Trojan, który powraca

**Posty:** 1728 · przez **Sith[PL]** 04 Kwi 2009, 14:36

Witam.
Wczoraj złapałem trojana.
Usunąłem go Spyware Doctor
i plik za niego odpowiedzialny KillBox'em

jednak dzisiaj znów pojawił się trojan.

oto moje logi

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:33:51, on 2009-04-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ABIT\ABIT uGuru\uGuru.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe E:\Program Files\DAEMON Tools Pro\DTProAgent.exe D:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe d:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.kotor2.pl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [GuruClock] C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [RemoteControl] "e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "E:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Pobierz wszystko przez FlashGet - C:\Program Files\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: &Pobrane przez FlashGet - C:\Program Files\FlashGet universal\ComDlls\Bholink.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\WINDOWS\ -- End of file - 6825 bytes

**Posty:** 18165 · przez **wojtas** 04 Kwi 2009, 18:32

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 1728 · przez **Sith[PL]** 04 Kwi 2009, 20:38

SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Macias on 2009-04-04 at 20:15 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\Program Files\Internet Explorer\setupapi.dll - Deleted C:\WINDOWS\system32\bb1.dat - Deleted C:\WINDOWS\system32\ps1.dat - Deleted C:\WINDOWS\system32\rc.dat - Deleted C:\WINDOWS\system32\rtc.dat - Deleted Removing Temp Files [b]ADS Check [/b]: C:\WINDOWS :EE1CC2304039434A 24 Total size: 24 bytes. WINDOWS: deleted 24 bytes in 1 streams. Checking for remaining Streams C:\WINDOWS No streams found. [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-04 20:24:41 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ca8a17f1] "ImagePath"="\SystemRoot\System32\drivers\ca8a17f1.sys" "Type"=dword:00000001 "Start"=dword:00000001 "ErrorControl"=dword:00000001 "F96ZK6nPB"="emVyb2VkaW4uaW5mbw==" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000000 "hdf12"=hex:ff,1f,9f,23,c6,75,55,eb,7f,ba,36,f4,1e,f5,16,84,07,ad,56,58,55,.. "p0"="E:\Program Files\DAEMON Tools Pro\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,01,a2,5d,d1,14,a7,52,d1,a1,b7,93,70,5f,32,97,42,47,.. "hdf12"=hex:ae,9e,5f,28,28,a4,5d,28,bf,3a,a4,3b,d7,2a,35,50,bc,4c,f0,c4,93,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:07,03,59,53,33,c9,17,e3,20,85,f5,05,c2,b1,43,1f,41,b9,b7,8b,64,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002] "a0"=hex:20,01,00,00,6b,f8,a5,bd,40,90,ee,bd,27,2c,05,dc,6c,1b,b9,c6,be,.. "hdf12"=hex:65,27,88,be,22,b7,17,0e,7a,69,d3,96,5e,4c,f7,6d,93,ff,c4,a8,35,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0] "hdf12"=hex:94,6b,4c,3b,b0,3e,43,be,52,16,47,aa,b2,98,67,73,3d,df,a7,ec,ef,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1] "hdf12"=hex:86,c4,e7,27,f3,38,59,14,11,e8,9c,33,19,ab,31,59,1e,4e,0c,61,19,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ca8a17f1] "ImagePath"="\SystemRoot\System32\drivers\ca8a17f1.sys" "Type"=dword:00000001 "Start"=dword:00000001 "ErrorControl"=dword:00000001 "F96ZK6nPB"="emVyb2VkaW4uaW5mbw==" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000000 "hdf12"=hex:ff,1f,9f,23,c6,75,55,eb,7f,ba,36,f4,1e,f5,16,84,07,ad,56,58,55,.. "p0"="E:\Program Files\DAEMON Tools Pro\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,01,a2,5d,d1,14,a7,52,d1,a1,b7,93,70,5f,32,97,42,47,.. "hdf12"=hex:ae,9e,5f,28,28,a4,5d,28,bf,3a,a4,3b,d7,2a,35,50,bc,4c,f0,c4,93,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:07,03,59,53,33,c9,17,e3,20,85,f5,05,c2,b1,43,1f,41,b9,b7,8b,64,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002] "a0"=hex:20,01,00,00,6b,f8,a5,bd,40,90,ee,bd,27,2c,05,dc,6c,1b,b9,c6,be,.. "hdf12"=hex:65,27,88,be,22,b7,17,0e,7a,69,d3,96,5e,4c,f7,6d,93,ff,c4,a8,35,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0] "hdf12"=hex:94,6b,4c,3b,b0,3e,43,be,52,16,47,aa,b2,98,67,73,3d,df,a7,ec,ef,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1] "hdf12"=hex:86,c4,e7,27,f3,38,59,14,11,e8,9c,33,19,ab,31,59,1e,4e,0c,61,19,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "H:\\pes2008\\PES2008.exe"="H:\\pes2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "C:\\Program Files\\Tlen.pl\\tlen.exe"="C:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl" "J:\\WAG200G.exe"="J:\\WAG200G.exe:*:Enabled:WAG200G" "D:\\pes2008\\PES2008.exe"="D:\\pes2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\\Documents and Settings\\Macias\\Pulpit\\xbins.exe"="C:\\Documents and Settings\\Macias\\Pulpit\\xbins.exe:*:Enabled:xbins" "E:\\Program Files\\BitComet\\BitComet.exe"="E:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\Java\\jre1.6.0_02\\launch4j-tmp\\JDownloader.exe"="C:\\Program Files\\Java\\jre1.6.0_02\\launch4j-tmp\\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Program Files\\RouterControl\\RouterControl.exe"="C:\\Program Files\\RouterControl\\RouterControl.exe:*:Enabled:RouterControl" "C:\\Program Files\\Java\\jre1.6.0_05\\launch4j-tmp\\JDownloader.exe"="C:\\Program Files\\Java\\jre1.6.0_05\\launch4j-tmp\\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary" "D:\\Steam\\SteamApps\\User\\Half-Life 2\\hl2.exe"="D:\\Steam\\SteamApps\\User\\Half-Life 2\\hl2.exe:*:Enabled:hl2" "D:\\Steam\\SteamApps\\xxxmaciass91xxx\\counter-strike\\hl.exe"="D:\\Steam\\SteamApps\\xxxmaciass91xxx\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\Program Files\\Kolekcja Klasyki\\Deus Ex\\System\\DeusEx.exe"="D:\\Program Files\\Kolekcja Klasyki\\Deus Ex\\System\\DeusEx.exe:*:Disabled:DeusEx" "D:\\LittleFighter2\\LF2_v2.0\\lf2.exe"="D:\\LittleFighter2\\LF2_v2.0\\lf2.exe:*:Enabled:lf2" "D:\\Program Files\\LucasArts\\STAR WARS Jedi Academy\\jamp.exe"="D:\\Program Files\\LucasArts\\STAR WARS Jedi Academy\\jamp.exe:*:Enabled:Jedi Academy MultiPlayer" "D:\\KotF Jedi Academy Expansion Pack\\GameData\\jamp.exe"="D:\\KotF Jedi Academy Expansion Pack\\GameData\\jamp.exe:*:Enabled:Jedi Academy MultiPlayer" "D:\\KotF Jedi Academy Expansion Pack\\GameData\\jampDed.exe"="D:\\KotF Jedi Academy Expansion Pack\\GameData\\jampDed.exe:*:Enabled:Jedi Academy MP Dedicated Server" "D:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"="D:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe:*:Enabled:Age of Empires 3" "C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"="C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"="C:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Program Files\\FlashGet universal\\FlashGet.exe"="C:\\Program Files\\FlashGet universal\\FlashGet.exe:*:Enabled:Flashget2" "C:\\Program Files\\FlashGet universal\\LiveUpdate.exe"="C:\\Program Files\\FlashGet universal\\LiveUpdate.exe:*:Enabled:FGLiveUpdate" "C:\\Program Files\\FlashGet universal\\LiveUpdateEx.exe"="C:\\Program Files\\FlashGet universal\\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx" "C:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"="C:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" "D:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"="D:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Disabled:Eksplorator Windows" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 3 Mar 2008 568 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg" Mon 3 Mar 2008 5,702 A..H. --- "C:\WINDOWS\nod32restoretemdono.reg" Mon 15 Dec 2008 24 ..SH. --- "C:\WINDOWS\S862D0123.tmp" Wed 4 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Thu 29 May 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 4 Aug 2004 60,928 A.SH. --- "C:\WINDOWS\ServicePackFiles\i386\msimn.exe" [b]Finished![/b]

ComboFix

Kod: Zaznacz wszystko: ComboFix 09-04-03.01 - Macias 2009-04-04 20:30:16.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1535.1110 [GMT 2:00] Uruchomiony z: c:\documents and settings\Macias\Pulpit\ComboFix.exe AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Macias\Dane aplikacji\BITS c:\documents and settings\Macias\Dane aplikacji\BITS\BITS.ini c:\documents and settings\Macias\Dane aplikacji\BITS\DHTTable.dat c:\documents and settings\Macias\Dane aplikacji\BITS\ProxyList.ini c:\documents and settings\Macias\Dane aplikacji\BITS\UPnP.ini c:\documents and settings\Macias\Dane aplikacji\EurekaLog c:\documents and settings\Macias\Dane aplikacji\EurekaLog\EurekaLog.ini c:\documents and settings\Macias\Dane aplikacji\inst.exe c:\documents and settings\Macias\Dane aplikacji\wiaserva.log c:\program files\Mozilla Firefox\setupapi.dll . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-04 do 2009-04-04 ))))))))))))))))))))))))))))))) . 2009-04-04 20:13 . 2009-04-04 20:13 <DIR> d-------- c:\windows\ERUNT 2009-04-04 20:06 . 2009-04-04 20:26 <DIR> d-------- C:\SDFix 2009-04-03 20:13 . 2009-04-04 14:30 <DIR> d-------- C:\!KillBox 2009-04-03 20:00 . 2009-04-03 20:03 <DIR> d-------- c:\program files\Spyware Doctor 2009-04-03 20:00 . 2009-04-03 20:03 <DIR> d-------- c:\program files\Common Files\PC Tools 2009-04-03 20:00 . 2009-04-03 20:00 <DIR> d-------- c:\documents and settings\Macias\Dane aplikacji\PC Tools 2009-04-03 20:00 . 2009-04-03 20:00 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Tools 2009-04-03 20:00 . 2008-12-11 08:38 159,600 --a------ c:\windows\system32\drivers\pctgntdi.sys 2009-04-03 20:00 . 2009-03-06 16:45 130,424 --a------ c:\windows\system32\drivers\PCTCore.sys 2009-04-03 20:00 . 2008-12-18 12:16 73,840 --a------ c:\windows\system32\drivers\PCTAppEvent.sys 2009-04-03 20:00 . 2008-12-10 12:36 64,392 --a------ c:\windows\system32\drivers\pctplsg.sys 2009-04-03 19:23 . 2009-04-04 20:32 83,294 --a------ c:\windows\system32\drivers\ca8a17f1.sys 2009-03-29 13:10 . 2009-03-29 13:10 <DIR> d-------- c:\program files\uTorrent 2009-03-29 13:10 . 2009-03-29 13:12 <DIR> d-------- c:\documents and settings\Macias\Dane aplikacji\uTorrent 2009-03-22 16:46 . 2009-03-22 16:58 101,287 --a------ c:\windows\system32\drivers\klin.dat 2009-03-22 16:46 . 2009-03-22 16:58 89,601 --a------ c:\windows\system32\drivers\klick.dat 2009-03-22 16:45 . 2009-04-04 20:26 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-03-22 16:45 . 2009-04-04 20:25 1,745,440 --ahs---- c:\windows\system32\drivers\fidbox.dat 2009-03-22 16:45 . 2009-04-04 20:26 393,248 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2009-03-22 16:45 . 2009-04-04 20:25 16,812 --ahs---- c:\windows\system32\drivers\fidbox.idx 2009-03-22 16:45 . 2009-04-04 20:26 4,520 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2009-03-22 16:44 . 2009-03-22 16:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-03-17 21:35 . 2009-03-17 21:39 <DIR> d-------- c:\windows\system32\embedded 2009-03-17 21:35 . 2002-06-06 15:38 139,264 --a------ c:\windows\system32\eax.dll 2009-03-13 23:30 . 2009-03-13 23:30 <DIR> d---s---- c:\documents and settings\Macias\UserData 2009-03-13 20:54 . 2009-03-13 20:55 <DIR> d-------- c:\program files\Windows Live 2009-03-13 20:54 . 2009-03-13 20:54 <DIR> d-------- c:\program files\Microsoft 2009-03-07 15:44 . 2009-03-07 15:44 <DIR> d-------- c:\documents and settings\Macias\Dane aplikacji\Acoustica 2009-03-04 23:06 . 2009-03-27 21:08 <DIR> d-------- c:\documents and settings\Macias\Dane aplikacji\ipla 2009-03-04 23:06 . 2009-03-04 23:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ipla 2009-03-04 23:05 . 2009-03-04 23:05 1,700,352 --a------ c:\windows\system32\gdiplus.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-04 18:26 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-31 20:08 --------- d-----w c:\program files\Java 2009-03-22 14:58 33,808 ----a-w c:\windows\system32\drivers\klbg.sys 2009-03-21 22:53 --------- d-----w c:\documents and settings\Macias\Dane aplikacji\Skype 2009-03-21 22:52 --------- d-----w c:\documents and settings\Macias\Dane aplikacji\skypePM 2009-03-17 10:51 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-16 18:34 --------- d-----w c:\documents and settings\Macias\Dane aplikacji\Winamp 2009-03-10 11:18 --------- d-----w c:\program files\Winamp 2009-03-09 03:19 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-02-25 10:11 --------- d-----w c:\program files\Windows Live SkyDrive 2009-02-25 10:05 --------- d-----w c:\program files\Common Files\Windows Live 2009-02-24 10:21 --------- d-----w c:\program files\Tlen.pl 2009-02-22 14:16 --------- d-----w c:\documents and settings\Macias\Dane aplikacji\Vso 2009-02-11 16:45 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DVD Shrink 2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll 2008-12-15 19:36 47,360 ----a-w c:\documents and settings\Macias\Dane aplikacji\pcouffin.sys 2008-05-08 11:53 22,328 ----a-w c:\documents and settings\Macias\Dane aplikacji\PnkBstrK.sys 2008-04-05 12:20 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2004-08-03 22:44 60,928 --sha-w c:\windows\ServicePackFiles\i386\msimn.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "SpeedX"="c:\progra~1\MyPortal\Speed-X\SpeedX.exe" [2006-06-27 46718] "DAEMON Tools Pro Agent"="e:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "AQQ"="d:\progra~1\WapSter\WAPSTE~1\AQQ.exe" [2009-02-25 4879360] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRTCLK"="c:\windows\system32\NVRTCLK\NVRTClk.exe" [2003-12-30 24576] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "GuruClock"="c:\program files\ABIT\ABIT uGuru\GuruClock.exe" [2004-10-06 4489280] "ABIT uGuru"="c:\program files\ABIT\ABIT uGuru\uGuru.exe" [2005-01-11 1695830] "WheelMouse"="c:\progra~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 192512] "RemoteControl"="e:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344] "AVP"="d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-03-22 206088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384] "nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Documents and Settings\\Macias\\Pulpit\\xbins.exe"= "c:\\Program Files\\Java\\jre1.6.0_02\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "c:\\Program Files\\RouterControl\\RouterControl.exe"= "c:\\Program Files\\Java\\jre1.6.0_05\\launch4j-tmp\\JDownloader.exe"= "d:\\Steam\\SteamApps\\User\\Half-Life 2\\hl2.exe"= "d:\\Steam\\SteamApps\\xxxmaciass91xxx\\counter-strike\\hl.exe"= "d:\\KotF Jedi Academy Expansion Pack\\GameData\\jamp.exe"= "d:\\KotF Jedi Academy Expansion Pack\\GameData\\jampDed.exe"= "c:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"= "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"= "d:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "13403:TCP"= 13403:TCP:BitComet 13403 TCP "13403:UDP"= 13403:UDP:BitComet 13403 UDP "55171:TCP"= 55171:TCP:*:Disabled:SolidNetworkManager "55171:UDP"= 55171:UDP:*:Disabled:SolidNetworkManager R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2008-09-08 39472] R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [2008-04-02 16640] R0 pctcore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-04-03 130424] R0 uGuru;uGuru;c:\windows\system32\drivers\uGuru.SYS [2008-04-02 10752] R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPortIO.sys [2008-04-03 3584] R2 sdauxservice;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-04-03 348752] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592] R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;c:\windows\system32\drivers\PhTVTune.sys [2008-04-03 24704] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] S2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2008-04-02 44928] S2 RadPciNT;RadPciNT;c:\windows\system32\drivers\RadPciNT.sys [2000-04-24 9417] S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [2004-08-25 9984] S3 FlyPCI;FlyPCI;c:\windows\system32\drivers\FlyPCI.sys [2008-04-03 4134] S3 im_bus;Paragon Image Mounter;c:\windows\system32\DRIVERS\imounter.sys --> c:\windows\system32\DRIVERS\imounter.sys [?] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2008-04-02 55936] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - mchinjdrv *Deregistered* - Winflash . Zawartość folderu 'Zaplanowane zadania' . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-UnlockerAssistant - c:\unlocker\UnlockerAssistant.exe . ------- Skan uzupełniający ------- . uStart Page = www.kotor2.pl uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local IE: &Pobierz wszystko przez FlashGet - c:\program files\FlashGet universal\ComDlls\Bhoall.htm IE: &Pobrane przez FlashGet - c:\program files\FlashGet universal\ComDlls\Bholink.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Macias\Dane aplikacji\Mozilla\Firefox\Profiles\s0o0drog.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ig?hl=pl&source=iglk FF - plugin: c:\documents and settings\Macias\Dane aplikacji\Mozilla\Firefox\Profiles\s0o0drog.default\extensions\SolidStateION@solidstatenetworks.com\plugins\npssn.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPBILLARD8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCARDS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll . . ------- Skojarzenia plików ------- . regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1 . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-04 20:32:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ca8a17f1] "ImagePath"="\SystemRoot\System32\drivers\ca8a17f1.sys" . Czas ukończenia: 2009-04-04 20:34:21 ComboFix-quarantined-files.txt 2009-04-04 18:34:18 Przed: 5 133 631 488 bajtów wolnych Po: 5,139,161,088 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 209

Hijack This

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:38:10, on 2009-04-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\ABIT\ABIT uGuru\uGuru.exe C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe E:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.kotor2.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [GuruClock] C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [RemoteControl] "e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "E:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Pobierz wszystko przez FlashGet - C:\Program Files\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: &Pobrane przez FlashGet - C:\Program Files\FlashGet universal\ComDlls\Bholink.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\WINDOWS\ -- End of file - 6854 bytes

**Posty:** 18165 · przez **wojtas** 05 Kwi 2009, 10:39

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 1728 · przez **Sith[PL]** 05 Kwi 2009, 17:36

raport ze skanowania.

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 niedziela, 5 kwiecień 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Sunday, April 05, 2009 15:56:33 Liczba wpisów: 2015080 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ G:\ H:\ I:\ J:\ K:\ M:\ Statystyki skanowania: Przeskanowanych plików: 55462 Nazwa zagrożenia: 2 Zainfekowanych obiektów: 2 Podejrzanych obiektów: 0 Czas skanowania: 01:08:51 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\Program Files\MyPortal\Speed-X\uninstall.exe Zainfekowany: not-a-virus:AdWare.Win32.BetterInternet.ih 1 D:\KotF Jedi Academy Expansion Pack\src\cmds\menucmds\cmdow.exe Zainfekowany: not-a-virus:RiskTool.Win32.HideWindows 1 Wybrany obszar został przeskanowany.

i FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 17:34:46 on Sunday, April 05, 2009 Time Zone : Logged On User : Macias Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 AMD Athlon(tm) 64 Processor 3000+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System System Drive Size : 20 GB System Drive Free : 10.65 GB Total Physical Memory: 1535 MB Free Physical Memory : 1054 MB Total Page File : 1535 MB Free Page File : 5634 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1968 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 05 Kwi 2009, 19:48

powinno byc ok

Autor postu otrzymał pochwałę

**Posty:** 1728 · przez **Sith[PL]** 05 Kwi 2009, 22:33

wielkie dzieki już nic nie wyskakuje ani nie ma niczego czym mógłbym się martwić. :lol:

Kto jest na forum