zmienia hasła na różnych stronach

**Posty:** 2042 · przez **Wojtaz** 23 Mar 2008, 11:25

Koleś do mnie piszę, żebym dał loga tutaj, bo zmienia mu hasła na stronach i sądzi, że ma wirusa.
Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:47:01, on 2008-03-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\libusbd-nt.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no file) O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit FileMonitor (ABFileMon) - Unknown owner - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe (file missing) O23 - Service: ArcaBit NetMonitor (ABNetMon) - Unknown owner - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe (file missing) O23 - Service: ArcaBit.Core.Configurator - Unknown owner - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe (file missing) O23 - Service: ArcaBit.Core.LoggingService - Unknown owner - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe (file missing) O23 - Service: ArcaBit.TaskScheduler - Unknown owner - C:\Program Files\ArcaBit\Common\TaskScheduler.exe (file missing) O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: ArcaBit Update Service (AVUpdate) - Unknown owner - C:\Program Files\ArcaBit\ArcaUpdate\update.exe (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing) O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 8122 bytes

Zrobił już to z tym WWDC, czy jakoś tak

**Posty:** 18165 · przez **wojtas** 23 Mar 2008, 12:26

O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no file)

na kasacje ^^

dwa antywirusy widze sa jaki jest uzywany?daj loga z combofixa

**Posty:** 8 · przez **simonnt** 23 Mar 2008, 16:38

Witam!
Zrobilem wszystko po kolei.
Oto log z ComboFix'a

Kod: Zaznacz wszystko: ComboFix 08-03-22.3 - Szymon 2008-03-23 14:38:00.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.526 [GMT 1:00] Running from: C:\Documents and Settings\Szymon\Pulpit\Default.ctf\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . -- Other TimeOuts -- CF27940.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot" CF27940.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot" catchme -apx CF27940.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot" Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement" GREP -i "C:\\Program Files\\[^\\]*\\[^\\]*$" VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll" CF27940.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot" SED "s/\\/\\\\/g" MTEE /+ cfiles.dat SED -r "/^svchost.exe$/I!d; s/.{37}//" Handle .exe Handle .exe ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\Packet.dll C:\WINDOWS\system32\prsgrc.dll C:\WINDOWS\system32\WanPacket.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF -------\Service_NPF ((((((((((((((((((((((((( Files Created from 2008-02-23 to 2008-03-23 ))))))))))))))))))))))))))))))) . 2008-03-23 10:52 . 2008-03-23 10:52 <DIR> d-------- C:\Program Files\Lavasoft 2008-03-23 10:34 . 2008-03-23 10:35 <DIR> d-------- C:\WINDOWS\Internet Logs 2008-03-22 21:42 . 2008-03-22 21:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-21 00:37 . 2008-03-21 00:37 9,610 --a------ C:\WINDOWS\system32\shutdown.rar 2008-03-21 00:37 . 2008-03-21 00:37 9,610 --a------ C:\WINDOWS\system32\prog.rar 2008-03-21 00:36 . 2008-03-21 00:36 9,610 --a------ C:\WINDOWS\system32\progs.rar 2008-03-15 21:54 . 2008-03-15 21:54 <DIR> d-------- C:\Program Files\NitrousXP 2008-03-15 21:46 . 2006-12-19 16:53 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-03-15 21:40 . 2008-03-15 21:40 140,288 --a------ C:\WINDOWS\~GLC0000.TMP 2008-03-14 16:06 . 2008-03-14 16:09 <DIR> d-------- C:\Program Files\Moyea 2008-03-14 16:06 . 2008-03-21 14:30 <DIR> d-------- C:\Documents and Settings\Szymon\Dane aplikacji\Moyea 2008-03-14 16:03 . 2008-03-14 16:05 15,349,209 --a------ C:\FLV2Video_Setup.exe 2008-03-14 15:50 . 2008-03-14 15:50 2,242,173 --a------ C:\vistav1.rar 2008-03-14 15:31 . 2008-03-14 15:35 25,654,469 --a------ C:\390.PBP 2008-03-14 15:20 . 2008-03-14 15:20 103,960 --a------ C:\150k_addon390v2.rar 2008-03-14 15:20 . 2008-03-14 15:20 14,398 --a------ C:\PSP_Instaler_3.90M33_kernel1.5_extras_www.NewPCT.com_Dark_Alex_creted_By_Neo_31__mininova_.torrent 2008-03-14 15:18 . 2008-03-14 15:18 216,890 --a------ C:\390m33.rar 2008-03-14 15:17 . 2008-03-14 15:17 199,447 --a------ C:\390m33_2.rar 2008-03-13 20:24 . 2008-03-13 20:23 60,690 --a------ C:\media1.jpg 2008-03-12 15:34 . 2008-03-12 15:34 46,379 --a------ C:\buttonay9.gif 2008-03-12 12:41 . 2008-03-12 12:44 12,685,312 --a------ C:\entrance_08032008014.mpg 2008-03-12 00:32 . 2008-03-12 00:32 9,964 --a------ C:\paszport_simka.gif 2008-03-11 20:16 . 2008-03-11 20:16 70,746 --a------ C:\az_cesja.pdf 2008-03-10 18:09 . 2008-03-10 18:09 455,168 --a------ C:\Project1.exe 2008-03-10 18:07 . 2008-03-10 18:09 <DIR> d-------- C:\Program Files\IDoser v4 2008-03-10 17:47 . 2008-03-10 18:07 28,567,270 --a------ C:\I-doser4.5_74doses.rar 2008-03-09 23:34 . 2008-03-09 23:34 41,741 --a------ C:\women_love_the_piper_by_Bakanekonei.jpg 2008-03-09 20:39 . 2008-03-09 20:39 30,400 --a------ C:\16088.gif 2008-03-09 19:25 . 2008-03-09 19:26 1,289,097 --a------ C:\cenzura-spam.rar 2008-03-09 17:21 . 2008-03-09 17:21 619,376 --a------ C:\grand_theft_auto_vcs_e.zip 2008-03-09 17:12 . 2008-03-09 17:16 3,722,162 --a------ C:\spiderman_3_gba.rar 2008-03-09 17:07 . 2008-03-09 17:10 2,268,283 --a------ C:\[u]0[/u]622 - Worms World Party (E) (M5).zip 2008-03-09 16:56 . 2008-03-09 16:56 <DIR> d-------- C:\gba 2008-03-09 16:55 . 2008-03-09 16:55 346,735 --a------ C:\GPSP 0.9 + gba bios.rar 2008-03-09 16:50 . 2008-03-09 16:50 419,893 --a------ C:\gpsp-v09-for-hen-dta-082-users.zip 2008-03-09 15:35 . 2008-03-09 15:35 1,179,425 --a------ C:\CYGP.rar 2008-03-08 20:50 . 2008-03-08 22:03 <DIR> d-------- C:\ISO 2008-03-08 19:41 . 2008-03-08 19:55 <DIR> d-------- C:\DAROS KOPIA 2008-03-07 22:52 . 2008-03-07 22:53 <DIR> d-------- C:\kowaniec 2008-03-06 23:00 . 2008-03-06 23:01 9,760,773 --a------ C:\Oczy Kobry.flv 2008-03-06 22:47 . 2008-03-06 22:49 <DIR> d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter 2008-03-06 22:45 . 2008-03-06 22:46 3,971,283 --a------ C:\flv2video_converter.exe 2008-03-06 22:43 . 2008-03-06 22:45 13,193,776 --a------ C:\Prawdziwy dyskotekowy podrywacz.flv 2008-03-06 22:13 . 2008-03-06 22:13 461,539 --a------ C:\Black Mirror_2.zip 2008-03-06 22:13 . 1601-01-04 11:30 27,997 --a------ C:\Black Mirror_2.jpg 2008-03-06 22:11 . 1601-01-04 11:59 437,948 --a------ C:\Black Mirror_3.ptf 2008-03-06 22:09 . 2008-03-06 22:12 6,692,443 --a------ C:\Organ_3.90_M33__Dracrius_Remix__R3.rar 2008-03-06 21:47 . 2008-03-06 21:48 778,419 --a------ C:\16047_LightMP3_ALPHA2.rar 2008-03-06 20:35 . 2008-03-06 20:35 <DIR> d-------- C:\Program Files\LibUSB-Win32-0.1.10.1 2008-03-06 20:35 . 2008-03-06 20:35 379,822 --a------ C:\libusb-win32-filter-bin-0.1.10.1.exe 2008-03-06 20:35 . 2007-09-19 10:02 43,520 --a------ C:\WINDOWS\system32\libusb0.dll 2008-03-06 20:35 . 2007-09-19 10:02 28,672 --a------ C:\WINDOWS\system32\drivers\libusb0.sys 2008-03-06 20:35 . 2005-03-09 20:50 19,456 --a------ C:\WINDOWS\system32\libusbd-9x.exe 2008-03-06 20:35 . 2005-03-09 20:50 18,944 --a------ C:\WINDOWS\system32\libusbd-nt.exe 2008-03-06 20:28 . 2008-03-06 20:27 2,662,398 --a------ C:\15106_Custom_Firmware_Extender_1.9.2.zip 2008-03-06 20:23 . 2008-03-06 20:23 879 --a------ C:\anti.prx.zip 2008-03-06 17:48 . 2008-03-06 17:48 813,276 --a------ C:\P3060215.JPG 2008-03-06 17:48 . 2008-03-06 17:49 805,905 --a------ C:\P3060216.JPG 2008-03-06 15:22 . 2008-03-06 15:22 3,917,423 --a------ C:\NPJG90019.zip 2008-03-05 22:55 . 2008-03-05 23:46 99,999,999 --a------ C:\Wlatcy.Moch.S04E01.PL_LEKCJA_40_Poch_t.uploadarbuzik1992.part1.rar 2008-03-03 23:05 . 2008-03-03 23:05 1,652,864 --a------ C:\pt.mp3 2008-03-03 22:56 . 2008-03-03 22:56 <DIR> d-------- C:\Program Files\ivo 2008-03-03 22:56 . 2008-03-03 22:56 <DIR> d-------- C:\Documents and Settings\Szymon\Dane aplikacji\Expressivo 2008-03-02 20:27 . 2006-04-18 20:58 1,715,200 -ra------ C:\mat_1.pps 2008-03-01 10:12 . 2008-03-01 10:12 1,024 --a------ C:\WINDOWS\system32\grcauth2.dll 2008-03-01 10:12 . 2008-03-01 10:12 1,024 --a------ C:\WINDOWS\system32\grcauth1.dll 2008-03-01 10:12 . 2008-03-01 10:12 1,024 --a------ C:\WINDOWS\system32\clauth2.dll 2008-03-01 10:12 . 2008-03-01 10:12 1,024 --a------ C:\WINDOWS\system32\clauth1.dll 2008-02-27 23:12 . 2008-02-27 23:12 <DIR> d-------- C:\Documents and Settings\Szymon\Dane aplikacji\Grisoft 2008-02-27 23:11 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-02-27 23:10 . 2008-02-27 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-02-24 22:12 . 2008-02-24 22:12 <DIR> d-------- C:\Program Files\danny_kay1710 2008-02-23 16:04 . 2008-02-23 17:06 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-02-23 16:04 . 2008-02-23 16:04 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-02-23 16:03 . 2008-02-23 16:03 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-02-23 16:03 . 2008-03-23 15:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-02-23 16:03 . 2008-03-23 15:11 22,330,144 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-02-23 16:03 . 2008-03-23 15:11 294,584 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-02-23 16:03 . 2008-03-23 15:11 101,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-02-23 16:03 . 2008-03-23 15:11 10,604 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-02-23 00:47 . 2008-02-23 00:47 434,688 --a------ C:\WINDOWS\system32\ss2uinst.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-23 13:46 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\MegauploadToolbar 2008-03-22 23:34 --------- d-----w C:\Program Files\mIRC 2008-03-22 21:22 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-03-20 23:23 --------- d-----w C:\Program Files\Gadu-Gadu 2008-03-17 17:54 --------- d-----w C:\Program Files\Cheat Engine 2008-03-17 17:43 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\Skype 2008-03-17 17:42 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\skypePM 2008-03-16 20:32 --------- d-----w C:\Program Files\SmartFTP Client 2008-03-16 20:23 --------- d-----w C:\Program Files\SmartFTP Client 2.5 Setup Files 2008-03-16 00:13 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\DNA 2008-03-15 20:46 --------- d-----w C:\Program Files\TuneUp Utilities 2007 2008-03-15 20:40 140,288 ----a-w C:\WINDOWS\~GLC0000.TMP 2008-03-15 10:52 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\Spamihilator 2008-03-09 13:23 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\BitTorrent 2008-02-27 15:01 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-27 15:00 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-02-23 16:12 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\Xfire 2008-02-23 15:02 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-02-23 14:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-02-21 16:33 --------- d-----w C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2008-02-21 14:31 --------- d-----w C:\Program Files\Webroot 2008-02-21 14:31 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\Webroot 2008-02-21 14:31 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\Webroot 2008-02-21 14:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Webroot 2008-02-20 13:32 --------- d-----w C:\Program Files\MegauploadToolbar 2008-02-19 15:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-02-17 15:29 --------- d-----w C:\Program Files\Xfire 2008-02-12 22:16 --------- d-----w C:\Program Files\Clicking Agent 2008-02-12 14:36 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\Gzegzolka XP 2008-02-12 14:25 --------- d-----w C:\Program Files\Gżegżółka XP 2008-02-05 13:03 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-05 11:13 --------- d-----w C:\Program Files\Teamspeak2_RC2 2008-02-04 23:09 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-02-04 23:06 --------- d-----w C:\Program Files\Skype 2008-02-04 23:06 --------- d-----w C:\Program Files\Common Files\Skype 2008-02-04 23:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-02-01 21:22 --------- d-----w C:\Program Files\Winamp 2008-02-01 19:35 --------- d-----w C:\Program Files\Spamihilator 2008-01-31 23:20 --------- d-----w C:\Program Files\MoorHunt 2008-01-31 02:02 54,608 ----a-w C:\WINDOWS\system32\xfcodec.dll 2008-01-30 21:34 --------- d-----w C:\Program Files\Hide IP Platinum 2008-01-30 17:48 --------- d-----w C:\Program Files\Makayama Interactive 2008-01-28 21:52 --------- d-----w C:\Program Files\DNA 2008-01-28 16:53 --------- d-----w C:\Documents and Settings\Szymon\Dane aplikacji\Hamachi 2008-01-28 11:43 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\Xfire 2008-01-07 12:37 4,230,520 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2008-01-06 11:11 679,936 ----a-w C:\WINDOWS\system32\spsplib1.dll 2007-12-28 19:24 23,432 ----a-w C:\Documents and Settings\Szymon\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-12-26 16:30 679,936 ----a-w C:\WINDOWS\system32\D3DX81ab.dll 2007-12-26 16:30 1,970,176 ----a-w C:\WINDOWS\system32\d3dx9.dll 2007-12-03 20:02 22,328 ----a-w C:\Documents and Settings\Szymon\Dane aplikacji\PnkBstrK.sys 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe 2004-08-04 12:00 93,184 --sha-w C:\WINDOWS\BricoPacks\SysFiles\79_iexplore.exe 2007-12-15 21:17 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012007121520071216\index.dat . ------- Sigcheck ------- 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe 2007-12-15 22:28 504832 381221f69d1248864861889a64f100b6 C:\WINDOWS\system32\winlogon.exe 2007-06-13 14:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\explorer.exe 2007-06-13 14:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-04 13:00 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2004-08-04 00:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\ServicePackFiles\i386\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-09 20:57 2119104] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 15:49 16126464 C:\WINDOWS\RTHDCPL.exe] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 13:00 33280 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-12-18 00:43 227856] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-02-27 23:17 6731312] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40 5367608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "RunStartupScriptSync"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoChangeAnimation"= 0 (0x0) "NoStrCmpLogical"= 0 (0x0) "NoPropertiesRecycleBin"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) "NoStrCmpLogical"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener] TS_LogonListener.dll 2007-01-12 16:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "AQQ"=C:\PROGRA~1\WapSter\AQQ\AQQ.exe "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "E:\\download\\Prizee Hacks\\handy\\HandyCache\\HandyCache.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\Spamihilator\\dccproc.exe"= "E:\\Metin2_PL\\metin2.bin"= "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-23 21:52] R1 SandBox;Lavasoft Firewall Sandbox Driver;C:\Program Files\Lavasoft\Personal Firewall\kernel\Sandbox.SYS [2007-06-26 19:01] R1 VFILT;Lavasoft Firewall Kernel Driver;C:\Program Files\Lavasoft\Personal Firewall\kernel\FILTNT.SYS [2007-04-05 16:56] R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-04 13:00] R3 ADBLOCK.DLL;Lavasoft Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\ADBLOCK.DLL [2007-04-05 16:57] R3 ARP.DLL;Lavasoft Firewall PlugIn (ARP.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\ARP.DLL [2007-04-05 16:57] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 15:12] R3 CONTENT.DLL;Lavasoft Firewall PlugIn (CONTENT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\CONTENT.DLL [2007-04-05 16:57] R3 DNSCACHE.DLL;Lavasoft Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\DNSCACHE.DLL [2007-04-05 16:57] R3 FTPFILT.DLL;Lavasoft Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\FTPFILT.DLL [2007-04-05 16:57] R3 HTMLFILT.DLL;Lavasoft Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\HTMLFILT.DLL [2007-04-05 16:57] R3 HTTPFILT.DLL;Lavasoft Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\HTTPFILT.DLL [2007-04-05 16:57] R3 IMAPFILT.DLL;Lavasoft Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\IMAPFILT.DLL [2007-04-05 16:57] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] R3 libusb0;LibUsb-Win32 - Kernel Driver 08/27/2006, 0.1.12.0;C:\WINDOWS\system32\drivers\libusb0.sys [2007-09-19 10:02] R3 MAILFILT.DLL;Lavasoft Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\MAILFILT.DLL [2007-04-05 16:57] R3 NNTPFILT.DLL;Lavasoft Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\NNTPFILT.DLL [2007-04-05 16:57] R3 POP3FILT.DLL;Lavasoft Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\POP3FILT.DLL [2007-04-05 16:57] R3 PROTECT.DLL;Lavasoft Firewall PlugIn (PROTECT.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\PROTECT.DLL [2007-04-05 16:57] R3 SECRET.DLL;Lavasoft Firewall PlugIn (SECRET.DLL);C:\Program Files\Lavasoft\Personal Firewall\kernel\SECRET.DLL [2007-04-05 16:57] S1 ABTDI;ABTDI;C:\Program Files\ArcaBit\ArcaVir\ABTDI.sys [] S2 ABFileMon;ArcaBit FileMonitor;"C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe" [] S2 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;"C:\Program Files\ArcaBit\Common\TaskScheduler.exe" [] S2 AVUpdate;ArcaBit Update Service;C:\Program Files\ArcaBit\ArcaUpdate\update.exe [] S3 ABFLT;ArcaBit File Monitor Driver;C:\PROGRA~1\ArcaBit\ArcaVir\ABFLT.sys [] S3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;"C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe" [] S3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;"C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe" [] S3 jfdcd;jfdcd;C:\DOCUME~1\Szymon\USTAWI~1\Temp\jfdcd.sys [] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\CojLauncher.exe . Contents of the 'Scheduled Tasks' folder "2008-03-22 00:56:10 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-23 15:13:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Lavasoft\Personal Firewall\lpfw.exe C:\WINDOWS\system32\libusbd-nt.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE . ************************************************************************** . Completion time: 2008-03-23 15:24:40 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-23 14:23:09 . 2008-03-13 13:39:16 --- E O F ---

Używam Kasperskiego i AVG AntiSpyware :mrgreen:

**Posty:** 18165 · przez **wojtas** 23 Mar 2008, 17:47

te plik/i :

C:\WINDOWS\~GLC0000.TMP

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

odinstaluj ArcaVir i Noda32

**Posty:** 8 · przez **simonnt** 23 Mar 2008, 18:04

wszedzie not found

Zostaje tylko FORMAT ?? :roll:

zmienia hasła na różnych stronach

Zmienia hasła na różnych stronach

Kto jest na forum