trojan

**Posty:** 3 · przez **Arot1987** 10 Lip 2008, 18:33

Witam mam problem z trojanem i nie potrafię sobie poradzić.
Jest to Win32:Trojan-gen {Other} i przykleił mi się do pliku
C:\WINDOWS\system32\opnlJyvu.dll
C:\WINDOWS\system32\yayxxVMF.dll

Log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:31:14, on 2008-07-10 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\ALWILS~1\Avast4\ashQuick.exe C:\Documents and Settings\Aro\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {C56CE3C0-210F-4C3F-87B1-2D9B3EF5FD21} - C:\WINDOWS\system32\byXQJDtr.dll O2 - BHO: (no name) - {C6EA321D-EE5F-4ED5-B1FF-3A87F9D81ABF} - C:\WINDOWS\system32\opnlJyvu.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [3c5382ab] rundll32.exe "C:\WINDOWS\system32\gvnotpvv.dll",b O4 - HKLM\..\Run: [BM3f60b137] Rundll32.exe "C:\WINDOWS\system32\fniedbxd.dll",s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SBE.tmp" /EF "HKCU" O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: opnlJyvu - C:\WINDOWS\SYSTEM32\opnlJyvu.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Z góry dziękuje za pomoc

**Posty:** 7956 · przez **Magik** 10 Lip 2008, 18:39

do tego log z combofix'a
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

i
by Mario
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

fix w HJt

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {C56CE3C0-210F-4C3F-87B1-2D9B3EF5FD21} - C:\WINDOWS\system32\byXQJDtr.dll O2 - BHO: (no name) - {C6EA321D-EE5F-4ED5-B1FF-3A87F9D81ABF} - C:\WINDOWS\system32\opnlJyvu.dll O4 - HKLM\..\Run: [3c5382ab] rundll32.exe "C:\WINDOWS\system32\gvnotpvv.dll",b O4 - HKLM\..\Run: [BM3f60b137] Rundll32.exe "C:\WINDOWS\system32\fniedbxd.dll",s O20 - Winlogon Notify: opnlJyvu - C:\WINDOWS\SYSTEM32\opnlJyvu.dll

Autor postu otrzymał pochwałę

**Posty:** 3 · przez **Arot1987** 10 Lip 2008, 19:11

Najpierw włączyłem tego combofix'a i oto log:

Kod: Zaznacz wszystko: ComboFix 08-07-09.5 - Aro 2008-07-10 18:48:25.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.140 [GMT 2:00] Running from: C:\Documents and Settings\Aro\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pskt.ini C:\WINDOWS\system32\byXQJDtr.dll C:\WINDOWS\system32\fniedbxd.dll C:\WINDOWS\system32\gvnotpvv.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\opnlJyvu.dll C:\WINDOWS\system32\rtDJQXyb.ini C:\WINDOWS\system32\rtDJQXyb.ini2 C:\WINDOWS\system32\vvptonvg.ini C:\WINDOWS\system32\yayxxVMF.dll . ((((((((((((((((((((((((( Files Created from 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))) . 2008-07-10 14:58 . 2008-07-10 18:18 110,492 --a------ C:\WINDOWS\BM3f60b137.xml 2008-07-10 14:20 . 2008-07-10 15:22 <DIR> d-------- C:\Documents and Settings\Aro\Dane aplikacji\Azureus 2008-07-10 14:20 . 2006-11-09 15:07 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl 2008-07-10 14:19 . 2008-07-10 14:20 <DIR> d-------- C:\Program Files\Java 2008-07-10 14:19 . 2008-07-10 14:19 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-10 14:19 . 2008-07-10 14:19 <DIR> d-------- C:\Program Files\Azureus 2008-07-08 16:31 . 2008-07-10 16:12 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-07-06 16:28 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-07-06 16:28 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-07-05 14:25 . 2008-07-05 14:25 <DIR> d-------- C:\Documents and Settings\Aro\Dane aplikacji\Media Player Classic 2008-07-05 13:15 . 2008-07-05 13:15 <DIR> d-------- C:\Program Files\Wapster 2008-07-05 13:15 . 2008-07-05 13:15 <DIR> d-------- C:\Documents and Settings\Aro\Wapster 2008-07-05 00:23 . 2008-07-05 00:24 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-07-05 00:23 . 2005-06-17 00:18 81,920 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-07-04 23:45 . 2008-07-04 23:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-07-04 23:43 . 2008-07-04 23:43 <DIR> d-------- C:\WINDOWS\nview 2008-07-04 23:43 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-07-04 23:43 . 2008-07-05 14:25 163,353 --a------ C:\WINDOWS\system32\nvapps.xml 2008-07-04 23:43 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-07-04 23:38 . 2008-07-04 23:38 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-04 23:38 . 2008-07-10 14:50 <DIR> d-------- C:\dc 2008-07-04 23:38 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2008-07-04 23:38 . 2003-03-18 20:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll 2008-07-04 23:34 . 2008-07-04 22:58 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-07-04 23:34 . 2008-07-04 23:34 <DIR> d-------- C:\NVIDIA 2008-07-04 23:34 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-07-04 23:32 . 2008-07-04 23:32 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-04 23:30 . 2008-07-04 23:30 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-07-04 23:30 . 2008-07-04 23:30 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-07-04 23:30 . 2008-07-04 23:30 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-07-04 23:28 . 2008-07-04 23:29 <DIR> d-------- C:\Program Files\Winamp 2008-07-04 23:28 . 2008-07-04 23:29 <DIR> d-------- C:\Documents and Settings\Aro\Dane aplikacji\Winamp 2008-07-04 23:19 . 2008-07-10 18:06 <DIR> d-------- C:\Program Files\DC++ 2008-07-04 23:17 . 2008-07-04 23:17 <DIR> d-------- C:\Program Files\Webteh 2008-07-04 23:17 . 2008-07-05 00:23 <DIR> d-------- C:\Program Files\ffdshow 2008-07-04 23:17 . 2008-07-04 23:17 <DIR> d-------- C:\Program Files\DirectShow Pack 2008-07-04 23:17 . 2003-06-23 02:44 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2008-07-04 23:17 . 2002-08-20 01:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2008-07-04 23:17 . 2004-07-29 02:23 401,408 --a------ C:\WINDOWS\system32\lameACM.acm 2008-07-04 23:17 . 2004-01-12 00:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-07-04 23:17 . 2002-01-05 13:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-07-04 23:17 . 2004-08-16 15:39 344,064 --a------ C:\WINDOWS\system32\MatroskaSplitter.ax 2008-07-04 23:17 . 2001-09-17 13:20 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll 2008-07-04 23:16 . 2008-07-04 23:16 <DIR> d-------- C:\Program Files\Elecard MPEG2 Decoder Package 2.0 2008-07-04 23:16 . 2008-07-04 23:16 <DIR> d-------- C:\Program Files\DivX 2008-07-04 23:16 . 2008-07-04 23:16 <DIR> d-------- C:\Program Files\Common Files\Elecard 2008-07-04 23:16 . 2008-07-04 23:16 209,635 --a------ C:\WINDOWS\IPUI_DivXG400.exe 2008-07-04 23:16 . 2008-07-04 23:16 180,224 --a------ C:\WINDOWS\system32\DivXG400.ax 2008-07-04 23:16 . 2008-07-04 23:16 20,996 --a------ C:\WINDOWS\system32\divxg400.htm 2008-07-04 23:16 . 2008-07-04 23:16 2,098 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2008-07-04 23:16 . 2008-07-04 23:16 56 -r-hs---- C:\WINDOWS\system32\7CEFAC3F77.sys 2008-07-04 23:14 . 2008-07-04 23:14 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-07-04 23:14 . 2008-07-04 23:14 <DIR> d-------- C:\Program Files\Microsoft Works 2008-07-04 23:14 . 2004-03-22 15:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2008-07-04 23:14 . 2008-07-04 23:39 526 --a------ C:\WINDOWS\ODBC.INI 2008-07-04 23:13 . 2008-07-04 23:14 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-07-04 23:08 . 2008-07-04 23:08 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-07-04 23:08 . 2008-07-05 13:16 <DIR> d-------- C:\Documents and Settings\Aro\Gadu-Gadu 2008-07-04 23:07 . 2008-07-04 23:07 <DIR> d-------- C:\Documents and Settings\Aro\Dane aplikacji\ABBYY 2008-07-04 23:05 . 2008-07-04 23:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ABBYY 2008-07-04 23:00 . 2008-07-04 23:00 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-07-04 23:00 . 2005-04-25 10:43 159,616 --a------ C:\WINDOWS\system32\drivers\Vax347b.sys 2008-07-04 23:00 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\Vax347s.sys 2008-07-04 21:18 . 2008-07-04 22:45 <DIR> d--h----- C:\Documents and Settings\Aro\Ustawienia lokalne 2008-07-04 21:18 . 2008-07-04 21:18 <DIR> dr------- C:\Documents and Settings\Aro\Ulubione 2008-07-04 21:18 . 2008-07-04 20:50 <DIR> d--h----- C:\Documents and Settings\Aro\Szablony 2008-07-04 21:18 . 2008-07-10 18:42 <DIR> d-------- C:\Documents and Settings\Aro\Pulpit 2008-07-04 21:18 . 2008-07-04 21:18 <DIR> dr------- C:\Documents and Settings\Aro\Moje dokumenty 2008-07-04 21:18 . 2008-07-04 23:08 <DIR> dr------- C:\Documents and Settings\Aro\Menu Start 2008-07-04 21:18 . 2008-07-10 14:20 <DIR> dr-h----- C:\Documents and Settings\Aro\Dane aplikacji 2008-07-04 21:18 . 2008-07-10 18:48 <DIR> d-------- C:\Documents and Settings\Aro 2008-07-04 21:00 . 2008-07-04 21:00 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2008-07-04 21:00 . 2008-07-04 21:00 <DIR> d--h----- C:\Documents and Settings\LocalService\Ustawienia lokalne 2008-07-04 21:00 . 2008-07-04 21:00 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji 2008-07-04 21:00 . 2008-07-04 21:00 <DIR> d--hs---- C:\Documents and Settings\LocalService . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 20:58 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-04 20:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\UDL 2008-07-04 20:57 --------- d-----w C:\Program Files\epson 2008-07-04 20:56 --------- d-----w C:\Documents and Settings\Aro\Dane aplikacji\InstallShield 2008-07-04 20:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\EPSON 2008-07-04 20:50 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-07-04 20:50 --------- d-----w C:\Program Files\AvRack 2008-07-04 20:49 4,096 ----a-w C:\WINDOWS\gdrv.sys 2008-07-04 20:49 --------- d-----w C:\Program Files\AMD 2008-07-04 18:54 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-04 18:52 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2005-07-20 20:00 15360] "EPSON Stylus DX8400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE" [2007-04-12 08:00 182272] "AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2006-12-21 23:27 2355448] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 15:07 49263] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2004-12-22 11:09 77824 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2005-07-20 20:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= "C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] . - - - - ORPHANS REMOVED - - - - HKLM-Run-3c5382ab - C:\WINDOWS\system32\gvnotpvv.dll HKLM-Run-BM3f60b137 - C:\WINDOWS\system32\fniedbxd.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-10 18:52:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\ComboFix\CreateC00 C:\ComboFix\CreateC00.bat scan completed successfully hidden files: 2 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe . ************************************************************************** . Completion time: 2008-07-10 18:55:04 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-10 16:54:34 Pre-Run: 47,361,073,152 bajtów wolnych Post-Run: 47,366,995,968 bajt˘w wolnych 180

potem zastosowałem tego SDFix'a:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.204 [/b] Run by Aro on 2008-07-10 at 19:00 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-10 19:03:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40] "ujdew"=hex:20,02,00,00,6c,ee,07,64,3c,c8,23,7b,3c,bc,0f,46,cb,a3,fd,02,86,.. "ljej40"=hex:f3,80,b4,b3,83,e0,19,32,8b,ff,ea,76,18,34,8b,0d,20,af,66,80,54,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120%" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "C:\\Program Files\\Wapster\\AQQ\\AQQ.exe"="C:\\Program Files\\Wapster\\AQQ\\AQQ.exe:*:Enabled:AQQ" "C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Fri 4 Jul 2008 56 ..SHR --- "C:\WINDOWS\system32\7CEFAC3F77.sys" Fri 4 Jul 2008 2,098 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" [b]Finished![/b]

Na koniec chciałem zrobić te fix w HJt

Ale po zrobieniu scana juz nie było tych:

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {C56CE3C0-210F-4C3F-87B1-2D9B3EF5FD21} - C:\WINDOWS\system32\byXQJDtr.dll O2 - BHO: (no name) - {C6EA321D-EE5F-4ED5-B1FF-3A87F9D81ABF} - C:\WINDOWS\system32\opnlJyvu.dll O4 - HKLM\..\Run: [3c5382ab] rundll32.exe "C:\WINDOWS\system32\gvnotpvv.dll",b O4 - HKLM\..\Run: [BM3f60b137] Rundll32.exe "C:\WINDOWS\system32\fniedbxd.dll",s O20 - Winlogon Notify: opnlJyvu - C:\WINDOWS\SYSTEM32\opnlJyvu.dll

HJt log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:05:30, on 2008-07-10 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Aro\Pulpit\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SBE.tmp" /EF "HKCU" O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 8001 · przez **Okocza** 10 Lip 2008, 19:13

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
skasuj ten plik do kosza:

C:\WINDOWS\BM3f60b137.xml

i bedzie OK

Autor postu otrzymał pochwałę

**Posty:** 3 · przez **Arot1987** 10 Lip 2008, 19:49

Wielkie dzięki.
okocza zrobiłem wszystko to co napisałeś

również dzięki za pomoc!

A skasować to normalnie ręcznie?

**Posty:** 8001 · przez **Okocza** 10 Lip 2008, 19:51

tak. możesz ręcznie.

trojan

trojan

Kto jest na forum