Komputer muli,nie do końca wchodzą www

**Posty:** 653 · przez **holi12** 09 Sty 2009, 12:23

tak jak w opisie tematu:) aha...combofix nawet sie nie chce odpalic:(

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:21, on 2009-01-09 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {273d7f34-6a7c-447b-88e8-ed5e29c2c98d} - C:\WINDOWS\system32\pulovuwi.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKLM\..\Run: [CPMffea2606] Rundll32.exe "c:\windows\system32\puyekebi.dll",a O4 - HKLM\..\Run: [vidilatuta] Rundll32.exe "C:\WINDOWS\system32\lifakobe.dll",s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [vidilatuta] Rundll32.exe "C:\WINDOWS\system32\lifakobe.dll",s (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [vidilatuta] Rundll32.exe "C:\WINDOWS\system32\lifakobe.dll",s (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O20 - AppInit_DLLs: c:\windows\system32\puyekebi.dll c:\windows\system32\domohodu.dll c:\windows\system32\nenusudu.dll,C:\WINDOWS\system32\luravufa.dll O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\puyekebi.dll O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\puyekebi.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 3235 bytes

**Posty:** 18165 · przez **wojtas** 09 Sty 2009, 14:44

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Kod: Zaznacz wszystko: Files to delete: c:\windows\system32\puyekebi.dll C:\WINDOWS\system32\luravufa.dll c:\windows\system32\domohodu.dll c:\windows\system32\nenusudu.dll C:\WINDOWS\system32\lifakobe.dll C:\WINDOWS\system32\pulovuwi.dll

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt
oraz nowy log z rsita ( opis tam gdzie combo) albo z combofixa jesli sie uda

Autor postu otrzymał pochwałę

**Posty:** 653 · przez **holi12** 09 Sty 2009, 23:56

ComboFix

Kod: Zaznacz wszystko: ComboFix 09-01-08.05 - D@wid 2009-01-09 22:42:23.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1023.738 [GMT 1:00] Uruchomiony z: c:\documents and settings\D@wid\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat c:\windows\system32\jibugana.dll c:\windows\system32\oyepijum.ini c:\windows\system32\ukijiton.ini c:\windows\Temp\tmp3.tmp . ---- Previous Run ------- . c:\windows\system32\acmteocg.ini c:\windows\system32\eefedfii.ini c:\windows\system32\eefedfii.ini2 c:\windows\system32\fvxngqxr.dll c:\windows\system32\lwhzag.dll c:\windows\system32\skyuqxlp.ini c:\windows\system32\spzjsh.dll c:\windows\system32\srbfcxgc.dll c:\windows\system32\tmivru.dll c:\windows\system32\tswkrely.dll c:\windows\system32\urqQkKbc.dll c:\windows\system32\vekrneiq.ini c:\windows\system32\wiceebli.dll c:\windows\system32\xgjmoc.dll ----- BITS: Możliwe zainfekowane strony ----- hxxp://77.74.48.105 . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-09 do 2009-01-09 ))))))))))))))))))))))))))))))) . 2009-01-09 11:49 . 2009-01-09 11:49 2,208 ---hs---- c:\windows\system32\vevinaho.dll 2009-01-09 11:49 . 2009-01-09 11:49 2,208 ---hs---- c:\windows\system32\hakologe.dll 2009-01-08 23:49 . 2009-01-08 23:49 102,912 --ah----- c:\windows\system32\BIT7.tmp 2009-01-08 23:49 . 2009-01-08 23:49 90,112 --ah----- c:\windows\system32\BIT6.tmp 2009-01-08 23:49 . 2009-01-08 23:49 2,208 ---hs---- c:\windows\system32\pipibuju.dll 2009-01-08 23:49 . 2009-01-08 23:49 2,208 ---hs---- c:\windows\system32\lopibeki.dll 2009-01-08 11:48 . 2009-01-08 11:48 2,208 ---hs---- c:\windows\system32\neremije.dll 2009-01-07 12:03 . 1601-01-01 01:12 61,089 --------- c:\windows\system32\trz4.tmp 2009-01-07 12:03 . 1601-01-01 01:12 61,089 --------- c:\windows\system32\trz3.tmp 2009-01-07 12:00 . 1601-01-01 01:12 61,089 --------- c:\windows\system32\trz1.tmp 2009-01-07 08:01 . 2009-01-07 08:01 2,208 ---hs---- c:\windows\system32\wijuhalu.dll 2009-01-06 19:52 . 2009-01-06 19:52 2,208 ---hs---- c:\windows\system32\vutanoko.dll 2009-01-06 19:52 . 2009-01-06 19:52 2,208 ---hs---- c:\windows\system32\jokapovu.dll 2009-01-06 07:51 . 2009-01-06 07:51 2,208 ---hs---- c:\windows\system32\notabage.dll 2009-01-06 07:51 . 2009-01-06 07:51 2,208 ---hs---- c:\windows\system32\beziseno.dll 2009-01-05 19:51 . 2009-01-05 19:51 2,208 ---hs---- c:\windows\system32\tadofuvo.dll 2009-01-05 19:51 . 2009-01-05 19:51 2,208 ---hs---- c:\windows\system32\biyedepu.dll 2009-01-05 07:50 . 2009-01-05 07:50 2,208 ---hs---- c:\windows\system32\yufarapu.dll 2009-01-04 12:34 . 2009-01-04 12:56 <DIR> d-------- c:\program files\3D Driving-School Demo 2009-01-04 10:35 . 2009-01-04 10:35 2,208 ---hs---- c:\windows\system32\jorujedi.dll 2009-01-03 14:35 . 2009-01-03 14:35 2,208 ---hs---- c:\windows\system32\wirijepi.dll 2009-01-03 14:35 . 2009-01-03 14:35 2,208 ---hs---- c:\windows\system32\fasapako.dll 2009-01-02 15:15 . 2009-01-02 15:15 2,208 ---hs---- c:\windows\system32\kulepive.dll 2009-01-01 13:06 . 2009-01-01 13:06 <DIR> d-------- c:\documents and settings\D@wid\Dane aplikacji\Sports Interactive 2009-01-01 13:06 . 2009-01-01 13:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2009-01-01 12:51 . 2009-01-01 12:55 <DIR> d--h----- c:\program files\Zero G Registry 2009-01-01 12:50 . 2009-01-01 12:50 <DIR> d--h----- c:\documents and settings\D@wid\InstallAnywhere 2009-01-01 11:05 . 2009-01-01 11:05 2,208 ---hs---- c:\windows\system32\sezerabo.dll 2009-01-01 11:05 . 2009-01-01 11:05 2,208 ---hs---- c:\windows\system32\bimefili.dll 2008-12-27 14:35 . 2008-12-28 11:44 <DIR> d-------- c:\documents and settings\Mirek\Dane aplikacji\Winamp 2008-12-25 15:53 . 2008-12-25 15:53 <DIR> d-------- c:\program files\Grupa IMAGE 2008-12-25 14:02 . 2008-12-25 14:03 <DIR> d-------- c:\program files\mp3DirectCut 2008-12-25 13:32 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbser.sys 2008-12-25 13:32 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbmdm.sys 2008-12-24 10:19 . 2008-12-24 10:19 <DIR> d-------- c:\program files\Trend Micro 2008-12-22 23:56 . 2008-12-22 23:56 45,056 --a------ c:\windows\system32\mlJYolml.dll 2008-12-22 23:31 . 2005-06-03 15:09 454,656 --a------ c:\windows\system32\CapabilityTable.exe 2008-12-22 23:30 . 2005-04-06 03:22 261,888 --a------ c:\windows\system32\drivers\nvnrm.sys 2008-12-22 23:30 . 2005-04-06 03:22 208,256 --a------ c:\windows\system32\drivers\nvsnpu.sys 2008-12-22 23:30 . 2005-04-06 03:19 201,728 --a------ c:\windows\system32\fdco1.dll 2008-12-22 23:30 . 2005-05-13 10:52 176,128 --a------ c:\windows\system32\nvusmb.exe 2008-12-22 23:30 . 2005-06-03 15:07 176,128 --a------ c:\windows\system32\nvunrm.exe 2008-12-22 23:30 . 2005-04-06 03:22 33,536 --a------ c:\windows\system32\drivers\NVENETFD.sys 2008-12-22 23:30 . 2005-04-04 19:00 32,256 --a------ c:\windows\system32\nvconrm.dll 2008-12-22 23:30 . 2005-04-06 03:22 12,928 --a------ c:\windows\system32\drivers\nvnetbus.sys 2008-12-22 23:30 . 2005-04-06 03:19 9,728 --a------ c:\windows\system32\bdco1.dll 2008-12-22 23:30 . 2005-02-08 14:26 3,596 --a------ c:\windows\system32\nvnrm.nvu 2008-12-22 23:30 . 2005-02-08 14:26 1,231 --a------ c:\windows\system32\nvsmb.nvu 2008-12-22 23:26 . 2008-04-30 17:27 442,368 --a------ c:\windows\system32\NVUNINST.EXE 2008-12-22 23:14 . 2008-12-22 23:16 <DIR> d-------- c:\windows\NV24162420.TMP 2008-12-22 23:13 . 2008-12-22 23:13 <DIR> d-------- C:\NVIDIA 2008-12-22 23:11 . 2008-05-03 05:46 6,554,496 --a------ c:\windows\system32\drivers\nv4_mini.sys 2008-12-22 23:11 . 2008-05-03 05:46 6,554,496 --a--c--- c:\windows\system32\dllcache\nv4_mini.sys 2008-12-22 23:11 . 2008-05-03 05:46 6,108,160 --a------ c:\windows\system32\nv4_disp.dll 2008-12-22 23:11 . 2008-05-03 05:46 6,108,160 --a--c--- c:\windows\system32\dllcache\nv4_disp.dll 2008-12-22 23:08 . 2008-12-22 23:27 <DIR> d-------- c:\windows\nvidia icons 2008-12-22 23:08 . 2008-12-22 23:09 <DIR> d-------- c:\windows\NV33603352.TMP 2008-12-22 22:37 . 2008-12-22 22:37 <DIR> d-------- c:\windows\system32\Futuremark 2008-12-22 22:37 . 2008-12-22 22:37 <DIR> d-------- c:\program files\Futuremark 2008-12-22 22:37 . 2004-10-25 20:02 21,664 --a------ c:\windows\system32\drivers\Entech.sys 2008-12-22 22:37 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys 2008-12-21 20:44 . 2008-12-21 20:44 <DIR> d-------- c:\windows\Downloaded Installations 2008-12-21 20:44 . 2005-05-17 17:45 300,032 --a------ c:\windows\system32\idecoi.dll 2008-12-21 20:44 . 2005-04-06 03:19 201,728 --a------ c:\windows\system32\fdco1ins.dll 2008-12-21 20:44 . 2005-05-17 17:45 92,800 --a------ c:\windows\system32\drivers\nvatabus.sys 2008-12-21 20:44 . 2005-05-17 17:45 92,800 --a------ c:\windows\system32\drivers\nvata.sys 2008-12-21 20:44 . 2005-04-06 03:19 9,728 --a------ c:\windows\system32\bdco1ins.dll 2008-12-21 18:25 . 2008-12-21 18:27 <DIR> d-------- c:\program files\Common Files\Ahead 2008-12-21 18:25 . 2008-12-21 18:25 <DIR> d-------- c:\program files\Ahead 2008-12-21 18:25 . 2004-07-20 17:24 1,568,768 --------- c:\windows\system32\ImagX7.dll 2008-12-21 18:25 . 2004-07-20 17:24 476,320 --------- c:\windows\system32\ImagXpr7.dll 2008-12-21 18:25 . 2004-07-20 17:24 471,040 --------- c:\windows\system32\ImagXRA7.dll 2008-12-21 18:25 . 2004-07-09 09:43 364,544 --------- c:\windows\system32\TwnLib4.dll 2008-12-21 18:25 . 2004-07-20 17:24 262,144 --------- c:\windows\system32\ImagXR7.dll 2008-12-21 18:25 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe 2008-12-21 18:25 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll 2008-12-21 18:25 . 2001-06-26 08:15 38,912 --------- c:\windows\system32\picn20.dll 2008-12-21 16:37 . 2008-12-21 16:37 <DIR> d-------- c:\windows\system32\VIRepair 2008-12-16 22:18 . 2008-12-16 22:18 <DIR> d-------- c:\documents and settings\D@wid\Dane aplikacji\ViStart 2008-12-16 22:16 . 2008-12-16 22:16 <DIR> d-------- c:\documents and settings\D@wid\Dane aplikacji\Styler 2008-12-16 22:13 . 2008-12-16 22:13 <DIR> d-------- c:\program files\WinFlip 2008-12-16 22:13 . 2008-12-16 22:13 <DIR> d-------- c:\program files\Vista Rainbar 2008-12-16 22:13 . 2008-12-16 22:13 <DIR> d-------- c:\program files\TrueTransparency 2008-12-16 22:13 . 2008-12-21 16:37 <DIR> d-------- c:\program files\Styler 2008-12-16 22:11 . 2008-12-16 22:11 78,942 --a------ c:\windows\Icon_1.ico 2008-12-16 22:10 . 2008-12-21 16:42 <DIR> d-------- c:\windows\system32\VITrans 2008-12-16 22:10 . 2008-12-16 22:13 <DIR> d-------- C:\VTPFiles 2008-12-16 22:10 . 2006-12-03 17:15 111,104 --a------ c:\windows\system32\Uharc.exe 2008-12-16 22:10 . 2004-11-27 19:00 94,208 --a------ c:\windows\system32\pskill.exe 2008-12-16 22:10 . 2006-12-03 17:15 69,632 --a------ c:\windows\system32\moveex.exe 2008-12-16 22:10 . 2006-12-03 17:15 19,968 --a------ c:\windows\system32\reico.exe 2008-12-16 22:10 . 2006-12-03 17:14 8,636 --a------ c:\windows\system32\modifype.exe 2008-12-16 22:05 . 2008-11-11 23:22 20,480 --a------ c:\windows\system32\scrnrdr.exe 2008-12-16 18:36 . 2008-12-25 13:39 <DIR> d-------- c:\documents and settings\D@wid\Dane aplikacji\Samsung 2008-12-16 18:12 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-12-16 18:11 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-12-16 18:10 . 2008-12-16 18:11 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers 2008-12-16 18:10 . 2008-12-25 13:32 <DIR> d-------- c:\program files\Samsung 2008-12-16 18:10 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-12-16 17:52 . 2008-12-16 17:52 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-16 17:50 . 2008-04-14 00:15 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-12-16 17:50 . 2008-04-14 00:15 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2008-12-12 06:48 . 2008-12-12 06:48 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-12-12 06:48 . 2008-12-12 06:48 <DIR> d-------- c:\documents and settings\D@wid\SystemRequirementsLab 2008-12-11 22:20 . 2008-12-11 22:20 <DIR> d-------- c:\documents and settings\D@wid\Dane aplikacji\Leadertech 2008-12-11 15:22 . 2008-12-11 15:22 <DIR> d-------- c:\program files\ASUS 2008-12-11 15:22 . 2008-12-11 15:22 <DIR> d-------- c:\program files\AMD 2008-12-11 15:22 . 2004-02-27 00:00 962,612 --a------ c:\windows\system32\mfc42d.dll 2008-12-11 15:22 . 2004-02-17 00:00 434,252 --a------ c:\windows\system32\MSVCRTD.DLL 2008-12-11 15:22 . 2004-05-08 10:22 38,400 --a------ c:\windows\system32\drivers\AmdK8.sys 2008-12-11 15:22 . 2005-01-28 09:44 24,576 -ra------ c:\windows\system32\AsIO.dll 2008-12-11 15:22 . 2004-09-07 11:41 5,120 --a------ c:\windows\system32\drivers\AsInsHelp64.sys 2008-12-11 15:22 . 2004-10-14 10:52 4,962 -ra------ c:\windows\system32\drivers\AsIO.sys 2008-12-11 15:22 . 2004-03-10 14:31 3,328 --a------ c:\windows\system32\drivers\AsInsHelp32.sys 2008-12-11 15:21 . 2000-03-29 07:17 5,824 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS 2008-12-11 15:21 . 2008-12-11 15:21 3,869 --a------ c:\windows\Ascd_tmp.ini 2008-12-11 14:02 . 2008-12-11 14:02 <DIR> d-------- c:\program files\CCleaner 2008-12-09 14:17 . 2008-12-09 14:17 <DIR> d-------- c:\program files\K-Lite Codec Pack . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-05 14:53 --------- d-----w c:\program files\Gadu-Gadu 2009-01-05 07:55 --------- d-----w c:\documents and settings\D@wid\Dane aplikacji\uTorrent 2008-12-25 12:34 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-22 22:47 --------- d-----w c:\program files\BearShare 2008-12-21 19:44 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-21 17:30 --------- d-----w c:\program files\DC++ 2008-12-14 21:48 2,516 --sha-w c:\documents and settings\All Users\Dane aplikacji\KGyGaAvL.sys 2008-12-11 13:04 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-12-08 17:43 8 --sh--r c:\documents and settings\All Users\Dane aplikacji\86B8256ACB.sys 2008-12-08 17:43 --------- d-----w c:\documents and settings\D@wid\Dane aplikacji\Corel 2008-12-08 17:33 --------- d-----w c:\program files\Common Files\Protexis 2008-12-08 17:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Corel 2008-12-08 17:31 --------- d-----w c:\program files\Common Files\Corel 2008-12-08 17:28 --------- d-----w c:\program files\Corel 2008-12-08 17:24 --------- d-----w c:\documents and settings\D@wid\Dane aplikacji\InstallShield 2008-12-08 12:26 --------- d-----w c:\documents and settings\Mirek\Dane aplikacji\Gadu-Gadu 2008-12-19 21:26 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-19 21:26 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-19 21:26 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-19 21:26 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-19 21:26 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-30_16.07.36.89 ))))))))))))))))))))))))))))))))))))))))) . - 2008-12-11 20:58:52 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll + 2009-01-01 11:56:30 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll - 2008-12-11 20:58:52 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll + 2009-01-01 11:56:31 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll - 2008-12-11 20:58:52 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll + 2009-01-01 11:56:31 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll - 2008-12-11 20:58:46 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:21 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:47 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:23 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:47 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:24 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:48 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:25 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:48 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:25 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:49 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:26 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:49 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:27 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:50 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:28 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:50 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:28 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:53 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2009-01-01 11:56:31 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-12-11 20:58:53 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll + 2009-01-01 11:56:32 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll - 2008-12-11 20:58:53 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll + 2009-01-01 11:56:32 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll - 2008-12-11 20:58:54 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll + 2009-01-01 11:56:32 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll - 2008-12-11 20:58:54 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll + 2009-01-01 11:56:33 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll - 2008-12-11 20:58:51 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll + 2009-01-01 11:56:30 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll - 2008-12-29 15:00:09 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2009-01-08 10:48:46 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-12-29 15:00:09 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2009-01-08 10:48:46 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-12-29 15:00:09 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2009-01-08 10:48:46 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2009-01-09 21:44:52 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_59c.dat - 2008-12-30 15:05:11 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_744.dat + 2009-01-09 21:44:52 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_744.dat . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "aux"= ctwdm32.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "d:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"= "c:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe"= "c:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2003-01-11 111184] R3 qcusbmdm;Qualcomm Proprietary USB Driver (PID 3197);c:\windows\system32\drivers\qcusbmdm.sys [2008-12-25 59632] R3 qcusbser;Qualcomm Diagnostic Port 3197;c:\windows\system32\drivers\qcusbser.sys [2008-12-25 59632] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2003-01-11 20560] . Zawartość folderu 'Zaplanowane zadania' 2009-01-09 c:\windows\Tasks\egnqschu.job - c:\windows\system32\rundll32.exe [2008-04-14 22:51] 2009-01-09 c:\windows\Tasks\okiilkgw.job - c:\windows\system32\rundll32.exe [2008-04-14 22:51] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{273d7f34-6a7c-447b-88e8-ed5e29c2c98d} - c:\windows\system32\pulovuwi.dll HKLM-Run-CPMffea2606 - c:\windows\system32\puyekebi.dll HKLM-Run-vidilatuta - c:\windows\system32\lifakobe.dll MSConfigStartUp-CPMffea2606 - c:\windows\system32\puyekebi.dll MSConfigStartUp-vidilatuta - c:\windows\system32\lifakobe.dll . ------- Skan uzupełniający ------- . FF - ProfilePath - c:\documents and settings\D@wid\Dane aplikacji\Mozilla\Firefox\Profiles\es2q9t99.default\ FF - prefs.js: browser.startup.homepage - google.pl FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-09 22:45:15 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Protexis\License Service\PsiService_2.exe c:\windows\system32\wdfmgr.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\devldr32.exe c:\windows\system32\wscntfy.exe c:\program files\Mozilla Firefox\firefox.exe . ************************************************************************** . Czas ukończenia: 2009-01-09 22:48:46 - komputer został uruchomiony ponownie [D@wid] ComboFix-quarantined-files.txt 2009-01-09 21:47:28 Przed: 12,784,386,048 bajtów wolnych Po: 12,859,215,872 bajtów wolnych 317

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:55:16, on 2009-01-09 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 2483 bytes

The Avenger

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "c:\windows\system32\puyekebi.dll" deleted successfully. File "C:\WINDOWS\system32\luravufa.dll" deleted successfully. File "c:\windows\system32\domohodu.dll" deleted successfully. File "c:\windows\system32\nenusudu.dll" deleted successfully. File "C:\WINDOWS\system32\lifakobe.dll" deleted successfully. File "C:\WINDOWS\system32\pulovuwi.dll" deleted successfully. Completed script processing. ******************* Finished! Terminate.

Dziękówa PANOWIE :banan:

**Posty:** 8001 · przez **Okocza** 10 Sty 2009, 00:02

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka