Trend chipawayvirus has detected a boot virus on your hard

**Posty:** 40 · przez **Niewierny** 08 Paź 2008, 18:25

witam pojawił mi się problem z kompem musiałem jakiegoś robala złapać
zrestertował mi się komp i przy ładowaniu systemu wyskakuje mi żółta ramka w niej napis
Trend chipawayvirus has detected a boot virus on your hard disk
lata tam w lewo i prawo taka buźka i pisze TCAV guard

później wyskakuje mi jakaś stronka z antywirysem tzn link http://www.antivirus.com

starsznie mnie to denerwuje mozecie mi pomóc o to log

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:28, on 08-10-08 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Niewierny\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing) O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - Unknown owner - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service (file missing) O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe (file missing)

**Posty:** 18165 · przez **wojtas** 08 Paź 2008, 19:05

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

tylko w tagach code !

**Posty:** 40 · przez **Niewierny** 08 Paź 2008, 19:49

Kod: Zaznacz wszystko: [b]SDFix: Version 1.233 [/b] Run by Niewierny on 08-10-08 at 19:20 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: NtmlSvc {DEF85C80-216A-43ab-AF70-1665EDBE2780} [b]Path [/b]: %SystemRoot%\System32\svchost.exe -k netsvcs \??\C:\WINDOWS\TEMP\A8.tmp NtmlSvc - Deleted {DEF85C80-216A-43ab-AF70-1665EDBE2780} - Deleted C:\WINDOWS\system32\Microsoft\backup.ftp Found C:\WINDOWS\system32\Microsoft\backup.tftp Found [b]Checking files[/b]: [b]Genuine[/b]: C:\WINDOWS\system32\Microsoft\backup.ftp C:\WINDOWS\system32\Microsoft\backup.tftp [b]Dummy[/b]: C:\WINDOWS\system32\ftp.exe C:\WINDOWS\system32\tftp.exe C:\WINDOWS\system32\dllcache\ftp.exe C:\WINDOWS\system32\dllcache\tftp.exe Files copied to SDFix\Backups Restoring files if backups are found [b]Final Check[/b]: [b]Genuine[/b]: C:\WINDOWS\system32\Microsoft\backup.ftp C:\WINDOWS\system32\Microsoft\backup.tftp C:\WINDOWS\system32\ftp.exe C:\WINDOWS\system32\tftp.exe C:\WINDOWS\system32\dllcache\ftp.exe C:\WINDOWS\system32\dllcache\tftp.exe Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\hosts - Deleted C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted C:\WINDOWS\Temp\$_2341233.TMP - Deleted C:\WINDOWS\Temp\$_2341234.TMP - Deleted C:\WINDOWS\Temp\$b17a2e8.tmp - Deleted C:\WINDOWS\Temp\bca4e2da.$$$ - Deleted C:\WINDOWS\Temp\ed47fa.$ - Deleted C:\WINDOWS\Temp\fa56d7ec.$$$ - Deleted [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/]MBR Rootkit Detector[/url] by Gmer[/color] Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 19:26:26 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sun 1 Jul 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 2 May 2001 53,248 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATPS.dll" Thu 6 Sep 2001 40,960 A..H. --- "C:\Program Files\Anti-Trojan-55\DLL\ATRep.dll" Wed 16 Jan 2002 134,144 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATT.dll" Wed 16 Jan 2002 113,152 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATTexte.dll" Wed 16 Jan 2002 23,040 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\BetriebsSys.dll" Wed 2 May 2001 23,552 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileOp.dll" Wed 16 Jan 2002 40,960 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileSys.dll" Wed 2 May 2001 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ListBox.dll" Wed 2 May 2001 24,064 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\Registry.dll" Wed 2 May 2001 32,256 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\RegValues.dll" Wed 16 Jan 2002 27,648 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\SysIni.dll" Thu 12 Sep 2002 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\WinExit.dll" Tue 8 May 2001 88,576 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ATPClose.dll" Wed 2 May 2001 36,352 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ProcView.dll" Thu 17 May 2007 1,283,072 ...H. --- "C:\Documents and Settings\Niewierny\Dane aplikacji\Microsoft\Word\~WRL0004.tmp" Mon 14 Apr 2008 116,224 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0182.tmp" Tue 22 Apr 2008 150,016 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0326.tmp" Mon 7 Apr 2008 105,472 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0725.tmp" Mon 7 Apr 2008 99,328 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0774.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0990.tmp" Mon 31 Mar 2008 72,192 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1455.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1502.tmp" Fri 21 Mar 2008 63,488 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1703.tmp" Mon 21 Apr 2008 136,704 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1746.tmp" Mon 28 Apr 2008 161,792 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1920.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL2572.tmp" Mon 17 Mar 2008 57,856 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL2661.tmp" Sun 6 Apr 2008 95,744 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL2785.tmp" Tue 22 Apr 2008 137,728 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3081.tmp" Fri 21 Mar 2008 60,416 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3562.tmp" Tue 22 Apr 2008 152,576 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3827.tmp" Mon 7 Apr 2008 101,376 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3948.tmp" Wed 2 Apr 2008 88,064 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3978.tmp" Mon 14 Apr 2008 116,224 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0182.tmp" Tue 22 Apr 2008 150,016 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0326.tmp" Mon 7 Apr 2008 105,472 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0725.tmp" Mon 7 Apr 2008 99,328 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0774.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0990.tmp" Mon 31 Mar 2008 72,192 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1455.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1502.tmp" Fri 21 Mar 2008 63,488 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1703.tmp" Mon 21 Apr 2008 136,704 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1746.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL2572.tmp" Mon 17 Mar 2008 57,856 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL2661.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: [b]SDFix: Version 1.233 [/b] Run by Niewierny on 08-10-08 at 19:20 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: NtmlSvc {DEF85C80-216A-43ab-AF70-1665EDBE2780} [b]Path [/b]: %SystemRoot%\System32\svchost.exe -k netsvcs \??\C:\WINDOWS\TEMP\A8.tmp NtmlSvc - Deleted {DEF85C80-216A-43ab-AF70-1665EDBE2780} - Deleted C:\WINDOWS\system32\Microsoft\backup.ftp Found C:\WINDOWS\system32\Microsoft\backup.tftp Found [b]Checking files[/b]: [b]Genuine[/b]: C:\WINDOWS\system32\Microsoft\backup.ftp C:\WINDOWS\system32\Microsoft\backup.tftp [b]Dummy[/b]: C:\WINDOWS\system32\ftp.exe C:\WINDOWS\system32\tftp.exe C:\WINDOWS\system32\dllcache\ftp.exe C:\WINDOWS\system32\dllcache\tftp.exe Files copied to SDFix\Backups Restoring files if backups are found [b]Final Check[/b]: [b]Genuine[/b]: C:\WINDOWS\system32\Microsoft\backup.ftp C:\WINDOWS\system32\Microsoft\backup.tftp C:\WINDOWS\system32\ftp.exe C:\WINDOWS\system32\tftp.exe C:\WINDOWS\system32\dllcache\ftp.exe C:\WINDOWS\system32\dllcache\tftp.exe Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\hosts - Deleted C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted C:\WINDOWS\Temp\$_2341233.TMP - Deleted C:\WINDOWS\Temp\$_2341234.TMP - Deleted C:\WINDOWS\Temp\$b17a2e8.tmp - Deleted C:\WINDOWS\Temp\bca4e2da.$$$ - Deleted C:\WINDOWS\Temp\ed47fa.$ - Deleted C:\WINDOWS\Temp\fa56d7ec.$$$ - Deleted [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/]MBR Rootkit Detector[/url] by Gmer[/color] Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 19:26:26 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sun 1 Jul 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 2 May 2001 53,248 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATPS.dll" Thu 6 Sep 2001 40,960 A..H. --- "C:\Program Files\Anti-Trojan-55\DLL\ATRep.dll" Wed 16 Jan 2002 134,144 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATT.dll" Wed 16 Jan 2002 113,152 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATTexte.dll" Wed 16 Jan 2002 23,040 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\BetriebsSys.dll" Wed 2 May 2001 23,552 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileOp.dll" Wed 16 Jan 2002 40,960 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileSys.dll" Wed 2 May 2001 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ListBox.dll" Wed 2 May 2001 24,064 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\Registry.dll" Wed 2 May 2001 32,256 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\RegValues.dll" Wed 16 Jan 2002 27,648 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\SysIni.dll" Thu 12 Sep 2002 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\WinExit.dll" Tue 8 May 2001 88,576 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ATPClose.dll" Wed 2 May 2001 36,352 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ProcView.dll" Thu 17 May 2007 1,283,072 ...H. --- "C:\Documents and Settings\Niewierny\Dane aplikacji\Microsoft\Word\~WRL0004.tmp" Mon 14 Apr 2008 116,224 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0182.tmp" Tue 22 Apr 2008 150,016 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0326.tmp" Mon 7 Apr 2008 105,472 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0725.tmp" Mon 7 Apr 2008 99,328 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0774.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL0990.tmp" Mon 31 Mar 2008 72,192 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1455.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1502.tmp" Fri 21 Mar 2008 63,488 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1703.tmp" Mon 21 Apr 2008 136,704 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1746.tmp" Mon 28 Apr 2008 161,792 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL1920.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL2572.tmp" Mon 17 Mar 2008 57,856 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL2661.tmp" Sun 6 Apr 2008 95,744 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL2785.tmp" Tue 22 Apr 2008 137,728 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3081.tmp" Fri 21 Mar 2008 60,416 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3562.tmp" Tue 22 Apr 2008 152,576 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3827.tmp" Mon 7 Apr 2008 101,376 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3948.tmp" Wed 2 Apr 2008 88,064 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\~WRL3978.tmp" Mon 14 Apr 2008 116,224 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0182.tmp" Tue 22 Apr 2008 150,016 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0326.tmp" Mon 7 Apr 2008 105,472 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0725.tmp" Mon 7 Apr 2008 99,328 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0774.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL0990.tmp" Mon 31 Mar 2008 72,192 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1455.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1502.tmp" Fri 21 Mar 2008 63,488 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1703.tmp" Mon 21 Apr 2008 136,704 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL1746.tmp" Fri 21 Mar 2008 61,440 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL2572.tmp" Mon 17 Mar 2008 57,856 A..H. --- "C:\Documents and Settings\Niewierny\Pulpit\praca\praca\praca\~WRL2661.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-10-07.06 - Niewierny 2008-10-08 19:35:59.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.243 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Niewierny\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\MyWay C:\Program Files\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS C:\Program Files\MyWay\myBar\1.bin\PARTNER.DAT C:\Program Files\MyWay\myBar\1.bin\PARTNER2.DAT C:\Program Files\MyWay\myBar\Cache\[u]0[/u]000BBED C:\Program Files\MyWay\myBar\Cache\[u]0[/u]000D205 C:\Program Files\MyWay\myBar\Cache\[u]0[/u]000D561.bin C:\Program Files\MyWay\myBar\Cache\[u]0[/u]000D716.bin C:\Program Files\MyWay\myBar\Cache\[u]0[/u]000D8CC.bin C:\Program Files\MyWay\myBar\Cache\files.ini C:\Program Files\MyWay\myBar\History\search C:\Program Files\MyWay\myBar\Settings\prevcfg.htm . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINDOWS_TUNE_SERVICE -------\Service_Windows Tune service ((((((((((((((((((((((((( Pliki utworzone od 2008-09-08 do 2008-10-08 ))))))))))))))))))))))))))))))) . 2008-10-08 19:17 . 2008-10-08 19:17 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-08 19:14 . 2008-10-08 19:32 <DIR> d-------- C:\SDFix 2008-09-24 20:05 . 2008-10-03 10:25 117,640 --a------ C:\test.htm 2008-09-22 13:15 . 2008-09-22 13:14 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2008-09-22 13:15 . 2008-09-22 13:15 298,104 --a------ C:\WINDOWS\system32\imon.dll 2008-09-22 13:15 . 2008-09-22 13:14 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-08 17:33 --------- d-----w C:\Documents and Settings\Niewierny\Dane aplikacji\SlimBrowser 2008-10-08 17:10 --------- d-----w C:\Program Files\English Translator 3 2008-10-07 19:56 --------- d-----w C:\Program Files\ESET 2008-09-03 17:29 --------- d-----w C:\Documents and Settings\Niewierny\Dane aplikacji\AdobeAUM 2008-08-21 08:44 --------- d-----w C:\Program Files\SkanerOnline 2008-08-21 08:06 --------- d-----w C:\Program Files\Canon 2008-05-01 22:03 25,600 ----a-w C:\Documents and Settings\Niewierny\usbsermptxp.sys 2008-05-01 22:03 22,768 ----a-w C:\Documents and Settings\Niewierny\usbsermpt.sys 2007-11-01 23:13 32,400 ----a-w C:\Documents and Settings\Niewierny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2001-11-23 12:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\audio3d.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-08-30 1708032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-09-22 949376] "nwiz"="nwiz.exe" [2003-01-10 C:\WINDOWS\system32\nwiz.exe] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^iFormat.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\iFormat.lnk backup=C:\WINDOWS\pss\iFormat.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ImageFox.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ImageFox.lnk backup=C:\WINDOWS\pss\ImageFox.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] --a------ 2008-07-14 11:52 883992 C:\Program Files\AdVantage\AdVantage.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-Trojan-Watch] --a------ 2002-09-08 10:03 26624 C:\Program Files\Anti-Trojan-55\ATWatch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT-Watch] --a------ 2002-09-08 10:03 26624 C:\Program Files\Anti-Trojan-55\ATWatch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] --a------ 2008-01-08 12:25 2124088 C:\Program Files\BitComet\BitComet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] --a------ 2002-07-02 19:22 1540096 C:\WINDOWS\NewMixer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-05-11 23:12 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2002-08-20 15:08 1511453 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-07-02 17:10 23237416 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] --a------ 2008-05-06 10:42 202088 C:\Program Files\TomTom HOME 2\HOMERunner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVG Anti-Spyware Guard"=2 (0x2) R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 660768] S2 S3 Graphics, Inc.;Copyright (C) 2001-2005 S3 Graphics, Inc.;C:\WINDOWS\VTTimer.exe [ ] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-FineReader7NewsReaderPro - C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe MSConfigStartUp-Sony Ericsson PC Suite - C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe MSConfigStartUp-UVS10 Preload - C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe . ------- Skan uzupełniający ------- . R0 -: HKCU-Main,Start Page = hxxp://www.interia.pl/ R0 -: HKLM-Main,Start Page = about:blank R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 -: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 -: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd O16 -: ING Bank Online - hxxps://ssl.bsk.com.pl/bskonl/component/INGOnl.cab C:\WINDOWS\Downloaded Program Files\ING Bank Online.osd O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://slimak.onet.pl/_m/wirusy/ArcaOnline.cab C:\WINDOWS\Downloaded Program Files\ArcaOnline.inf C:\WINDOWS\System32\ArcaMicroScanUpdater.exe C:\WINDOWS\System32\ArcaOnlineUninstall.exe C:\WINDOWS\System32\ArcaOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\System32\SkanerOnlineUninstall.exe C:\WINDOWS\System32\SkanerOnline.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 19:40:32 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\ESET\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe . ************************************************************************** . Czas ukończenia: 2008-10-08 19:43:17 - komputer został uruchomiony ponownie [Niewierny] ComboFix-quarantined-files.txt 2008-10-08 17:43:11 Przed: 622,280,704 bajtów wolnych Po: 592,695,296 bajtów wolnych 162

**Posty:** 18165 · przez **wojtas** 08 Paź 2008, 22:37

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe

i dajesz na forum...

**Posty:** 40 · przez **Niewierny** 08 Paź 2008, 23:29

Kod: Zaznacz wszystko: Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK malicious code @ sector 0x6fc7c80 size 0x1b5 ! copy of MBR has been found in sector 62 !

**Posty:** 18165 · przez **wojtas** 08 Paź 2008, 23:34

Przenieś program mbr.exe bezpośrednio na C:\
nastepnie przejdz do trybu awaryjnego z z obsługą linii komend
w linii komend wpisz polecenie C:\mbr.exe -f (tam jest spacja między mbr.exe a -f) i ENTER
Reset komputera do trybu normalnego i robisz nowy log z mbr.exe i combofixa i z sdfixa

wszystkie nowe logi

**Posty:** 7956 · przez **Magik** 09 Paź 2008, 02:00

a tak przy okazji, wcinając się w środeczek bitwy....

na marginesie niewierny, zainstaluj SP 3 i zmień przeglądarkę na

Mozilla Firefox 3

taka mała dygresja..inaczej będziesz co miesiąc wpadał z logami :wink:

**Posty:** 684 · przez **djarta** 09 Paź 2008, 13:22

user & kernel MBR OK

To oznacza, że Rootkita nie ma, więc nie trzeba nic naprawić itp.

======================
K.

**Posty:** 18165 · przez **wojtas** 09 Paź 2008, 16:01

nie wiem dałem to bo sdfix krzyczał...