Zainfekowany komputer, trojany

**Posty:** 202 · przez **edo_90** 15 Lut 2009, 16:45

Dzisiaj miałem bardzo dziwną sytuację. Do kasperskiego dodawały się programy jako "niskiego zagrożenia". Było ich kilka. Po chwili komputer się zresetował i od tamtej pory wolno chodzi. A o to logi z:
cf:

Kod: Zaznacz wszystko: ComboFix 09-02-14.01 - edo 2009-02-15 15:17:21.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2046.1658 [GMT 1:00] Uruchomiony z: c:\documents and settings\edo\Pulpit\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) FW: Kaspersky Internet Security *disabled* . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\fccdbebfd_r.dll . ---- Poprzednie uruchomienie ------- . c:\windows\icon.ico . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-15 do 2009-02-15 ))))))))))))))))))))))))))))))) . 2009-02-14 16:56 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2009-02-14 16:54 . 2009-02-14 16:56 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-14 16:54 . 2009-02-14 16:54 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-14 16:53 . 2009-02-14 16:54 <DIR> d-------- C:\8689229af200c3bc5773c797a0c992 2009-02-14 16:53 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-14 16:53 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-14 16:53 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-14 16:53 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-14 16:53 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-14 16:53 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-14 16:53 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-14 16:26 . 2009-02-15 13:28 <DIR> d-------- c:\program files\Prec 2009-02-14 12:14 . 2009-02-14 12:17 <DIR> d-------- c:\program files\Yahoo! 2009-02-09 14:37 . 2009-02-09 14:37 <DIR> d-------- c:\program files\Nowe Gadu-Gadu 2009-02-09 14:35 . 2009-02-14 14:02 <DIR> d-------- c:\documents and settings\edo\Dane aplikacji\Nowe Gadu-Gadu 2009-01-26 11:40 . 2009-01-26 11:40 <DIR> d-------- c:\program files\Techland 2009-01-21 16:02 . 2009-01-21 16:02 <DIR> d-------- c:\documents and settings\edo\Dane aplikacji\DivX 2009-01-19 22:14 . 2009-01-19 22:15 <DIR> d-------- c:\program files\mp3DirectCut . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-15 14:20 --------- d-----w c:\program files\AutoConnect 2009-02-15 14:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-15 14:18 426,016 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-02-15 14:18 3,584 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-02-15 14:18 18,072 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-02-15 14:18 1,906,720 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-02-14 15:54 --------- d-----w c:\program files\MSBuild 2009-02-14 14:02 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Tlen.pl 2009-02-12 13:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2009-02-11 13:54 --------- d-----w c:\program files\FlashGet 2009-02-10 12:37 33,808 ----a-w c:\windows\system32\drivers\klbg.sys 2009-02-03 18:23 89,601 ----a-w c:\windows\system32\drivers\klick.dat 2009-02-03 18:23 101,287 ----a-w c:\windows\system32\drivers\klin.dat 2009-01-27 15:38 --------- d-----w c:\program files\Neostrada TP 2009-01-26 10:41 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-26 10:15 --------- d-----w c:\program files\Soulseek 2009-01-22 14:50 --------- d-----w c:\documents and settings\edo\Dane aplikacji\skypePM 2009-01-22 14:50 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Skype 2009-01-20 07:36 --------- d-----w c:\program files\Garena 2009-01-14 15:54 --------- d-----w c:\program files\WinXMedia 2009-01-11 13:53 --------- d-----w c:\program files\VentriloMIX 2009-01-08 17:25 --------- d-----w c:\program files\Uniblue 2009-01-08 16:43 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Uniblue 2009-01-08 15:29 --------- d-----w c:\program files\IDoser v4 2009-01-05 19:02 137,688 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-01-05 18:46 --------- d-----w c:\program files\Activision 2009-01-04 15:40 22,328 ----a-w c:\documents and settings\edo\Dane aplikacji\PnkBstrK.sys 2009-01-04 10:41 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Media Player Classic 2009-01-02 22:07 --------- d-----w c:\program files\CCleaner 2008-12-26 16:33 23,600 ----a-w c:\windows\system32\drivers\TVICHW32.SYS 2008-12-26 14:03 --------- d-----w c:\program files\AGEIA Technologies 2008-12-26 14:02 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-26 12:18 --------- d-----w c:\program files\Kaspersky Lab 2008-12-26 12:18 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-12-23 14:52 --------- d-----w c:\program files\Real Alternative 2008-12-20 23:37 --------- d-----w c:\program files\Skype 2008-12-20 23:37 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-20 23:36 --------- d-----w c:\program files\Common Files\Skype 2008-12-20 23:26 --------- d-----w c:\documents and settings\edo\Dane aplikacji\teamspeak2 2008-12-20 10:34 --------- d-----w c:\program files\Tlen.pl 2008-12-16 20:16 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-16 17:22 716,272 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-16 17:22 --------- d-----w c:\documents and settings\edo\Dane aplikacji\DAEMON Tools 2008-12-13 14:33 14,656 ----a-w c:\windows\gdrv.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2009-01-17 5853672] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-03 310784] "Prec"="c:\program files\Prec\PrecStarter.exe" [2009-01-25 508014] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-31 36864] "36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-17 1953792] "Habu"="c:\program files\Razer\Habu\razerhid.exe" [2007-05-11 176128] "OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2004-12-14 98304] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-10 201992] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-02-14 00:09 486856 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-11-18 16:31 21633320 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2] --a------ 2007-06-20 14:22 1859864 c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-09-12 17:45 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] --a------ 2003-10-16 19:07 24576 c:\progra~1\NEOSTR~1\CnxMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2003-10-16 19:07 53248 c:\progra~1\NEOSTR~1\TaskBarIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --------- 2003-10-16 19:07 20480 c:\progra~1\NEOSTR~1\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\edek666\\counter-strike\\hl.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\PROGRAMY DO INSTALACJI\\slskPLbyFoxconn.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\yah69\\counter-strike\\hl.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\24zawi91\\counter-strike\\hl.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R3 HabuFltr;Habu Mouse;c:\windows\system32\drivers\habu.sys [2008-12-13 27776] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592] S3 uisp;Freescale USB JW32 driver;c:\windows\system32\drivers\USBICP.sys [2008-12-13 14592] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-CmUsbSound - cmcnfgu.cpl MSConfigStartUp-Gadu-Gadu - c:\program files\Gadu-Gadu\gg.exe MSConfigStartUp-Steam - c:\program files\valve\steam\steam.exe MSConfigStartUp-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.yahoo.com mStart Page = hxxp://www.yahoo.com uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com IE: &Ściągnij przy pomocy FlashGet'a - c:\program files\FlashGet\jc_link.htm IE: &Ściągnij wszystko przy pomocy FlashGet'a - c:\program files\FlashGet\jc_all.htm IE: Dodaj do listy blokowanych banerów - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: { - c:\program files\Messenger\msmsgs.exe IE: {{B46B0919-62BA-4D99-A5C4-916B57A6805C} - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - c:\program files\Techland\Common\InternetTranslator\InternetTranslator.dll FF - ProfilePath - c:\documents and settings\edo\Dane aplikacji\Mozilla\Firefox\Profiles\8shrgu7e.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-15 15:20:11 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1060) c:\windows\system32\klogon.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\PnkBstrB.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\program files\Razer\Habu\razertra.exe c:\program files\Razer\Habu\razerofa.exe . ************************************************************************** . Czas ukończenia: 2009-02-15 15:23:40 - komputer został uruchomiony ponownie [edo] ComboFix-quarantined-files.txt 2009-02-15 14:22:09 Przed: 18,681,270,272 bajtów wolnych Po: 18,610,528,256 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 220 --- E O F --- 2008-12-14 22:40:37

i Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:44:50, on 2009-02-15 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Razer\Habu\razerhid.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Razer\Habu\razertra.exe C:\Program Files\Razer\Habu\razerofa.exe C:\WINDOWS\explorer.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\Documents and Settings\edo\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: FGCatchUrl - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Prec] C:\Program Files\Prec\PrecStarter.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E71AB510-AD25-4B77-A809-207C01510CBD}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 7892 bytes

A i jeszcze logi z fixiedef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7389 * * * ******************************************************************************** Created at 15:48:21 on Sunday, February 15, 2009 Time Zone : Logged On User : edo Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 Intel(R) Core(TM)2 CPU 6320 @ 1.86GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 70 GB System Drive Free : 14.46 GB Total Physical Memory: 2046 MB Free Physical Memory : 1450 MB Total Page File : 2046 MB Free Page File : 3628 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1970 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Z góry dziękuję.

**Posty:** 8001 · przez **Okocza** 15 Lut 2009, 17:14

edo_90, jakie to były programy?

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 202 · przez **edo_90** 15 Lut 2009, 17:37

Nie pamiętam jakie były to programy. Skasowałem Kasperskiego ze względu, że zamulało totalnie.

Hm, dziwna sprawa nie mogę uruchomić trybu awaryjnego. W sensie nie mam takiej opcji. Jest taka możliwość, że coś się usunęło?

teraz zauważyłem, że podczas gdy chce wejść na pendrive to wyskakuje mi błąd copy.exe i informacja o jakimś wirusie.

edit// z copy.exe poradziłem sobie. AVG skasował mi jakiegoś trojana, ale komputer nadal zamula. A trybu awaryjnego nadal nie mam.

**Posty:** 18165 · przez **wojtas** 16 Lut 2009, 17:38

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

oraz daj nowy log z combofixa

**Posty:** 202 · przez **edo_90** 16 Lut 2009, 17:47

Udało mi się jakoś uruchomić w trybie awaryjnym. Zrobiłem czynności w/w. A o to raport.

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by edo on 2009-02-16 at 16:41 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-16 16:44:41 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:32,a5,df,ba,62,25,b3,e9,78,5a,9f,f3,3a,13,88,2c,c2,fe,57,48,8e,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,d8,da,d2,35,59,b5,4f,cb,90,65,5f,ea,5c,e2,54,b9,fe,.. "khjeh"=hex:70,56,7b,f7,77,43,af,4c,11,4e,7e,2a,94,18,2a,5d,ed,1a,5c,71,a4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:91,af,09,24,98,0f,91,62,05,4a,0c,b9,21,59,ce,b5,be,f6,6a,fe,f9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:32,a5,df,ba,62,25,b3,e9,78,5a,9f,f3,3a,13,88,2c,c2,fe,57,48,8e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,d8,da,d2,35,59,b5,4f,cb,90,65,5f,ea,5c,e2,54,b9,fe,.. "khjeh"=hex:70,56,7b,f7,77,43,af,4c,11,4e,7e,2a,94,18,2a,5d,ed,1a,5c,71,a4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:91,af,09,24,98,0f,91,62,05,4a,0c,b9,21,59,ce,b5,be,f6,6a,fe,f9,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Tlen.pl\\tlen.exe"="C:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Valve\\Steam\\SteamApps\\edek666\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\edek666\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "D:\\PROGRAMY DO INSTALACJI\\slskPLbyFoxconn.exe"="D:\\PROGRAMY DO INSTALACJI\\slskPLbyFoxconn.exe:*:Enabled:Soulseek PL by Foxconn" "C:\\Program Files\\Valve\\Steam\\SteamApps\\yah69\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\yah69\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Valve\\Steam\\SteamApps\\24zawi91\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\24zawi91\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe:*:Enabled:Kaspersky Internet Security 2009 Setup" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) " "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: [b]Finished![/b]

**Posty:** 18165 · przez **wojtas** 16 Lut 2009, 18:24

wykonaj jeszcze to co ja pisałem,

**Posty:** 202 · przez **edo_90** 16 Lut 2009, 19:37

Nie miałem chwilowego dostępu więc dopiero zabrałem się za to. Wyniki:
Kaspersky nie chciał się włączyć przez tą przeglądarkę. Wyskakiwał błąd. Dlatego przeskanowałem mks vir skaner online. Nic nie wykrył.

a o to logi z cf:

Kod: Zaznacz wszystko: ComboFix 09-02-14.01 - edo 2009-02-16 18:31:32.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2046.1498 [GMT 1:00] Uruchomiony z: c:\documents and settings\edo\Pulpit\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) FW: Kaspersky Internet Security *enabled* . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . H:\autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-16 do 2009-02-16 ))))))))))))))))))))))))))))))) . 2009-02-16 18:18 . 2009-02-16 18:18 <DIR> d-------- c:\windows\Sun 2009-02-16 18:17 . 2009-02-16 18:17 <DIR> d-------- c:\program files\Java 2009-02-16 18:17 . 2009-02-16 18:17 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-16 18:17 . 2009-02-16 18:17 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-02-16 16:40 . 2009-02-16 16:40 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-02-15 20:11 . 2009-02-15 20:11 <DIR> d-------- c:\documents and settings\edo\Dane aplikacji\Grisoft 2009-02-15 20:11 . 2009-02-15 20:11 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Grisoft 2009-02-15 20:11 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2009-02-15 20:10 . 2009-02-15 20:20 <DIR> d-------- c:\program files\SkanerOnline 2009-02-15 19:57 . 2009-02-15 19:57 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Yahoo! Companion 2009-02-15 16:29 . 2009-02-16 16:45 <DIR> d-------- C:\SDFix 2009-02-15 15:47 . 2009-02-16 16:40 <DIR> d-------- c:\windows\ERUNT 2009-02-15 15:47 . 2009-02-15 15:47 <DIR> d-------- C:\ERDNT 2009-02-15 15:47 . 2009-02-15 15:47 <DIR> d-------- C:\!FixIEDef 2009-02-14 16:56 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2009-02-14 16:54 . 2009-02-14 16:56 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-14 16:54 . 2009-02-14 16:54 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-14 16:53 . 2009-02-14 16:54 <DIR> d-------- C:\8689229af200c3bc5773c797a0c992 2009-02-14 16:53 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-14 16:53 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-14 16:53 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-14 16:53 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-14 16:53 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-14 16:53 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-14 16:53 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-14 16:26 . 2009-02-15 16:31 <DIR> d-------- c:\program files\Prec 2009-02-14 12:14 . 2009-02-14 12:17 <DIR> d-------- c:\program files\Yahoo! 2009-02-09 14:37 . 2009-02-09 14:37 <DIR> d-------- c:\program files\Nowe Gadu-Gadu 2009-02-09 14:35 . 2009-02-15 22:02 <DIR> d-------- c:\documents and settings\edo\Dane aplikacji\Nowe Gadu-Gadu 2009-01-26 11:40 . 2009-01-26 11:40 <DIR> d-------- c:\program files\Techland 2009-01-21 17:11 . 2009-01-21 17:11 473,600 --a------ c:\windows\system32\SkanerOnline.dll 2009-01-21 16:02 . 2009-01-21 16:02 <DIR> d-------- c:\documents and settings\edo\Dane aplikacji\DivX 2009-01-19 22:14 . 2009-01-19 22:15 <DIR> d-------- c:\program files\mp3DirectCut . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-16 17:11 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Tlen.pl 2009-02-16 15:45 --------- d-----w c:\program files\AutoConnect 2009-02-16 15:45 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-16 15:37 426,016 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-02-16 15:37 3,584 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-02-16 15:37 18,128 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-02-16 15:37 1,913,888 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-02-15 17:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2009-02-14 15:54 --------- d-----w c:\program files\MSBuild 2009-02-11 13:54 --------- d-----w c:\program files\FlashGet 2009-02-10 12:37 33,808 ----a-w c:\windows\system32\drivers\klbg.sys 2009-02-03 18:23 89,601 ----a-w c:\windows\system32\drivers\klick.dat 2009-02-03 18:23 101,287 ----a-w c:\windows\system32\drivers\klin.dat 2009-01-27 15:38 --------- d-----w c:\program files\Neostrada TP 2009-01-26 10:41 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-26 10:15 --------- d-----w c:\program files\Soulseek 2009-01-22 14:50 --------- d-----w c:\documents and settings\edo\Dane aplikacji\skypePM 2009-01-22 14:50 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Skype 2009-01-20 07:36 --------- d-----w c:\program files\Garena 2009-01-14 15:54 --------- d-----w c:\program files\WinXMedia 2009-01-11 13:53 --------- d-----w c:\program files\VentriloMIX 2009-01-08 17:25 --------- d-----w c:\program files\Uniblue 2009-01-08 16:43 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Uniblue 2009-01-08 15:29 --------- d-----w c:\program files\IDoser v4 2009-01-05 19:02 202,040 ----a-w c:\windows\system32\PnkBstrB.exe 2009-01-05 19:02 137,688 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-01-05 18:46 --------- d-----w c:\program files\Activision 2009-01-04 16:44 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2009-01-04 15:40 22,328 ----a-w c:\documents and settings\edo\Dane aplikacji\PnkBstrK.sys 2009-01-04 11:01 682,280 ----a-w c:\windows\system32\pbsvc.exe 2009-01-04 10:41 --------- d-----w c:\documents and settings\edo\Dane aplikacji\Media Player Classic 2009-01-02 22:07 --------- d-----w c:\program files\CCleaner 2008-12-26 16:33 23,600 ----a-w c:\windows\system32\drivers\TVICHW32.SYS 2008-12-26 14:03 --------- d-----w c:\program files\AGEIA Technologies 2008-12-26 14:02 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-26 12:18 --------- d-----w c:\program files\Kaspersky Lab 2008-12-26 12:18 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-12-23 14:52 --------- d-----w c:\program files\Real Alternative 2008-12-20 23:37 --------- d-----w c:\program files\Skype 2008-12-20 23:37 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-20 23:36 --------- d-----w c:\program files\Common Files\Skype 2008-12-20 23:26 --------- d-----w c:\documents and settings\edo\Dane aplikacji\teamspeak2 2008-12-20 10:34 --------- d-----w c:\program files\Tlen.pl 2008-12-16 20:16 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-16 17:22 716,272 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-16 17:22 --------- d-----w c:\documents and settings\edo\Dane aplikacji\DAEMON Tools 2008-12-13 16:31 142,976 ----a-w c:\windows\system32\usbport.sys 2008-12-13 14:33 14,656 ----a-w c:\windows\gdrv.sys . ((((((((((((((((((((((((((((( SnapShot@2009-02-16_16.55.55,34 ))))))))))))))))))))))))))))))))))))))))) . + 2009-02-16 17:17:16 144,792 ----a-w c:\windows\system32\java.exe + 2009-02-16 17:17:16 144,792 ----a-w c:\windows\system32\javaw.exe + 2009-02-16 17:17:16 148,888 ----a-w c:\windows\system32\javaws.exe + 2009-02-16 17:17:28 16,384 ----atw c:\windows\temp\Perflib_Perfdata_9b8.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2009-01-17 5853672] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-03 310784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-31 36864] "36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-17 1953792] "Habu"="c:\program files\Razer\Habu\razerhid.exe" [2007-05-11 176128] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-10 201992] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-16 148888] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-02-14 00:09 486856 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder] -ra------ 2004-12-14 18:28 98304 c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prec] --a------ 2009-01-25 04:38 508014 c:\program files\Prec\PrecStarter.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-11-18 16:31 21633320 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2] --a------ 2007-06-20 14:22 1859864 c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-09-12 17:45 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] --a------ 2003-10-16 19:07 24576 c:\progra~1\NEOSTR~1\CnxMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2003-10-16 19:07 53248 c:\progra~1\NEOSTR~1\TaskBarIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --------- 2003-10-16 19:07 20480 c:\progra~1\NEOSTR~1\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\edek666\\counter-strike\\hl.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\PROGRAMY DO INSTALACJI\\slskPLbyFoxconn.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\yah69\\counter-strike\\hl.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\24zawi91\\counter-strike\\hl.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R3 HabuFltr;Habu Mouse;c:\windows\system32\drivers\habu.sys [2008-12-13 27776] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592] S3 uisp;Freescale USB JW32 driver;c:\windows\system32\drivers\USBICP.sys [2008-12-13 14592] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - JAVAQUICKSTARTERSERVICE *NewlyCreated* - WMIAPSRV . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com IE: &Ściągnij przy pomocy FlashGet'a - c:\program files\FlashGet\jc_link.htm IE: &Ściągnij wszystko przy pomocy FlashGet'a - c:\program files\FlashGet\jc_all.htm IE: Dodaj do listy blokowanych banerów - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: { - c:\program files\Messenger\msmsgs.exe IE: {{B46B0919-62BA-4D99-A5C4-916B57A6805C} - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - c:\program files\Techland\Common\InternetTranslator\InternetTranslator.dll Trusted Zone: com.pl\mks TCP: {E71AB510-AD25-4B77-A809-207C01510CBD} = 194.204.159.1 217.98.63.164 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\edo\Dane aplikacji\Mozilla\Firefox\Profiles\8shrgu7e.default\ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-16 18:33:09 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1068) c:\windows\system32\klogon.dll . Czas ukończenia: 2009-02-16 18:34:43 ComboFix-quarantined-files.txt 2009-02-16 17:34:39 ComboFix2.txt 2009-02-16 15:57:24 Przed: 24 060 227 584 bajtów wolnych Po: 24,059,924,480 bajtów wolnych 226 --- E O F --- 2008-12-14 22:40:37

**Posty:** 18165 · przez **wojtas** 16 Lut 2009, 19:47

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt