Zamulenie kompa, logi combofix i hijack

**Posty:** 96 · przez **bielu** 16 Sty 2009, 15:24

Jak w temacie, nie wiedzieć czemu, momentami komp się strasznie zamula.

Log z combofix:

Kod: Zaznacz wszystko: ComboFix 09-01-15.01 - Tomasz 2009-01-16 14:17:17.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.895.443 [GMT 1:00] Uruchomiony z: c:\documents and settings\Tomasz\Pulpit\ComboFix.exe FW: ZoneAlarm Firewall *disabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\nq0cq.cmd c:\windows\system32\ckvo0.dll c:\windows\system32\ddr.exe c:\windows\system32\mpg4c32.dll D:\nq0cq.cmd . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-16 do 2009-01-16 ))))))))))))))))))))))))))))))) . 2009-01-16 13:35 . 2009-01-16 13:35 95,744 -r-hs---- c:\windows\system32\nmdfgds2.dll 2009-01-16 11:34 . 2009-01-16 11:34 <DIR> d-------- c:\program files\Trojan Guarder Gold Version 2009-01-16 11:21 . 2009-01-16 14:06 95,744 -r-hs---- c:\windows\system32\nmdfgds1.dll 2009-01-16 11:04 . 2004-08-04 13:00 70,144 --a------ c:\windows\AhnRpta.exe 2009-01-16 10:55 . 2009-01-16 14:09 110,003 -r-hs---- C:\x2csvg.exe 2009-01-16 10:55 . 2009-01-16 14:13 95,744 -r-hs---- c:\windows\system32\nmdfgds0.dll 2009-01-16 00:56 . 2009-01-16 01:41 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\Auslogics 2009-01-16 00:55 . 2009-01-16 01:36 <DIR> d-------- c:\program files\Disk Size Manager 2.0 2009-01-16 00:55 . 2009-01-16 01:36 <DIR> d-------- c:\program files\Auslogics 2009-01-15 20:17 . 2009-01-15 20:17 <DIR> d-------- c:\program files\THQ 2009-01-15 00:04 . 2009-01-15 00:05 <DIR> d-------- C:\Westwood 2009-01-09 20:14 . 2009-01-09 20:31 <DIR> d-------- c:\program files\Common Files\AVSMedia 2009-01-09 20:14 . 2009-01-09 20:31 <DIR> d-------- c:\program files\AVSMedia 2009-01-06 08:57 . 2009-01-06 08:57 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\5400 Series 2009-01-05 22:13 . 2009-01-16 10:54 <DIR> d-------- c:\program files\Lx_cats 2009-01-05 22:12 . 2006-11-07 12:30 344,064 --a------ c:\windows\system32\lxctcoin.dll 2009-01-05 22:12 . 2006-04-25 04:11 40,960 --a------ c:\windows\system32\lxctvs.dll 2009-01-05 22:12 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2009-01-05 22:12 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2009-01-05 22:10 . 2009-01-05 22:13 <DIR> d-------- c:\program files\Lexmark Toolbar 2009-01-05 22:10 . 2009-01-05 22:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\5400 Series 2009-01-05 22:09 . 2009-01-05 22:11 <DIR> d-------- c:\program files\Lexmark 5400 Series 2009-01-05 22:09 . 2009-01-05 22:10 <DIR> d-------- c:\program files\Abbyy FineReader 6.0 Sprint 2009-01-05 22:08 . 2006-11-06 17:35 1,224,704 --a------ c:\windows\system32\lxctserv.dll 2009-01-05 22:01 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2009-01-05 22:01 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2009-01-05 21:59 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2009-01-05 21:59 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2009-01-04 15:14 . 2009-01-15 20:23 43,520 --a------ c:\windows\system32\CmdLineExt03.dll 2009-01-01 16:40 . 2009-01-01 16:40 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\EBookSys 2009-01-01 16:06 . 2009-01-01 16:06 <DIR> d-------- c:\program files\SystemRequirementsLab 2009-01-01 16:06 . 2009-01-01 16:06 <DIR> d-------- c:\documents and settings\Tomasz\SystemRequirementsLab 2008-12-29 10:49 . 2008-12-29 10:53 <DIR> d-------- c:\program files\eMule 2008-12-27 19:01 . 2008-12-27 19:03 <DIR> d-------- c:\program files\RegCleaner 2008-12-27 16:37 . 2008-12-27 16:37 2,668,686 --a------ c:\windows\ACD Wallpaper.bmp 2008-12-27 00:16 . 2008-12-27 00:16 <DIR> d-------- c:\program files\YourWare Solutions 2008-12-26 01:08 . 2008-12-26 01:08 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\acccore 2008-12-26 01:06 . 2008-12-26 01:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\AOL OCP 2008-12-26 01:06 . 2008-12-26 01:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\AOL 2008-12-26 01:05 . 2008-12-26 01:05 <DIR> d-------- c:\program files\Viewpoint 2008-12-26 01:05 . 2008-12-26 01:05 <DIR> d-------- c:\program files\Common Files\AOL 2008-12-26 01:05 . 2008-12-26 01:06 <DIR> d-------- c:\program files\AIM6 2008-12-26 01:05 . 2008-12-26 01:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Viewpoint 2008-12-26 01:05 . 2008-12-26 01:06 478 --ah----- C:\IPH.PH 2008-12-25 22:56 . 2008-12-25 23:02 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\vlc 2008-12-25 22:55 . 2008-12-25 22:55 <DIR> d-------- c:\program files\VideoLAN 2008-12-25 22:41 . 2008-12-25 22:42 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\FLVPlayer4Free 2008-12-25 13:38 . 2008-12-28 16:15 37 --a------ c:\windows\9É 2008-12-24 20:11 . 2009-01-09 20:32 <DIR> d-------- c:\program files\WinX DVD Player 3.0 2008-12-24 15:48 . 2008-12-24 15:48 37 --a------ c:\windows\(9É 2008-12-24 15:47 . 2008-12-24 15:47 86,528 --a------ c:\windows\system32\Dvdvideo.ax 2008-12-24 15:47 . 2008-12-24 15:47 65,536 --a------ c:\windows\system32\Dvdaudio.ax 2008-12-24 15:38 . 2008-12-24 15:38 37 --a------ c:\windows\r007 2008-12-24 15:07 . 2008-12-24 15:16 <DIR> d-------- c:\program files\SkanerOnline 2008-12-23 21:26 . 2008-12-23 21:26 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\Apple Computer 2008-12-19 19:40 . 2008-12-19 19:40 <DIR> d-------- c:\windows\Easy CD-DA Extractor 12 2008-12-19 19:40 . 2008-12-19 19:40 <DIR> d-------- c:\program files\Easy CD-DA Extractor 12 2008-12-19 19:40 . 2008-12-19 23:04 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-19 19:40 . 2008-12-19 19:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Easy CD-DA Extractor 2008-12-17 21:26 . 2008-12-17 21:36 <DIR> d-------- c:\program files\Return to Castle Wolfenstein 2008-12-17 21:25 . 2008-12-17 21:36 600 --a------ c:\windows\Rtcw.INI 2008-12-17 01:22 . 2008-12-17 01:22 <DIR> d-------- c:\program files\Audio Phonics, Inc 2008-12-17 01:22 . 1997-04-08 20:08 299,520 --a------ c:\windows\uninst.exe 2008-12-17 01:20 . 2008-12-17 01:20 <DIR> d-------- c:\program files\AP Tuner 2008-12-16 19:33 . 2008-12-16 19:33 <DIR> d-------- c:\program files\NCH Software 2008-12-16 19:30 . 2009-01-09 19:06 <DIR> d-------- c:\program files\NCH Swift Sound 2008-12-16 19:30 . 2008-12-16 19:30 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\NCH Swift Sound 2008-12-16 19:30 . 2009-01-09 19:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-16 13:11 78,848 ----a-w c:\windows\system32\afmain5.dll 2009-01-16 12:29 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\uTorrent 2009-01-16 10:39 --------- d-----w c:\program files\DC++ 2009-01-15 19:17 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-14 22:00 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Skype 2009-01-14 21:56 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\skypePM 2008-12-27 12:57 --------- d-----w c:\program files\Gadu-Gadu 2008-12-25 00:53 --------- d-----w c:\program files\NAPI-PROJEKT 2008-12-13 22:52 --------- d-----w c:\program files\Codemasters 2008-12-13 19:40 --------- d-----w c:\program files\Sierra On-Line 2008-12-13 18:57 --------- d-----w c:\program files\Real Alternative 2008-12-13 01:37 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Media Player Classic 2008-12-13 01:21 --------- d-----w c:\program files\Skype 2008-12-13 01:20 --------- d-----w c:\program files\Media Player Classic 2008-12-13 00:14 --------- d-----w c:\program files\Common Files\Adobe 2008-12-12 21:06 --------- d-----w c:\program files\Common Files\Skype 2008-12-12 21:06 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-12 16:09 --------- d-----w c:\program files\QuickTime 2008-12-12 16:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-12 10:14 106,628 ----a-w c:\windows\Internet Logs\vsmon_2nd_2008_12_11_21_49_00_small.dmp.zip 2008-12-11 23:19 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Hamachi 2008-12-11 22:11 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys 2008-12-11 18:41 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Toshiba 2008-12-11 11:11 --------- d-----w c:\program files\uTorrent 2008-12-10 22:22 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-12-10 22:22 --------- d-----w c:\program files\Java 2008-12-10 12:56 --------- d-----w c:\program files\SubEdit-Player 2008-12-09 23:12 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\ACD Systems 2008-12-09 23:11 9,856 ----a-w c:\windows\system32\drivers\pfc.sys 2008-12-09 23:11 --------- d-----w c:\program files\Common Files\ACD Systems 2008-12-09 23:11 --------- d-----w c:\program files\ACD Systems 2008-12-09 23:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ACD Systems 2008-12-09 21:13 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-09 21:11 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-09 21:11 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\DAEMON Tools 2008-12-09 08:16 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Gadu-Gadu 2008-12-09 00:07 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Thunderbird 2008-12-08 23:34 --------- d-----w c:\program files\Zone Labs 2008-12-08 23:29 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Last.fm 2008-12-08 23:28 --------- d-----w c:\program files\Last.fm 2008-12-08 23:27 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Winamp 2008-12-08 23:24 --------- d-----w c:\program files\Winamp 2008-12-08 23:12 --------- d-----w c:\program files\Toshiba 2008-12-08 23:04 15,781 ----a-w c:\windows\system32\drivers\mdc8021x.sys 2008-12-08 23:04 --------- d-----w c:\program files\Asus 2008-12-08 22:59 --------- d-----w c:\program files\Wireless Console 2 2008-12-08 22:49 --------- d-----w c:\program files\Synaptics 2008-12-08 22:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\InstallShield 2008-12-08 22:48 --------- d-----w c:\program files\Realtek 2008-12-08 22:48 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-08 22:42 --------- d-----w c:\program files\Common Files\ATI Technologies 2008-12-08 22:41 --------- d-----w c:\program files\ATI Technologies 2008-12-08 22:18 --------- d-----w c:\program files\microsoft frontpage 2008-12-08 22:16 --------- d-----w c:\program files\Usługi online 2008-11-11 22:22 20,480 ----a-w c:\windows\system32\scrnrdr.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="c:\windows\ATK0100\HControl.exe" [2006-02-23 106496] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-08 344064] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 761945] "Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136] "Control Center"="c:\program files\ASUS\WLAN Card Utilities\Center.exe" [2005-09-13 1668096] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 919280] "LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496] "RTHDCPL"="RTHDCPL.EXE" [2006-05-04 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 49152] Trojan Guarder Gold Version.lnk - c:\program files\Trojan Guarder Gold Version\Trojan Guarder.exe [2009-01-16 620544] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyDocs"= 1 (0x1) "NoRecentDocsNetHood"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyDocs"= 1 (0x1) "NoRecentDocsNetHood"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain2.dll" [2004-08-04 78848] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\WINDOWS\\system32\\lxctcoms.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [2008-12-09 16269] R3 SynMini;USB2.0 1.3M WebCam;c:\windows\system32\drivers\SynMini.sys [2008-12-08 1056512] R3 SynScan;USB2.0 1.3M WebCam Still Image;c:\windows\system32\drivers\SynScan.sys [2008-12-08 8064] S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\Tomasz\USTAWI~1\Temp\DMSKSSRh.sys --> c:\docume~1\Tomasz\USTAWI~1\Temp\DMSKSSRh.sys [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d1c6802-cdf7-11dd-9931-0018f3af95fa}] \Shell\AutoRun\command - G:\nq0cq.cmd \Shell\explore\Command - G:\nq0cq.cmd \Shell\open\Command - G:\nq0cq.cmd . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.windowsxlive.net TCP: {8140D5BA-2E41-4500-809B-225DB3D36A91} = 213.184.16.1,213.184.16.2 c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FF - ProfilePath - c:\documents and settings\Tomasz\Dane aplikacji\Mozilla\Firefox\Profiles\nej3u9tw.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ---- FIREFOX - SPOSÓB POSTEPOWANIA ---- user_pref('capability.policy.policynames', 'localfilelinks');user_pref('capability.policy.localfilelinks.sites', 'hxxp://www.webmynd.com http://www.google.com');user_pref('capability.policy.localfilelinks.checkloaduri.enabled', 'allAccess');. ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-16 14:19:02 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(992) c:\windows\SYSTEM32\Ati2evxx.dll . Czas ukończenia: 2009-01-16 14:20:18 ComboFix-quarantined-files.txt 2009-01-16 13:20:12 Przed: 7 432 048 640 bajtów wolnych Po: 7,421,493,248 bajtów wolnych 231

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:22:48, on 2009-01-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ASWLSVC.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lxctcoms.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\ATK0100\HControl.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ASUS\WLAN Card Utilities\Center.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Last.fm\LastFM.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\AhnRpta.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Trojan Guarder Gold Version.lnk = C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8140D5BA-2E41-4500-809B-225DB3D36A91}: NameServer = 213.184.16.1,213.184.16.2 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 4709 bytes

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 15:48

File::
c:\windows\system32\nmdfgds2.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\AhnRpta.exe
C:\x2csvg.exe
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\afmain5.dll
c:\windows\system32\scrnrdr.exe

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d1c6802-cdf7-11dd-9931-0018f3af95fa}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 96 · przez **bielu** 16 Sty 2009, 16:07

OK, powstało coś takiego:

Kod: Zaznacz wszystko: ComboFix 09-01-15.01 - Tomasz 2009-01-16 15:00:19.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.895.170 [GMT 1:00] Uruchomiony z: c:\documents and settings\Tomasz\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Tomasz\Pulpit\CFScript.txt FW: ZoneAlarm Firewall *disabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! FILE :: c:\windows\AhnRpta.exe c:\windows\system32\afmain5.dll c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\nmdfgds2.dll c:\windows\system32\scrnrdr.exe C:\x2csvg.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\AhnRpta.exe c:\windows\system32\afmain5.dll c:\windows\system32\ddr.exe c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\nmdfgds2.dll c:\windows\system32\scrnrdr.exe C:\x2csvg.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-16 do 2009-01-16 ))))))))))))))))))))))))))))))) . 2009-01-16 14:52 . 2009-01-16 14:52 110,003 -r-hs---- c:\windows\system32\olhrwef.exe 2009-01-16 14:34 . 2009-01-16 14:57 <DIR> d-------- c:\program files\a-squared Free 2009-01-16 14:22 . 2009-01-16 14:22 <DIR> d-------- c:\program files\Trend Micro 2009-01-16 00:56 . 2009-01-16 01:41 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\Auslogics 2009-01-16 00:55 . 2009-01-16 01:36 <DIR> d-------- c:\program files\Disk Size Manager 2.0 2009-01-16 00:55 . 2009-01-16 01:36 <DIR> d-------- c:\program files\Auslogics 2009-01-15 20:17 . 2009-01-15 20:17 <DIR> d-------- c:\program files\THQ 2009-01-15 00:04 . 2009-01-15 00:05 <DIR> d-------- C:\Westwood 2009-01-09 20:14 . 2009-01-09 20:31 <DIR> d-------- c:\program files\Common Files\AVSMedia 2009-01-09 20:14 . 2009-01-09 20:31 <DIR> d-------- c:\program files\AVSMedia 2009-01-06 08:57 . 2009-01-06 08:57 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\5400 Series 2009-01-05 22:13 . 2009-01-16 10:54 <DIR> d-------- c:\program files\Lx_cats 2009-01-05 22:12 . 2006-11-07 12:30 344,064 --a------ c:\windows\system32\lxctcoin.dll 2009-01-05 22:12 . 2006-04-25 04:11 40,960 --a------ c:\windows\system32\lxctvs.dll 2009-01-05 22:12 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2009-01-05 22:12 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2009-01-05 22:10 . 2009-01-05 22:13 <DIR> d-------- c:\program files\Lexmark Toolbar 2009-01-05 22:10 . 2009-01-05 22:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\5400 Series 2009-01-05 22:09 . 2009-01-05 22:11 <DIR> d-------- c:\program files\Lexmark 5400 Series 2009-01-05 22:09 . 2009-01-05 22:10 <DIR> d-------- c:\program files\Abbyy FineReader 6.0 Sprint 2009-01-05 22:08 . 2006-11-06 17:35 1,224,704 --a------ c:\windows\system32\lxctserv.dll 2009-01-05 22:01 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2009-01-05 22:01 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2009-01-05 21:59 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2009-01-05 21:59 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2009-01-04 15:14 . 2009-01-15 20:23 43,520 --a------ c:\windows\system32\CmdLineExt03.dll 2009-01-01 16:40 . 2009-01-01 16:40 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\EBookSys 2009-01-01 16:06 . 2009-01-01 16:06 <DIR> d-------- c:\program files\SystemRequirementsLab 2009-01-01 16:06 . 2009-01-01 16:06 <DIR> d-------- c:\documents and settings\Tomasz\SystemRequirementsLab 2008-12-29 10:49 . 2008-12-29 10:53 <DIR> d-------- c:\program files\eMule 2008-12-27 19:01 . 2008-12-27 19:03 <DIR> d-------- c:\program files\RegCleaner 2008-12-27 16:37 . 2008-12-27 16:37 2,668,686 --a------ c:\windows\ACD Wallpaper.bmp 2008-12-27 00:16 . 2008-12-27 00:16 <DIR> d-------- c:\program files\YourWare Solutions 2008-12-26 01:08 . 2008-12-26 01:08 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\acccore 2008-12-26 01:06 . 2008-12-26 01:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\AOL OCP 2008-12-26 01:06 . 2008-12-26 01:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\AOL 2008-12-26 01:05 . 2008-12-26 01:05 <DIR> d-------- c:\program files\Viewpoint 2008-12-26 01:05 . 2008-12-26 01:05 <DIR> d-------- c:\program files\Common Files\AOL 2008-12-26 01:05 . 2008-12-26 01:06 <DIR> d-------- c:\program files\AIM6 2008-12-26 01:05 . 2008-12-26 01:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Viewpoint 2008-12-26 01:05 . 2008-12-26 01:06 478 --ah----- C:\IPH.PH 2008-12-25 22:56 . 2008-12-25 23:02 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\vlc 2008-12-25 22:55 . 2008-12-25 22:55 <DIR> d-------- c:\program files\VideoLAN 2008-12-25 22:41 . 2008-12-25 22:42 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\FLVPlayer4Free 2008-12-25 13:38 . 2008-12-28 16:15 37 --a------ c:\windows\9É 2008-12-24 20:11 . 2009-01-09 20:32 <DIR> d-------- c:\program files\WinX DVD Player 3.0 2008-12-24 15:48 . 2008-12-24 15:48 37 --a------ c:\windows\(9É 2008-12-24 15:47 . 2008-12-24 15:47 86,528 --a------ c:\windows\system32\Dvdvideo.ax 2008-12-24 15:47 . 2008-12-24 15:47 65,536 --a------ c:\windows\system32\Dvdaudio.ax 2008-12-24 15:38 . 2008-12-24 15:38 37 --a------ c:\windows\r007 2008-12-24 15:07 . 2008-12-24 15:16 <DIR> d-------- c:\program files\SkanerOnline 2008-12-23 21:26 . 2008-12-23 21:26 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\Apple Computer 2008-12-19 19:40 . 2008-12-19 19:40 <DIR> d-------- c:\windows\Easy CD-DA Extractor 12 2008-12-19 19:40 . 2008-12-19 19:40 <DIR> d-------- c:\program files\Easy CD-DA Extractor 12 2008-12-19 19:40 . 2008-12-19 23:04 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-19 19:40 . 2008-12-19 19:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Easy CD-DA Extractor 2008-12-17 21:26 . 2008-12-17 21:36 <DIR> d-------- c:\program files\Return to Castle Wolfenstein 2008-12-17 21:25 . 2008-12-17 21:36 600 --a------ c:\windows\Rtcw.INI 2008-12-17 01:22 . 2008-12-17 01:22 <DIR> d-------- c:\program files\Audio Phonics, Inc 2008-12-17 01:22 . 1997-04-08 20:08 299,520 --a------ c:\windows\uninst.exe 2008-12-17 01:20 . 2008-12-17 01:20 <DIR> d-------- c:\program files\AP Tuner 2008-12-16 19:33 . 2008-12-16 19:33 <DIR> d-------- c:\program files\NCH Software 2008-12-16 19:30 . 2009-01-09 19:06 <DIR> d-------- c:\program files\NCH Swift Sound 2008-12-16 19:30 . 2008-12-16 19:30 <DIR> d-------- c:\documents and settings\Tomasz\Dane aplikacji\NCH Swift Sound 2008-12-16 19:30 . 2009-01-09 19:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-16 13:52 110,003 --sh--r C:\x2csvg.exe 2009-01-16 12:29 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\uTorrent 2009-01-16 10:39 --------- d-----w c:\program files\DC++ 2009-01-15 19:17 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-14 22:00 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Skype 2009-01-14 21:56 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\skypePM 2008-12-27 12:57 --------- d-----w c:\program files\Gadu-Gadu 2008-12-25 00:53 --------- d-----w c:\program files\NAPI-PROJEKT 2008-12-13 19:40 --------- d-----w c:\program files\Sierra On-Line 2008-12-13 18:57 --------- d-----w c:\program files\Real Alternative 2008-12-13 01:37 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Media Player Classic 2008-12-13 01:21 --------- d-----w c:\program files\Skype 2008-12-13 01:20 --------- d-----w c:\program files\Media Player Classic 2008-12-13 00:14 --------- d-----w c:\program files\Common Files\Adobe 2008-12-12 21:06 --------- d-----w c:\program files\Common Files\Skype 2008-12-12 21:06 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-12 16:09 --------- d-----w c:\program files\QuickTime 2008-12-12 16:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-12 10:14 106,628 ----a-w c:\windows\Internet Logs\vsmon_2nd_2008_12_11_21_49_00_small.dmp.zip 2008-12-11 23:19 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Hamachi 2008-12-11 22:11 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys 2008-12-11 18:41 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Toshiba 2008-12-11 11:11 --------- d-----w c:\program files\uTorrent 2008-12-10 22:22 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-12-10 22:22 --------- d-----w c:\program files\Java 2008-12-10 12:56 --------- d-----w c:\program files\SubEdit-Player 2008-12-09 23:12 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\ACD Systems 2008-12-09 23:11 9,856 ----a-w c:\windows\system32\drivers\pfc.sys 2008-12-09 23:11 --------- d-----w c:\program files\Common Files\ACD Systems 2008-12-09 23:11 --------- d-----w c:\program files\ACD Systems 2008-12-09 23:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ACD Systems 2008-12-09 21:13 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-09 21:11 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-09 21:11 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\DAEMON Tools 2008-12-09 08:16 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Gadu-Gadu 2008-12-09 00:07 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Thunderbird 2008-12-08 23:34 --------- d-----w c:\program files\Zone Labs 2008-12-08 23:29 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Last.fm 2008-12-08 23:28 --------- d-----w c:\program files\Last.fm 2008-12-08 23:27 --------- d-----w c:\documents and settings\Tomasz\Dane aplikacji\Winamp 2008-12-08 23:24 --------- d-----w c:\program files\Winamp 2008-12-08 23:12 --------- d-----w c:\program files\Toshiba 2008-12-08 23:04 15,781 ----a-w c:\windows\system32\drivers\mdc8021x.sys 2008-12-08 23:04 --------- d-----w c:\program files\Asus 2008-12-08 22:59 --------- d-----w c:\program files\Wireless Console 2 2008-12-08 22:49 --------- d-----w c:\program files\Synaptics 2008-12-08 22:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\InstallShield 2008-12-08 22:48 --------- d-----w c:\program files\Realtek 2008-12-08 22:48 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-08 22:42 --------- d-----w c:\program files\Common Files\ATI Technologies 2008-12-08 22:41 --------- d-----w c:\program files\ATI Technologies 2008-12-08 22:18 --------- d-----w c:\program files\microsoft frontpage 2008-12-08 22:16 --------- d-----w c:\program files\Usługi online . ((((((((((((((((((((((((((((( snapshot@2009-01-16_14.19.31,78 ))))))))))))))))))))))))))))))))))))))))) . + 2009-01-16 14:03:01 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6ec.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "cdoosoft"="c:\windows\system32\olhrwef.exe" [2009-01-16 110003] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="c:\windows\ATK0100\HControl.exe" [2006-02-23 106496] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-08 344064] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 761945] "Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136] "Control Center"="c:\program files\ASUS\WLAN Card Utilities\Center.exe" [2005-09-13 1668096] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 919280] "LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496] "RTHDCPL"="RTHDCPL.EXE" [2006-05-04 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyDocs"= 1 (0x1) "NoRecentDocsNetHood"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyDocs"= 1 (0x1) "NoRecentDocsNetHood"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 00:55 1667584 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\WINDOWS\\system32\\lxctcoms.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\windows\system32\ASNDIS5.sys [2008-12-09 16269] R3 SynMini;USB2.0 1.3M WebCam;c:\windows\system32\drivers\SynMini.sys [2008-12-08 1056512] R3 SynScan;USB2.0 1.3M WebCam Still Image;c:\windows\system32\drivers\SynScan.sys [2008-12-08 8064] S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\Tomasz\USTAWI~1\Temp\DMSKSSRh.sys --> c:\docume~1\Tomasz\USTAWI~1\Temp\DMSKSSRh.sys [?] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.windowsxlive.net TCP: {8140D5BA-2E41-4500-809B-225DB3D36A91} = 213.184.16.1,213.184.16.2 c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FF - ProfilePath - c:\documents and settings\Tomasz\Dane aplikacji\Mozilla\Firefox\Profiles\nej3u9tw.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ---- FIREFOX - SPOSÓB POSTEPOWANIA ---- user_pref('capability.policy.policynames', 'localfilelinks');user_pref('capability.policy.localfilelinks.sites', 'hxxp://www.webmynd.com http://www.google.com');user_pref('capability.policy.localfilelinks.checkloaduri.enabled', 'allAccess');. ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-16 15:03:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1000) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ZoneLabs\vsmon.exe c:\program files\a-squared Free\a2service.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\ASWLSVC.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\lxctcoms.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe c:\windows\system32\wscntfy.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe c:\windows\ATK0100\ATKOSD.exe c:\windows\system32\wbem\wmiapsrv.exe . ************************************************************************** . Czas ukończenia: 2009-01-16 15:04:41 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-16 14:04:37 ComboFix2.txt 2009-01-16 13:20:20 Przed: 7 303 868 416 bajtów wolnych Po: 7,289,757,696 bajtów wolnych 254

A przy okazji: pojawiło mi się coś, co w Menadżerze Urządzeń zwie się ddr.exe. I działa mi takich 10-20-30 procesów. Co to jest?

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 17:05

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\olhrwef.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdoosoft"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.