Win32.netbooster

**Posty:** 8 · przez **frugo84** 04 Paź 2008, 14:35

Miałem wirusa Win32.Netbooster dzisiaj udało mi się go usunąć za pomocą ComboFix,komputer na pierwszy rzut oka wrócił do normy, jednak chciałbym żeby ktoś rzucił okiem i powiedział czy nie zostało się jeszcze coś.
Tu log z Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:26, on 2008-10-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\system32\acs.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\Explorer.EXE F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe F:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe F:\WINDOWS\system32\niSvcLoc.exe F:\WINDOWS\system32\HPZipm12.exe F:\Program Files\CyberLink\Shared files\RichVideo.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe F:\WINDOWS\system32\nipalsm.exe F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe F:\Program Files\TP-LINK\TWCU\TWCU.exe F:\Program Files\Motherboard Monitor 5\MBM5.EXE F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe F:\Program Files\Samurize\Client.exe F:\Program Files\Gadu-Gadu\gg.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\Program Files\FreeUser_staleIP-i-zmienneIP-03.07.2008\USDownloader.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - F:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - F:\Program Files\Orbitdownloader\GrabPro.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O4 - HKLM\..\Run: [WheelMouse] F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [TWCU] "F:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui O4 - HKLM\..\Run: [MBM 5] "F:\Program Files\Motherboard Monitor 5\MBM5.EXE" O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AVP] "F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Samurize.lnk = F:\Program Files\Samurize\Client.exe O8 - Extra context menu item: &Download by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Dodaj do blokowanych banerów - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: Down&load all by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7A3D29A3-B27C-4EE6-8095-36E89137AFA7}: NameServer = 192.168.1.1,194.204.152.34 O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - F:\WINDOWS\system32\acs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Capture Device Service - InterVideo Inc. - F:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NILM License manager - Macrovision Corporation - F:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe O23 - Service: nipxirmu - National Instruments Corporation - F:\WINDOWS\system32\nipalsm.exe O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - F:\WINDOWS\system32\niSvcLoc.exe O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - F:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7314 bytes

Z góry dziękuję za pomoc

**Posty:** 684 · przez **djarta** 04 Paź 2008, 14:50

Fix w HijackThis

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2

Daj nam log z ComboFixa!

=========================
K.

**Posty:** 8 · przez **frugo84** 04 Paź 2008, 15:07

To log z ComboFixa

Kod: Zaznacz wszystko: ComboFix 08-10-03.06 - frugo 2008-10-04 12:50:08.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.265 [GMT 2:00] Uruchomiony z: F:\Documents and Settings\frugo\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Autorun.inf F:\WINDOWS\dkwqgnbe.dll F:\WINDOWS\epev.exe F:\WINDOWS\fkebanrw.exe F:\WINDOWS\neksolda.dll F:\WINDOWS\nkefbltdlba.dll F:\WINDOWS\xgpsarbm.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MCHINJDRV ((((((((((((((((((((((((( Pliki utworzone od 2008-09-04 do 2008-10-04 ))))))))))))))))))))))))))))))) . 2008-10-04 11:59 . 2008-10-04 11:59 <DIR> d-------- F:\Program Files\Trend Micro 2008-10-04 11:44 . 2008-10-04 11:44 <DIR> d-------- F:\Documents and Settings\LocalService\Menu Start 2008-10-04 11:42 . 2008-10-04 11:42 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\PC Tools 2008-10-04 11:41 . 2008-10-04 11:30 160,792 --a------ F:\WINDOWS\system32\drivers\pctfw2.sys 2008-10-04 11:32 . 2008-10-04 11:32 38,208 --a------ F:\WINDOWS\system32\drivers\TfSysMon.sys 2008-10-04 11:32 . 2008-10-04 11:32 33,088 --a------ F:\WINDOWS\system32\drivers\TfNetMon.sys 2008-10-04 11:31 . 2008-10-04 11:31 51,520 --a------ F:\WINDOWS\system32\drivers\TfFsMon.sys 2008-10-04 11:31 . 2008-10-04 11:31 12,608 --a------ F:\WINDOWS\system32\drivers\TfKbMon.sys 2008-10-04 10:59 . 2008-10-04 11:41 <DIR> d-------- F:\Program Files\Common Files\PC Tools 2008-10-04 10:56 . 2008-10-04 12:40 <DIR> d-------- F:\Program Files\Spyware Doctor 2008-10-04 10:56 . 2008-10-04 10:56 <DIR> d-------- F:\Documents and Settings\frugo\Dane aplikacji\PC Tools 2008-10-04 10:56 . 2008-08-25 11:36 81,288 --a------ F:\WINDOWS\system32\drivers\iksyssec.sys 2008-10-04 10:56 . 2008-08-25 11:36 66,952 --a------ F:\WINDOWS\system32\drivers\iksysflt.sys 2008-10-04 10:56 . 2008-08-25 11:36 40,840 --a------ F:\WINDOWS\system32\drivers\ikfilesec.sys 2008-10-04 10:56 . 2008-06-02 15:19 29,576 --a------ F:\WINDOWS\system32\drivers\kcom.sys 2008-10-04 08:43 . 2008-10-04 08:43 <DIR> d-------- F:\Program Files\XoftSpySE 2008-10-04 00:29 . 2008-10-04 00:29 <DIR> d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-10-03 19:54 . 2008-10-04 12:40 <DIR> d-a------ F:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-10-03 15:21 . 2008-10-04 12:11 <DIR> d-------- F:\Program Files\Spybot - Search & Destroy 2008-10-03 15:21 . 2008-10-04 12:37 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-03 08:56 . 2008-10-03 09:09 <DIR> d-------- F:\Program Files\Techland 2008-10-01 18:10 . 2008-10-01 18:10 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-10-01 18:10 . 2008-10-01 18:10 1,409 --a------ F:\WINDOWS\QTFont.for 2008-09-26 20:14 . 2008-09-26 20:14 <DIR> d-------- F:\Documents and Settings\frugo\Dane aplikacji\GARMIN 2008-09-26 20:10 . 2008-09-26 20:10 <DIR> d-------- F:\Garmin 2008-09-26 20:09 . 2008-09-26 20:09 <DIR> d-------- F:\Program Files\Garmin 2008-09-22 17:23 . 2007-05-16 16:45 3,497,832 --a------ F:\WINDOWS\system32\d3dx9_34.dll 2008-09-22 17:22 . 2008-09-22 17:22 <DIR> d-------- F:\WINDOWS\Logs . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-04 10:58 8,580,128 --sha-w F:\WINDOWS\system32\drivers\fidbox.dat 2008-10-04 10:56 570,144 --sha-w F:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-04 10:54 57,584 --sha-w F:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-04 10:54 119,048 --sha-w F:\WINDOWS\system32\drivers\fidbox.idx 2008-10-04 10:44 --------- d-----w F:\Program Files\Net Activity Diagram 2008-10-04 10:39 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-04 10:23 --------- d-----w F:\Program Files\Mozilla Thunderbird 2008-10-04 07:57 --------- d-----w F:\Program Files\Orbitdownloader 2008-10-04 07:48 --------- d-----w F:\Program Files\NAPI-PROJEKT 2008-10-03 22:26 --------- d-----w F:\Program Files\FreeUser_staleIP-i-zmienneIP-03.07.2008 2008-10-03 08:54 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\Orbit 2008-10-03 07:08 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-10-02 20:33 --------- d-----w F:\Program Files\eMule 2008-09-30 16:57 --------- d-----w F:\Program Files\WhereIsIt 2008-09-29 19:25 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\foobar2000 2008-09-27 09:57 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\uTorrent 2008-09-14 10:05 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\MyPhoneExplorer 2008-09-11 16:08 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\Image Zone Express 2008-09-04 19:35 --------- d-----w F:\Program Files\Gadu-Gadu 2008-09-03 15:13 163,644 ----a-w F:\WINDOWS\system32\drivers\secdrv.sys 2008-09-03 13:57 --------- d-----w F:\Program Files\PowerISO 2008-08-16 20:49 --------- d-----w F:\Program Files\DC++ 2008-08-16 11:24 --------- d-----w F:\Program Files\Xilisoft 2008-08-09 09:00 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\Ahead 2008-08-09 08:56 --------- d-----w F:\Program Files\Common Files\Ahead 2008-08-09 08:50 --------- d-----w F:\Program Files\Nero 2008-08-09 08:45 --------- d-----w F:\Program Files\Ahead 2008-08-06 17:42 96,976 ----a-w F:\WINDOWS\system32\drivers\klin.dat 2008-08-05 15:38 --------- d-----w F:\Program Files\GIF Movie Gear 2008-07-31 08:41 68,616 ----a-w F:\WINDOWS\system32\XAPOFX1_1.dll 2008-07-31 08:41 238,088 ----a-w F:\WINDOWS\system32\xactengine3_2.dll 2008-07-31 08:40 509,448 ----a-w F:\WINDOWS\system32\XAudio2_2.dll 2008-07-12 06:18 467,984 ----a-w F:\WINDOWS\system32\d3dx10_39.dll 2008-07-12 06:18 3,851,784 ----a-w F:\WINDOWS\system32\D3DX9_39.dll 2008-07-12 06:18 1,493,528 ----a-w F:\WINDOWS\system32\D3DCompiler_39.dll 2008-07-08 08:42 43,698 ----a-w F:\WINDOWS\system32\xvid-uninstall.exe 2008-06-13 20:52 88 --sh--r F:\Documents and Settings\All Users\Dane aplikacji\F57F310484.sys 2008-06-13 20:52 2,516 --sha-w F:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys 2001-11-23 04:08 712,704 -c--a-w F:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2003-05-01 07:36 114,688 ----a-w F:\Program Files\internet explorer\plugins\LV7ActiveXControl.dll 2008-05-03 14:21 56 --sh--r F:\WINDOWS\system32\8404317FF5.sys 2008-05-03 14:24 2,516 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2004-08-04 14:00 544256 87d414eba254e42649f4d0a00bb653c6 F:\WINDOWS\system32\winlogon.exe 2004-08-04 14:00 544256 87d414eba254e42649f4d0a00bb653c6 F:\WINDOWS\system32\dllcache\winlogon.exe 2004-08-04 14:00 504832 0344407089b08548d4feba62bb0f32d0 F:\WINDOWS\VistaMizer\old\winlogon.exe 2004-08-04 14:00 2315392 37e799d6050ae484152b039cc2f06e5d F:\WINDOWS\system32\ntkrnlpa.exe 2004-08-04 14:00 2058112 44d1bc1b05e0c7c82e81687b79c653c7 F:\WINDOWS\VistaMizer\old\ntkrnlpa.exe 2004-08-04 14:00 2439552 c9d5b530332fe1f4c7c2189104da7ffd F:\WINDOWS\system32\ntoskrnl.exe 2004-08-04 14:00 2182272 dcf53422b7edded3b7431fbae4a7ee3f F:\WINDOWS\VistaMizer\old\ntoskrnl.exe 2004-08-04 14:00 1551872 fe6ddf00b672c3647b9f20e09b7774ee F:\WINDOWS\explorer.exe 2004-08-04 14:00 1551872 fe6ddf00b672c3647b9f20e09b7774ee F:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 14:00 1033728 379098a96e6c165b659de7e4328010ea F:\WINDOWS\VistaMizer\old\explorer.exe 2004-08-04 14:00 25088 36eab91ffd244d3202830e417c45e0a5 F:\WINDOWS\system32\ctfmon.exe 2004-08-04 14:00 25088 36eab91ffd244d3202830e417c45e0a5 F:\WINDOWS\system32\dllcache\ctfmon.exe 2004-08-04 14:00 15360 cbfa30492d70ce3938d8a7783d0c0436 F:\WINDOWS\VistaMizer\old\ctfmon.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 25088] "SpybotSD TeaTimer"="F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WheelMouse"="F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2003-12-21 147456] "TWCU"="F:\Program Files\TP-LINK\TWCU\TWCU.exe" [2006-03-29 364544] "MBM 5"="F:\Program Files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 594944] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "AVP"="F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 218376] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 25088] "Picasa Media Detector"="F:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] F:\Documents and Settings\frugo\Menu Start\Programy\Autostart\ Samurize.lnk - F:\Program Files\Samurize\Client.exe [2005-05-16 1327104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= F:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= F:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= F:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 14:00 25088 F:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2006-05-18 11:29 49152 F:\Program Files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] --a------ 1997-06-03 08:51 48576 f:\PROGRA~1\SOWNIK~2\WATCH.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --------- 2005-12-07 22:57 30208 F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "F:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "F:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "F:\\Program Files\\Gadu-Gadu\\gg.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "F:\\Program Files\\National Instruments\\LabVIEW 7.0\\LabVIEW.exe"= "F:\\Program Files\\uTorrent\\uTorrent.exe"= "F:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "F:\\Program Files\\DC++\\DCPlusPlus.exe"= "F:\\Program Files\\Ares\\Ares.exe"= R0 NIPALK;NIPALK;F:\WINDOWS\system32\drivers\NIPALK.sys [2004-07-07 373853] R0 TfFsMon;TfFsMon;F:\WINDOWS\system32\drivers\TfFsMon.sys [2008-10-04 51520] R0 TfSysMon;TfSysMon;F:\WINDOWS\system32\drivers\TfSysMon.sys [2008-10-04 38208] R1 pctfw2;pctfw2;F:\WINDOWS\system32\drivers\pctfw2.sys [2008-10-04 160792] R2 cvintdrv;cvintdrv;F:\WINDOWS\system32\drivers\cvintdrv.sys [2002-10-07 7140] R2 Nadim;NAD Proto Driver;F:\WINDOWS\system32\DRIVERS\nadim.sys [2008-04-24 18688] R2 nidimk;nidimk;F:\WINDOWS\system32\drivers\nidimk.dll [2004-03-26 108124] R2 nipxirmk;nipxirmk;F:\WINDOWS\system32\drivers\nipxirmk.dll [2004-07-07 41075] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;F:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2003-08-26 9728] R3 klim5;Kaspersky Anti-Virus NDIS Filter;F:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344] R3 niorbk;niorbk;F:\WINDOWS\system32\drivers\niorbk.dll [2004-03-31 35420] S3 NiViPxiK;NiViPxiK;F:\WINDOWS\system32\drivers\NiViPxiK.sys [2004-07-14 24576] S3 TfNetMon;TfNetMon;F:\WINDOWS\system32\drivers\TfNetMon.sys [2008-10-04 33088] S3 ThreatFire;ThreatFire;F:\Program Files\Spyware Doctor\TFEngine\TFService.exe service [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{476d90d4-87ad-11dd-a1b2-001478106f19}] \Shell\AutoRun\command - J:\1nkbd8h.bat \Shell\explore\Command - J:\1nkbd8h.bat \Shell\open\Command - J:\1nkbd8h.bat . Zawartość folderu 'Zaplanowane zadania' 2008-07-31 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job - F:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] 2008-10-04 F:\WINDOWS\Tasks\XoftSpySE 2.job - F:\Program Files\XoftSpySE\XoftSpy.exe [2008-10-01 16:37] 2008-10-04 F:\WINDOWS\Tasks\XoftSpySE.job - F:\Program Files\XoftSpySE\XoftSpy.exe [2008-10-01 16:37] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{8B3C60B4-D538-4DED-9F8B-43210D4D1FF4} - F:\WINDOWS\nkefbltdlba.dll Toolbar-{3E96B465-87EF-41EC-BBAA-EAA5E8E04521} - F:\WINDOWS\dkwqgnbe.dll SSODL-neksolda-{4F36156D-AF98-4D06-B526-E703948E85DA} - F:\WINDOWS\neksolda.dll SSODL-xgpsarbm-{357014DC-5D56-48B9-A067-FD5118C14F1A} - F:\WINDOWS\xgpsarbm.dll . ------- Skan uzupełniający ------- . FireFox -: Profile - F:\Documents and Settings\frugo\Dane aplikacji\Mozilla\Firefox\Profiles\v2vyouih.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-04 12:56:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . F:\WINDOWS\system32\ati2evxx.exe F:\WINDOWS\system32\acs.exe F:\WINDOWS\system32\ati2evxx.exe F:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe F:\WINDOWS\system32\niSvcLoc.exe F:\WINDOWS\system32\HPZipm12.exe F:\Program Files\CyberLink\Shared files\RichVideo.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe F:\WINDOWS\system32\nipalsm.exe F:\WINDOWS\system32\imapi.exe . ************************************************************************** . Czas ukończenia: 2008-10-04 13:03:05 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-04 11:02:48 Przed: 3 355 881 472 bajtów wolnych Po: 3,277,926,400 bajtów wolnych 239

**Posty:** 684 · przez **djarta** 04 Paź 2008, 15:52

Na początek spytam się: Po co Ci 2 Antyvirusy, 2 Antyspyware, 2 skanery, 1 Firewall?

1)

Wylecz pendriva lub kartę pamięci
Perlovga Removal Tool
Flash Disinfector
lub format

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: J:\1nkbd8h.bat F:\1nkbd8h.bat F:\WINDOWS\Tasks\XoftSpySE 2.job F:\WINDOWS\Tasks\XoftSpySE.job Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{476d90d4-87ad-11dd-a1b2-001478106f19}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

==============================
K.

**Posty:** 8 · przez **frugo84** 04 Paź 2008, 16:39

Te wszystkie programy instalowałem próbując usunąć tego wirusa zanim znalazłem Combofix
Zrobiłem wszystko tak jak napisaliście i chyba jest ok
to logi

Kod: Zaznacz wszystko: ComboFix 08-10-03.06 - frugo 2008-10-04 16:03:31.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.190 [GMT 2:00] Uruchomiony z: F:\Documents and Settings\frugo\Pulpit\ComboFix.exe Użyto następujących komend :: F:\Documents and Settings\frugo\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: F:\1nkbd8h.bat F:\WINDOWS\Tasks\XoftSpySE 2.job F:\WINDOWS\Tasks\XoftSpySE.job J:\1nkbd8h.bat . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-04 do 2008-10-04 ))))))))))))))))))))))))))))))) . 2008-10-04 11:59 . 2008-10-04 11:59 <DIR> d-------- F:\Program Files\Trend Micro 2008-10-04 11:44 . 2008-10-04 11:44 <DIR> d-------- F:\Documents and Settings\LocalService\Menu Start 2008-10-04 11:42 . 2008-10-04 11:42 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\PC Tools 2008-10-04 00:29 . 2008-10-04 00:29 <DIR> d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-10-03 19:54 . 2008-10-04 13:05 <DIR> d-a------ F:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-10-03 15:21 . 2008-10-04 12:37 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-03 08:56 . 2008-10-03 09:09 <DIR> d-------- F:\Program Files\Techland 2008-10-01 18:10 . 2008-10-01 18:10 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-10-01 18:10 . 2008-10-01 18:10 1,409 --a------ F:\WINDOWS\QTFont.for 2008-09-26 20:14 . 2008-09-26 20:14 <DIR> d-------- F:\Documents and Settings\frugo\Dane aplikacji\GARMIN 2008-09-26 20:10 . 2008-09-26 20:10 <DIR> d-------- F:\Garmin 2008-09-26 20:09 . 2008-09-26 20:09 <DIR> d-------- F:\Program Files\Garmin 2008-09-22 17:23 . 2007-05-16 16:45 3,497,832 --a------ F:\WINDOWS\system32\d3dx9_34.dll 2008-09-22 17:22 . 2008-09-22 17:22 <DIR> d-------- F:\WINDOWS\Logs . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-04 14:11 8,744,992 --sha-w F:\WINDOWS\system32\drivers\fidbox.dat 2008-10-04 14:11 577,312 --sha-w F:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-04 13:52 --------- d-----w F:\Program Files\Mozilla Thunderbird 2008-10-04 13:03 --------- d-----w F:\Program Files\Net Activity Diagram 2008-10-04 13:03 --------- d-----w F:\Program Files\FreeUser_staleIP-i-zmienneIP-03.07.2008 2008-10-04 11:31 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-04 11:17 57,800 --sha-w F:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-04 11:17 119,912 --sha-w F:\WINDOWS\system32\drivers\fidbox.idx 2008-10-04 07:57 --------- d-----w F:\Program Files\Orbitdownloader 2008-10-04 07:48 --------- d-----w F:\Program Files\NAPI-PROJEKT 2008-10-03 08:54 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\Orbit 2008-10-03 07:08 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-10-02 20:33 --------- d-----w F:\Program Files\eMule 2008-09-30 16:57 --------- d-----w F:\Program Files\WhereIsIt 2008-09-29 19:25 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\foobar2000 2008-09-27 09:57 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\uTorrent 2008-09-14 10:05 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\MyPhoneExplorer 2008-09-11 16:08 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\Image Zone Express 2008-09-04 19:35 --------- d-----w F:\Program Files\Gadu-Gadu 2008-09-03 15:13 163,644 ----a-w F:\WINDOWS\system32\drivers\secdrv.sys 2008-09-03 13:57 --------- d-----w F:\Program Files\PowerISO 2008-08-16 20:49 --------- d-----w F:\Program Files\DC++ 2008-08-16 11:24 --------- d-----w F:\Program Files\Xilisoft 2008-08-09 09:00 --------- d-----w F:\Documents and Settings\frugo\Dane aplikacji\Ahead 2008-08-09 08:56 --------- d-----w F:\Program Files\Common Files\Ahead 2008-08-09 08:50 --------- d-----w F:\Program Files\Nero 2008-08-09 08:45 --------- d-----w F:\Program Files\Ahead 2008-08-06 17:42 96,976 ----a-w F:\WINDOWS\system32\drivers\klin.dat 2008-08-05 15:38 --------- d-----w F:\Program Files\GIF Movie Gear 2008-07-31 08:41 68,616 ----a-w F:\WINDOWS\system32\XAPOFX1_1.dll 2008-07-31 08:41 238,088 ----a-w F:\WINDOWS\system32\xactengine3_2.dll 2008-07-31 08:40 509,448 ----a-w F:\WINDOWS\system32\XAudio2_2.dll 2008-07-12 06:18 467,984 ----a-w F:\WINDOWS\system32\d3dx10_39.dll 2008-07-12 06:18 3,851,784 ----a-w F:\WINDOWS\system32\D3DX9_39.dll 2008-07-12 06:18 1,493,528 ----a-w F:\WINDOWS\system32\D3DCompiler_39.dll 2008-07-08 08:42 43,698 ----a-w F:\WINDOWS\system32\xvid-uninstall.exe 2008-06-13 20:52 88 --sh--r F:\Documents and Settings\All Users\Dane aplikacji\F57F310484.sys 2008-06-13 20:52 2,516 --sha-w F:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys 2001-11-23 04:08 712,704 -c--a-w F:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2003-05-01 07:36 114,688 ----a-w F:\Program Files\internet explorer\plugins\LV7ActiveXControl.dll 2008-05-03 14:21 56 --sh--r F:\WINDOWS\system32\8404317FF5.sys 2008-05-03 14:24 2,516 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2004-08-04 14:00 14336 ba98327e90022dbd6ee76490e0622e2e F:\WINDOWS\system32\svchost.exe 2004-08-04 14:00 14336 ba98327e90022dbd6ee76490e0622e2e F:\WINDOWS\system32\dllcache\svchost.exe 2004-08-04 14:00 544256 87d414eba254e42649f4d0a00bb653c6 F:\WINDOWS\system32\winlogon.exe 2004-08-04 14:00 544256 87d414eba254e42649f4d0a00bb653c6 F:\WINDOWS\system32\dllcache\winlogon.exe 2004-08-04 14:00 504832 0344407089b08548d4feba62bb0f32d0 F:\WINDOWS\VistaMizer\old\winlogon.exe 2004-08-04 14:00 2315392 37e799d6050ae484152b039cc2f06e5d F:\WINDOWS\system32\ntkrnlpa.exe 2004-08-04 14:00 2058112 44d1bc1b05e0c7c82e81687b79c653c7 F:\WINDOWS\VistaMizer\old\ntkrnlpa.exe 2004-08-04 14:00 2439552 c9d5b530332fe1f4c7c2189104da7ffd F:\WINDOWS\system32\ntoskrnl.exe 2004-08-04 14:00 2182272 dcf53422b7edded3b7431fbae4a7ee3f F:\WINDOWS\VistaMizer\old\ntoskrnl.exe 2004-08-04 14:00 1551872 fe6ddf00b672c3647b9f20e09b7774ee F:\WINDOWS\explorer.exe 2004-08-04 14:00 1551872 fe6ddf00b672c3647b9f20e09b7774ee F:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 14:00 1033728 379098a96e6c165b659de7e4328010ea F:\WINDOWS\VistaMizer\old\explorer.exe 2004-08-04 14:00 25088 36eab91ffd244d3202830e417c45e0a5 F:\WINDOWS\system32\ctfmon.exe 2004-08-04 14:00 25088 36eab91ffd244d3202830e417c45e0a5 F:\WINDOWS\system32\dllcache\ctfmon.exe 2004-08-04 14:00 15360 cbfa30492d70ce3938d8a7783d0c0436 F:\WINDOWS\VistaMizer\old\ctfmon.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 25088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WheelMouse"="F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2003-12-21 147456] "TWCU"="F:\Program Files\TP-LINK\TWCU\TWCU.exe" [2006-03-29 364544] "MBM 5"="F:\Program Files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 594944] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 25088] "Picasa Media Detector"="F:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] F:\Documents and Settings\frugo\Menu Start\Programy\Autostart\ Samurize.lnk - F:\Program Files\Samurize\Client.exe [2005-05-16 1327104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= F:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= F:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= F:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 14:00 25088 F:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2006-05-18 11:29 49152 F:\Program Files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] --a------ 1997-06-03 08:51 48576 f:\PROGRA~1\SOWNIK~2\WATCH.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --------- 2005-12-07 22:57 30208 F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "F:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "F:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "F:\\Program Files\\Gadu-Gadu\\gg.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "F:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "F:\\Program Files\\National Instruments\\LabVIEW 7.0\\LabVIEW.exe"= "F:\\Program Files\\uTorrent\\uTorrent.exe"= "F:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "F:\\Program Files\\DC++\\DCPlusPlus.exe"= "F:\\Program Files\\Ares\\Ares.exe"= R0 NIPALK;NIPALK;F:\WINDOWS\system32\drivers\NIPALK.sys [2004-07-07 373853] R2 cvintdrv;cvintdrv;F:\WINDOWS\system32\drivers\cvintdrv.sys [2002-10-07 7140] R2 Nadim;NAD Proto Driver;F:\WINDOWS\system32\DRIVERS\nadim.sys [2008-04-24 18688] R2 nidimk;nidimk;F:\WINDOWS\system32\drivers\nidimk.dll [2004-03-26 108124] R2 nipxirmk;nipxirmk;F:\WINDOWS\system32\drivers\nipxirmk.dll [2004-07-07 41075] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;F:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2003-08-26 9728] R3 klim5;Kaspersky Anti-Virus NDIS Filter;F:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344] R3 niorbk;niorbk;F:\WINDOWS\system32\drivers\niorbk.dll [2004-03-31 35420] S0 TfFsMon;TfFsMon;F:\WINDOWS\system32\drivers\TfFsMon.sys [ ] S0 TfSysMon;TfSysMon;F:\WINDOWS\system32\drivers\TfSysMon.sys [ ] S3 NiViPxiK;NiViPxiK;F:\WINDOWS\system32\drivers\NiViPxiK.sys [2004-07-14 24576] S3 TfNetMon;TfNetMon;F:\WINDOWS\system32\drivers\TfNetMon.sys [ ] . Zawartość folderu 'Zaplanowane zadania' 2008-07-31 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job - F:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-04 16:11:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-04 16:15:22 ComboFix-quarantined-files.txt 2008-10-04 14:15:11 ComboFix2.txt 2008-10-04 11:03:09 Przed: 3 301 437 440 bajtów wolnych Po: 3,332,567,040 bajtów wolnych 184

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:38, on 2008-10-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\system32\acs.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\Explorer.EXE F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe F:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe F:\WINDOWS\system32\niSvcLoc.exe F:\WINDOWS\system32\HPZipm12.exe F:\Program Files\CyberLink\Shared files\RichVideo.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe F:\WINDOWS\system32\nipalsm.exe F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe F:\Program Files\TP-LINK\TWCU\TWCU.exe F:\Program Files\Motherboard Monitor 5\MBM5.EXE F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Samurize\Client.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe F:\WINDOWS\system32\NOTEPAD.EXE F:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - F:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - F:\Program Files\Orbitdownloader\GrabPro.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O4 - HKLM\..\Run: [WheelMouse] F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [TWCU] "F:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui O4 - HKLM\..\Run: [MBM 5] "F:\Program Files\Motherboard Monitor 5\MBM5.EXE" O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AVP] "F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Samurize.lnk = F:\Program Files\Samurize\Client.exe O8 - Extra context menu item: &Download by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Dodaj do blokowanych banerów - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: Down&load all by Orbit - res://F:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - F:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7A3D29A3-B27C-4EE6-8095-36E89137AFA7}: NameServer = 192.168.1.1,194.204.152.34 O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - F:\WINDOWS\system32\acs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Capture Device Service - InterVideo Inc. - F:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NILM License manager - Macrovision Corporation - F:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe O23 - Service: nipxirmu - National Instruments Corporation - F:\WINDOWS\system32\nipalsm.exe O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - F:\WINDOWS\system32\niSvcLoc.exe O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - F:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7105 bytes