Wirusy z pendrive'a

**Posty:** 2042 · przez **Wojtaz** 08 Kwi 2009, 21:03

Co tutaj pisać, kolega dał mi pendrive'a i miał wirusy na nim i teraz jakieś pliki mi powyskakiwały na dyskach..

ComboFix:

Kod: Zaznacz wszystko: ComboFix 09-04-04.01 - Wojtaz 2009-04-08 20:52:55.12 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.218 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\copy.exe C:\host.exe C:\WINDOWS\autorun.inf C:\WINDOWS\svchost.exe C:\WINDOWS\system32\temp1.exe C:\WINDOWS\system32\temp2.exe C:\WINDOWS\xcopy.exe D:\Autorun.inf D:\copy.exe D:\host.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ISODRIVE -------\Service_ISODrive ((((((((((((((((((((((((( Pliki utworzone od 2009-03-08 do 2009-04-08 ))))))))))))))))))))))))))))))) . 2009-04-08 20:16 . 2009-04-08 20:16 196,941,305 --a------ C:\NFS_Porsche_Unleashed.zip 2009-04-08 17:37 . 2009-04-08 17:37 <DIR> d-------- C:\AV_LOGS 2009-04-08 17:36 . 2008-12-10 16:56 17,792 --a------ C:\WINDOWS\system32\drivers\vcsvad.sys 2009-04-07 17:44 . 2009-04-07 17:44 145 --a------ C:\WINDOWS\Eudcedit.ini 2009-03-28 12:49 . 2009-03-28 12:49 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\anpo.republika.pl 2009-03-28 12:36 . 2009-03-28 12:36 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\fltk.org 2009-03-22 16:19 . 2004-08-22 17:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2009-03-22 16:19 . 2004-08-22 17:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2009-03-22 13:38 . 2009-03-29 12:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2009-03-22 13:38 . 2009-03-22 13:38 1,409 --a------ C:\WINDOWS\QTFont.for 2009-03-22 12:54 . 2009-03-22 12:56 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\DC++ 2009-03-21 20:45 . 2009-03-21 20:46 <DIR> d-------- C:\Quake2 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-08 18:54 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\uTorrent 2009-04-08 18:50 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Tlen.pl 2009-04-08 15:48 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\foobar2000 2009-04-01 20:52 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2009-03-28 19:26 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2009-03-28 19:26 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Skype 2009-02-08 07:30 --------- d--h--w C:\Program Files\InstallShield Installation Information 2009-01-27 10:30 286,720 ------w C:\WINDOWS\Setup1.exe 2008-06-18 19:17 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-05-10 19:53 22,328 ----a-w C:\Documents and Settings\Wojtaz\Dane aplikacji\PnkBstrK.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Komunikator"="D:\Program Files\Tlen.pl\tlen.exe" [2008-08-25 12:42 5853160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 19:11 925696] "UVS11 Preload"="D:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 13:17 340136] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-17 17:23 81920] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-17 17:23 8478720] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe] "nwiz"="nwiz.exe" [2007-08-17 17:23 1626112 C:\WINDOWS\system32\nwiz.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\WINDOWS\system32\logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.avis"= ff_acm.acm "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio] --a------ 2002-09-03 18:38 987187 D:\Program Files\WinCustomize\LogonStudio\LogonStudio.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-08-17 17:23 8478720 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-31 23:13 385024 D:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup] --a------ 2003-03-31 18:28 155648 C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-08-17 17:23 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\Tlen.pl\\tlen.exe"= "D:\\Program Files\\BearShare\\BearShare.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "D:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "D:\\Program Files\\UltraVNC\\vncviewer.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "67:UDP"= 67:UDP:DHCP Discovery Service "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);C:\WINDOWS\system32\drivers\vcsvad.sys [2009-04-08 17:36:20 17792] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys --> C:\WINDOWS\system32\Drivers\e4ldr.sys [?] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys --> C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [?] S3 gggen;Generic USB Flash Driver;C:\WINDOWS\system32\drivers\gggen.sys [2008-05-08 22:21:31 11648] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\drivers\libusb0.sys [2008-05-14 10:22:05 29184] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2009-01-27 23:07:47 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2009-01-27 23:07:47 8320] S3 PPJoyBus;Parallel Port Joystick Bus device driver;C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-01-23 16:33:01 13952] S3 PPortJoystick;Parallel Port Joystick device driver;C:\WINDOWS\system32\drivers\PPortJoy.sys [2004-01-23 16:32:47 28800] S3 PsSdk41;PsSdk41;C:\WINDOWS\system32\drivers\pssdk41.sys [2008-06-13 19:07:40 36928] S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\drivers\s115bus.sys [2008-05-10 10:21:17 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\drivers\s115mdfl.sys [2008-05-10 10:22:00 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\drivers\s115mdm.sys [2008-05-10 10:22:00 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\drivers\s115mgmt.sys [2008-05-10 10:22:12 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\drivers\s115obex.sys [2008-05-10 10:22:08 98568] S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\drivers\s125bus.sys [2008-05-26 18:56:20 83336] S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\drivers\s125mdfl.sys [2008-07-05 12:48:30 15112] S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\drivers\s125mdm.sys [2008-07-05 12:48:30 108680] S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS --> C:\WINDOWS\system32\ZDCndis5.SYS [?] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - BootScreen . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = <local> IE: Ściągnij przez IDM - D:\Program Files\Internet Download Manager\IEExt.htm IE: Ściągnij wszystkie linki przez IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm IE: Ściągnij zawartość wideo FLV przez IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm TCP: {52A11F0F-890C-4730-A989-FEE6EEEBA053} = 192.168.1.1,192.168.1.13 FF - ProfilePath - C:\Documents and Settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\ywdopzl0.default\ FF - prefs.js: browser.startup.homepage - www.google.pl FF - plugin: C:\Program Files\thriXXX\WebLaunch\Binaries\npWebLaunch.dll FF - plugin: D:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF - plugin: D:\Program Files\Mozilla Firefox\plugins\npWebLaunch.dll FF - plugin: D:\Program Files\Opera\program\plugins\npdsplay.dll FF - plugin: D:\Program Files\Opera\program\plugins\NPSWF32.dll FF - plugin: D:\Program Files\Opera\program\plugins\npWebLaunch.dll FF - plugin: D:\Program Files\Opera\program\plugins\npwmsdrm.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin2.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin3.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin4.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin5.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin6.dll FF - plugin: D:\Program Files\QuickTime\Plugins\npqtplugin7.dll .

Hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:03, on 2009-04-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\Tlen.pl\tlen.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [UVS11 Preload] D:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O8 - Extra context menu item: Ściągnij przez IDM - D:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Ściągnij zawartość wideo FLV przez IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm O17 - HKLM\System\CCS\Services\Tcpip\..\{52A11F0F-890C-4730-A989-FEE6EEEBA053}: NameServer = 192.168.1.1,192.168.1.13 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Unknown owner - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 4386 bytes

**Posty:** 8001 · przez **Okocza** 08 Kwi 2009, 21:21

C:\WINDOWS\Setup1.exe

usuń ten plik

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.