Wirus heur.w32 i heur.win32

**Posty:** 5 · przez **dmw** 09 Sty 2009, 23:24

Witam!

Mam problem z wirusem heur.w32 (wykrył mi go arcavir). niby nic groźnego się nie dzieje, ale od czasu do czasu zwiesi się przeglądarka no i nie działa mi bardzo ważny dla mnie program! (ostatnio właśnie w nim został znaleziony w/w wirus). program niby instaluje się bez problemów, ale jak chcę go uruchomić wyskakuje komunikat, że nastąpił błąd i program zostanie zamknięty (to ma chyba coś wspólnego z rozszerzeniem .exe) jestem laikiem w sprawie komputerów itp, proszę o wyrozumiałość i cierpliwość:)

poniżej zamieszczam loga z programu HijachThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:11:24, on 2009-01-09 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\ARCABIT\ARCAUP~1\update.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\ArcaBit\ArcaVir\arcavir.exe C:\Documents and Settings\user\Pulpit\HiJackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pg.gda.pl/architektura/?jezyk=pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://hp.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HPWS myPrintMileage Agent] C:\Program Files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O9 - Extra button: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra 'Tools' menuitem: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\PROGRA~1\ARCABIT\ARCAUP~1\update.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - C:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe -- End of file - 8023 bytes

z góry dziękuje za pomoc!
pozdrawiam

**Posty:** 8001 · przez **Okocza** 09 Sty 2009, 23:45

dmw, wstaw log z hijack i combofix.

**Posty:** 5 · przez **dmw** 10 Sty 2009, 13:18

Okocza, dzieki za odpowiedz:)

poniżej log z combofixa

Kod: Zaznacz wszystko: ComboFix 09-01-09.03 - user 2009-01-10 12:07:56.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1015.441 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NVMINI ((((((((((((((((((((((((( Pliki utworzone od 2008-12-10 do 2009-01-10 ))))))))))))))))))))))))))))))) . 2009-01-10 12:04 . 2009-01-09 01:10 <DIR> d-------- C:\32788R22FWJFW 2009-01-10 12:03 . 2009-01-09 01:10 <DIR> d-------- C:\32788R22FWJFW.0.tmp 2009-01-09 18:43 . 2009-01-09 18:43 <DIR> d--hs---- c:\documents and settings\user\UserData 2009-01-05 11:38 . 2009-01-05 11:38 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2009-01-05 11:38 . 2009-01-05 11:38 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-01-05 11:21 . 2009-01-05 11:21 <DIR> d-------- c:\program files\Trend Micro 2009-01-05 10:34 . 2009-01-05 10:34 0 --a------ c:\windows\nsreg.dat 2009-01-05 10:26 . 2009-01-05 10:26 <DIR> d--hs---- C:\FOUND.002 2009-01-05 09:20 . 2009-01-05 09:20 <DIR> d--hs---- C:\FOUND.001 2008-12-18 16:15 . 2008-12-18 16:15 <DIR> d-------- c:\windows\system32\pl 2008-12-18 16:15 . 2008-12-18 16:15 <DIR> d-------- c:\windows\system32\bits 2008-12-18 16:15 . 2008-12-18 16:15 <DIR> d-------- c:\windows\l2schemas 2008-12-18 15:13 . 2008-12-18 15:13 <DIR> d-------- C:\337cf6188c24c9d1e35dc3ef 2008-12-18 15:07 . 2008-04-14 18:20 4,874,240 --------- c:\windows\system32\dllcache\wmp.dll 2008-12-18 15:07 . 2008-04-14 18:20 1,306,624 --------- c:\windows\system32\dllcache\msxml6.dll 2008-12-18 15:07 . 2008-04-14 18:20 712,704 --------- c:\windows\system32\windowscodecs.dll 2008-12-18 15:07 . 2008-04-14 18:20 651,264 --------- c:\windows\system32\dot3ui.dll 2008-12-18 15:07 . 2007-06-26 07:00 572,557 --------- c:\windows\system32\dllcache\rtuner.wmv 2008-12-18 15:07 . 2007-06-26 07:00 457,607 --------- c:\windows\system32\dllcache\mdlib.wmv 2008-12-18 15:07 . 2007-06-26 07:00 375,519 --------- c:\windows\system32\dllcache\nuskin.wmv 2008-12-18 15:07 . 2008-04-14 18:20 346,112 --------- c:\windows\system32\windowscodecsext.dll 2008-12-18 15:07 . 2007-06-26 07:00 300,969 --------- c:\windows\system32\dllcache\viz.wmv 2008-12-18 15:05 . 2008-04-14 17:15 2,977,792 --------- c:\windows\system32\dllcache\wmploc.dll 2008-12-18 14:46 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys 2008-12-18 14:46 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\dllcache\bthport.sys 2008-12-18 14:46 . 2008-08-14 11:04 138,496 --------- c:\windows\system32\dllcache\afd.sys 2008-12-18 14:44 . 2008-08-14 14:26 2,190,464 --------- c:\windows\system32\dllcache\ntoskrnl.exe 2008-12-18 14:44 . 2008-08-14 14:26 2,146,816 --------- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-12-18 14:44 . 2008-08-14 14:26 2,067,328 --------- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-12-18 14:44 . 2008-08-14 14:26 2,025,472 --------- c:\windows\system32\dllcache\ntkrpamp.exe 2008-12-18 14:44 . 2008-09-15 16:27 1,846,656 --------- c:\windows\system32\dllcache\win32k.sys 2008-12-18 14:44 . 2008-04-11 20:06 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll 2008-12-18 14:44 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-12-18 14:44 . 2008-05-01 15:37 331,776 --------- c:\windows\system32\dllcache\msadce.dll 2008-12-18 14:44 . 2008-05-08 15:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys 2008-12-18 14:43 . 2008-10-15 17:36 337,408 --------- c:\windows\system32\dllcache\netapi32.dll 2008-12-14 17:36 . 2008-12-14 17:36 <DIR> d-------- c:\windows\system32\DRVSTORE 2008-12-14 17:36 . 2008-12-14 17:36 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Raxco 2008-12-14 17:36 . 2008-01-09 22:00 68,624 -ra------ c:\windows\system32\drivers\DefragFS.sys 2008-12-14 17:35 . 2008-12-14 17:35 <DIR> d-------- c:\program files\Raxco 2008-12-14 17:18 . 2008-12-14 17:18 <DIR> d-------- c:\program files\PowerQuest 2008-12-14 17:15 . 2008-01-21 17:43 13,576 --a------ c:\windows\system32\wnaspi32.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-22 10:40 90,112 ----a-w c:\windows\DUMP2376.tmp 2008-12-18 16:08 90,112 ----a-w c:\windows\DUMP2f0e.tmp 2008-12-18 16:07 90,112 ----a-w c:\windows\DUMP2270.tmp 2008-12-18 16:02 90,112 ----a-w c:\windows\DUMP2260.tmp 2008-12-18 16:01 90,112 ----a-w c:\windows\DUMP33a2.tmp 2008-12-18 16:00 90,112 ----a-w c:\windows\DUMP1f20.tmp 2008-12-18 15:59 90,112 ----a-w c:\windows\DUMP227e.tmp 2008-12-18 15:57 90,112 ----a-w c:\windows\DUMP22ac.tmp 2008-12-18 15:57 90,112 ----a-w c:\windows\DUMP225f.tmp 2008-12-18 15:55 90,112 ----a-w c:\windows\DUMP226f.tmp 2008-12-18 15:53 90,112 ----a-w c:\windows\DUMP227d.tmp 2008-12-18 15:52 90,112 ----a-w c:\windows\DUMP226e.tmp 2008-12-18 15:51 90,112 ----a-w c:\windows\DUMP225e.tmp 2008-12-18 15:49 90,112 ----a-w c:\windows\DUMP22f9.tmp 2008-12-18 15:48 90,112 ----a-w c:\windows\DUMP227c.tmp 2008-12-18 15:47 90,112 ----a-w c:\windows\DUMP226d.tmp 2008-12-18 15:42 90,112 ----a-w c:\windows\DUMP226c.tmp 2008-12-18 15:41 90,112 ----a-w c:\windows\DUMP3393.tmp 2008-12-18 15:40 90,112 ----a-w c:\windows\DUMP228c.tmp 2008-12-18 15:34 90,112 ----a-w c:\windows\DUMP22ab.tmp 2008-12-18 15:33 90,112 ----a-w c:\windows\DUMP33b2.tmp 2008-12-18 15:32 90,112 ----a-w c:\windows\DUMP228b.tmp 2008-12-18 15:31 90,112 ----a-w c:\windows\DUMP2318.tmp 2008-12-18 15:29 90,112 ----a-w c:\windows\DUMP225d.tmp 2008-12-18 15:28 90,112 ----a-w c:\windows\DUMP223d.tmp 2008-12-18 15:27 90,112 ----a-w c:\windows\DUMP225c.tmp 2008-12-18 14:56 90,112 ----a-w c:\windows\DUMP2308.tmp 2008-12-18 14:37 90,112 ----a-w c:\windows\DUMP57e4.tmp 2008-12-13 06:39 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll 2008-12-04 20:49 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-11-14 23:00 --------- d-----w c:\documents and settings\user\Dane aplikacji\Apple Computer 2008-11-12 09:50 --------- d-----w c:\program files\AnswerWorks 4.0 2008-11-12 09:45 --------- d-----w c:\program files\AutoCAD 2005 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-23 12:42 286,720 ------w c:\windows\system32\dllcache\gdi32.dll 2008-10-16 13:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe 2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll 2004-10-01 14:00 40,960 ----a-w c:\program files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-09-13 22880040] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] "DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-21 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "HPWS myPrintMileage Agent"="c:\program files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe" [2004-10-31 102400] "AvMenu"="c:\program files\ArcaBit\ArcaVir\AVMenu.exe" [2008-11-12 514568] "ABRegmon"="c:\program files\ArcaBit\ArcaVir\ABregmon.exe" [2007-10-23 348160] "ArcaCheck"="c:\program files\ArcaBit\ArcaVir\ArcaCheck.exe" [2008-09-27 630784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-09 108544] HP Photosmart Premier - Szybkie uruchomienie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728] Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2004-02-25 10872] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "SENTINEL"= snti386.dll "msacm.l3codecp"= l3codecp.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\[u]0[/u]autocheck autochk * [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\GG.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 ABTDI;ABTDI;c:\program files\ArcaBit\ArcaVir\ABTDI.sys [2007-05-08 51208] R3 ABFLT;ArcaBit File Monitor Driver;c:\progra~1\ARCABIT\ARCAVIR\ABFLT.sys [2007-12-10 37896] R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;c:\program files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe [2008-01-30 200704] R4 ABFileMon;ArcaBit FileMonitor;c:\program files\ArcaBit\ArcaVir\FileMonSV.exe [2007-11-02 158216] R4 ArcaBit.TaskScheduler;ArcaBit.TaskScheduler;c:\program files\ArcaBit\Common\taskscheduler.exe [2007-10-25 151552] R4 AVUpdate;ArcaBit Update Service;c:\progra~1\ARCABIT\ARCAUP~1\update.exe [2008-01-22 117256] R4 PD91Agent;PD91Agent;c:\program files\Raxco\PerfectDisk2008\PD91Agent.exe [2008-01-16 664840] S3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;c:\program files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe [2008-01-30 241664] S3 PD91Engine;PD91Engine;c:\program files\Raxco\PerfectDisk2008\PD91Engine.exe [2008-01-16 894216] --- Other Services/Drivers In Memory --- *NewlyCreated* - NVMINI *Deregistered* - nvmini [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64759a2c-8317-11dc-bdf6-0008028d5238}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c16a5b5e-c990-11dc-be5a-0008028d5238}] \Shell\AutoRun\command - F:\xn1i9x.com \Shell\explore\Command - F:\xn1i9x.com \Shell\open\Command - F:\xn1i9x.com . Zawartość folderu 'Zaplanowane zadania' 2009-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.pg.gda.pl/architektura/?jezyk=pl uInternet Connection Wizard,ShellNext = hxxp://hp.com/ IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - c:\program files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\46vd42nh.default\ FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-10 12:11:41 Windows 5.1.2600 Dodatek Service Pack 3 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini] "ImagePath"="system32\DRIVERS\nvmini.sys" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\ARCABIT\ARCAUPDATE\UPDATE.EXE c:\program files\JAVA\JRE6\BIN\JQS.EXE c:\program files\ANALOG DEVICES\SOUNDMAX\SMAGENT.EXE c:\program files\COMMON FILES\YDP\USERACCESSMANAGER\USERACCESS.EXE c:\program files\ARCABIT\ARCAVIR\NETMONSV.EXE c:\windows\SYSTEM32\WSCNTFY.EXE c:\program files\HP\DIGITAL IMAGING\BIN\HPQIMZONE.EXE c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\SYSTEM32\WBEM\WMIAPSRV.EXE . ************************************************************************** . Czas ukończenia: 2009-01-10 12:14:03 - komputer został uruchomiony ponownie [user] ComboFix2.txt 2009-01-05 09:55:36 ComboFix-quarantined-files.txt 2009-01-10 11:13:58 Przed: 5,183,881,216 bajtów wolnych Po: 5,275,549,696 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe 220 --- E O F --- 2008-12-18 15:22:12

a tutaj jeszcze raz z hijacka (zrobiony jeszcze zaraz po tym z combofixa)

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:17:04, on 2009-01-10 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\PROGRA~1\ARCABIT\ARCAUP~1\update.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\ArcaBit\ArcaVir\abregmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\user\Pulpit\HiJackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pg.gda.pl/architektura/?jezyk=pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://hp.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HPWS myPrintMileage Agent] C:\Program Files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O9 - Extra button: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra 'Tools' menuitem: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\PROGRA~1\ARCABIT\ARCAUP~1\update.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - C:\PROGRAM FILES\COMMON FILES\YDP\USERACCESSMANAGER\useraccess.exe -- End of file - 8017 bytes

czy o to chodzilo?
pozdrawiam

**Posty:** 18165 · przez **wojtas** 10 Sty 2009, 19:09

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c16a5b5e-c990-11dc-be5a-0008028d5238}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 5 · przez **dmw** 10 Sty 2009, 19:53

ooo...dzięki Wojtas:) już zabieram się do pracy:) rozumiem, ze C:\Qoobox mam skasować jak OTMovelt skończy pracę, tak?

Dodano Dzisiaj, 18:54:
aaa...jeszcze jedno...jak mam dodać ten plik 'do rejestru' ?

Dodano Dzisiaj, 18:57:
już dodałam....(przepraszam, to było proste...Twoje instrukcje są bardzo czytelne)

Dodano Dzisiaj, 21:28:
hm...ufam, że wszystko się udało...poniżej

raport z kaspersky'ego

Nazwa pliku Nazwa zagrożenia Liczba zagrożeń
C:\Documents and Settings\user\Moje dokumenty\kodeki+best player\bestplayer1.0.exe Zainfekowany: Virus.Win32.Alman.b 1
C:\Documents and Settings\user\Moje dokumenty\V_MATH\VMath.exe Zainfekowany: Virus.Win32.Alman.b 1

oraz z FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.7261 * * * ******************************************************************************** Created at 21:16:20 on Saturday, January 10, 2009 Time Zone : Logged On User : user Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 2.00GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : SYSTEM System Drive Size : 16.07 GB System Drive Free : 5.01 GB Total Physical Memory: 1015 MB Free Physical Memory : 516 MB Total Page File : 1015 MB Free Page File : 1284 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1972 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

i jak to wygląda?

**Posty:** 18165 · przez **wojtas** 11 Sty 2009, 14:40

powinnno byc ok

**Posty:** 5 · przez **dmw** 11 Sty 2009, 16:35

dzięki dzięki baaaaaardzo za pomoc :* jak to miło, że są dobrzy ludzie na świecie;)

(rozumiem, że tym co wyskoczyło w Kaspersky'm nie powinnam się przejmować,bo już zostało naprawione) aa....a czy to, że teraz mój ArcVir nie włącza się przy odpaleniu systemu to coś znaczy? (czy go gdzieś nieświadomie wyłączyłam....teoretycznie jak optymalizowałam windowsa to go nigdzie nie wyłączałam...)

serdeczności!

**Posty:** 18165 · przez **wojtas** 11 Sty 2009, 21:06

przeinstaluj go i powinno byc ok

tak bedzie najszybciej i najlepiej

**Posty:** 5 · przez **dmw** 11 Sty 2009, 22:07

oki! jeszcze raz dzięki dzięki