wyskakujące popupy

[Kuba1]

Nie żebym Ci nie wierzył ale jesteś nowym użytkownikiem i nie chce sobie niczego popsuć. Chciałbym poczekać na opinie "fachowców".

Możesz mi spokojnie wierzyć i wykonać to co napisałem.

Jeśli znasz te foldery to je zostaw.

Autor postu otrzymał pochwałę

[konrad7890]

Jeszcze może log z virustotal coś pomoże:

http://up.programosy.pl/foto/virus.jpg

Zaraz się pobawię w tym o czym pisałeś.

[Kuba1]

To tylko potwierdza to co napisałem.

[konrad7890]

Stosujesz to narzędzie Seconfig XP

Co mam w nim zaznaczyć?

[Kuba1]

>>>>Opis<<<<

[konrad7890]

SDFix: Version 1.103

Run by Konrad on 2007-09-09 at 12:43

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\iexplorer.exe - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:


Finished!

[ Dodano: Dzisiaj o 12:04 ]
Jak na razie nic to nie dało.

<a href='http://up.programosy.pl/foto/mz.jpg'><img src='http://up.programosy.pl/foto/mz_min.jpg'></a>

DEL C:\WINDOWS\unvise32.exe

Nie może odnaleźć pliku.

[Kuba1]

Daj nowe logi o które prosiłem.

[konrad7890]

Nowe logi tutaj:

http://s008.wyslijto.pl/index.php?file_id=77498179935518830531

[Kuba1]

Otwórz notatnik i wklej w nim

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\]
"Explorer"=-

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG w trybie awaryjnym >>> Uruchom ponownie komputer.


Przeskanuj ten plik na www.virustota.com i wklej raport.

C:\WINDOWS\system32\eafdfb7_r.dll

Pobierz narzędzie Killbox zaznacz opcje delete on reboot i w polu full patch of file to delete wklej

C:\WINDOWS\iexplorer.exe

Klikasz X

Nastepnie wklej

C:\WINDOWS\unvise32.exe

Klikasz X reset kompa.


Zobacz,czy jeśli będziesz korzystał z Mozilli Firefox to problem będzie również występował.

Daj nowy log z ComboFix i Silentrunners.

Możliwe,że już wiem co powoduje nam ciągłe powracanie tego szkodnika a jest to ten wpis

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freewebportal.net/

Przejrzałem inne fora i w logach w któych był nasz szkodnik był również ten wpis,dlatego Sfixuj ten wpis

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freewebportal.net/

Czyli na początku wykonujesz to co napisałem na początku,fixujesz tenb wpis >>restart kompa>> upewnij sięze nie ma już tego wpisu i wtedy daj nowe logi.

Przed wykonaniem wszystkich powyższych czynności nie uruchamiaj żadnej przeglądarki internetowej.

[konrad7890]

C:\WINDOWS\unvise32.exe

Klikasz X reset kompa.

Tego pliku nie odnalazło. Chyba go już wcześniej usunąłem poprzez cmd

Zrobiłem to wszytsko. Włączyłem virustotal aby zeskanować ten plik i wyskoczył znowu popup i virustotal się wyłączył

Oto logi:

ComboFix 07-09-08.7 - "Konrad" 2007-09-09 22:48:50.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.715 [GMT 2:00]
.

((((((((((((((((((((((((( Files Created from 2007-08-09 to 2007-09-09 )))))))))))))))))))))))))))))))
.

2007-09-09 22:42 <DIR> d-------- C:\!KillBox
2007-09-09 15:00 <DIR> d-------- C:\Downloads
2007-09-09 13:37 23 --ahs---- C:\WINDOWS\system32\eafdfb7_r.dll
2007-09-09 13:37 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007
2007-09-09 12:45 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-09-09 12:45 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-09-09 12:43 <DIR> d-------- C:\WINDOWS\ERUNT
2007-09-08 19:38 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-08 13:15 61,600 --a------ C:\WINDOWS\system32\drivers\SE27bus.sys
2007-09-08 13:15 5,872 --a------ C:\WINDOWS\system32\drivers\SE27whnt.sys
2007-09-08 13:15 5,872 --a------ C:\WINDOWS\system32\drivers\SE27wh.sys
2007-09-08 12:52 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-09-08 11:20 <DIR> d-------- C:\Program Files\VID_0E8F&PID_0003
2007-09-07 23:43 <DIR> d-------- C:\DOCUME~1\Konrad\.housecall6.6
2007-09-07 23:19 <DIR> d-------- C:\Program Files\Lavasoft
2007-09-07 23:19 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Lavasoft
2007-09-07 23:16 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-09-07 23:13 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP
2007-09-07 23:13 <DIR> d-------- C:\Program Files\Your Uninstaller 2006
2007-09-07 23:13 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\URSoft
2007-09-07 20:54 <DIR> d-------- C:\Program Files\uTorrent
2007-09-07 20:54 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\uTorrent
2007-09-07 18:52 <DIR> d-------- C:\Program Files\BitComet
2007-09-07 16:58 <DIR> d-------- C:\USDownloader
2007-09-05 22:26 <DIR> d-------- C:\WINDOWS\pss
2007-09-05 22:24 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\vlc
2007-09-05 22:22 <DIR> d-------- C:\Program Files\VideoLAN
2007-09-05 19:26 <DIR> d-------- C:\Poker
2007-09-04 21:32 <DIR> d-------- C:\MicroGaming
2007-09-04 18:15 <DIR> d-------- C:\Casino
2007-09-04 14:15 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Help
2007-09-04 14:05 <DIR> d-------- C:\Program Files\1st Mass Mailer
2007-09-03 19:36 <DIR> d-------- C:\Program Files\TVAnts
2007-09-03 13:14 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2007-09-03 13:14 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2007-09-03 13:14 <DIR> d-------- C:\Program Files\D-Tools
2007-09-02 19:41 <DIR> d-------- C:\Program Files\TVUPlayer
2007-09-02 19:25 <DIR> d-------- C:\Program Files\PPMate
2007-09-02 19:25 <DIR> d-------- C:\Program Files\Common Files\Synacast
2007-09-02 19:25 <DIR> d-------- C:\ppmaterecord
2007-09-02 19:25 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\PPMate
2007-09-02 19:03 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\TVU Networks
2007-09-02 18:59 <DIR> d-------- C:\Program Files\SopCast
2007-09-02 18:59 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\SopCast
2007-09-02 17:08 96,224 --a------ C:\WINDOWS\system32\drivers\w800mdm.sys
2007-09-02 17:08 9,264 --a------ C:\WINDOWS\system32\drivers\w800mdfl.sys
2007-09-02 17:08 87,792 --a------ C:\WINDOWS\system32\drivers\w800mgmt.sys
2007-09-02 17:08 85,664 --a------ C:\WINDOWS\system32\drivers\w800obex.sys
2007-09-02 17:08 60,768 --a------ C:\WINDOWS\system32\drivers\w800bus.sys
2007-09-02 17:08 6,144 --a------ C:\WINDOWS\system32\drivers\w800cmnt.sys
2007-09-02 17:08 6,144 --a------ C:\WINDOWS\system32\drivers\w800cm.sys
2007-09-02 17:08 5,744 --a------ C:\WINDOWS\system32\drivers\w800whnt.sys
2007-09-02 17:08 5,744 --a------ C:\WINDOWS\system32\drivers\w800wh.sys
2007-09-02 17:08 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-09-02 16:42 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Media Player Classic
2007-09-01 17:38 <DIR> d-------- C:\DOCUME~1\Kasia\DANEAP~1\DivX
2007-09-01 17:36 <DIR> d-------- C:\DOCUME~1\Kasia\DANEAP~1\Ahead
2007-08-31 19:59 9,603,360 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-31 19:59 252,960 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-08-31 19:05 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-08-31 19:05 9,600 --a------ C:\WINDOWS\system32\dllcache\hidusb.sys
2007-08-31 15:28 <DIR> d-------- C:\Program Files\Mass Downloader
2007-08-31 15:28 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\MetaProducts
2007-08-31 12:56 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-08-31 12:52 <DIR> d-------- C:\Program Files\Binboy
2007-08-31 12:34 <DIR> d-------- C:\Program Files\FlashGet
2007-08-31 12:34 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\FlashGet
2007-08-31 00:18 <DIR> d-------- C:\Program Files\Mozilla Thunderbird
2007-08-31 00:18 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Thunderbird
2007-08-30 22:53 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Ahead
2007-08-30 22:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead
2007-08-30 22:52 <DIR> d-------- C:\Program Files\Nero
2007-08-30 22:52 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-08-30 22:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-08-30 19:54 <DIR> d--h----- C:\WINDOWS\PIF
2007-08-30 19:05 <DIR> d-------- C:\Program Files\Total Video Converter
2007-08-30 18:19 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2007-08-30 18:19 <DIR> d-------- C:\Program Files\Foxit Software
2007-08-30 18:17 <DIR> d-------- C:\Program Files\Lavalys
2007-08-30 17:55 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-08-30 17:55 3,072 --a------ C:\WINDOWS\system32\dllcache\audstub.sys
2007-08-30 17:54 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-08-30 17:54 58,624 --a------ C:\WINDOWS\system32\dllcache\redbook.sys
2007-08-30 17:53 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2007-08-30 17:53 77,312 --a------ C:\WINDOWS\system32\dllcache\usbui.dll
2007-08-30 17:52 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne
2007-08-30 17:52 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start
2007-08-30 17:52 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-08-30 17:52 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty
2007-08-30 17:52 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony
2007-08-30 17:52 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit
2007-08-30 17:50 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji
2007-08-30 17:50 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji
2007-08-30 17:50 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-08-30 17:50 <DIR> d-------- C:\WINDOWS\system32\CatRoot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-09 22:46 30980 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-09-09 22:46 142616 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-08-31 19:57 78415 --a------ C:\WINDOWS\system32\drivers\klif.cab
2007-06-28 12:51 206088 --a------ C:\WINDOWS\system32\klogon.dll
2007-06-27 19:05 972072 --a------ C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-06-20 20:46 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-06-20 20:45 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
--------- C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((( snapshot_2007-09-09_145047,42 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 16,384 2007-09-09 20:43:46 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-09-09 20:43:46 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
----a-w 32,768 2007-09-09 20:43:48 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
----a-w 16,384 2007-09-09 09:28:32 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-09-09 09:28:32 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
----a-w 32,768 2007-09-09 09:28:38 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-03-23 12:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EPSON Stylus DX4800 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
"Alcmtr"=ALCMTR.EXE
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
"SkyTel"=SkyTel.EXE
"RTHDCPL"=RTHDCPL.EXE
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2007-09-07 15:16:16 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-09 22:56:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-09 22:57:36
C:\ComboFix-quarantined-files.txt ... 2007-09-09 22:57
C:\ComboFix2.txt ... 2007-09-09 14:51
C:\ComboFix3.txt ... 2007-09-08 19:56
.
--- E O F ---

"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"" ["Kaspersky Lab"]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch"
-> {HKLM...CLSID} = "FGCatchUrl"
\InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]
{B930BA63-9E5A-11D3-A288-0000E80E2EDE}\(Default) = (no title provided)
-> {HKLM...CLSID} = "IECatcher Class"
\InProcServer32\(Default) = "C:\PROGRA~1\MASSDO~1\MDHELPER.DLL" [empty string]
{F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided)
-> {HKLM...CLSID} = "FlashGet GetFlash Class"
\InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete"
-> {HKLM...CLSID} = "IE Microsoft AutoComplete"
\InProcServer32\(Default) = "C:\WINDOWS\system32\BROWSEUI.dll" [MS]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM...CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki dla ochrony WWW"
-> {HKLM...CLSID} = "Statystyki dla ochrony WWW"
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll" ["Kaspersky Lab"]
"{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension"
-> {HKLM...CLSID} = "TuneUp Theme Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\uxtuneup.dll" ["TuneUp Software GmbH"]
"{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "AppInit_DLLs" = "C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll" ["Kaspersky Lab"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll" ["Kaspersky Lab"]
TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"


Enabled Scheduled Tasks:
------------------------

"1-Click Maintenance" -> launches: "C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki dla ochrony WWW"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll" ["Kaspersky Lab"]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_02"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_02"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."]

{0FD01980-CCCB-11D3-80D4-0000E80E2EDE}\
"ButtonText" = "Mass Downloader"
"MenuText" = "&Mass Downloader"
"Exec" = "C:\Program Files\Mass Downloader\massdown.exe" ["MetaProducts corp."]

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statystyki dla ochrony WWW"

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "FlashGet"
"Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
<<H>> "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Kaspersky Internet Security 7.0, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r" ["Kaspersky Lab"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
TuneUp Design Expansion, UxTuneUp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"]}
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON Stylus DX4800 Series 2KMonitor5E\Driver = "E_FLMADE.DLL" ["SEIKO EPSON CORPORATION"]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]


---------- (launch time: 2007-09-09 22:57:44)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 145 seconds.
---------- (total run time: 179 seconds)

[Red]

zastosuj jeszcze ewido:

http://www.ewido.net/de/

usuń wszystko co znajdzie i wklej wynik skanowania na forum...

[konrad7890]

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 15:36:32 2007-09-10

+ Scan result:



C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\extensions\{c17127b0-af04-11db-abbd-0800200c9a66}\dlplugin.exe -> Backdoor.Nucledor.11.a : No action taken.
E:\System Volume Information\_restore{E151FE79-FC7F-4404-A00E-030C616CE004}\RP5\A0000409.exe -> Backdoor.Rbot : No action taken.
I:\System Volume Information\_restore{E151FE79-FC7F-4404-A00E-030C616CE004}\RP21\A0002892.exe -> Backdoor.Rbot : No action taken.
:mozilla.232:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.233:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Hitslink : No action taken.
:mozilla.161:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Information : No action taken.
:mozilla.313:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.25:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Netflame : No action taken.
:mozilla.257:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Oewabox : No action taken.
:mozilla.214:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.215:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.66:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.27:C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\7c5zuanj.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.28:C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\7c5zuanj.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.188:C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
E:\System Volume Information\_restore{A78C8ADB-B3CF-445C-88EE-52A6D2394748}\RP45\A0015915.exe -> Trojan.Agent.bcn : No action taken.
E:\System Volume Information\_restore{A78C8ADB-B3CF-445C-88EE-52A6D2394748}\RP45\A0015923.exe -> Trojan.Agent.bcn : No action taken.
E:\System Volume Information\_restore{A78C8ADB-B3CF-445C-88EE-52A6D2394748}\RP45\A0015924.exe -> Trojan.Agent.bcn : No action taken.


::Report end

Jak wchodzę do Mozilli to to AVG blokuje mi coś z profilów.

[Dzi@dek]

C:\Documents and Settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\0c94h6pk.default\extensions\{c17127b0-af04-11db-abbd-0800200c9a66}\dlplugin.exe
usuń ten plik.
nie wchodź na strone file2you

[konrad7890]

Tom@szek nie mogę znaleźć tego pliku. AVG chyba sam go usunął. Na razie nic się nie pojawia. Jak coś będzie nie tak to napiszę.

@edit i Znowu wyskoczył popup. Kurdę takiego problemu to jeszcze nie miałem. Albo rozwiązywałem go sam albo dzięki wam. Ma ktoś jeszcze jakieś pomysły bo formata mi się nie chce za bardzo robić bo dopiero co jestem po nim

[wojtas]

konrad7890 daj jeszcze screena z puopow oraz

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)

po chwili wlacz i daj log z combofixa

Autor postu otrzymał pochwałę

[konrad7890]

konrad7890 daj jeszcze screena z puopow oraz

http://up.programosy.pl/foto/popup.jpg

daj log z combofixa

ComboFix 07-09-08.7 - "Konrad" 2007-09-10 18:56:32.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.610 [GMT 2:00]
.

((((((((((((((((((((((((( Files Created from 2007-08-10 to 2007-09-10 )))))))))))))))))))))))))))))))
.

2007-09-10 15:05 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-09 23:08 <DIR> d-------- C:\LinhaDefensiva
2007-09-09 22:42 <DIR> d-------- C:\!KillBox
2007-09-09 15:00 <DIR> d-------- C:\Downloads
2007-09-09 13:37 23 --ahs---- C:\WINDOWS\system32\eafdfb7_r.dll
2007-09-09 13:37 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007
2007-09-09 12:45 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-09-09 12:45 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-09-09 12:43 <DIR> d-------- C:\WINDOWS\ERUNT
2007-09-08 19:38 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-08 13:15 61,600 --a------ C:\WINDOWS\system32\drivers\SE27bus.sys
2007-09-08 13:15 5,872 --a------ C:\WINDOWS\system32\drivers\SE27whnt.sys
2007-09-08 13:15 5,872 --a------ C:\WINDOWS\system32\drivers\SE27wh.sys
2007-09-08 12:52 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-09-08 11:20 <DIR> d-------- C:\Program Files\VID_0E8F&PID_0003
2007-09-07 23:43 <DIR> d-------- C:\DOCUME~1\Konrad\.housecall6.6
2007-09-07 23:19 <DIR> d-------- C:\Program Files\Lavasoft
2007-09-07 23:19 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Lavasoft
2007-09-07 23:16 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-09-07 23:13 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP
2007-09-07 23:13 <DIR> d-------- C:\Program Files\Your Uninstaller 2006
2007-09-07 23:13 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\URSoft
2007-09-07 20:54 <DIR> d-------- C:\Program Files\uTorrent
2007-09-07 20:54 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\uTorrent
2007-09-07 18:52 <DIR> d-------- C:\Program Files\BitComet
2007-09-07 16:58 <DIR> d-------- C:\USDownloader
2007-09-05 22:26 <DIR> d-------- C:\WINDOWS\pss
2007-09-05 22:24 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\vlc
2007-09-05 22:22 <DIR> d-------- C:\Program Files\VideoLAN
2007-09-05 19:26 <DIR> d-------- C:\Poker
2007-09-04 21:32 <DIR> d-------- C:\MicroGaming
2007-09-04 18:15 <DIR> d-------- C:\Casino
2007-09-04 14:15 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Help
2007-09-04 14:05 <DIR> d-------- C:\Program Files\1st Mass Mailer
2007-09-03 19:36 <DIR> d-------- C:\Program Files\TVAnts
2007-09-03 13:14 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2007-09-03 13:14 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2007-09-03 13:14 <DIR> d-------- C:\Program Files\D-Tools
2007-09-02 19:41 <DIR> d-------- C:\Program Files\TVUPlayer
2007-09-02 19:25 <DIR> d-------- C:\Program Files\PPMate
2007-09-02 19:25 <DIR> d-------- C:\Program Files\Common Files\Synacast
2007-09-02 19:25 <DIR> d-------- C:\ppmaterecord
2007-09-02 19:25 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\PPMate
2007-09-02 19:03 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\TVU Networks
2007-09-02 18:59 <DIR> d-------- C:\Program Files\SopCast
2007-09-02 18:59 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\SopCast
2007-09-02 17:08 96,224 --a------ C:\WINDOWS\system32\drivers\w800mdm.sys
2007-09-02 17:08 9,264 --a------ C:\WINDOWS\system32\drivers\w800mdfl.sys
2007-09-02 17:08 87,792 --a------ C:\WINDOWS\system32\drivers\w800mgmt.sys
2007-09-02 17:08 85,664 --a------ C:\WINDOWS\system32\drivers\w800obex.sys
2007-09-02 17:08 60,768 --a------ C:\WINDOWS\system32\drivers\w800bus.sys
2007-09-02 17:08 6,144 --a------ C:\WINDOWS\system32\drivers\w800cmnt.sys
2007-09-02 17:08 6,144 --a------ C:\WINDOWS\system32\drivers\w800cm.sys
2007-09-02 17:08 5,744 --a------ C:\WINDOWS\system32\drivers\w800whnt.sys
2007-09-02 17:08 5,744 --a------ C:\WINDOWS\system32\drivers\w800wh.sys
2007-09-02 17:08 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-09-02 16:42 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Media Player Classic
2007-09-01 17:38 <DIR> d-------- C:\DOCUME~1\Kasia\DANEAP~1\DivX
2007-09-01 17:36 <DIR> d-------- C:\DOCUME~1\Kasia\DANEAP~1\Ahead
2007-08-31 19:59 265,760 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-08-31 19:59 10,646,304 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-31 19:05 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-08-31 19:05 9,600 --a------ C:\WINDOWS\system32\dllcache\hidusb.sys
2007-08-31 15:28 <DIR> d-------- C:\Program Files\Mass Downloader
2007-08-31 15:28 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\MetaProducts
2007-08-31 12:56 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-08-31 12:52 <DIR> d-------- C:\Program Files\Binboy
2007-08-31 12:34 <DIR> d-------- C:\Program Files\FlashGet
2007-08-31 12:34 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\FlashGet
2007-08-31 00:18 <DIR> d-------- C:\Program Files\Mozilla Thunderbird
2007-08-31 00:18 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Thunderbird
2007-08-30 22:53 <DIR> d-------- C:\DOCUME~1\Konrad\DANEAP~1\Ahead
2007-08-30 22:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead
2007-08-30 22:52 <DIR> d-------- C:\Program Files\Nero
2007-08-30 22:52 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-08-30 22:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-08-30 19:54 <DIR> d--h----- C:\WINDOWS\PIF
2007-08-30 19:05 <DIR> d-------- C:\Program Files\Total Video Converter
2007-08-30 18:19 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2007-08-30 18:19 <DIR> d-------- C:\Program Files\Foxit Software
2007-08-30 18:17 <DIR> d-------- C:\Program Files\Lavalys
2007-08-30 17:55 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-08-30 17:55 3,072 --a------ C:\WINDOWS\system32\dllcache\audstub.sys
2007-08-30 17:54 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-08-30 17:54 58,624 --a------ C:\WINDOWS\system32\dllcache\redbook.sys
2007-08-30 17:53 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2007-08-30 17:53 77,312 --a------ C:\WINDOWS\system32\dllcache\usbui.dll
2007-08-30 17:52 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne
2007-08-30 17:52 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start
2007-08-30 17:52 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-08-30 17:52 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty
2007-08-30 17:52 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony
2007-08-30 17:52 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione
2007-08-30 17:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit
2007-08-30 17:50 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji
2007-08-30 17:50 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-10 15:08 31676 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-09-10 15:08 145640 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-08-31 19:57 78415 --a------ C:\WINDOWS\system32\drivers\klif.cab
2007-06-28 12:51 206088 --a------ C:\WINDOWS\system32\klogon.dll
2007-06-27 19:05 972072 --a------ C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-06-20 20:46 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-06-20 20:45 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
--------- C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((( snapshot_2007-09-09_145047,42 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 16,384 2007-09-09 20:43:46 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-09-09 20:43:46 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
.
----a-w 16,384 2007-09-09 09:28:32 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-09-09 09:28:32 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-03-23 12:06]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-09-10 15:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"Konnekt"="C:\Program Files\Konnekt\konnekt.exe" /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EPSON Stylus DX4800 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
"Alcmtr"=ALCMTR.EXE
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
"SkyTel"=SkyTel.EXE
"RTHDCPL"=RTHDCPL.EXE
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - AVGASCLN
.
Contents of the 'Scheduled Tasks' folder
"2007-09-07 15:16:16 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-10 19:02:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-10 19:04:03
C:\ComboFix-quarantined-files.txt ... 2007-09-10 19:04
C:\ComboFix2.txt ... 2007-09-09 22:57
C:\ComboFix3.txt ... 2007-09-09 14:51
.
--- E O F ---

[Red]

wejdz w rejestr ścieżką:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

i wklej wynik tego co masz po prawej stronie w oknie....


koniecznie zastosuj:

http://www.atribune.org/ccount/click.php?id=7

oraz:

http://www.atribune.org/downloads/l2mfix.exe

z opcji 2

Autor postu otrzymał pochwałę

[konrad7890]

[Red]

Zastosuj jeszcze te dwa usuwacze które zalinkowałem.

napisz jak sytuacja....

[konrad7890]

Zastosuj jeszcze te dwa usuwacze które zalinkowałem.

napisz jak sytuacja....

Więc tak. Jak siedziałem na kompie było ok. Zrobiłem restart i wtedy zawsze wyskakiwał popup po jakiejś minucie połączenia z internetem. Teraz uruchomiłem ponownie i ani w C:/Windows ani w HJ nie ma wpisów dotyczących tego syfa. Oby problem był rozwiązany. Napisze jaka sytuacja jeszcze potem jeżeli coś będzie nie tak

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)

Chyba to pomogło.

Albo to że usunąłem wszystkie profile w Firefoksie i utworzyłem na nowo.