Wirusy

**Posty:** 99 · przez **turbo16** 23 Lis 2008, 12:59

Otwiera mi się sam internet explorer i wyświetla różne strony. Myślę że to jakiś wirus. Skanowałem mój komputer różnymi programami avast (avast znajduje mi najczęściej wirusa "Win32:Trojan-gen {Other}"), Spyware Terminator, Ad-Aware 2008 i innymi -każdy znalazł jakies błędy po usunięciu ich problem z przeglądarką nadal jest a wirusy i błędy na drugi dzień powracają.
Daje logi z programu HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:42:33, on 2008-11-23
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\firefox.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\Rar$EX00.750\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windiwsfsearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windiwsfsearch.com/ie6.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://windiwsfsearch.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windiwsfsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.tpnet.pl:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {4FD130AE-D8D2-4137-A680-C5CF233BE545} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Java Update] C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\firefox.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: pobierz za pomocą mega manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - (no file) (HKCU)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202969780014
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D1EFFA3-A514-4A17-9784-A9A99DE5101B}: NameServer = 217.96.62.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: dmbumr.dll
O20 - Winlogon Notify: rqRIbaAt - rqRIbaAt.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8982 bytes

**Posty:** 18165 · przez **wojtas** 23 Lis 2008, 13:04

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka (tylko w tagach code )

Autor postu otrzymał pochwałę

**Posty:** 99 · przez **turbo16** 23 Lis 2008, 13:45

Miałes racje porty były odblokowane. Oto raport z SDFixa:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by _Turbo_ on 2008-11-23 at 12:23 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: TDSSserv.sys [b]Path [/b]: \systemroot\system32\drivers\TDSSmaxt.sys TDSSserv.sys - Deleted djpInit_Dlls Registry Value Removed Restoring Default Security Values Restoring Default Hosts File Restoring Default IE Search Pages Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\-12606~1 - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMP10.tmp - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMP3.tmp - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMP4.tmp - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMP5.tmp - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMP6.tmp - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMP7.tmp - Deleted C:\DOCUME~1\_Turbo_\USTAWI~1\Temp\TMPD5.tmp - Deleted C:\WINDOWS\system32\drivers\TDSSmaxt.sys - Deleted C:\WINDOWS\SYSTEM32\TDSSOSVD.dat - Deleted C:\WINDOWS\SYSTEM32\TDSSTKDV.log - Deleted Folder C:\WINDOWS\system32\675873 - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 12:28:31 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:72,80,79,48,76,d2,c3,84,2a,27,75,9b,fc,47,d8,91,13,8d,be,1e,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000001 "khjeh"=hex:b3,2a,80,7f,c5,76,76,62,98,cf,bb,ce,34,80,de,1a,75,97,8d,16,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,aa,aa,1f,1a,f3,04,24,d5,fe,e4,63,67,da,91,08,3c,8c,.. "khjeh"=hex:ba,29,5d,aa,38,3d,84,40,51,cf,6d,b1,fb,05,09,89,cb,d2,54,25,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:8f,33,3a,b2,af,d0,9d,8e,67,45,33,a6,a9,73,d2,3a,94,30,97,7d,44,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:3f,e7,4e,32,a5,49,c3,74,88,95,69,57,04,be,0b,19,9b,5e,97,ac,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:b3,c4,ac,34,ac,da,f0,c3,80,c5,83,91,a8,10,f8,d7,d7,8a,d6,8e,56,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:90,6a,d3,bc,c0,28,f3,f8,1f,df,39,53,fa,52,77,80,75,c5,8b,2c,dc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:72,80,79,48,76,d2,c3,84,2a,27,75,9b,fc,47,d8,91,13,8d,be,1e,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000001 "khjeh"=hex:b3,2a,80,7f,c5,76,76,62,98,cf,bb,ce,34,80,de,1a,75,97,8d,16,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,aa,aa,1f,1a,f3,04,24,d5,fe,e4,63,67,da,91,08,3c,8c,.. "khjeh"=hex:ba,29,5d,aa,38,3d,84,40,51,cf,6d,b1,fb,05,09,89,cb,d2,54,25,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:36,6b,5c,69,35,12,ae,28,49,ee,6a,df,10,d9,06,3f,d1,1a,dc,3f,63,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:3f,e7,4e,32,a5,49,c3,74,88,95,69,57,04,be,0b,19,9b,5e,97,ac,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:b3,c4,ac,34,ac,da,f0,c3,80,c5,83,91,a8,10,f8,d7,d7,8a,d6,8e,56,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:90,6a,d3,bc,c0,28,f3,f8,1f,df,39,53,fa,52,77,80,75,c5,8b,2c,dc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:72,80,79,48,76,d2,c3,84,2a,27,75,9b,fc,47,d8,91,13,8d,be,1e,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000001 "khjeh"=hex:b3,2a,80,7f,c5,76,76,62,98,cf,bb,ce,34,80,de,1a,75,97,8d,16,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,aa,aa,1f,1a,f3,04,24,d5,fe,e4,63,67,da,91,08,3c,8c,.. "khjeh"=hex:ba,29,5d,aa,38,3d,84,40,51,cf,6d,b1,fb,05,09,89,cb,d2,54,25,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:8f,33,3a,b2,af,d0,9d,8e,67,45,33,a6,a9,73,d2,3a,94,30,97,7d,44,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:3f,e7,4e,32,a5,49,c3,74,88,95,69,57,04,be,0b,19,9b,5e,97,ac,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:b3,c4,ac,34,ac,da,f0,c3,80,c5,83,91,a8,10,f8,d7,d7,8a,d6,8e,56,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:90,6a,d3,bc,c0,28,f3,f8,1f,df,39,53,fa,52,77,80,75,c5,8b,2c,dc,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions] "A\1U?K?A?S?Z?-?P?C?"="" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Twain] "y\1r?ó?d?B\1o? ?d?o?m?y?[\1l?n?e?"="C:\WINDOWS\Twain_32\Pfc027\TWAINUI.ds" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "D:\\cs 1.6\\hl.exe"="D:\\cs 1.6\\hl.exe:*:Disabled:Half-Life Launcher" "E:\\Counter-Strike Source\\hl2.exe"="E:\\Counter-Strike Source\\hl2.exe:*:Enabled:hl2" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "E:\\cs16\\hl.exe"="E:\\cs16\\hl.exe:*:Enabled:Half-Life Launcher" "E:\\cs16\\hlds.exe"="E:\\cs16\\hlds.exe:*:Enabled:HLDS Launcher" "C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget" "C:\\d1.exe"="C:\\d1.exe:*:Enabled:enable" "C:\\WINDOWS\\system32\\service.exe"="C:\\WINDOWS\\system32\\service.exe:*:Enabled:enable" "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "I:\\Cossacks\\dmcr.exe"="I:\\Cossacks\\dmcr.exe:*:Enabled:dmcr" "C:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe:*:Enabled:Nero Home" "C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console" "D:\\cs1.6\\hl.exe"="D:\\cs1.6\\hl.exe:*:Disabled:Half-Life Launcher" "D:\\cs\\hl.exe"="D:\\cs\\hl.exe:*:Disabled:Half-Life Launcher" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Onet.pl - Skype" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "J:\\StrongholdLegends.exe"="J:\\StrongholdLegends.exe:*:Enabled:Stronghold Legends" "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE:*:Enabled:SAgent4" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sat 23 Aug 2008 635,848 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe" Mon 14 Apr 2008 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Fri 15 Feb 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 15 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" [b]Finished![/b]

combofixa

Kod: Zaznacz wszystko: ComboFix 08-11-22.02 - _Turbo_ 2008-11-23 12:38:01.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.431 [GMT 1:00] Uruchomiony z: c:\documents and settings\_Turbo_\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\bmf.cs c:\windows\system32\ccs.so c:\windows\system32\Cfx32.lic c:\windows\system32\cfx32.ocx c:\windows\system32\cgclqeoc.dll c:\windows\system32\ho.ln c:\windows\system32\hxkjvv.dll c:\windows\system32\khqsdqfh.dll c:\windows\system32\kjweuyfq.ini c:\windows\system32\ko.o c:\windows\system32\mn.n c:\windows\system32\qaanlntp.ini c:\windows\system32\shgpijty.ini c:\windows\system32\skwirgbj.ini c:\windows\system32\tgdmwv.dll c:\windows\system32\wbodnmbl.ini . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-23 do 2008-11-23 ))))))))))))))))))))))))))))))) . 2008-11-23 12:22 . 2008-11-23 12:22 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-11-23 12:20 . 2008-11-23 12:21 <DIR> d-------- c:\windows\ERUNT 2008-11-23 12:16 . 2008-11-23 12:29 <DIR> d-------- C:\SDFix 2008-11-22 15:08 . 2008-11-22 15:08 356,352 --a------ c:\windows\eSellerateEngine.dll 2008-11-22 15:03 . 2008-11-22 15:03 2,208 --a------ c:\windows\system32\drivers\nxsIO32.sys 2008-11-22 14:44 . 2008-11-22 14:44 <DIR> d-------- c:\documents and settings\Master\Dane aplikacji\Spyware Terminator 2008-11-22 09:39 . 2008-11-22 09:39 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-22 09:38 . 2008-11-23 11:07 <DIR> d-------- c:\program files\Spyware Terminator 2008-11-22 09:38 . 2008-11-23 11:07 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-11-22 09:38 . 2008-11-23 11:06 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Spyware Terminator 2008-11-22 09:38 . 2008-11-22 09:38 141,312 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-22 07:57 . 2008-11-22 07:57 <DIR> d-------- c:\program files\Lavasoft 2008-11-22 07:57 . 2008-11-22 09:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2008-11-22 07:38 . 2008-11-22 07:40 <DIR> d-------- c:\documents and settings\Marvolo\Dane aplikacji\Spyware Terminator 2008-11-21 20:16 . 2008-11-21 20:16 0 --a------ c:\windows\system32\drivers\wnmsav.dat 2008-11-21 07:18 . 2008-11-21 07:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2008-11-21 07:18 . 2008-11-21 07:18 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Malwarebytes 2008-11-20 19:20 . 2008-11-20 19:20 1,990 --a------ c:\windows\system32\drivers\net_m32.inf 2008-11-20 18:49 . 2008-11-20 18:49 37 --a------ c:\windows\r007 2008-11-20 18:44 . 2008-11-20 18:44 <DIR> d-------- c:\program files\Panda Software 2008-11-20 18:32 . 2008-11-21 20:27 <DIR> d-------- c:\program files\Common Files\Panda Software 2008-11-20 18:31 . 2008-11-20 20:20 1,743 --a------ c:\windows\unins000.dat 2008-11-20 18:28 . 2004-02-19 03:03 65,536 --a------ c:\windows\system32\E_S00RP1.EXE 2008-11-20 18:28 . 2008-11-20 18:28 9,662 --a------ c:\windows\EPISME00.SWB 2008-11-17 15:39 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2008-11-17 15:15 . 2008-11-17 15:15 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Lavasoft 2008-11-17 14:57 . 2008-11-17 14:57 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\ArcaBit 2008-11-17 14:11 . 2008-11-17 14:11 <DIR> d-------- c:\program files\Enigma Software Group 2008-11-15 20:20 . 2008-11-15 20:20 <DIR> d-------- c:\program files\Common Files\xing shared 2008-11-15 20:19 . 2008-11-15 20:19 <DIR> d-------- c:\program files\Real 2008-11-15 20:19 . 2008-11-15 20:22 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Real 2008-11-15 19:44 . 2008-11-15 19:54 <DIR> d-------- c:\program files\SkanerOnline 2008-11-15 09:03 . 2008-11-15 09:03 2,276 --a------ c:\windows\system32\TDSSfxwp.dll 2008-11-15 09:01 . 2008-11-23 09:26 <DIR> d-------- c:\program files\WebMediaViewer 2008-11-14 18:37 . 2008-11-14 18:37 <DIR> d-------- c:\program files\Common Files\NSV 2008-11-13 13:57 . 2008-04-14 18:20 713,728 --a--c--- c:\windows\system32\dllcache\opengl32.dll 2008-11-13 07:36 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-13 07:36 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-06 17:57 . 2008-11-06 17:57 <DIR> d-------- c:\program files\Runtime Software 2008-11-02 15:39 . 2008-11-02 15:39 73,216 --a------ c:\windows\temp.000 2008-10-30 15:10 . 2008-10-30 15:10 <DIR> d-------- c:\documents and settings\_Turbo_\.borland 2008-10-30 15:09 . 2008-10-30 15:09 <DIR> d-------- c:\program files\Common Files\Borland Shared 2008-10-30 15:09 . 2008-10-30 15:09 <DIR> d-------- c:\program files\Borland 2008-10-27 14:20 . 2008-10-27 14:20 <DIR> d--h----- c:\windows\system32\GroupPolicy 2008-10-24 09:45 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-23 13:36 . 2008-11-04 12:40 <DIR> d-------- c:\documents and settings\Master\Dane aplikacji\MEGAUPLOADTOOLBAR 2008-10-23 13:03 . 2008-11-23 12:39 <DIR> d--h----- c:\documents and settings\Master\Ustawienia lokalne 2008-10-23 13:03 . 2008-10-23 13:03 <DIR> dr------- c:\documents and settings\Master\Ulubione 2008-10-23 13:03 . 2008-02-12 13:32 <DIR> d--h----- c:\documents and settings\Master\Szablony 2008-10-23 13:03 . 2008-02-12 14:25 <DIR> d-------- c:\documents and settings\Master\Pulpit 2008-10-23 13:03 . 2008-10-23 13:03 <DIR> dr------- c:\documents and settings\Master\Moje dokumenty 2008-10-23 13:03 . 2008-02-12 14:25 <DIR> dr------- c:\documents and settings\Master\Menu Start 2008-10-23 13:03 . 2008-10-23 13:03 <DIR> d-------- c:\documents and settings\Master\Dane aplikacji\Nero 2008-10-23 13:03 . 2008-11-22 14:45 <DIR> dr-h----- c:\documents and settings\Master\Dane aplikacji 2008-10-23 13:03 . 2008-10-23 13:04 <DIR> d-------- c:\documents and settings\Master . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-21 19:27 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-21 18:31 --------- d-----w c:\program files\DC++ 2008-11-20 18:16 --------- d-----w c:\program files\Gadu-Gadu 2008-11-18 13:58 --------- d-----w c:\documents and settings\_Turbo_\Dane aplikacji\Skype 2008-11-15 19:20 --------- d-----w c:\program files\Common Files\Real 2008-11-02 14:39 249,856 ------w c:\windows\Setup1.exe 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-11 16:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Firefly Studios 2008-10-10 14:50 921,600 ----a-w c:\windows\system32\vorbisenc.dll 2008-10-10 14:50 892,928 ----a-w c:\windows\system32\iconv.dll 2008-10-10 14:50 45,056 ----a-w c:\windows\system32\ogg.dll 2008-10-10 14:50 237,568 ----a-w c:\windows\system32\OggDS.dll 2008-10-10 14:50 188,416 ----a-w c:\windows\system32\vorbis.dll 2008-10-10 14:50 1,415,680 ----a-w c:\windows\system32\WMV9VCM.dll 2008-10-10 14:49 9,216 ----a-w c:\windows\system32\cpuinf32.dll 2008-10-10 14:49 755,027 ----a-w c:\windows\system32\xvidcore.dll 2008-10-10 14:49 245,760 ----a-w c:\windows\system32\mplvpx.dll 2008-10-07 15:56 --------- d-----w c:\documents and settings\_Turbo_\Dane aplikacji\skypePM 2008-10-07 14:12 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Nero 2008-10-07 14:12 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\MEGAUPLOADTOOLBAR 2008-10-05 06:17 --------- d-----w c:\documents and settings\Marvolo\Dane aplikacji\InstallShield 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-29 05:54 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Gadu-Gadu 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-31 11:24 103,736 -c--a-w c:\windows\system32\PnkBstrB.exe 2008-08-30 17:02 66,872 -c--a-w c:\windows\system32\PnkBstrA.exe 2008-08-30 16:42 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll 2008-03-04 18:35 32 -c--a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2004-10-01 13:00 40,960 ----a-w c:\program files\Uninstall_CDS.exe 2001-11-23 04:08 712,704 -c--a-w c:\windows\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-02-14 486856] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 344064] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-11-22 1783808] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=dmbumr.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "e:\\cs16\\hl.exe"= "e:\\cs16\\hlds.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= "d:\\cs\\hl.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-17 28544] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-21 110160] R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-22 141312] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-21 20560] R2 nxsIO32;NextSensor Kernel I/O Driver;\??\c:\windows\System32\DRIVERS\nxsIO32.sys [2008-11-22 2208] R3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys [2008-02-12 112380] S0 knsywcw;knsywcw;c:\windows\system32\drivers\bbtdekyy.sys [] S3 ddsxeiservice;ddsxeiservice2;\??\c:\program files\sXe Injected\ddsxei.sys [] *Newly Created Service* - PROCEXP90 . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{4FD130AE-D8D2-4137-A680-C5CF233BE545} - (no file) HKLM-Run-Cmaudio - cmicnfg.cpl ShellExecuteHooks-{4FD130AE-D8D2-4137-A680-C5CF233BE545} - (no file) Notify-rqRIbaAt - rqRIbaAt.dll Notify-WgaLogon - (no file) . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\_Turbo_\Dane aplikacji\Mozilla\Firefox\Profiles\7uf6tb2a.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 12:39:21 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(544) c:\windows\SYSTEM32\Ati2evxx.dll . Czas ukończenia: 2008-11-23 12:40:21 ComboFix-quarantined-files.txt 2008-11-23 11:40:07 Przed: 10 774 822 912 bajtów wolnych Po: 10,843,152,384 bajtów wolnych 202 --- E O F --- 2008-11-13 11:59:04

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:44:41, on 2008-11-23 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\SDFix\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = w3cache.tpnet.pl:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file) O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: pobierz za pomocą mega manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - (no file) (HKCU) O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202969780014 O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8D1EFFA3-A514-4A17-9784-A9A99DE5101B}: NameServer = 217.96.62.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: dmbumr.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe -- End of file - 7893 bytes

**Posty:** 18165 · przez **wojtas** 23 Lis 2008, 13:55

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\TDSSfxwp.dll

Folder::
c:\program files\WebMediaViewer

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 99 · przez **turbo16** 23 Lis 2008, 14:22

Podczas pracy programu wyskoczyło mi że nie mam konsoli przywracania systemu czy trzeba to zainstalować?

Kod: Zaznacz wszystko: ComboFix 08-11-22.02 - _Turbo_ 2008-11-23 13:17:47.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.414 [GMT 1:00] Uruchomiony z: c:\sdfix\ComboFix.exe Użyto następujących komend :: c:\documents and settings\_Turbo_\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: c:\windows\system32\TDSSfxwp.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\TDSSfxwp.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-23 do 2008-11-23 ))))))))))))))))))))))))))))))) . 2008-11-23 12:22 . 2008-11-23 12:22 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-11-23 12:20 . 2008-11-23 12:21 <DIR> d-------- c:\windows\ERUNT 2008-11-23 12:16 . 2008-11-23 12:44 <DIR> d-------- C:\SDFix 2008-11-22 15:08 . 2008-11-22 15:08 356,352 --a------ c:\windows\eSellerateEngine.dll 2008-11-22 15:03 . 2008-11-22 15:03 2,208 --a------ c:\windows\system32\drivers\nxsIO32.sys 2008-11-22 14:44 . 2008-11-22 14:44 <DIR> d-------- c:\documents and settings\Master\Dane aplikacji\Spyware Terminator 2008-11-22 09:39 . 2008-11-22 09:39 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-22 09:38 . 2008-11-23 11:07 <DIR> d-------- c:\program files\Spyware Terminator 2008-11-22 09:38 . 2008-11-23 11:07 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-11-22 09:38 . 2008-11-23 11:06 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Spyware Terminator 2008-11-22 09:38 . 2008-11-22 09:38 141,312 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-22 07:57 . 2008-11-22 07:57 <DIR> d-------- c:\program files\Lavasoft 2008-11-22 07:57 . 2008-11-22 09:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2008-11-22 07:38 . 2008-11-22 07:40 <DIR> d-------- c:\documents and settings\Marvolo\Dane aplikacji\Spyware Terminator 2008-11-21 20:16 . 2008-11-21 20:16 0 --a------ c:\windows\system32\drivers\wnmsav.dat 2008-11-21 07:18 . 2008-11-21 07:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2008-11-21 07:18 . 2008-11-21 07:18 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Malwarebytes 2008-11-20 19:20 . 2008-11-20 19:20 1,990 --a------ c:\windows\system32\drivers\net_m32.inf 2008-11-20 18:49 . 2008-11-20 18:49 37 --a------ c:\windows\r007 2008-11-20 18:44 . 2008-11-20 18:44 <DIR> d-------- c:\program files\Panda Software 2008-11-20 18:32 . 2008-11-21 20:27 <DIR> d-------- c:\program files\Common Files\Panda Software 2008-11-20 18:31 . 2008-11-20 20:20 1,743 --a------ c:\windows\unins000.dat 2008-11-20 18:28 . 2004-02-19 03:03 65,536 --a------ c:\windows\system32\E_S00RP1.EXE 2008-11-20 18:28 . 2008-11-20 18:28 9,662 --a------ c:\windows\EPISME00.SWB 2008-11-17 15:39 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2008-11-17 15:15 . 2008-11-17 15:15 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Lavasoft 2008-11-17 14:57 . 2008-11-17 14:57 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\ArcaBit 2008-11-17 14:11 . 2008-11-17 14:11 <DIR> d-------- c:\program files\Enigma Software Group 2008-11-15 20:20 . 2008-11-15 20:20 <DIR> d-------- c:\program files\Common Files\xing shared 2008-11-15 20:19 . 2008-11-15 20:19 <DIR> d-------- c:\program files\Real 2008-11-15 20:19 . 2008-11-15 20:22 <DIR> d-------- c:\documents and settings\_Turbo_\Dane aplikacji\Real 2008-11-15 19:44 . 2008-11-15 19:54 <DIR> d-------- c:\program files\SkanerOnline 2008-11-15 09:01 . 2008-11-23 09:26 <DIR> d-------- c:\program files\WebMediaViewer 2008-11-14 18:37 . 2008-11-14 18:37 <DIR> d-------- c:\program files\Common Files\NSV 2008-11-13 13:57 . 2008-04-14 18:20 713,728 --a--c--- c:\windows\system32\dllcache\opengl32.dll 2008-11-13 07:36 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-13 07:36 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-06 17:57 . 2008-11-06 17:57 <DIR> d-------- c:\program files\Runtime Software 2008-11-02 15:39 . 2008-11-02 15:39 73,216 --a------ c:\windows\temp.000 2008-10-30 15:10 . 2008-10-30 15:10 <DIR> d-------- c:\documents and settings\_Turbo_\.borland 2008-10-30 15:09 . 2008-10-30 15:09 <DIR> d-------- c:\program files\Common Files\Borland Shared 2008-10-30 15:09 . 2008-10-30 15:09 <DIR> d-------- c:\program files\Borland 2008-10-27 14:20 . 2008-10-27 14:20 <DIR> d--h----- c:\windows\system32\GroupPolicy 2008-10-24 09:45 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-23 13:36 . 2008-11-04 12:40 <DIR> d-------- c:\documents and settings\Master\Dane aplikacji\MEGAUPLOADTOOLBAR 2008-10-23 13:03 . 2008-11-23 13:18 <DIR> d--h----- c:\documents and settings\Master\Ustawienia lokalne 2008-10-23 13:03 . 2008-10-23 13:03 <DIR> dr------- c:\documents and settings\Master\Ulubione 2008-10-23 13:03 . 2008-02-12 13:32 <DIR> d--h----- c:\documents and settings\Master\Szablony 2008-10-23 13:03 . 2008-02-12 14:25 <DIR> d-------- c:\documents and settings\Master\Pulpit 2008-10-23 13:03 . 2008-10-23 13:03 <DIR> dr------- c:\documents and settings\Master\Moje dokumenty 2008-10-23 13:03 . 2008-02-12 14:25 <DIR> dr------- c:\documents and settings\Master\Menu Start 2008-10-23 13:03 . 2008-10-23 13:03 <DIR> d-------- c:\documents and settings\Master\Dane aplikacji\Nero 2008-10-23 13:03 . 2008-11-22 14:45 <DIR> dr-h----- c:\documents and settings\Master\Dane aplikacji 2008-10-23 13:03 . 2008-10-23 13:04 <DIR> d-------- c:\documents and settings\Master . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-21 19:27 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-21 18:31 --------- d-----w c:\program files\DC++ 2008-11-20 18:16 --------- d-----w c:\program files\Gadu-Gadu 2008-11-18 13:58 --------- d-----w c:\documents and settings\_Turbo_\Dane aplikacji\Skype 2008-11-15 19:20 --------- d-----w c:\program files\Common Files\Real 2008-11-02 14:39 249,856 ------w c:\windows\Setup1.exe 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-11 16:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Firefly Studios 2008-10-10 14:50 921,600 ----a-w c:\windows\system32\vorbisenc.dll 2008-10-10 14:50 892,928 ----a-w c:\windows\system32\iconv.dll 2008-10-10 14:50 45,056 ----a-w c:\windows\system32\ogg.dll 2008-10-10 14:50 237,568 ----a-w c:\windows\system32\OggDS.dll 2008-10-10 14:50 188,416 ----a-w c:\windows\system32\vorbis.dll 2008-10-10 14:50 1,415,680 ----a-w c:\windows\system32\WMV9VCM.dll 2008-10-10 14:49 9,216 ----a-w c:\windows\system32\cpuinf32.dll 2008-10-10 14:49 755,027 ----a-w c:\windows\system32\xvidcore.dll 2008-10-10 14:49 245,760 ----a-w c:\windows\system32\mplvpx.dll 2008-10-07 15:56 --------- d-----w c:\documents and settings\_Turbo_\Dane aplikacji\skypePM 2008-10-07 14:12 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Nero 2008-10-07 14:12 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\MEGAUPLOADTOOLBAR 2008-10-05 06:17 --------- d-----w c:\documents and settings\Marvolo\Dane aplikacji\InstallShield 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-29 05:54 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Gadu-Gadu 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-31 11:24 103,736 -c--a-w c:\windows\system32\PnkBstrB.exe 2008-08-30 17:02 66,872 -c--a-w c:\windows\system32\PnkBstrA.exe 2008-08-30 16:42 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll 2008-03-04 18:35 32 -c--a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2004-10-01 13:00 40,960 ----a-w c:\program files\Uninstall_CDS.exe 2001-11-23 04:08 712,704 -c--a-w c:\windows\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-02-14 486856] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 344064] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-11-22 1783808] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=dmbumr.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "e:\\cs16\\hl.exe"= "e:\\cs16\\hlds.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= "d:\\cs\\hl.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-17 28544] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-21 110160] R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-22 141312] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-21 20560] R2 nxsIO32;NextSensor Kernel I/O Driver;\??\c:\windows\System32\DRIVERS\nxsIO32.sys [2008-11-22 2208] R3 CIF USB CAMERA Service;CIF USB CAMERA;c:\windows\system32\DRIVERS\pfc027.sys [2008-02-12 112380] S0 knsywcw;knsywcw;c:\windows\system32\drivers\bbtdekyy.sys [] S3 ddsxeiservice;ddsxeiservice2;\??\c:\program files\sXe Injected\ddsxei.sys [] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 13:19:03 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(544) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-11-23 13:19:53 ComboFix-quarantined-files.txt 2008-11-23 12:19:35 ComboFix2.txt 2008-11-23 11:40:22 Przed: 10 842 247 168 bajtów wolnych Po: 10,834,206,720 bajtów wolnych 185 --- E O F --- 2008-11-13 11:59:04

**Posty:** 8001 · przez **Okocza** 23 Lis 2008, 14:23

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: Folder:: c:\program files\WebMediaViewer

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

(ewentualnie tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 99 · przez **turbo16** 23 Lis 2008, 15:21

0 Przeskanowałem ComboFixem jak jak chciałeś.
1 OTMoveIt - twój link nie działał więc ściągnąłem z innej strony. Po ponownym uruchomieniu plik zniknął i zakładam że przeskanowało się.
2 CO do optymalizacji wykonałem prawie wszystko co było możliwe .
3 Oczyściłem
4 Zrobiłem
5 Przeskanowałem
6 Oto screen :
http://img241.imageshack.us/img241/3623/aaand3.png

**Posty:** 8001 · przez **Okocza** 23 Lis 2008, 15:21

gg i spyware terminator możesz wyłączyć

Autor postu otrzymał pochwałę

**Posty:** 99 · przez **turbo16** 23 Lis 2008, 15:26

a czy gg włączy się samo po włączeniu komputera czy trzeba będzie je włączać samemu

**Posty:** 8001 · przez **Okocza** 23 Lis 2008, 15:28

turbo16 napisał(a):a czy gg włączy się samo po włączeniu komputera czy trzeba będzie je włączać samemu

będziesz musiał je sam włączać, ale przyspieszy to włączanie komputera bo nie bedzie włączał nie wiadomo ilu programów na raz.

**Posty:** 99 · przez **turbo16** 23 Lis 2008, 15:32

Sądzę że teraz wszystko będzie ok dzięki za pomoc. Temat można zamknąć bo chyba już się nie otwierają same strony internetowe.

Wirusy

Wirusy

Wirusy

Re: wirusy

Wirusy

Re: wirusy

Wirusy

Re: wirusy

Wirusy

Re: wirusy

Wirusy

Wirusy

Kto jest na forum