System po po adware/32 (tak sądzę ż już po)

**Posty:** 41 · przez **RenifereK1987** 05 Wrz 2008, 14:07

Witam wydaje mi się że to był jakiś z adware/32 ale nie jestem do końca pewien poznikały mi dyski, menadżer zadań obok zegara pojawił się napis "VIRUS ALERT!" na pulpicie jakaś radioaktywna tapeta o informacji że jestem zarażony obecnie uporałem się z tymi wszystkimi objawami powywalałem ręcznie te syfy chciał bym jednak by ktoś profilaktycznie przeczesał mojego loga po tym za co będę bardzo wdzięczny dziękuję z góry i pozdrawiam.

Kod: Zaznacz wszystko: ComboFix 08-09-04.08 - Ania 2008-09-05 11:44:28.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.188 [GMT 1:00] Running from: E:\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Ania\Pulpit\Error Cleaner.url C:\Documents and Settings\Ania\Pulpit\Privacy Protector.url C:\Documents and Settings\Ania\Pulpit\Spyware&Malware Protection.url C:\Documents and Settings\Ania\Ulubione\Error Cleaner.url C:\Documents and Settings\Ania\Ulubione\Privacy Protector.url C:\Documents and Settings\Ania\Ulubione\Spyware&Malware Protection.url C:\WINDOWS\dgksvbpn.dll C:\WINDOWS\evnr.exe C:\WINDOWS\gksraemq.dll C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\danger.jpg C:\WINDOWS\privacy_danger\images\down.gif C:\WINDOWS\privacy_danger\images\spacer.gif C:\WINDOWS\privacy_danger\index.htm C:\WINDOWS\system32\ntos.exe C:\WINDOWS\system32\oembios.exe C:\WINDOWS\xrdwbfgn.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TDSSSERV ((((((((((((((((((((((((( Files Created from 2008-08-05 to 2008-09-05 ))))))))))))))))))))))))))))))) . 2008-09-05 11:32 . 2008-09-05 12:24 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-09-03 17:56 . 2008-09-03 17:56 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-09-03 16:27 . 2008-09-03 10:31 86,016 --a------ C:\WINDOWS\sxmaokgf.exe 2008-09-02 13:48 . 2008-09-02 13:48 <DIR> d-------- C:\Program Files\kRk Software 2008-09-02 13:27 . 2008-09-02 13:27 <DIR> d-------- C:\Program Files\Data Doctor Recovery - SIM Card (Evaluation) 2008-08-20 22:45 . 2008-08-20 22:51 1,024 --a------ C:\WINDOWS\system32\pwdremover.dat 2008-08-20 22:45 . 2008-08-20 22:51 63 --a------ C:\pdfinfo.ini 2008-08-20 22:45 . 2008-08-20 22:51 39 --a------ C:\WINDOWS\winDecrypt.INI 2008-08-20 22:44 . 2008-08-20 22:48 <DIR> d-------- C:\Program Files\PDF Password Remover v2.1 2008-08-20 22:39 . 2008-08-20 22:39 <DIR> d-------- C:\Program Files\ElcomSoft 2008-08-14 23:36 . 2008-04-11 19:51 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 23:35 . 2008-05-01 15:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-06 14:03 . 2008-06-14 19:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-06 03:16 . 2008-08-06 03:16 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-06 03:08 . 2008-06-23 17:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-08-06 03:08 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-08-06 03:08 . 2007-03-08 06:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-08-06 03:08 . 2008-06-23 17:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-08-06 03:08 . 2008-06-23 17:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-08-06 03:08 . 2008-06-23 17:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-08-06 03:08 . 2008-06-23 17:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-08-06 03:08 . 2008-06-23 17:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-08-06 03:08 . 2008-06-23 10:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-08-05 11:54 . 2008-08-16 19:31 13,030 --a------ C:\PDOXUSRS.NET 2008-08-05 11:53 . 2008-08-16 19:31 <DIR> d-------- C:\Program Files\Wizard 2008-08-05 11:53 . 2008-08-05 11:53 <DIR> d-------- C:\Program Files\Common Files\grafa 2008-08-05 11:53 . 2008-08-05 11:53 <DIR> d-------- C:\Program Files\Common Files\Borland Shared 2008-08-05 11:52 . 2008-08-05 11:52 <DIR> d-------- C:\WINDOWS\Downloaded Installations . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-05 11:25 6,596,384 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-05 11:25 246,304 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-09-05 11:18 89,816 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-05 11:18 23,900 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-09-05 10:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-08 23:59 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-08-05 12:20 --------- d-----w C:\Program Files\Magic Suitcase 2008-08-04 15:00 1,409 ----a-w C:\WINDOWS\Fonts\MAGIS.FOT 2008-08-04 15:00 1,409 ----a-w C:\WINDOWS\Fonts\MAGIC.FOT 2008-08-04 14:45 --------- d-----w C:\Program Files\PalmROOT 2008-08-01 07:56 --------- d-----w C:\Documents and Settings\Ania\Dane aplikacji\Netscape 2008-08-01 07:55 --------- d-----w C:\Program Files\Netscape 2008-07-31 13:24 --------- d-----w C:\Documents and Settings\Ania\Dane aplikacji\Wizards of the Coast 2008-07-31 12:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-31 12:37 --------- d-----w C:\Program Files\Wizards of the Coast 2008-07-28 20:04 --------- d-----w C:\Program Files\CCleaner 2008-07-28 19:59 --------- d-----w C:\Program Files\Trend Micro 2008-07-27 19:51 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-07-25 20:22 --------- d-----w C:\Program Files\Real Alternative 2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 21:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2007-07-20 22:41 0 --sha-w C:\WINDOWS\system32\httpget.sys 2007-07-20 22:44 137 --sha-w C:\WINDOWS\system32\httpklg.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{a33fa729-d155-4b23-842b-2c665ecabdb6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2007-12-10 1510424] [HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}] 2007-12-10 14:46 1510424 --a------ C:\Program Files\The_Pirate_Bay\tbThe_.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{a33fa729-d155-4b23-842b-2c665ecabdb6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2007-12-10 1510424] [HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A33FA729-D155-4B23-842B-2C665ECABDB6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2007-12-10 1510424] [HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2006-11-13 16:57 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 17:40 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost] --a------ 2004-08-04 01:44 14336 C:\WINDOWS\system32\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7701:TCP"= 7701:TCP:BitComet 7701 TCP "7701:UDP"= 7701:UDP:BitComet 7701 UDP R3 AN983;Karta ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet;C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 36224] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S3 PRODIGY;PRODIGY;C:\WINDOWS\system32\Drivers\PRODIGY.SYS [2006-08-29 32377] . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - Notify-WgaLogon - (no file) MSConfigStartUp-Google Desktop Search - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe MSConfigStartUp-kkkkkkkkkk - C:\Windows\system32\kkkkkkkkkk.exe MSConfigStartUp-kkkkkkkkkkkkkk - C:\Windows\system32\kkkkkkkkkkkkkk.exe MSConfigStartUp-minollll - C:\Windows\system32\minollll.exe MSConfigStartUp-orangutannnn - C:\Windows\system32\orangutannnn.exe MSConfigStartUp-remiiiii - C:\Windows\system32\remiiiii.exe MSConfigStartUp-romennnnn - C:\Windows\system32\romennnnn.exe MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Ania\Dane aplikacji\Mozilla\Firefox\Profiles\ehw4eczf.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-05 12:22:16 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\TEMP\cch~19db8e56.htp 8192 bytes C:\WINDOWS\TEMP\cch~19dbc9fc.htp scan completed successfully hidden files: 2 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\brss01a.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\system32\wdfmgr.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\WINDOWS\SoftwareDistribution\Download\8a7603e7cf792509c9ebbd8c74c82553\update\update.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-09-05 12:37:54 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-05 11:37:23 Pre-Run: 4,805,267,456 bajtów wolnych Post-Run: 5,072,101,376 bajt˘w wolnych 200 --- E O F --- 2008-08-15 00:44:40

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:06, on 2008-09-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: The Pirate Bay Toolbar - {a33fa729-d155-4b23-842b-2c665ecabdb6} - C:\Program Files\The_Pirate_Bay\tbThe_.dll R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL O2 - BHO: The Pirate Bay Toolbar - {a33fa729-d155-4b23-842b-2c665ecabdb6} - C:\Program Files\The_Pirate_Bay\tbThe_.dll O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL O3 - Toolbar: The Pirate Bay Toolbar - {a33fa729-d155-4b23-842b-2c665ecabdb6} - C:\Program Files\The_Pirate_Bay\tbThe_.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.mks.com.pl O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe -- End of file - 5942 bytes

**Posty:** 684 · przez **djarta** 05 Wrz 2008, 14:29

Widzę "sierotkę" do usunięcia.

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\sxmaokgf.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

=======================
K.

**Posty:** 41 · przez **RenifereK1987** 05 Wrz 2008, 16:02

zrobiłem jak napisałeś ;]

Kod: Zaznacz wszystko: ComboFix 08-09-04.09 - Ania 2008-09-05 13:57:46.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.138 [GMT 1:00] Running from: E:\ComboFix.exe Command switches used :: E:\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\sxmaokgf.exe . ((((((((((((((((((((((((( Files Created from 2008-08-05 to 2008-09-05 ))))))))))))))))))))))))))))))) . 2008-09-05 12:27 . 2008-09-05 12:27 72 --ahs---- C:\WINDOWS\klif.spi 2008-09-05 11:32 . 2008-09-05 13:46 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-09-03 17:56 . 2008-09-03 17:56 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-09-02 13:48 . 2008-09-02 13:48 <DIR> d-------- C:\Program Files\kRk Software 2008-09-02 13:27 . 2008-09-02 13:27 <DIR> d-------- C:\Program Files\Data Doctor Recovery - SIM Card (Evaluation) 2008-08-20 22:45 . 2008-08-20 22:51 1,024 --a------ C:\WINDOWS\system32\pwdremover.dat 2008-08-20 22:45 . 2008-08-20 22:51 63 --a------ C:\pdfinfo.ini 2008-08-20 22:45 . 2008-08-20 22:51 39 --a------ C:\WINDOWS\winDecrypt.INI 2008-08-20 22:44 . 2008-08-20 22:48 <DIR> d-------- C:\Program Files\PDF Password Remover v2.1 2008-08-20 22:39 . 2008-08-20 22:39 <DIR> d-------- C:\Program Files\ElcomSoft 2008-08-14 23:36 . 2008-04-11 19:51 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 23:35 . 2008-05-01 15:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-06 14:03 . 2008-06-14 19:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-06 03:16 . 2008-08-06 03:16 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-06 03:08 . 2008-06-23 17:42 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-08-06 03:08 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-08-06 03:08 . 2007-03-08 06:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-08-06 03:08 . 2008-06-23 17:42 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-08-06 03:08 . 2008-06-23 17:42 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-08-06 03:08 . 2008-06-23 17:42 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-08-06 03:08 . 2008-06-23 17:42 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-08-06 03:08 . 2008-06-23 17:42 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-08-06 03:08 . 2008-06-23 10:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-08-05 11:54 . 2008-08-16 19:31 13,030 --a------ C:\PDOXUSRS.NET 2008-08-05 11:53 . 2008-08-16 19:31 <DIR> d-------- C:\Program Files\Wizard 2008-08-05 11:53 . 2008-08-05 11:53 <DIR> d-------- C:\Program Files\Common Files\grafa 2008-08-05 11:53 . 2008-08-05 11:53 <DIR> d-------- C:\Program Files\Common Files\Borland Shared 2008-08-05 11:52 . 2008-08-05 11:52 <DIR> d-------- C:\WINDOWS\Downloaded Installations . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-05 13:15 7,089,184 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-05 13:12 292,128 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-09-05 11:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-09-05 11:18 89,816 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-05 11:18 23,900 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-08 23:59 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-08-05 12:20 --------- d-----w C:\Program Files\Magic Suitcase 2008-08-04 15:00 1,409 ----a-w C:\WINDOWS\Fonts\MAGIS.FOT 2008-08-04 15:00 1,409 ----a-w C:\WINDOWS\Fonts\MAGIC.FOT 2008-08-04 14:45 --------- d-----w C:\Program Files\PalmROOT 2008-08-01 07:56 --------- d-----w C:\Documents and Settings\Ania\Dane aplikacji\Netscape 2008-08-01 07:55 --------- d-----w C:\Program Files\Netscape 2008-07-31 13:24 --------- d-----w C:\Documents and Settings\Ania\Dane aplikacji\Wizards of the Coast 2008-07-31 12:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-31 12:37 --------- d-----w C:\Program Files\Wizards of the Coast 2008-07-28 20:04 --------- d-----w C:\Program Files\CCleaner 2008-07-28 19:59 --------- d-----w C:\Program Files\Trend Micro 2008-07-27 19:51 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-07-25 20:22 --------- d-----w C:\Program Files\Real Alternative 2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 21:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2007-07-20 22:41 0 --sha-w C:\WINDOWS\system32\httpget.sys 2007-07-20 22:44 137 --sha-w C:\WINDOWS\system32\httpklg.sys . ((((((((((((((((((((((((((((( snapshot@2008-09-05_12.34.29.48 ))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{a33fa729-d155-4b23-842b-2c665ecabdb6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2007-12-10 1510424] "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2007-12-05 57344] [HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}] [HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}] 2007-12-10 14:46 1510424 --a------ C:\Program Files\The_Pirate_Bay\tbThe_.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{a33fa729-d155-4b23-842b-2c665ecabdb6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2007-12-10 1510424] [HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A33FA729-D155-4B23-842B-2C665ECABDB6}"= "C:\Program Files\The_Pirate_Bay\tbThe_.dll" [2007-12-10 1510424] [HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2006-11-13 16:57 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 17:40 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost] --a------ 2004-08-04 01:44 14336 C:\WINDOWS\system32\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7701:TCP"= 7701:TCP:BitComet 7701 TCP "7701:UDP"= 7701:UDP:BitComet 7701 UDP R3 AN983;Karta ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet;C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 36224] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S3 PRODIGY;PRODIGY;C:\WINDOWS\system32\Drivers\PRODIGY.SYS [2006-08-29 32377] . Contents of the 'Scheduled Tasks' folder . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-05 14:12:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-05 14:18:55 ComboFix-quarantined-files.txt 2008-09-05 13:18:45 ComboFix2.txt 2008-09-05 11:38:31 Pre-Run: 4,535,013,376 bajtów wolnych Post-Run: 4,518,514,688 bajtów wolnych 156 --- E O F --- 2008-08-15 00:44:40

**Posty:** 684 · przez **djarta** 05 Wrz 2008, 16:05

Ja nie widzę teraz żadnej aktywnej infekcji.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=========================
K.