaudio
Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom
Service [SYSTEM] Changer
Service [SYSTEM] Fips
Service [SYSTEM] Fs_Rec
Service [SYSTEM] i2omgmt
Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt
Service C:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi
Service C:\WINDOWS\system32\DRIVERS\intelppm.sys [SYSTEM] intelppm
Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [SYSTEM] IPSec
Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass
Service C:\WINDOWS\system32\DRIVERS\kbdhid.sys [SYSTEM] kbdhid
Service [SYSTEM] lbrtfdc
Service [SYSTEM] mnmdd
Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [SYSTEM] Mouclass
Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb
Service [SYSTEM] Msfs
Service C:\WINDOWS\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS
Service [SYSTEM] Npfs
Service [SYSTEM] Null
Service [SYSTEM] PCIDump
Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [SYSTEM] RasAcd
Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [SYSTEM] Rdbss
Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD
Service C:\WINDOWS\system32\DRIVERS\redbook.sys [SYSTEM] redbook
Service C:\WINDOWS\system32\DRIVERS\serial.sys [SYSTEM] Serial
Service [SYSTEM] Sfloppy
Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [SYSTEM] Tcpip
Service C:\WINDOWS\system32\DRIVERS\termdd.sys [SYSTEM] TermDD
Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave
Service [SYSTEM] WS2IFSL
Service BattC
Service ContentFilter
Service ContentIndex
Service inetaccs
Service Inport
Service ISAPISearch
Service ldap
Service LicenseService
Service Outlook
Service PerfDisk
Service PerfNet
Service PerfOS
Service PerfProc
Service RDPDD
Service RDPNP
Service TSDDD
Service W3SVC
Service WinSock2
Service WinTrust
Service WmiApRpl
Service {34F9EF85-0235-4381-83EC-382BA104B06F}

---- EOF - GMER 1.0.13 ----

"kasia" - 2007-07-12 10:02:37 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))


2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 10:28 <DIR> d-------- C:\!KillBox
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-11 23:03:06 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-24 23:02:22 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a28b9fe4-9e54-11db-8aa2-0013d3c81659}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- F:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aae14ec5-9fe5-11db-8aa6-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2f0e606-fcb7-11db-8be5-0013d3c81659}]
Auto\command- F:\activexdebugger32.exe f
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
explore\Command- F:\activexdebugger32.exe f
open\Command- F:\activexdebugger32.exe f


Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 10:03:35
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 10:04:12
C:\ComboFix-quarantined-files.txt ... 2007-07-12 10:04
C:\ComboFix2.txt ... 2007-07-11 10:32
C:\ComboFix3.txt ... 2007-07-10 11:13

--- E O F ---

[ Dodano: Dzisiaj o 10:07 ]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]

Auto\command- F:\activexdebugger32.exe

to chyba nic dobrego?

[wojtas]

skasuj do kosza:

C:\!KillBox

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

start>uruchom>regedit> przejdz do klucza:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2

i usun z niego:

ten 3 wpisy:

{a28b9fe4-9e54-11db-8aa2-0013d3c81659}
{aae14ec5-9fe5-11db-8aa6-0013d3c81659}
{c2f0e606-fcb7-11db-8be5-0013d3c81659}

[kassiuniaa]

juz...

[ Dodano: Dzisiaj o 13:14 ]
mam wkleic jakiegos loga??

[wojtas]

combofixa jeszcze daj

[kassiuniaa]

"kasia" - 2007-07-12 18:23:58 - ComboFix 07-07-10.1 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))


2007-07-10 11:10 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-09 22:56 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Help
2007-07-09 22:50 299,520 --a------ C:\WINDOWS\uninst.exe
2007-07-09 22:50 264,704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe
2007-07-09 11:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-07-09 09:01 <DIR> d-------- C:\WINDOWS\pss
2007-07-02 15:21 <DIR> dr-hs---- C:\Recycled
2007-06-22 09:05 <DIR> d-------- C:\DOCUME~1\kasia\DANEAP~1\Gadu-Gadu
2007-06-21 22:55 <DIR> d-------- C:\Program Files\Gadu-Gadu


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-12 16:17:03 -------- d-----w C:\Program Files\eMule
2007-07-09 15:53:48 -------- d-----w C:\Program Files\Picasa2
2007-07-06 21:26:11 -------- d-----w C:\Program Files\Soulseek
2007-07-03 18:57:12 -------- d-----w C:\DOCUME~1\kasia\DANEAP~1\Tlen.pl
2007-06-24 23:02:22 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-11 16:14:24 -------- d-----w C:\Program Files\Messenger
2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 11:33:18 56 --sh--r C:\WINDOWS\system32\85FAC91C03.sys
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-09-25 18:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 01:15]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]


Contents of the 'Scheduled Tasks' folder
2007-06-12 04:55:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 18:25:08
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 18:25:39
C:\ComboFix-quarantined-files.txt ... 2007-07-12 18:25
C:\ComboFix2.txt ... 2007-07-12 10:04
C:\ComboFix3.txt ... 2007-07-11 10:32

--- E O F ---

[wojtas]

jest ok

[kassiuniaa]

juz ok???:))) kurczaki! Dziekuje wszystkim za pomoc!:)
mam jeszcze kilka pytan i problemow dot. dzialania mojego kompa niestety:/ wiec licze na dalsza pomoc;)
pozdrowionka