trojan.w32.looksky

**Posty:** 130 · przez **bil gates** 03 Paź 2007, 18:32

Witam dzisiaj wlaczylem komputer i wyskoczylo takie cos:

Kod: Zaznacz wszystko: Trojan.W32.Looksky detected on your machine. This virus is distrubuted via the internet throug email and active x objects. The worm has its own SMTP engine which means it gathers e-mails from your local cimputer and re-distributes itself. In worst cases this worm can allow attackers to acces your computer, this process should be removed from your system. Type virus System affected Windows 200,NT,ME,XP,Vista security risk 5 click yes to remove it from your PC

Moze cos sciagalem moze nie ale to nie ma znaczenia da sie usunac tego wirusa jakimis programami ? bo przewaznia jak mialem jakiegos trojana ktory ciagle spamowal programami "free spyware" to format i new windows :]. Bo zaden antywirus go nie mogl usunac a jak usunal to i tak byl :]. Programy adware rowniez wyszukal wirusa usunal skanowalem jeszcze raz i juz niby nie bylo go ale i tak spamowal dalej. I czy jak go usune i nie bedzie wyswietlal swoich reklam to mam 100 % pewnosci ze go nie mam ? bo mam duzo gier z konte i haslem. I sprawdzam jeszcze konto bankowe przez internet.

Posiadam Windows Xp professional sp2 z wszystkimi aktualizacjami i norton internet security 2007.

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:24:12, on 2007-10-03 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Apoint\HidFind.exe C:\program files\valve\steam\steam.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: MSVPS System - {ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1} - C:\WINDOWS\afxp.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: The netadv - {E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5} - C:\WINDOWS\netadv.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: msvb - {79359E7F-949C-4420-B116-40242099F77F} - C:\WINDOWS\msvb.dll O21 - SSODL: sysdx - {D7DB5B6A-A999-403C-95B4-995D30390B78} - C:\WINDOWS\sysdx.dll O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Iap - Dell Inc. - C:\Program Files\Dell\OpenManage\Client\Iap.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm -- End of file - 7635 bytes

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 18:35

jakos dziwnie loga wkleiles ( postaraj sie wpis pod wpisem )

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem nowy log z hijacka oraz combofixa

**Posty:** 130 · przez **bil gates** 03 Paź 2007, 19:07

wlaczylem tego smitfraufix poskanowal system, daj loga ze usunal kilka rzeczy, i koło zegarka znikenal ikonko ktora przypominala ze mam trojany i ikonki z pulpitu (ktore same sie wgraly i niby to byl ten free spywae) zmienily ikony na takie jak ktos usunie program a ikona zostaje. No i oczywiscie nie spamuje mi juz te pozostale programy nic nie wykryly, ale zostalo mi takie cos nie wiem czy to od tego trojana ale dopiero teraz to zauwazylem, lewy gorny róg
nie wiem co to moze byc:

http://img257.imageshack.us/my.php?image=capture1de3.jpg

log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:58, on 2007-10-03 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Apoint\HidFind.exe C:\program files\valve\steam\steam.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Wisdom-soft AutoScreenRecorder Free\AutoScreenRecorderFree.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\miq\Desktop\FixVundo.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\findstr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Iap - Dell Inc. - C:\Program Files\Dell\OpenManage\Client\Iap.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 7245 bytes

log z combofixa:

Kod: Zaznacz wszystko: ComboFix 07-10-03.7 - miq 2007-10-03 18:57:18.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.479 [GMT -7:00] Running from: C:\Documents and Settings\miq\Desktop\ComboFix.exe * Created a new restore point . [i] ADS - system32: deleted 61311 bytes in 2 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\miq\Favorites\Error Cleaner.url C:\Documents and Settings\miq\Favorites\Privacy Protector.url C:\Documents and Settings\miq\Favorites\Spyware&Malware Protection.url C:\WINDOWS\dat.txt C:\WINDOWS\rs.txt . ((((((((((((((((((((((((( Files Created from 2007-09-04 to 2007-10-04 ))))))))))))))))))))))))))))))) . 2007-10-03 18:47 <DIR> d-------- C:\Program Files\Capture-A-ScreenShot 2007-10-03 18:43 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-03 18:40 <DIR> d-------- C:\VundoFix Backups 2007-10-03 18:36 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-03 18:36 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-03 18:36 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-03 18:36 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-03 18:36 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-03 18:36 1,730 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-03 18:23 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-03 15:03 <DIR> d-------- C:\Program Files\SystemDefender 2007-10-03 14:57 81,920 --a------ C:\WINDOWS\netadv.dll 2007-10-03 14:51 32 --a------ C:\WINDOWS\system87sG.dat 2007-10-03 14:51 <DIR> d-------- C:\Program Files\English Translator 3 Demo 2007-10-02 00:08 <DIR> d-------- C:\WINDOWS\Data 2007-10-01 23:06 79,360 --a------ C:\WINDOWS\system32\CNBJMON2.DLL 2007-10-01 23:05 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-10-01 23:05 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-10-01 22:13 5,888 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2007-10-01 22:13 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-10-01 22:13 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-10-01 22:13 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-10-01 22:13 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-10-01 22:13 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-10-01 22:13 127,488 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2007-10-01 22:13 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-10-01 22:13 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-10-01 22:13 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-01 22:13 <DIR> d-------- C:\Program Files\Ahead 2007-09-30 09:24 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2007-09-30 09:24 <DIR> d-------- C:\Documents and Settings\miq\Application Data\SystemRequirementsLab 2007-09-30 01:03 <DIR> d-------- C:\Quake III Arena 2007-09-28 20:25 <DIR> d-------- C:\Program Files\Asprate 2007-09-26 20:23 <DIR> d-------- C:\Program Files\Acez Mp3 Wav Converter 2007-09-26 20:20 <DIR> d-------- C:\Program Files\Smart MP3 Converter 2007-09-26 19:47 <DIR> d-------- C:\Documents and Settings\miq\.thumbnails 2007-09-26 19:44 <DIR> d-------- C:\Program Files\GIMP-2.0 2007-09-26 19:44 <DIR> d-------- C:\Documents and Settings\miq\.gimp-2.2 2007-09-26 19:43 <DIR> d-------- C:\Program Files\Common Files\GTK 2007-09-26 14:50 <DIR> d-------- C:\Program Files\Audacity 2007-09-26 11:41 <DIR> d-------- C:\Program Files\ESTsoft 2007-09-26 11:41 <DIR> d-------- C:\Documents and Settings\miq\Application Data\ESTsoft 2007-09-26 11:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESTsoft 2007-09-26 10:35 545 --a------ C:\WINDOWS\UC.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-26 10:35 <DIR> d-------- C:\totalcmd 2007-09-26 10:10 <DIR> d-------- C:\Program Files\mp3DirectCut 2007-09-23 22:06 61,440 --a------ C:\WINDOWS\system32\KPower.dll 2007-09-23 22:06 307,200 --a------ C:\WINDOWS\system32\BMAPI.dll 2007-09-23 22:06 16,128 --a------ C:\WINDOWS\system32\drivers\APPDRV.SYS 2007-09-23 22:06 <DIR> d-------- C:\Documents and Settings\miq\Application Data\InstallShield 2007-09-23 22:06 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Dell 2007-09-23 22:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell 2007-09-23 21:42 172,032 --a------ C:\WINDOWS\system32\igfxres.dll 2007-09-23 21:37 282,624 --a------ C:\WINDOWS\stsystra.exe 2007-09-23 21:37 208,896 --a------ C:\WINDOWS\system32\stacapi.dll 2007-09-23 21:37 112,128 --a------ C:\WINDOWS\system32\staco.dll 2007-09-23 21:37 1,156,648 --a------ C:\WINDOWS\system32\drivers\sthda.sys 2007-09-23 21:37 1,052,672 --a------ C:\WINDOWS\system32\stlang.dll 2007-09-23 21:37 <DIR> d-------- C:\Program Files\SigmaTel 2007-09-23 21:35 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-09-23 21:35 400,152 --a------ C:\WINDOWS\system32\igxpun.exe 2007-09-23 21:35 24,576 --a------ C:\WINDOWS\system32\igfxexps.dll 2007-09-23 21:35 2,334,720 --a------ C:\WINDOWS\system32\iglicd32.dll 2007-09-23 21:35 166,680 --a------ C:\WINDOWS\system32\igfxext.exe 2007-09-23 21:35 138,008 --a------ C:\WINDOWS\system32\igfxtray.exe 2007-09-23 21:35 138,008 --a------ C:\WINDOWS\system32\igfxpers.exe 2007-09-23 21:35 135,168 --a------ C:\WINDOWS\system32\igfxdo.dll 2007-09-23 21:35 <DIR> d-------- C:\WINDOWS\system32\Lang 2007-09-23 21:20 <DIR> d-------- C:\Program Files\Wisdom-soft AutoScreenRecorder Free 2007-09-22 22:20 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Reallusion 2007-09-22 22:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield 2007-09-22 20:05 <DIR> d-------- C:\Program Files\Tibia 2007-09-22 20:05 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Tibia 2007-09-22 16:20 19,968 -ra------ C:\WINDOWS\system32\drivers\omci.sys 2007-09-22 16:14 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys 2007-09-22 16:14 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys 2007-09-22 16:06 <DIR> d-------- C:\Documents and Settings\miq\Contacts 2007-09-22 16:02 <DIR> d-------- C:\Program Files\MSN Messenger 2007-09-22 15:38 <DIR> d-------- C:\Documents and Settings\miq\Application Data\MSNInstaller 2007-09-22 15:18 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-09-22 15:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-09-22 15:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-22 02:08 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2007-09-22 02:08 <DIR> d-------- C:\Program Files\Intel Audio Studio 2007-09-22 02:07 41,728 --a------ C:\WINDOWS\system32\drivers\sfng32.sys 2007-09-22 02:06 <DIR> d-------- C:\Program Files\Intel Desktop Boards 2007-09-22 01:02 <DIR> d-------- C:\Documents and Settings\miq\Application Data\teamspeak2 2007-09-22 00:55 <DIR> d-------- C:\Program Files\BitLord 2007-09-22 00:55 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Skype 2007-09-22 00:54 <DIR> d-------- C:\Program Files\Skype 2007-09-22 00:54 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-22 00:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype 2007-09-21 21:49 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Gadu-Gadu 2007-09-21 21:47 <DIR> d-------- C:\Documents and Settings\miq\Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-22 12:29 300 --a------ C:\WINDOWS\system32\drivers\sthdae.log 2007-09-21 15:13 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-20 00:57 267112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-07-20 00:54 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-07-19 18:14 444776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-07-19 18:14 3727720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-07-19 18:14 1358192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-07-13 14:09 84768 --a------ C:\WINDOWS\system32\DellSys.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-12 01:17 C:\WINDOWS\system32\bthprops.cpl] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-30 11:42] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 14:13] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 18:10] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-09-21 16:26] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-03-30 20:00] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-03-30 20:00] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-03-30 19:59] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 C:\WINDOWS\stsystra.exe] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-07-20 16:55] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\valve\steam\steam.exe" [2007-09-21 16:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 00:39] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-31 17:40] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-03 17:32] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip] c:\program files\powerstrip\pstrip.exe R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" R3 USBCCID;USB Smart Card reader;C:\WINDOWS\system32\DRIVERS\usbccid.sys *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EDC12331-E47A-B81E-D43B-74C9E78B5193}] C:\WINDOWS\system32:lpr.exe . Contents of the 'Scheduled Tasks' folder "2007-09-29 03:13:39 C:\WINDOWS\Tasks\Norton AntiVirus - Meinen Computer prüfen - miq.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-03 18:59:15 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-10-03 19:00:27 C:\ComboFix-quarantined-files.txt ... 2007-10-03 18:59 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 19:23

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

skasuj ten wpis ^^

C:\WINDOWS\netadv.dll
C:\WINDOWS\system87sG.dat
C:\Program Files\SystemDefender
C:\VundoFix Backups

oraz te pogrubione do kosza ^^

potem nowe logi

Autor postu otrzymał pochwałę

**Posty:** 130 · przez **bil gates** 03 Paź 2007, 19:51

wszystko usuniete, logi :

hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:38, on 2007-10-03 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\igfxsrvc.exe C:\program files\valve\steam\steam.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cscript.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Iap - Dell Inc. - C:\Program Files\Dell\OpenManage\Client\Iap.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 7064 bytes

combofix:

Kod: Zaznacz wszystko: ComboFix 07-10-03.7 - miq 2007-10-03 19:37:42.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.424 [GMT -7:00] Running from: C:\Documents and Settings\miq\My Documents\antywir\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-04 to 2007-10-04 ))))))))))))))))))))))))))))))) . 2007-10-03 18:47 <DIR> d-------- C:\Program Files\Capture-A-ScreenShot 2007-10-03 18:43 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-03 18:40 <DIR> d-------- C:\VundoFix Backups 2007-10-03 18:36 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-03 18:36 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-03 18:36 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-03 18:36 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-03 18:36 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-03 18:36 1,730 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-03 18:23 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-03 14:51 <DIR> d-------- C:\Program Files\English Translator 3 Demo 2007-10-02 00:08 <DIR> d-------- C:\WINDOWS\Data 2007-10-01 23:06 79,360 --a------ C:\WINDOWS\system32\CNBJMON2.DLL 2007-10-01 23:05 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-10-01 23:05 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-10-01 22:13 5,888 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2007-10-01 22:13 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-10-01 22:13 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-10-01 22:13 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-10-01 22:13 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-10-01 22:13 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-10-01 22:13 127,488 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2007-10-01 22:13 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-10-01 22:13 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-10-01 22:13 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-01 22:13 <DIR> d-------- C:\Program Files\Ahead 2007-09-30 09:24 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2007-09-30 09:24 <DIR> d-------- C:\Documents and Settings\miq\Application Data\SystemRequirementsLab 2007-09-30 01:03 <DIR> d-------- C:\Quake III Arena 2007-09-28 20:25 <DIR> d-------- C:\Program Files\Asprate 2007-09-26 20:23 <DIR> d-------- C:\Program Files\Acez Mp3 Wav Converter 2007-09-26 20:20 <DIR> d-------- C:\Program Files\Smart MP3 Converter 2007-09-26 19:47 <DIR> d-------- C:\Documents and Settings\miq\.thumbnails 2007-09-26 19:44 <DIR> d-------- C:\Program Files\GIMP-2.0 2007-09-26 19:44 <DIR> d-------- C:\Documents and Settings\miq\.gimp-2.2 2007-09-26 19:43 <DIR> d-------- C:\Program Files\Common Files\GTK 2007-09-26 14:50 <DIR> d-------- C:\Program Files\Audacity 2007-09-26 11:41 <DIR> d-------- C:\Program Files\ESTsoft 2007-09-26 11:41 <DIR> d-------- C:\Documents and Settings\miq\Application Data\ESTsoft 2007-09-26 11:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESTsoft 2007-09-26 10:35 545 --a------ C:\WINDOWS\UC.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-26 10:35 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-26 10:35 <DIR> d-------- C:\totalcmd 2007-09-26 10:10 <DIR> d-------- C:\Program Files\mp3DirectCut 2007-09-23 22:06 61,440 --a------ C:\WINDOWS\system32\KPower.dll 2007-09-23 22:06 307,200 --a------ C:\WINDOWS\system32\BMAPI.dll 2007-09-23 22:06 16,128 --a------ C:\WINDOWS\system32\drivers\APPDRV.SYS 2007-09-23 22:06 <DIR> d-------- C:\Documents and Settings\miq\Application Data\InstallShield 2007-09-23 22:06 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Dell 2007-09-23 22:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell 2007-09-23 21:42 172,032 --a------ C:\WINDOWS\system32\igfxres.dll 2007-09-23 21:37 282,624 --a------ C:\WINDOWS\stsystra.exe 2007-09-23 21:37 208,896 --a------ C:\WINDOWS\system32\stacapi.dll 2007-09-23 21:37 112,128 --a------ C:\WINDOWS\system32\staco.dll 2007-09-23 21:37 1,156,648 --a------ C:\WINDOWS\system32\drivers\sthda.sys 2007-09-23 21:37 1,052,672 --a------ C:\WINDOWS\system32\stlang.dll 2007-09-23 21:37 <DIR> d-------- C:\Program Files\SigmaTel 2007-09-23 21:35 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2007-09-23 21:35 400,152 --a------ C:\WINDOWS\system32\igxpun.exe 2007-09-23 21:35 24,576 --a------ C:\WINDOWS\system32\igfxexps.dll 2007-09-23 21:35 2,334,720 --a------ C:\WINDOWS\system32\iglicd32.dll 2007-09-23 21:35 166,680 --a------ C:\WINDOWS\system32\igfxext.exe 2007-09-23 21:35 138,008 --a------ C:\WINDOWS\system32\igfxtray.exe 2007-09-23 21:35 138,008 --a------ C:\WINDOWS\system32\igfxpers.exe 2007-09-23 21:35 135,168 --a------ C:\WINDOWS\system32\igfxdo.dll 2007-09-23 21:35 <DIR> d-------- C:\WINDOWS\system32\Lang 2007-09-23 21:20 <DIR> d-------- C:\Program Files\Wisdom-soft AutoScreenRecorder Free 2007-09-22 22:20 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Reallusion 2007-09-22 22:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield 2007-09-22 20:05 <DIR> d-------- C:\Program Files\Tibia 2007-09-22 20:05 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Tibia 2007-09-22 16:20 19,968 -ra------ C:\WINDOWS\system32\drivers\omci.sys 2007-09-22 16:14 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys 2007-09-22 16:14 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys 2007-09-22 16:06 <DIR> d-------- C:\Documents and Settings\miq\Contacts 2007-09-22 16:02 <DIR> d-------- C:\Program Files\MSN Messenger 2007-09-22 15:38 <DIR> d-------- C:\Documents and Settings\miq\Application Data\MSNInstaller 2007-09-22 15:18 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-09-22 15:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-09-22 15:18 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-22 02:08 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2007-09-22 02:08 <DIR> d-------- C:\Program Files\Intel Audio Studio 2007-09-22 02:07 41,728 --a------ C:\WINDOWS\system32\drivers\sfng32.sys 2007-09-22 02:06 <DIR> d-------- C:\Program Files\Intel Desktop Boards 2007-09-22 01:02 <DIR> d-------- C:\Documents and Settings\miq\Application Data\teamspeak2 2007-09-22 00:55 <DIR> d-------- C:\Program Files\BitLord 2007-09-22 00:55 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Skype 2007-09-22 00:54 <DIR> d-------- C:\Program Files\Skype 2007-09-22 00:54 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-22 00:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype 2007-09-21 21:49 <DIR> d-------- C:\Documents and Settings\miq\Application Data\Gadu-Gadu 2007-09-21 21:47 <DIR> d-------- C:\Documents and Settings\miq\Gadu-Gadu 2007-09-21 21:46 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-09-21 21:30 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-09-21 20:43 1,277 --a------ C:\WINDOWS\mozver.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-22 12:29 300 --a------ C:\WINDOWS\system32\drivers\sthdae.log 2007-09-21 15:13 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-20 00:57 267112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-07-20 00:54 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-07-19 18:14 444776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-07-19 18:14 3727720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-07-19 18:14 1358192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-07-13 14:09 84768 --a------ C:\WINDOWS\system32\DellSys.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-12 01:17 C:\WINDOWS\system32\bthprops.cpl] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-30 11:42] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 14:13] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 18:10] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-09-21 16:26] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-03-30 20:00] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-03-30 20:00] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-03-30 19:59] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 C:\WINDOWS\stsystra.exe] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-07-20 16:55] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\valve\steam\steam.exe" [2007-09-21 16:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 00:39] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-31 17:40] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-03 17:32] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip] c:\program files\powerstrip\pstrip.exe R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" R3 USBCCID;USB Smart Card reader;C:\WINDOWS\system32\DRIVERS\usbccid.sys [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EDC12331-E47A-B81E-D43B-74C9E78B5193}] C:\WINDOWS\system32:lpr.exe . Contents of the 'Scheduled Tasks' folder "2007-09-29 03:13:39 C:\WINDOWS\Tasks\Norton AntiVirus - Meinen Computer prüfen - miq.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-03 19:39:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-03 19:40:31 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 20:02

juz powinno byc ok ale

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje
Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt

**Posty:** 130 · przez **bil gates** 03 Paź 2007, 20:46

Kod: Zaznacz wszystko: SDFix: Version 1.107 Run by miq on 2007-10-03 at 20:34 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Fri 21 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Wed 3 Oct 2007 303,104 A..H. --- "C:\Documents and Settings\miq\Desktop\Hypnotick Hook v2.1.6\Hypnotick Hook v2.1.6\Hypnotick Hook.dll" Finished!

**Posty:** 18165 · przez **wojtas** 03 Paź 2007, 20:46

jest czysto

**Posty:** 130 · przez **bil gates** 03 Paź 2007, 20:48

ok, dzieki bardzo ;p

trojan.w32.looksky

trojan.w32.looksky

Kto jest na forum