Trojan.win32.monderc.gen

**Posty:** 3 · przez **Adrian23** 21 Lut 2009, 21:53

Witam mam na kompie tego i wirusa i nie wiem ktore wpisy usunąć aby się go pozbyć. Czy mógłbym prosić o sprawdzenie logów?

Kod: Zaznacz wszystko: ComboFix 09-02-19.01 - Adam 2009-02-21 20:34:32.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.2046.1509 [GMT 1:00] Uruchomiony z: i:\documents and settings\Adam\Desktop\ComboFix.exe AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . i:\documents and settings\Adam\Application Data\BITS i:\documents and settings\Adam\Application Data\BITS\BITS.ini i:\documents and settings\Adam\Application Data\BITS\DHTTable.dat i:\documents and settings\Adam\Application Data\BITS\ProxyList.ini i:\documents and settings\Adam\Application Data\BITS\Torrent\20080910185043.torrent i:\documents and settings\Adam\Application Data\BITS\Torrent\20080910185043.torrent.~tmp i:\documents and settings\Adam\Application Data\BITS\Torrent\20080910185043.torrent.bits i:\documents and settings\Adam\Application Data\BITS\Torrent\20080910185043.torrent.filelist i:\documents and settings\Adam\Application Data\BITS\Torrent\20080910185043.torrent.seeds i:\documents and settings\Adam\Application Data\BITS\UPnP.ini I:\install.exe i:\program files\FlashGet Network i:\program files\FlashGet Network\FlashGet universal\dbtrans_verbose.log i:\program files\FlashGet Network\FlashGet universal\fgoption.ini i:\program files\FlashGet Network\FlashGet universal\P2PCfg.ini i:\program files\FlashGet Network\FlashGet universal\p2spmgr.ini i:\program files\FlashGet Network\FlashGet universal\p4spmgr.ini i:\program files\FlashGet Network\FlashGet universal\Profiles\config.dat i:\program files\FlashGet Network\FlashGet universal\Profiles\tasks.dat i:\program files\FlashGet Network\FlashGet universal\transaction.log . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-21 do 2009-02-21 ))))))))))))))))))))))))))))))) . 2009-02-18 22:09 . 2009-02-18 22:09 <DIR> d-------- i:\program files\PITy 2009-02-15 22:32 . 2009-02-15 22:32 <DIR> d-------- i:\documents and settings\Adam\Application Data\InstallShield 2009-02-15 22:19 . 2009-02-15 22:19 <DIR> d-------- i:\program files\Dzielenie i laczenie plikow 2009-02-14 17:16 . 2009-02-14 17:16 <DIR> d-------- i:\documents and settings\All Users\Application Data\Electronic Arts 2009-02-14 16:14 . 2009-02-14 16:14 <DIR> d-------- i:\program files\EA Games 2009-02-09 23:00 . 2009-02-09 21:05 15,688 --a------ i:\windows\system32\lsdelete.exe 2009-02-09 21:05 . 2009-02-09 21:05 64,160 --a------ i:\windows\system32\drivers\Lbd.sys 2009-02-09 20:57 . 2009-02-09 20:57 <DIR> d--h-c--- i:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-02-09 20:55 . 2009-02-09 20:55 <DIR> d-------- i:\program files\Lavasoft 2009-02-09 20:55 . 2009-02-09 21:05 <DIR> d-------- i:\documents and settings\All Users\Application Data\Lavasoft 2009-02-09 20:49 . 2009-02-09 20:49 <DIR> d-------- i:\program files\jv16 PowerTools 2009-02-09 20:35 . 2009-02-09 20:49 <DIR> d-------- i:\program files\RegCleaner 2009-02-07 14:38 . 2009-02-07 14:38 <DIR> d-------- i:\program files\DVR212D 2009-01-31 13:57 . 2009-02-20 23:29 <DIR> d-------- i:\program files\ALLPlayer 2009-01-28 22:23 . 2009-01-28 22:41 <DIR> d-a------ i:\documents and settings\All Users\Application Data\TEMP 2009-01-25 14:21 . 2009-02-19 19:18 <DIR> d-------- i:\documents and settings\Adam\Application Data\gtk-2.0 2009-01-25 14:18 . 2009-01-25 14:18 <DIR> d-------- i:\documents and settings\Adam\.thumbnails 2009-01-25 14:17 . 2009-02-19 19:46 <DIR> d-------- i:\documents and settings\Adam\.gimp-2.6 2009-01-25 14:17 . 2009-01-25 14:17 <DIR> d-------- i:\documents and settings\Adam\.gegl-0.0 2009-01-25 14:16 . 2009-01-25 14:16 <DIR> d-------- i:\program files\GIMP-2.0 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-21 19:36 2,657,312 --sha-w i:\windows\system32\drivers\fidbox2.dat 2009-02-21 19:35 47,317,792 --sha-w i:\windows\system32\drivers\fidbox.dat 2009-02-21 19:21 --------- d-----w i:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-02-21 19:18 653,480 --sha-w i:\windows\system32\drivers\fidbox.idx 2009-02-21 19:18 252,680 --sha-w i:\windows\system32\drivers\fidbox2.idx 2009-02-21 19:18 --------- d-----w i:\program files\DC++ 2009-02-21 19:18 --------- d-----w i:\documents and settings\Adam\Application Data\Azureus 2009-02-16 20:45 --------- d-----w i:\program files\Ubisoft 2009-02-15 21:33 --------- d--h--w i:\program files\InstallShield Installation Information 2009-02-14 15:13 --------- d-----w i:\program files\Common Files\Wise Installation Wizard 2009-02-14 15:13 --------- d-----w i:\program files\AGEIA Technologies 2009-02-09 19:42 --------- d-----w i:\program files\Gothic III 2009-02-09 19:14 --------- d-----w i:\program files\NAPI-PROJEKT 2009-02-07 11:37 --------- d-----w i:\program files\Vuze 2009-02-03 21:39 89,601 ----a-w i:\windows\system32\drivers\klick.dat 2009-02-03 21:39 101,287 ----a-w i:\windows\system32\drivers\klin.dat 2008-12-26 21:39 --------- d-----w i:\program files\WorldOfGoo 2008-12-26 21:39 --------- d-----w i:\documents and settings\All Users\Application Data\2DBoy 2008-12-19 14:16 410,984 ----a-w i:\windows\system32\deploytk.dll 2008-12-18 22:10 1,700,352 ----a-w i:\windows\system32\gdiplus.dll 2008-12-18 22:10 1,060,864 ----a-w i:\windows\system32\mfc71.dll 2008-12-18 20:18 2,855 ----a-w i:\windows\PIF\setup.PIF 2008-12-05 16:05 202,000 ----a-w i:\windows\system32\PnkBstrB.exe 2008-11-24 19:44 682,280 ----a-w i:\windows\system32\pbsvc.exe 2008-11-24 19:44 22,328 ----a-w i:\documents and settings\Adam\Application Data\PnkBstrK.sys 2008-11-24 19:22 66,872 ----a-w i:\windows\system32\PnkBstrA.exe 2008-11-19 17:43 18,432 ----a-w i:\documents and settings\Adam\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-10-02 15:44 325000 --a------ i:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "i:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "i:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="i:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Lite"="i:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520] "ALLUpdate"="i:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600] "QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "StartCCC"="i:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440] "Ad-Watch"="i:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-09 509784] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 i:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 i:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="i:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "i:\\Program Files\\DC++\\DCPlusPlus.exe"= "i:\\Program Files\\Vuze\\Azureus.exe"= "i:\\Program Files\\Gadu-Gadu\\gg.exe"= "i:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"= "i:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= "i:\\Program Files\\TmNationsForever\\TmForever.exe"= "i:\\Program Files\\Codemasters\\GRID\\GRID.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "i:\\Program Files\\uTorrent\\uTorrent.exe"= "i:\\Program Files\\DNA\\btdna.exe"= "i:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe"= "i:\\WINDOWS\\system32\\PnkBstrA.exe"= "i:\\WINDOWS\\system32\\PnkBstrB.exe"= "i:\\Documents and Settings\\Adam\\Desktop\\telewizja.exe"= "i:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "i:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "i:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "i:\\Program Files\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"= R0 Lbd;Lbd;i:\windows\system32\drivers\Lbd.sys [2009-02-09 64160] R2 ASKService;ASKService;i:\program files\AskBarDis\bar\bin\AskService.exe [2008-10-16 460168] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;i:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] R3 AtiHdmiService;ATI Function Driver for HDMI Service;i:\windows\system32\drivers\AtiHdmi.sys [2008-07-02 89600] R3 klim5;Kaspersky Anti-Virus NDIS Filter;i:\windows\system32\drivers\klim5.sys [2007-12-13 24592] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3150b2cd-84c2-11dd-ac4b-00508db7ea06}] \Shell\AutoRun\command - D:\DTSP_Launcher.exe . Zawartość folderu 'Zaplanowane zadania' 2009-02-16 i:\windows\Tasks\Ad-Aware Update (Weekly).job - i:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-09 21:05] 2009-02-19 i:\windows\Tasks\AppleSoftwareUpdate.job - i:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - i:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 TCP: {0C41F997-95AF-4286-AD53-52CFB15851EB} = 80.54.146.40 80.54.146.40 FF - ProfilePath - i:\documents and settings\Adam\Application Data\Mozilla\Firefox\Profiles\enj4exyj.default\ FF - prefs.js: browser.startup.homepage - www.onet.pl FF - plugin: i:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: i:\program files\Mozilla Firefox\plugins\NPBOARDS.dll FF - plugin: i:\program files\Mozilla Firefox\plugins\npdjvu.dll FF - plugin: i:\program files\Mozilla Firefox\plugins\npganymedenet.dll . . ------- Skojarzenia plików ------- . . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-21 20:36:41 Windows 5.1.2600 Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** "ServiceDll"="i:\windows\system32\es.dll" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.328+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] -- [RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.657+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="i:\docume~1\Adam\LOCALS~1\Temp\Rar$EX04.328\ [RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart" "ImagePath"="i:\docume~1\Adam\LOCALS~1\Temp\Rar$EX04.657\ [RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.328+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="i:\docume~1\Adam\LOCALS~1\Temp\Rar$EX04.328\ [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.657+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="i:\docume~1\Adam\LOCALS~1\Temp\Rar$EX04.657\ . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1844237615-790525478-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:77,60,69,21,b7,ed,f8,80,0a,df,e2,0e,fb,c2,f8,f3,da,8a,21,96,12, 13,70,6a,cc,93,97,17,29,5a,13,87,b4,df,fb,28,38,92,23,27,87,25,97,58,81,0d,\ "rkeysecu"=hex:08,d5,bd,47,59,c8,7a,96,1e,a2,af,e8,93,41,1a,15 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1060) i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll i:\windows\system32\Ati2evxx.dll i:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(1116) i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll . Czas ukończenia: 2009-02-21 20:37:40 ComboFix-quarantined-files.txt 2009-02-21 19:37:38 Przed: 7 290 953 728 bytes free Po: 7,540,916,224 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4 217 --- E O F --- 2009-02-11 17:57:41

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:46:57, on 2009-02-21 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: I:\WINDOWS\System32\smss.exe I:\WINDOWS\system32\winlogon.exe I:\WINDOWS\system32\services.exe I:\WINDOWS\system32\lsass.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\svchost.exe I:\WINDOWS\System32\svchost.exe I:\Program Files\Lavasoft\Ad-Aware\AAWService.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\spoolsv.exe I:\WINDOWS\RTHDCPL.EXE I:\Program Files\Java\jre6\bin\jusched.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe I:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe I:\WINDOWS\system32\ctfmon.exe I:\Program Files\DAEMON Tools Lite\daemon.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe I:\Program Files\AskBarDis\bar\bin\AskService.exe I:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe I:\Program Files\Java\jre6\bin\jqs.exe I:\Program Files\CDBurnerXP\NMSAccessU.exe I:\WINDOWS\system32\PnkBstrA.exe I:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe I:\WINDOWS\system32\notepad.exe I:\WINDOWS\explorer.exe I:\Program Files\Mozilla Firefox\firefox.exe I:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - I:\Program Files\AskBarDis\bar\bin\askBar.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - I:\Program Files\AskBarDis\bar\bin\askBar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [Ad-Watch] I:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "I:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [ALLUpdate] "I:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: LCS.lnk = ? O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://I:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - I:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{0C41F997-95AF-4286-AD53-52CFB15851EB}: NameServer = 80.54.146.40 80.54.146.40 O17 - HKLM\System\CS1\Services\Tcpip\..\{0C41F997-95AF-4286-AD53-52CFB15851EB}: NameServer = 80.54.146.40 80.54.146.40 O17 - HKLM\System\CS4\Services\Tcpip\..\{0C41F997-95AF-4286-AD53-52CFB15851EB}: NameServer = 80.54.146.40 80.54.146.40 O23 - Service: ASKService - Unknown owner - I:\Program Files\AskBarDis\bar\bin\AskService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - I:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.328+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe - Unknown owner - I:\WINDOWS\ O23 - Service: FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.657+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe - Unknown owner - I:\WINDOWS\ O23 - Service: hpdj - Unknown owner - I:\DOCUME~1\Adam\LOCALS~1\Temp\hpdj.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: NMSAccessU - Unknown owner - I:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: PnkBstrA - Unknown owner - I:\WINDOWS\system32\PnkBstrA.exe -- End of file - 5933 bytes ]

**Posty:** 18165 · przez **wojtas** 22 Lut 2009, 12:44

skasuj te wpisy w hijacku:

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - I:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - I:\Program Files\AskBarDis\bar\bin\askBar.dll

wklej do notatnika:

Folder::
i:\program files\AskBarDis

Driver::
hpdj
FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.328+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe
FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.657+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 3 · przez **Adrian23** 22 Lut 2009, 14:41

Kod: Zaznacz wszystko: ComboFix 09-02-21.01 - Adam 2009-02-22 13:11:56.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.2046.1553 [GMT 1:00] Uruchomiony z: i:\documents and settings\Adam\Desktop\ComboFix.exe Użyto następujących komend :: i:\documents and settings\Adam\Desktop\CFScript.txt AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . i:\program files\AskBarDis i:\program files\AskBarDis\bar\bin\askPopStp.dll i:\program files\AskBarDis\bar\bin\AskService.exe i:\program files\AskBarDis\bar\bin\psvince.dll i:\program files\AskBarDis\bar\Cache\[u]0[/u]0460EA1.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]046124B.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]046141F.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]04615E5.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]04617E8.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]04619CD.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]0461BD0.bin i:\program files\AskBarDis\bar\Cache\[u]0[/u]0ACF894 i:\program files\AskBarDis\bar\Cache\files.ini i:\program files\AskBarDis\bar\History\search i:\program files\AskBarDis\bar\Settings\config.dat i:\program files\AskBarDis\bar\Settings\config.dat.bak i:\program files\AskBarDis\bar\Settings\prevcfg.htm i:\program files\AskBarDis\bar\Settings\prevCfg2.htm i:\program files\AskBarDis\unins000.dat i:\program files\AskBarDis\unins000.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FAH@I:+DOCUME~1+ADAM+LOCALS~1+TEMP+RAR$EX04.328+[RAZOR1911][WEB_SEED]_FAR_CRY_2_CRACK_-_REAL_100%_FULLY_WORKING+FAH.EXE -------\Legacy_FAH@I:+DOCUME~1+ADAM+LOCALS~1+TEMP+RAR$EX04.657+[RAZOR1911][WEB_SEED]_FAR_CRY_2_CRACK_-_REAL_100%_FULLY_WORKING+FAH.EXE -------\Legacy_HPDJ -------\Service_FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.328+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe -------\Service_FAH@I:+DOCUME~1+Adam+LOCALS~1+Temp+Rar$EX04.657+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe -------\Service_hpdj ((((((((((((((((((((((((( Pliki utworzone od 2009-01-22 do 2009-02-22 ))))))))))))))))))))))))))))))) . 2009-02-21 21:22 . 2009-02-21 21:22 <DIR> d-------- i:\program files\CCleaner 2009-02-21 20:46 . 2009-02-21 20:46 <DIR> d-------- i:\program files\Trend Micro 2009-02-18 22:09 . 2009-02-18 22:09 <DIR> d-------- i:\program files\PITy 2009-02-15 22:32 . 2009-02-15 22:32 <DIR> d-------- i:\documents and settings\Adam\Application Data\InstallShield 2009-02-15 22:19 . 2009-02-15 22:19 <DIR> d-------- i:\program files\Dzielenie i laczenie plikow 2009-02-14 17:16 . 2009-02-14 17:16 <DIR> d-------- i:\documents and settings\All Users\Application Data\Electronic Arts 2009-02-14 16:14 . 2009-02-14 16:14 <DIR> d-------- i:\program files\EA Games 2009-02-09 23:00 . 2009-02-09 21:05 15,688 --a------ i:\windows\system32\lsdelete.exe 2009-02-09 21:05 . 2009-02-09 21:05 64,160 --a------ i:\windows\system32\drivers\Lbd.sys 2009-02-09 20:57 . 2009-02-09 20:57 <DIR> d--h-c--- i:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-02-09 20:55 . 2009-02-09 20:55 <DIR> d-------- i:\program files\Lavasoft 2009-02-09 20:55 . 2009-02-09 21:05 <DIR> d-------- i:\documents and settings\All Users\Application Data\Lavasoft 2009-02-09 20:49 . 2009-02-09 20:49 <DIR> d-------- i:\program files\jv16 PowerTools 2009-02-09 20:35 . 2009-02-09 20:49 <DIR> d-------- i:\program files\RegCleaner 2009-02-07 14:38 . 2009-02-07 14:38 <DIR> d-------- i:\program files\DVR212D 2009-01-31 13:57 . 2009-02-20 23:29 <DIR> d-------- i:\program files\ALLPlayer 2009-01-28 22:23 . 2009-01-28 22:41 <DIR> d-a------ i:\documents and settings\All Users\Application Data\TEMP 2009-01-25 14:21 . 2009-02-19 19:18 <DIR> d-------- i:\documents and settings\Adam\Application Data\gtk-2.0 2009-01-25 14:18 . 2009-01-25 14:18 <DIR> d-------- i:\documents and settings\Adam\.thumbnails 2009-01-25 14:17 . 2009-02-19 19:46 <DIR> d-------- i:\documents and settings\Adam\.gimp-2.6 2009-01-25 14:17 . 2009-01-25 14:17 <DIR> d-------- i:\documents and settings\Adam\.gegl-0.0 2009-01-25 14:16 . 2009-01-25 14:16 <DIR> d-------- i:\program files\GIMP-2.0 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-22 12:16 47,559,712 --sha-w i:\windows\system32\drivers\fidbox.dat 2009-02-22 12:16 2,667,552 --sha-w i:\windows\system32\drivers\fidbox2.dat 2009-02-22 12:15 657,776 --sha-w i:\windows\system32\drivers\fidbox.idx 2009-02-22 12:15 254,216 --sha-w i:\windows\system32\drivers\fidbox2.idx 2009-02-22 12:08 --------- d-----w i:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-02-21 23:20 --------- d-----w i:\documents and settings\Adam\Application Data\Azureus 2009-02-21 20:26 --------- d-----w i:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-02-21 19:18 --------- d-----w i:\program files\DC++ 2009-02-16 20:45 --------- d-----w i:\program files\Ubisoft 2009-02-15 21:33 --------- d--h--w i:\program files\InstallShield Installation Information 2009-02-14 15:13 --------- d-----w i:\program files\Common Files\Wise Installation Wizard 2009-02-14 15:13 --------- d-----w i:\program files\AGEIA Technologies 2009-02-09 19:42 --------- d-----w i:\program files\Gothic III 2009-02-09 19:14 --------- d-----w i:\program files\NAPI-PROJEKT 2009-02-07 11:37 --------- d-----w i:\program files\Vuze 2009-02-03 21:39 89,601 ----a-w i:\windows\system32\drivers\klick.dat 2009-02-03 21:39 101,287 ----a-w i:\windows\system32\drivers\klin.dat 2008-12-26 21:39 --------- d-----w i:\program files\WorldOfGoo 2008-12-26 21:39 --------- d-----w i:\documents and settings\All Users\Application Data\2DBoy 2008-11-24 19:44 22,328 ----a-w i:\documents and settings\Adam\Application Data\PnkBstrK.sys 2008-11-19 17:43 18,432 ----a-w i:\documents and settings\Adam\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((( SnapShot@2009-02-21_20.37.04,56 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w i:\windows\ERDNT\subs\ERDNT.EXE + 2009-02-22 12:17:24 16,384 ----atw i:\windows\Temp\Perflib_Perfdata_7ac.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="i:\windows\system32\ctfmon.exe" [2008-04-14 15360] "ALLUpdate"="i:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600] "QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "StartCCC"="i:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440] "Ad-Watch"="i:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-09 509784] "AVP"="i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 227856] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 i:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 i:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="i:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-12-10 10:02 216520 i:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "i:\\Program Files\\DC++\\DCPlusPlus.exe"= "i:\\Program Files\\Vuze\\Azureus.exe"= "i:\\Program Files\\Gadu-Gadu\\gg.exe"= "i:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"= "i:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= "i:\\Program Files\\TmNationsForever\\TmForever.exe"= "i:\\Program Files\\Codemasters\\GRID\\GRID.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "i:\\Program Files\\uTorrent\\uTorrent.exe"= "i:\\Program Files\\DNA\\btdna.exe"= "i:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe"= "i:\\WINDOWS\\system32\\PnkBstrA.exe"= "i:\\WINDOWS\\system32\\PnkBstrB.exe"= "i:\\Documents and Settings\\Adam\\Desktop\\telewizja.exe"= "i:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "i:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "i:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "i:\\Program Files\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"= R0 Lbd;Lbd;i:\windows\system32\drivers\Lbd.sys [2009-02-09 64160] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;i:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] R3 AtiHdmiService;ATI Function Driver for HDMI Service;i:\windows\system32\drivers\AtiHdmi.sys [2008-07-02 89600] R3 klim5;Kaspersky Anti-Virus NDIS Filter;i:\windows\system32\drivers\klim5.sys [2007-12-13 24592] S2 ASKService;ASKService;i:\program files\AskBarDis\bar\bin\AskService.exe --> i:\program files\AskBarDis\bar\bin\AskService.exe [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3150b2cd-84c2-11dd-ac4b-00508db7ea06}] \Shell\AutoRun\command - D:\DTSP_Launcher.exe . Zawartość folderu 'Zaplanowane zadania' 2009-02-16 i:\windows\Tasks\Ad-Aware Update (Weekly).job - i:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-09 21:05] 2009-02-19 i:\windows\Tasks\AppleSoftwareUpdate.job - i:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - i:\program files\AskBarDis\bar\bin\askBar.dll . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - i:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 TCP: {0C41F997-95AF-4286-AD53-52CFB15851EB} = 80.54.146.40 80.54.146.40 FF - ProfilePath - i:\documents and settings\Adam\Application Data\Mozilla\Firefox\Profiles\enj4exyj.default\ FF - prefs.js: browser.startup.homepage - www.onet.pl FF - plugin: i:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: i:\program files\Mozilla Firefox\plugins\NPBOARDS.dll FF - plugin: i:\program files\Mozilla Firefox\plugins\npdjvu.dll FF - plugin: i:\program files\Mozilla Firefox\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-22 13:17:47 Windows 5.1.2600 Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1844237615-790525478-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:77,60,69,21,b7,ed,f8,80,0a,df,e2,0e,fb,c2,f8,f3,da,8a,21,96,12, 13,70,6a,cc,93,97,17,29,5a,13,87,b4,df,fb,28,38,92,23,27,87,25,97,58,81,0d,\ "rkeysecu"=hex:08,d5,bd,47,59,c8,7a,96,1e,a2,af,e8,93,41,1a,15 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1064) i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll i:\windows\system32\Ati2evxx.dll i:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(1120) i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll i:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . i:\windows\system32\ati2evxx.exe i:\windows\system32\ati2evxx.exe i:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe i:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe i:\program files\Java\jre6\bin\jqs.exe i:\program files\CDBurnerXP\NMSAccessU.exe i:\windows\system32\PnkBstrA.exe i:\windows\system32\wbem\unsecapp.exe i:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-02-22 13:21:32 - komputer został uruchomiony ponownie [Adam] ComboFix-quarantined-files.txt 2009-02-22 12:21:29 ComboFix2.txt 2009-02-21 19:37:45 Przed: 7 278 706 688 bytes free Po: 7,198,302,208 bajtów wolnych Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4 212 --- E O F --- 2009-02-11 17:57:41

**Posty:** 18165 · przez **wojtas** 22 Lut 2009, 16:24

Start => Uruchom => cmd =>

sc stop ASKService

enter

sc delete ASKService

enter

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Autor postu otrzymał pochwałę

**Posty:** 3 · przez **Adrian23** 24 Lut 2009, 23:21

Zrobiłem wszystko tak jak napisałeś, kaspersky nic nie wykrył więc komputer powinien już być czysty. Dzięki za pomoc.