wielka prosba o sprawdzenie loga

**Posty:** 84 · przez **zooo** 12 Wrz 2007, 22:42

Witam!!! mam wielka prosbe o sprawdzenie logow. kompi mi muli i co jakis czas mi wyskakuje stroana www.mp3goodies.com. wogole nie moge nic robic, bo ta stronka sama i co jakis czas wyskakuje pls help!!!
Oto logi:

1. HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 22:38, on 2007-09-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\NOTEPAD.EXE E:\dodatki\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O1 - Hosts: 69.80.225.31 nprotect.ryl.com.my O1 - Hosts: 72.232.248.222 nprotect.battlelands.net O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 4908 bytes

2.ComboScan:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by SZEWCO on 2007-09-12 at 22:37:28 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as SZEWCO.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 22:37, on 2007-09-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\csrs.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe E:\dodatki\comboscan.exe E:\dodatki\SZEWCO.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O1 - Hosts: 69.80.225.31 nprotect.ryl.com.my O1 - Hosts: 72.232.248.222 nprotect.battlelands.net O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- Files created between 2007-08-12 and 2007-09-12 ----------------------------- 2007-09-07 17:21:35 17664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-09-07 17:21:35 29184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys<BRGSP5~1.SYS> 2007-09-07 17:21:35 20608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-09-07 17:21:35 0 d-------- C:\Program Files\SAGEM WiFi manager<SAGEMW~1> 2007-09-07 17:21:28 0 d-------- C:\Program Files\SAGEM 2007-09-07 17:20:50 402432 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-09-07 17:20:50 493440 --a------ C:\WINDOWS\system32\drivers\WlanBZ64.SYS 2007-09-07 17:20:43 31744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys<ZDPSP5~1.SYS> 2007-09-03 05:27:36 122880 --a------ C:\Documents and Settings\SZEWCO\9332736.dll 2007-08-30 14:19:26 122880 --a------ C:\Documents and Settings\SZEWCO\830121926.dll<830121~1.DLL> 2007-08-25 10:07:15 55004 --a------ C:\WINDOWS\system32\xpdx.sys 2007-08-25 07:56:04 0 d-------- C:\Program Files\SD EnterNET<SDENTE~1> 2007-08-24 22:01:32 834790 --a------ C:\Program Files\LRGHZFLV3UIO56B6TPWTUKZPVRYJRU5C Free-Games_Navy_Field_Resurrection_Of_The_Steel_Fleet_1175.exe<LRGHZF~1.EXE> 2007-08-24 13:50:25 0 d-------- C:\NavyFIELD_WorldLeague2007_FullClient<NAVYFI~1> 2007-08-21 22:02:07 0 d-------- C:\Program Files\mIRC 2007-08-20 14:34:28 0 d-------- C:\Fishing Simulator 2<FISHIN~1> 2007-08-19 11:02:17 0 d-------- C:\Program Files\Wedkarz 2007-08-18 00:07:27 0 d-------- C:\psyBNC-2.3.2-7<PSYBNC~1.2-7> 2007-08-17 20:21:14 8704 --a------ C:\WINDOWS\csrs.exe 2007-08-17 20:20:14 5120 --a------ C:\WINDOWS\csrss.dll -- Find3M Report --------------------------------------------------------------- 2007-09-10 18:22:16 24 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~2.DAT> 2007-09-10 18:22:16 24 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~1.DAT> 2007-09-07 22:36:46 0 d-------- C:\Program Files\ffdshow 2007-09-07 17:21:35 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-09-05 21:20:44 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-09-01 14:58:01 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Skype 2007-08-24 22:09:41 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Azureus 2007-08-24 22:09:07 0 d-------- C:\Program Files\Azureus 2007-08-24 22:04:40 2081 --a------ C:\Program Files\LRGHZFLV3UIO56B6TPWTUKZPVRYJRU5C Free-Games_Navy_Field_Resurrection_Of_The_Steel_Fleet_1175.exe.sd<LRGHZF~1.SD> 2007-08-22 14:53:09 1902 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 22:01:25 0 d-------- C:\Program Files\AC3Filter<AC3FIL~1> 2007-08-17 22:41:10 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-08-15 22:19:00 28460032 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\Outlook.pst 2007-08-15 22:19:00 271360 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\archive.pst 2007-08-08 21:56:38 132075 --a------ C:\WINDOWS\system32\dnd823b8e7.dat<DND823~1.DAT> 2007-08-08 21:28:48 79761 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\tmp6.tmp.exe<TMP6TM~1.EXE> 2007-08-08 21:28:21 131426 --a------ C:\WINDOWS\cbxutt.dll 2007-08-08 21:28:21 124693 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\tmp1.tmp.exe<TMP1TM~1.EXE> 2007-08-08 20:46:07 131426 --a------ C:\WINDOWS\ddbcbc.dll 2007-08-07 14:57:30 0 d-------- C:\Program Files\Minefield<MINEFI~1> 2007-08-05 23:35:16 13380 --a------ C:\WINDOWS\system32\ssttqol.dll 2007-08-05 21:04:36 13380 --a------ C:\WINDOWS\system32\gebcdbx.dll 2007-08-05 18:35:20 13380 --a------ C:\WINDOWS\system32\ddccbcd.dll 2007-08-05 16:05:40 13380 --a------ C:\WINDOWS\system32\pmnllmn.dll 2007-08-05 13:24:41 25664 --a------ C:\WINDOWS\system32\0MT8d8jA.exe 2007-07-20 23:28:43 0 d-------- C:\Program Files\Metrum Demo<METRUM~1> 2007-07-19 11:49:35 10 --ah----- C:\WINDOWS\popcinfo.dat 2007-06-26 08:38:36 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-20 20:46:04 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll<XA3866~1.DLL> 2007-06-20 20:45:20 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll<X3DAUD~3.DLL> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe" "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] "item"="TeaTimer" "hkey"="HKCU" "command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "5T19I3B27A"="C:\\WINDOWS\\csrs.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}] Shell\AutoRun\command G:\SETUP.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command H:\SETUP.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command I:\PlayD2.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command J:\SETUP.EXE -- End of ComboScan: finished at 2007-09-12 at 22:37:47 ------------------------

Niestety loga z SR nie moge dac bo mi wyskakuja jakis krzaczki i moge kopiowac tylko do tego miejsca.

>> Z gory dzieki za pomoc <<

**Posty:** 18165 · przez **wojtas** 12 Wrz 2007, 22:50

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje
Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka + log z combofixa

**Posty:** 84 · przez **zooo** 13 Wrz 2007, 14:36

Okej zrobilem jak mowiles oto logi.

1.SDFix:

Kod: Zaznacz wszystko: SDFix: Version 1.104 Run by SZEWCO on 2007-09-13 at 14:14 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Service xpdx - Deleted after Reboot Normal Mode: Checking Files: Trojan Files Found: C:\Documents and Settings\SZEWCO\Dane aplikacji\tmp1.tmp.exe - Deleted C:\Documents and Settings\SZEWCO\Dane aplikacji\tmp6.tmp.exe - Deleted C:\WINDOWS\csrs.exe - Deleted C:\WINDOWS\system32\xpdx.sys - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\ICQLite\\ICQLite.exe"="C:\\Program Files\\ICQLite\\ICQLite.exe:*:Enabled:ICQ Lite" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\Program Files\Replay Converter\14_43260.dll C:\Program Files\Replay Converter\28_83260.dll C:\Program Files\Replay Converter\atrc3260.dll C:\Program Files\Replay Converter\cook3260.dll C:\Program Files\Replay Converter\cygwin1.dll C:\Program Files\Replay Converter\cygz.dll C:\Program Files\Replay Converter\dnet3260.dll C:\Program Files\Replay Converter\drv23260.dll C:\Program Files\Replay Converter\drv33260.dll C:\Program Files\Replay Converter\drv43260.dll C:\Program Files\Replay Converter\ivvideo.dll C:\Program Files\Replay Converter\qtmlClient.dll C:\Program Files\Replay Converter\raac.dll C:\Program Files\Replay Converter\sipr3260.dll C:\WINDOWS\system32\AVSredirect.dll C:\Program Files\InstallShield Installation Information\GUID.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\config\SAM.tmp.LOG C:\WINDOWS\system32\config\SECURITY.tmp.LOG Finished!

2.HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 14:30, on 2007-09-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\nsp\Notatnik SP.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe E:\dodatki\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 4922 bytes

3.ComboScan

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by SZEWCO on 2007-09-13 at 14:32:07 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as SZEWCO.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 14:32, on 2007-09-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\nsp\Notatnik SP.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe E:\dodatki\comboscan.exe E:\dodatki\SZEWCO.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- Files created between 2007-08-13 and 2007-09-13 ----------------------------- 2007-09-13 14:14:16 0 d-------- C:\WINDOWS\ERUNT 2007-09-12 23:24:19 0 d-------- C:\VundoFix Backups<VUNDOF~1> 2007-09-12 23:11:44 0 d-------- C:\SDFix 2007-09-07 17:21:35 17664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-09-07 17:21:35 29184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys<BRGSP5~1.SYS> 2007-09-07 17:21:35 20608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-09-07 17:21:35 0 d-------- C:\Program Files\SAGEM WiFi manager<SAGEMW~1> 2007-09-07 17:21:28 0 d-------- C:\Program Files\SAGEM 2007-09-07 17:20:50 402432 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-09-07 17:20:50 493440 --a------ C:\WINDOWS\system32\drivers\WlanBZ64.SYS 2007-09-07 17:20:43 31744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys<ZDPSP5~1.SYS> 2007-08-25 07:56:04 0 d-------- C:\Program Files\SD EnterNET<SDENTE~1> 2007-08-24 22:01:32 834790 --a------ C:\Program Files\LRGHZFLV3UIO56B6TPWTUKZPVRYJRU5C Free-Games_Navy_Field_Resurrection_Of_The_Steel_Fleet_1175.exe<LRGHZF~1.EXE> 2007-08-24 13:50:25 0 d-------- C:\NavyFIELD_WorldLeague2007_FullClient<NAVYFI~1> 2007-08-21 22:02:07 0 d-------- C:\Program Files\mIRC 2007-08-20 14:34:28 0 d-------- C:\Fishing Simulator 2<FISHIN~1> 2007-08-19 11:02:17 0 d-------- C:\Program Files\Wedkarz 2007-08-18 00:07:27 0 d-------- C:\psyBNC-2.3.2-7<PSYBNC~1.2-7> 2007-08-17 20:20:14 5120 --a------ C:\WINDOWS\csrss.dll -- Find3M Report --------------------------------------------------------------- 2007-09-13 05:36:27 24 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~2.DAT> 2007-09-13 05:36:27 24 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~1.DAT> 2007-09-12 23:08:28 1902 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-12 22:59:52 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-09-07 22:36:46 0 d-------- C:\Program Files\ffdshow 2007-09-07 17:21:35 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-09-05 21:20:44 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-09-01 14:58:01 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Skype 2007-08-24 22:09:41 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Azureus 2007-08-24 22:09:07 0 d-------- C:\Program Files\Azureus 2007-08-24 22:04:40 2081 --a------ C:\Program Files\LRGHZFLV3UIO56B6TPWTUKZPVRYJRU5C Free-Games_Navy_Field_Resurrection_Of_The_Steel_Fleet_1175.exe.sd<LRGHZF~1.SD> 2007-08-21 22:01:25 0 d-------- C:\Program Files\AC3Filter<AC3FIL~1> 2007-08-17 22:41:10 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-08-15 22:19:00 28460032 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\Outlook.pst 2007-08-15 22:19:00 271360 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\archive.pst 2007-08-08 21:56:38 132075 --a------ C:\WINDOWS\system32\dnd823b8e7.dat<DND823~1.DAT> 2007-08-08 21:28:21 131426 --a------ C:\WINDOWS\cbxutt.dll 2007-08-08 20:46:07 131426 --a------ C:\WINDOWS\ddbcbc.dll 2007-08-07 14:57:30 0 d-------- C:\Program Files\Minefield<MINEFI~1> 2007-08-05 13:24:41 25664 --a------ C:\WINDOWS\system32\0MT8d8jA.exe 2007-07-20 23:28:43 0 d-------- C:\Program Files\Metrum Demo<METRUM~1> 2007-07-19 11:49:35 10 --ah----- C:\WINDOWS\popcinfo.dat 2007-06-26 08:38:36 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-20 20:46:04 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll<XA3866~1.DLL> 2007-06-20 20:45:20 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll<X3DAUD~3.DLL> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe" "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] "item"="TeaTimer" "hkey"="HKCU" "command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @="" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}] Shell\AutoRun\command G:\SETUP.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command H:\SETUP.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command I:\PlayD2.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command J:\SETUP.EXE -- End of ComboScan: finished at 2007-09-13 at 14:32:25 ------------------------

**Posty:** 18165 · przez **wojtas** 13 Wrz 2007, 21:23

C:\VundoFix Backups
C:\WINDOWS\system32\dnd823b8e7.dat
C:\WINDOWS\cbxutt.dll
C:\WINDOWS\ddbcbc.dll
C:\WINDOWS\system32\0MT8d8jA.exe
C:\WINDOWS\csrss.dll

skasuj pogrubione ^^

znasz to:

C:\Program Files\LRGHZFLV3UIO56B6TPWTUKZPVRYJRU5C Free-Games_Navy_Field_Resurrection_Of_The_Steel_Fleet_1175.exe
C:\Program Files\LRGHZFLV3UIO56B6TPWTUKZPVRYJRU5C Free-Games_Navy_Field_Resurrection_Of_The_Steel_Fleet_1175.exe.sd
C:\NavyFIELD_WorldLeague2007_FullClient

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowy log z hijacka oraz combofixa

**Posty:** 84 · przez **zooo** 13 Wrz 2007, 23:32

Okej pogrubione usunolem. co do tych plikow to 2 pierwsze skasowalem to byly jakies pliki ktore zasysa client z serwera jak jest update, ale je tez usunolem. fix.reg dodalem do rejestru. tu sa logi z Hijacka i ComboFixa.

1. HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 23:27:35, on 2007-09-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe E:\dodatki\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 4801 bytes

2. ComboFix:

Kod: Zaznacz wszystko: "SZEWCO" - 2007-09-13 23:19:04 - ComboFix 07-06-27.7 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-08-13 to 2007-09-13 ))))))))))))))))))))))))))))))) 2007-09-13 14:14 <DIR> d-------- C:\WINDOWS\ERUNT 2007-09-07 17:21 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2007-09-07 17:21 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-09-07 17:21 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-09-07 17:21 <DIR> d-------- C:\Program Files\SAGEM WiFi manager 2007-09-07 17:21 <DIR> d-------- C:\Program Files\SAGEM 2007-09-07 17:20 493,440 --a------ C:\WINDOWS\system32\drivers\WlanBZ64.SYS 2007-09-07 17:20 402,432 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-09-07 17:20 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2007-08-25 07:56 <DIR> d-------- C:\Program Files\SD EnterNET 2007-08-24 13:50 <DIR> d-------- C:\NavyFIELD_WorldLeague2007_FullClient 2007-08-21 22:02 <DIR> d-------- C:\Program Files\mIRC 2007-08-20 14:34 <DIR> d-------- C:\Fishing Simulator 2 2007-08-19 11:02 <DIR> d-------- C:\Program Files\Wedkarz 2007-08-18 00:07 <DIR> d-------- C:\psyBNC-2.3.2-7 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-13 21:21:13 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2007-09-13 21:21:13 24 ----a-w C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2007-09-12 21:08:28 1,902 ----a-w C:\WINDOWS\system32\tmp.reg 2007-09-12 20:59:52 -------- d-----w C:\Program Files\SkanerOnline 2007-09-07 20:36:46 -------- d-----w C:\Program Files\ffdshow 2007-09-07 15:21:35 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-05 19:20:44 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-09-01 12:58:01 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Skype 2007-08-24 20:09:41 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Azureus 2007-08-24 20:09:07 -------- d-----w C:\Program Files\Azureus 2007-08-21 20:01:25 -------- d-----w C:\Program Files\AC3Filter 2007-08-17 20:41:10 -------- d-----w C:\Program Files\Gadu-Gadu 2007-08-07 12:57:30 -------- d-----w C:\Program Files\Minefield 2007-07-20 21:28:43 -------- d-----w C:\Program Files\Metrum Demo 2007-07-19 09:49:35 10 ---ha-w C:\WINDOWS\popcinfo.dat 2007-06-26 06:38:36 48,776 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-20 18:46:04 266,088 ----a-w C:\WINDOWS\system32\xactengine2_8.dll 2007-06-20 18:45:20 18,280 ----a-w C:\WINDOWS\system32\x3daudio1_2.dll 2005-07-14 19:31:20 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2007-06-15 10:41] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-01-12 04:08] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 21:33] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="NvMCTray.dll" [2006-11-17 18:29 C:\WINDOWS\system32\nvmctray.dll] "NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 21:01] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}] AutoRun\command- G:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}] AutoRun\command- H:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}] AutoRun\command- I:\PlayD2.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}] AutoRun\command- J:\SETUP.EXE ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-13 23:22:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ha10kx2k] "ImagePath"="system32\drivers\ha10kx2k.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e ] "ImagePath"="\"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe\"" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\helpsvc] "ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidServ] "ServiceDll"="%SystemRoot%\System32\hidserv.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hidusb] "ImagePath"="system32\DRIVERS\hidusb.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hpn] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTP] "ImagePath"="System32\Drivers\HTTP.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTPFilter] "ServiceDll"="%SystemRoot%\System32\w3ssl.dll" Completion time: 2007-09-13 23:22:47 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-09-13 23:22 C:\ComboFix2.txt ... 2007-08-08 21:10 C:\ComboFix3.txt ... 2007-06-27 16:36 --- E O F ---

**Posty:** 18165 · przez **wojtas** 13 Wrz 2007, 23:35

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

i powinno byc ok

**Posty:** 84 · przez **zooo** 13 Wrz 2007, 23:41

okej zrobione jakies logi chcesz??

**Posty:** 18165 · przez **wojtas** 13 Wrz 2007, 23:46

jakies logi chcesz??

mozesz dac jeszcze z combofixa

**Posty:** 84 · przez **zooo** 14 Wrz 2007, 00:06

Prosisz i masz

ComboFix:

Kod: Zaznacz wszystko: "SZEWCO" - 2007-09-14 0:00:11 - ComboFix 07-06-27.7 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-08-13 to 2007-09-13 ))))))))))))))))))))))))))))))) 2007-09-13 14:14 <DIR> d-------- C:\WINDOWS\ERUNT 2007-09-07 17:21 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2007-09-07 17:21 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-09-07 17:21 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-09-07 17:21 <DIR> d-------- C:\Program Files\SAGEM WiFi manager 2007-09-07 17:21 <DIR> d-------- C:\Program Files\SAGEM 2007-09-07 17:20 493,440 --a------ C:\WINDOWS\system32\drivers\WlanBZ64.SYS 2007-09-07 17:20 402,432 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-09-07 17:20 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2007-08-25 07:56 <DIR> d-------- C:\Program Files\SD EnterNET 2007-08-24 13:50 <DIR> d-------- C:\NavyFIELD_WorldLeague2007_FullClient 2007-08-21 22:02 <DIR> d-------- C:\Program Files\mIRC 2007-08-20 14:34 <DIR> d-------- C:\Fishing Simulator 2 2007-08-19 11:02 <DIR> d-------- C:\Program Files\Wedkarz 2007-08-18 00:07 <DIR> d-------- C:\psyBNC-2.3.2-7 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-13 21:21:13 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2007-09-13 21:21:13 24 ----a-w C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2007-09-12 21:08:28 1,902 ----a-w C:\WINDOWS\system32\tmp.reg 2007-09-12 20:59:52 -------- d-----w C:\Program Files\SkanerOnline 2007-09-07 20:36:46 -------- d-----w C:\Program Files\ffdshow 2007-09-07 15:21:35 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-05 19:20:44 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-09-01 12:58:01 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Skype 2007-08-24 20:09:41 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Azureus 2007-08-24 20:09:07 -------- d-----w C:\Program Files\Azureus 2007-08-21 20:01:25 -------- d-----w C:\Program Files\AC3Filter 2007-08-17 20:41:10 -------- d-----w C:\Program Files\Gadu-Gadu 2007-08-07 12:57:30 -------- d-----w C:\Program Files\Minefield 2007-07-20 21:28:43 -------- d-----w C:\Program Files\Metrum Demo 2007-07-19 09:49:35 10 ---ha-w C:\WINDOWS\popcinfo.dat 2007-06-26 06:38:36 48,776 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-20 18:46:04 266,088 ----a-w C:\WINDOWS\system32\xactengine2_8.dll 2007-06-20 18:45:20 18,280 ----a-w C:\WINDOWS\system32\x3daudio1_2.dll 2005-07-14 19:31:20 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2007-06-15 10:41] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-01-12 04:08] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 21:33] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="NvMCTray.dll" [2006-11-17 18:29 C:\WINDOWS\system32\nvmctray.dll] "NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 21:01] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-14 00:01:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ha10kx2k] "ImagePath"="system32\drivers\ha10kx2k.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e ] "ImagePath"="\"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe\"" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\helpsvc] "ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidServ] "ServiceDll"="%SystemRoot%\System32\hidserv.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hidusb] "ImagePath"="system32\DRIVERS\hidusb.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hpn] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTP] "ImagePath"="System32\Drivers\HTTP.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTPFilter] "ServiceDll"="%SystemRoot%\System32\w3ssl.dll" Completion time: 2007-09-14 0:02:17 C:\ComboFix-quarantined-files.txt ... 2007-09-14 00:01 C:\ComboFix2.txt ... 2007-09-13 23:22 C:\ComboFix3.txt ... 2007-08-08 21:10 --- E O F ---

**Posty:** 18165 · przez **wojtas** 14 Wrz 2007, 15:29

jest ok

**Posty:** 8694 · przez **Red** 14 Wrz 2007, 15:38

Proszę podesłać jeszcze log z ewido oraz kaspersky online

http://www.kaspersky.pl/virusscanner.html

http://www.ewido.net/de/

wklej wyniki na forum

**Posty:** 84 · przez **zooo** 14 Wrz 2007, 23:49

Okej oto logi

Kod: Zaznacz wszystko: AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 19:28:05 2007-09-14 + Scan result: D:\PROGRAMY\Nero 7\Nero7Keygen.exe -> Backdoor.Hupigon : No action taken. E:\dodatki\backups\backup-20070822-144926-119.dll -> Hijacker.Agent.hz : No action taken. C:\SDFix\backups\backups.zip/backups/csrs.exe -> Hijacker.Small.kj : No action taken. C:\Program Files\SnadBoy's Revelation v2\Revelation.exe -> Not-A-Virus.PSWTool.Win32.SnadBoy.2011 : No action taken. C:\Program Files\SnadBoy's Revelation v2\RevelationHelper.dll -> Not-A-Virus.PSWTool.Win32.SnadBoy.2011 : No action taken. D:\PROGRAMY\SnadBoy's Revelation v2\Revelation.exe -> Not-A-Virus.PSWTool.Win32.SnadBoy.2011 : No action taken. D:\PROGRAMY\SnadBoy's Revelation v2\RevelationHelper.dll -> Not-A-Virus.PSWTool.Win32.SnadBoy.2011 : No action taken. :mozilla.10:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.148:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.149:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.6:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.7:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.8:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.9:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@2o7[2].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@cnetaustralia.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. :mozilla.21:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.22:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@3.adbrite[2].txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@4.adbrite[2].txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@adbrite[2].txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ads.adbrite[2].txt -> TrackingCookie.Adbrite : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@adengage[1].txt -> TrackingCookie.Adengage : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ads.adengage[2].txt -> TrackingCookie.Adengage : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ad.adnet[1].txt -> TrackingCookie.Adnet : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@adrenaline[1].txt -> TrackingCookie.Adrenaline : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ads.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@www.burstnet[1].txt -> TrackingCookie.Burstnet : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@casalemedia[2].txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@com[1].txt -> TrackingCookie.Com : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@search.techrepublic.com[1].txt -> TrackingCookie.Com : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@software.techrepublic.com[1].txt -> TrackingCookie.Com : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@hotlog[1].txt -> TrackingCookie.Hotlog : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@komtrack[2].txt -> TrackingCookie.Komtrack : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@search.live[2].txt -> TrackingCookie.Live : No action taken. :mozilla.97:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Masterstats : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@image.masterstats[1].txt -> TrackingCookie.Masterstats : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@auto.search.msn[2].txt -> TrackingCookie.Msn : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ie.search.msn[1].txt -> TrackingCookie.Msn : No action taken. :mozilla.225:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Netflame : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@www.paypal[1].txt -> TrackingCookie.Paypal : No action taken. :mozilla.212:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Revenue : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@revsci[2].txt -> TrackingCookie.Revsci : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@counter10.cenzura-spam[1].txt -> TrackingCookie.cenzura-spam : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@cenzura-spam[2].txt -> TrackingCookie.cenzura-spam : No action taken. :mozilla.219:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Skype : No action taken. :mozilla.222:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Skype : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@site.skype[1].txt -> TrackingCookie.Skype : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@skype[2].txt -> TrackingCookie.Skype : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@specificclick[2].txt -> TrackingCookie.Specificclick : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@statcounter[2].txt -> TrackingCookie.Statcounter : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@tacoda[2].txt -> TrackingCookie.Tacoda : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.229:C:\Documents and Settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\3lex8aqv.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@yadro[1].txt -> TrackingCookie.Yadro : No action taken. C:\Documents and Settings\SZEWCO\Cookies\szewco@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken. ::Report end

Kod: Zaznacz wszystko: KASPERSKY ONLINE SCANNER REPORT 14 wrzesień 2007 23:12:42 System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.83.0 Ostatnia aktualizacja Kaspersky Anti-Virus14/09/2007 Liczba wpisów w bazie danych Kaspersky Anti-Virus392880 Ustawienia skanowania Skanowanie przy użyciu następujących baz danych standardowe Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer A:\ C:\ D:\ E:\ F:\ G:\ Statystyki skanowania Liczba skanowanych obiektów 133454 Liczba wykrytych wirusów 4 Liczba zainfekowanych obiektów 9 / 0 Liczba podejrzanych obiektów 0 Czas trwania skanowania 04:13:15 Nazwa zainfekowanego obiektu Nazwa wirusa Ostatnie działanie C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\SZEWCO\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\SZEWCO\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\SZEWCO\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\SZEWCO\UserData\index.dat Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\CardSpace\CardSpace.db Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\CardSpace\CardSpace.db.shadow Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Historia\History.IE5\MSHist012007091420070915\index.dat Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Temp\Perflib_Perfdata_ed4.dat Object is locked pominięty C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Program Files\mIRC\logs\DaIRC\#RYL2Fusion.7.log Object is locked pominięty C:\QooBox\Quarantine\C\DOCUME~1\SZEWCO\DANEAP~1\tmp55.tmp.exe.vir Zainfekowanych: Trojan.Win32.Agent.aoy pominięty C:\SDFix\backups\backups.zip/backups/csrs.exe Zainfekowanych: Trojan-Clicker.Win32.Small.kj pominięty C:\SDFix\backups\backups.zip ZIP: zainfekowany - 1 pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\System Volume Information\_restore{43830092-AAC7-429F-8689-70703BF9D2C1}\RP1\change.log Object is locked pominięty C:\WINDOWS\CSC\00000001 Object is locked pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\SchedLgU.Txt Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\default Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\software Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\system Object is locked pominięty C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\drivers\sptd.sys Object is locked pominięty C:\WINDOWS\system32\h323log.txt Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty E:\dodatki\backups\backup-20070822-144926-119.dll Zainfekowanych: Trojan-Clicker.Win32.Agent.hz pominięty E:\Norton Antivirus\Symantec.Norton.Antivirus.2007.Full\NortonAntivirus2007.iso/NAV071400.exe Zainfekowanych: Trojan-Downloader.Win32.Agent.ayi pominięty E:\Norton Antivirus\Symantec.Norton.Antivirus.2007.Full\NortonAntivirus2007.iso ISO image: zainfekowany - 1 pominięty E:\Norton Antivirus\Symantec.Norton.Antivirus.2007.Full\Symantec.Norton.Antivirus.2007.Full.with.Serials.zip/Symantec.Norton.Antivirus.2007.Full.with.Serials.zip/NAV071400.exe Zainfekowanych: Trojan-Downloader.Win32.Agent.ayi pominięty E:\Norton Antivirus\Symantec.Norton.Antivirus.2007.Full\Symantec.Norton.Antivirus.2007.Full.with.Serials.zip/Symantec.Norton.Antivirus.2007.Full.with.Serials.zip Zainfekowanych: Trojan-Downloader.Win32.Agent.ayi pominięty E:\Norton Antivirus\Symantec.Norton.Antivirus.2007.Full\Symantec.Norton.Antivirus.2007.Full.with.Serials.zip ZIP: zainfekowany - 2 pominięty Proces skanowania został zakończony.

**Posty:** 18165 · przez **wojtas** 15 Wrz 2007, 10:23

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

skasuj pogrubione do kosza:

C:\QooBox
C:\SDFix\backups

Autor postu otrzymał pochwałę

**Posty:** 84 · przez **zooo** 15 Wrz 2007, 12:35

te dwa to tylko do kosza, a nie calkiem z kompa??
jakies logi jeszcze dac?

[ Dodano: Dzisiaj o 11:42 ]
1. HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 12:35:10, on 2007-09-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\mIRC\mirc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\nsp\Notatnik SP.exe C:\WINDOWS\NOTEPAD.EXE E:\dodatki\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 5210 bytes

2. SR:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS] "NAV Agent" = "C:\PROGRA~1\NORTON~1\navapw32.exe" [file not found] "Kernel and Hardware Abstraction Layer" = "KHALMNPR.EXE" ["Logitech Inc."] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"" [null data] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["GRISOFT s.r.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{721A1B24-EC8B-4eda-9CCE-39720B9FA747}" = "WipeExt" -> {HKLM...CLSID} = "WipeExt" \InProcServer32\(Default) = "C:\Program Files\Ace Utilities\wipext.dll" [null data] "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{45670FA8-ED97-4F44-BC93-305082590BFB}" = "Microsoft.XPS.Shell.Metadata.1" -> {HKLM...CLSID} = "Windows XPS Document Metadata Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{44121072-A222-48f2-A58A-6D9AD51EBBE9}" = "Microsoft.XPS.Shell.Thumbnail.1" -> {HKLM...CLSID} = "Windows XPS Document Thumbnail Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" = "EditPlus Context Menu Handler" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\EditPlus 2\eppshell.dll" [null data] "{B95713CD-06FF-4D35-A9DA-4DBDFE5FD7F4}" = "Hex Editor Shell Extension" -> {HKLM...CLSID} = "ShellExt Class" \InProcServer32\(Default) = "C:\Program Files\HHD Software\Hex Editor 3.x\heshell.dll" ["HHD Software"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Moje foldery udostępniania" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C}" = "Logitech Setpoint Extension" -> {HKLM...CLSID} = "KbLogiExt Class" \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\kbcplext.dll" ["Logitech Inc."] "{B9B9F083-2B04-452A-8691-83694AC1037B}" = "Logitech Setpoint Extension" -> {HKLM...CLSID} = "LogiExt Class" \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\mcplext.dll" ["Logitech Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."] EditPlus\(Default) = "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\EditPlus 2\eppshell.dll" [null data] Hex Editor 3\(Default) = "{B95713CD-06FF-4D35-A9DA-4DBDFE5FD7F4}" -> {HKLM...CLSID} = "ShellExt Class" \InProcServer32\(Default) = "C:\Program Files\HHD Software\Hex Editor 3.x\heshell.dll" ["HHD Software"] ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] WipeExt\(Default) = "{721A1B24-EC8B-4eda-9CCE-39720B9FA747}" -> {HKLM...CLSID} = "WipeExt" \InProcServer32\(Default) = "C:\Program Files\Ace Utilities\wipext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."] ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] WipeExt\(Default) = "{721A1B24-EC8B-4eda-9CCE-39720B9FA747}" -> {HKLM...CLSID} = "WipeExt" \InProcServer32\(Default) = "C:\Program Files\Ace Utilities\wipext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "SZEWCO" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Logitech SetPoint" -> shortcut to: "C:\Program Files\Logitech\SetPoint\SetPoint.exe" ["Logitech Inc."] "SAGEM Wi-Fi 11g USB adapter LAN Utility" -> shortcut to: "C:\Program Files\SAGEM WiFi manager\WLANUTL.exe" [" "] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ "ButtonText" = "ICQ Lite" "MenuText" = "ICQ Lite" "Exec" = "C:\Program Files\ICQLite\ICQLite.exe" ["ICQ Ltd."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["GRISOFT s.r.o."] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 34 seconds, including 5 seconds for message boxes)

3. ComboScan:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by SZEWCO on 2007-09-15 at 12:37:30 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as SZEWCO.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 12:37:32, on 2007-09-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\mIRC\mirc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE E:\dodatki\comboscan.exe E:\dodatki\SZEWCO.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: SAGEM Wi-Fi 11g USB adapter LAN Utility.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- Files created between 2007-08-15 and 2007-09-15 ----------------------------- 2007-09-14 15:50:02 10872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-09-14 15:49:54 0 d-------- C:\Program Files\Grisoft 2007-09-13 23:18:42 212480 --a------ C:\WINDOWS\system32\swxcacls.exe 2007-09-13 23:18:42 370688 --a------ C:\WINDOWS\system32\swsc.exe 2007-09-13 23:18:42 428032 --a------ C:\WINDOWS\system32\swreg.exe 2007-09-13 14:14:16 0 d-------- C:\WINDOWS\ERUNT 2007-09-12 23:11:44 0 d-------- C:\SDFix 2007-09-07 17:21:35 17664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-09-07 17:21:35 29184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys<BRGSP5~1.SYS> 2007-09-07 17:21:35 20608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-09-07 17:21:35 0 d-------- C:\Program Files\SAGEM WiFi manager<SAGEMW~1> 2007-09-07 17:21:28 0 d-------- C:\Program Files\SAGEM 2007-09-07 17:20:50 402432 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-09-07 17:20:50 493440 --a------ C:\WINDOWS\system32\drivers\WlanBZ64.SYS 2007-09-07 17:20:43 31744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys<ZDPSP5~1.SYS> 2007-08-25 07:56:04 0 d-------- C:\Program Files\SD EnterNET<SDENTE~1> 2007-08-24 13:50:25 0 d-------- C:\NavyFIELD_WorldLeague2007_FullClient<NAVYFI~1> 2007-08-21 22:02:07 0 d-------- C:\Program Files\mIRC 2007-08-20 14:34:28 0 d-------- C:\Fishing Simulator 2<FISHIN~1> 2007-08-19 11:02:17 0 d-------- C:\Program Files\Wedkarz 2007-08-18 00:07:27 0 d-------- C:\psyBNC-2.3.2-7<PSYBNC~1.2-7> -- Find3M Report --------------------------------------------------------------- 2007-09-14 15:50:37 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Grisoft 2007-09-14 00:06:20 24 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~2.DAT> 2007-09-14 00:06:20 24 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~1.DAT> 2007-09-12 23:08:28 1902 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-12 22:59:52 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-09-07 22:36:46 0 d-------- C:\Program Files\ffdshow 2007-09-07 17:21:35 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-09-05 21:20:44 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-09-01 14:58:01 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Skype 2007-08-24 22:09:41 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Azureus 2007-08-24 22:09:07 0 d-------- C:\Program Files\Azureus 2007-08-21 22:01:25 0 d-------- C:\Program Files\AC3Filter<AC3FIL~1> 2007-08-17 22:41:10 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-08-15 22:19:00 28460032 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\Outlook.pst 2007-08-15 22:19:00 271360 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\archive.pst 2007-08-07 14:57:30 0 d-------- C:\Program Files\Minefield<MINEFI~1> 2007-07-20 23:28:43 0 d-------- C:\Program Files\Metrum Demo<METRUM~1> 2007-07-19 11:49:35 10 --ah----- C:\WINDOWS\popcinfo.dat 2007-06-26 08:38:36 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-20 20:46:04 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll<XA3866~1.DLL> 2007-06-20 20:45:20 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll<X3DAUD~3.DLL> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe" "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] "item"="TeaTimer" "hkey"="HKCU" "command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_DRIVER *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_GUARD -- End of ComboScan: finished at 2007-09-15 at 12:38:01 ------------------------

**Posty:** 8694 · przez **Red** 15 Wrz 2007, 13:08

W logach masz czysto.

te dwa to tylko do kosza, a nie calkiem z kompa??

całkiem usuń

Autor postu otrzymał pochwałę

**Posty:** 84 · przez **zooo** 15 Wrz 2007, 13:57

okej usunolem. dzieki za pomoc

wielka prosba o sprawdzenie loga

Wielka prosba o sprawdzenie loga

Kto jest na forum