proszę o sprawdzenie loga

**Posty:** 64 · przez **rafciooo** 22 Mar 2008, 20:41

Wywala mi non stop błędy w firefox'ie i jakis proces IExplore podejrzany ...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:40:36, on 2008-03-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\a-squared Anti-Malware\a2service.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe C:\WINDOWS\system32\lxddcoms.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe C:\Program Files\Lexmark 2500 Series\lxddamon.exe C:\WINDOWS\VMSnap23.exe C:\WINDOWS\Domino.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: (no name) - {39DEDAD1-AB87-4CFA-A8BC-14351FD1C272} - C:\WINDOWS\system32\apcup.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: adzgalore - {994B5FB4-0103-44A6-B6B3-C73572B362BC} - C:\WINDOWS\system32\nsk1891.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe" O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\bootskin.exe" /StartupJobs O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe" O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BigDogPath323VMSnap] C:\WINDOWS\VMSnap23.exe O4 - HKLM\..\Run: [BigDogPath323Domino] C:\WINDOWS\Domino.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PostSetupCheck] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\cpmsky.dll" DllStart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LOVE NEW] C:\DOCUME~1\a\DANEAP~1\VIEWNA~1\Ref fork grid.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: SymantecAntiBotAgent - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe -- End of file - 7418 bytes

**Posty:** 237 · przez **Kuba1** 22 Mar 2008, 22:12

Użyj No Lop

Uruchom Hijackthis>>Do a system scan>>Fix Checked

O2 - BHO: (no name) - {39DEDAD1-AB87-4CFA-A8BC-14351FD1C272} - C:\WINDOWS\system32\apcup.dll
O4 - HKLM\..\Run: [PostSetupCheck] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\cpmsky.dll" DllStart
O4 - HKCU\..\Run: [LOVE NEW] C:\DOCUME~1\a\DANEAP~1\VIEWNA~1\Ref fork grid.exe

Pobierz narzędzie SDFix

*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

Użyj i pokaż loga z ComboFix

To skanujesz na www.virustotal.com i wklejasz raporty.

C:\WINDOWS\system32\nsk1891.dll
C:\WINDOWS\VMSnap23.exe
C:\WINDOWS\Domino.exe

Wracasz z nowym logiem z Hijackthis, ComboFix, raport z SDFix oraz raporty ze skanowania.

**Posty:** 64 · przez **rafciooo** 23 Mar 2008, 13:16

Kod: Zaznacz wszystko: [b]SDFix: Version 1.160 [/b] Run by a on 2008-03-23 at 11:56 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-23 12:00:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Lexmark 2500 Series\\app4r.exe"="C:\\Program Files\\Lexmark 2500 Series\\App4R.exe:*:Enabled:Lexmark Imaging Studio" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 5 Mar 2008 4,909,064 ...H. --- "C:\Program Files\Picasa2\setup.exe" Sun 3 Feb 2008 195,072 A..H. --- "C:\Program Files\Intermedia Design\Helium 2007\UserDataRemove.exe" Sun 3 Feb 2008 824,832 A..H. --- "C:\Documents and Settings\All Users\Dane aplikacji\Data\LicenseManager2007.dll" Fri 22 Apr 2005 78,848 A..H. --- "C:\WINDOWS\Temp\PI11\PIP\launcher.exe" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-03-22.3 - a 2008-03-23 12:10:06.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.165 [GMT 1:00] Running from: C:\Documents and Settings\a\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . -- Other TimeOuts -- Findstr -MIF:/ sursen CF32566.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*" >progfile.dat" VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*" CF32566.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot" Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement" GREP -i "C:\\Program Files\\[^\\]*\\[^\\]*$" VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll" CF32566.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*" >progfile.dat" VFind.exe -ltf -s-1000000 -d+2007-12-23 "C:\Program Files\*" CF32566.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot" ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\nsk1891.dll . ((((((((((((((((((((((((( Files Created from 2008-02-23 to 2008-03-23 ))))))))))))))))))))))))))))))) . 2008-03-23 11:53 . 2008-03-23 11:53 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-23 11:53 . 2008-03-23 12:04 <DIR> d-------- C:\SDFix 2008-03-22 23:49 . 2008-03-22 23:50 <DIR> d-------- C:\Program Files\vghd 2008-03-22 23:49 . 2008-03-22 23:49 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\vghd 2008-03-22 18:49 . 2008-03-22 18:49 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-20 16:19 . 2008-03-20 16:19 <DIR> d-------- C:\Program Files\viewnamedefy 2008-03-20 16:19 . 2008-03-20 16:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bags Plus Online Chin 2008-03-20 16:19 . 2008-03-20 16:19 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\viewnamedefy 2008-03-20 16:17 . 2008-03-20 16:17 <DIR> d-------- C:\Program Files\Adzgalore Games Collection 2008-03-20 16:17 . 2008-03-20 16:17 84,761 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe 2008-03-20 16:17 . 2008-03-20 16:17 80,121 --a------ C:\WINDOWS\system32\adzgalore-remove.exe 2008-03-20 16:17 . 2008-03-20 16:17 40,713 --a------ C:\WINDOWS\system32\cpmsky-uninst.exe 2008-03-19 20:06 . 2004-08-03 23:10 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys 2008-03-19 10:22 . 2008-03-19 10:22 <DIR> d-------- C:\Program Files\Galaga - Destination Earth 2008-03-19 10:04 . 2008-03-19 10:04 <DIR> d-------- C:\WINDOWS\Sun 2008-03-19 10:03 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-19 10:02 . 2008-03-19 10:03 <DIR> d-------- C:\Program Files\Java 2008-03-19 10:02 . 2008-03-19 10:02 <DIR> d-------- C:\Program Files\Common Files\Java 2008-03-19 10:01 . 2008-03-19 10:01 <DIR> d-------- C:\Program Files\Onet 2008-03-19 10:01 . 2008-03-19 10:01 <DIR> d-------- C:\Program Files\Common Files\Onet.pl 2008-03-19 10:01 . 2008-03-19 10:01 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Kamerzysta 2008-03-19 10:01 . 2008-03-19 10:01 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Czat 2008-03-19 10:01 . 2008-03-19 10:01 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\AutoUpdate 2008-03-18 15:09 . 2004-08-03 23:10 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS 2008-03-18 15:09 . 2004-08-04 00:44 16,384 --a------ C:\WINDOWS\system32\ipsink.ax 2008-03-18 15:09 . 2004-08-03 23:10 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys 2008-03-18 15:09 . 2004-08-03 23:10 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys 2008-03-18 15:09 . 2004-08-03 23:10 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys 2008-03-18 15:08 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys 2008-03-18 15:07 . 2008-03-18 15:07 <DIR> d-------- C:\WINDOWS\EffectResources 2008-03-18 15:07 . 2004-08-04 00:44 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax 2008-03-18 15:07 . 2004-08-04 00:44 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax 2008-03-18 15:07 . 2004-08-04 00:44 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2008-03-18 15:06 . 2008-03-18 15:06 <DIR> d-------- C:\Program Files\Vimicro 2008-03-18 15:06 . 2008-03-18 15:06 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\InstallShield 2008-03-18 14:41 . 2008-03-18 14:41 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-03-18 14:41 . 2008-03-21 10:08 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Skype 2008-03-17 17:17 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-03-17 09:00 . 2008-03-17 09:00 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Pioneer 2008-03-17 08:59 . 2008-03-17 08:59 <DIR> d-------- C:\WINDOWS\system32\ipp20 2008-03-17 08:58 . 2008-03-17 08:58 <DIR> d-------- C:\Program Files\Pioneer 2008-03-16 19:03 . 2008-03-16 19:03 <DIR> d-------- C:\Program Files\Emapa 2008-03-16 19:01 . 2008-03-16 19:01 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\TransEngPol4 2008-03-16 13:59 . 2008-03-16 13:59 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\ArcSoft 2008-03-16 13:53 . 2008-03-16 13:53 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\CyberLink 2008-03-16 13:14 . 2008-03-16 13:14 <DIR> d-------- C:\Program Files\BWMeter 2008-03-16 13:14 . 2008-03-16 13:14 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\DeskSoft 2008-03-16 13:14 . 2008-03-16 13:14 16,896 --a------ C:\WINDOWS\system32\drivers\dsnpfd.sys 2008-03-16 13:13 . 2008-03-16 13:13 <DIR> d-------- C:\WINDOWS\MSSecurityNS 2008-03-16 13:13 . 2008-03-16 13:13 <DIR> d-------- C:\WINDOWS\MSSecurityNi 2008-03-16 13:11 . 2008-03-16 13:11 <DIR> d-------- C:\Program Files\SuperRam 2008-03-16 13:07 . 2008-03-22 18:28 <DIR> d-------- C:\Program Files\a-squared Anti-Malware 2008-03-16 13:06 . 2008-03-16 13:06 <DIR> d-------- C:\Program Files\Symantec 2008-03-16 13:06 . 2008-03-16 13:06 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Symantec 2008-03-16 13:05 . 2008-03-16 13:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2008-03-16 13:04 . 2008-03-16 13:05 <DIR> d-------- C:\Program Files\MemoriesOnTV4 2008-03-16 13:04 . 2006-10-02 12:38 10,368 --a------ C:\WINDOWS\system32\drivers\pfc.sys 2008-03-16 13:03 . 2008-03-16 13:03 <DIR> d-------- C:\Program Files\Pixarra 2008-03-16 13:03 . 2008-03-16 13:03 <DIR> d-------- C:\Program Files\Nufsoft 2008-03-16 13:02 . 2008-03-16 13:02 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Ashampoo Photo Commander 5 2008-03-16 13:01 . 2002-12-11 20:11 18,804 --a------ C:\WINDOWS\system32\WMPrfCHT.prx 2008-03-16 13:00 . 2008-03-16 13:01 <DIR> d-------- C:\Program Files\CyberLink 2008-03-16 13:00 . 2008-03-17 10:43 <DIR> d-------- C:\MyWorks 2008-03-16 13:00 . 2008-03-16 13:03 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-16 12:59 . 2008-03-16 12:59 <DIR> d-------- C:\Program Files\VideoReDoPlus 2008-03-16 12:59 . 2008-03-16 12:59 <DIR> d-------- C:\Program Files\ArcSoft 2008-03-16 12:59 . 2008-03-16 12:59 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\VideoReDoPlus 2008-03-16 12:58 . 2008-03-16 12:58 <DIR> d-------- C:\Program Files\Pearl Mountain Soft 2008-03-16 12:58 . 2008-03-16 12:58 <DIR> d-------- C:\Program Files\Common Files\Bcgsoft 2008-03-16 12:58 . 2002-01-29 15:55 21 --a------ C:\WINDOWS\FH_setup.ini 2008-03-16 12:57 . 2008-03-16 12:57 <DIR> d-------- C:\Program Files\Folder Marker 2008-03-16 12:57 . 2008-03-16 12:57 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\ArcticLine 2008-03-16 12:56 . 2008-03-16 12:56 <DIR> d-------- C:\Program Files\Natura Sound Therapy 2008-03-16 12:56 . 2008-03-16 12:56 456,137 --a------ C:\WINDOWS\Natura Sound Therapy Uninstaller.exe 2008-03-16 12:55 . 2008-03-16 12:55 <DIR> d-------- C:\Program Files\Batch Watermark Creator 2008-03-16 12:54 . 2008-03-16 12:54 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Zoner 2008-03-16 12:53 . 2008-03-16 12:53 <DIR> d-------- C:\Program Files\Zoner 2008-03-16 12:53 . 2008-03-23 12:07 <DIR> d-------- C:\Program Files\Media Resizer PRO 2008-03-16 12:53 . 2002-12-25 09:44 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-03-16 12:52 . 2008-03-16 12:52 <DIR> d-------- C:\WINDOWS\system32\ebay 2008-03-16 12:52 . 2008-03-16 13:01 <DIR> d-------- C:\Program Files\Ashampoo 2008-03-16 12:52 . 2008-03-16 12:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-03-16 12:51 . 2008-03-16 12:51 <DIR> d-------- C:\Program Files\Able Apples 2008-03-16 12:51 . 2008-03-16 12:51 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\MakeUpPilot 2008-03-16 12:50 . 2008-03-16 12:50 <DIR> d-------- C:\Program Files\MakeUp Pilot 2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\Program Files\LightZone 3 2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\Program Files\Common Files\eSellerate 2008-03-16 12:45 . 2008-03-16 12:45 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Nici 2008-03-16 12:44 . 2008-03-16 12:44 <DIR> d-------- C:\Program Files\Nici 2008-03-16 10:59 . 2008-03-16 11:59 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Winamp 2008-03-16 10:33 . 2008-03-16 10:33 <DIR> d-------- C:\Program Files\BeFaster 2008-03-16 10:33 . 2008-03-16 10:33 <DIR> dr------- C:\Program Files\Aston 2008-03-16 10:33 . 2008-03-16 10:43 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Aston 2008-03-16 10:31 . 2008-03-16 10:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bassic Technologies 2008-03-16 10:31 . 2008-03-16 10:31 <DIR> d-------- C:\Documents and Settings\a\Dane aplikacji\Bassic Technologies 2008-03-16 10:30 . 2008-03-16 10:30 <DIR> d-------- C:\Program Files\Bassic Technologies 2008-03-16 10:27 . 2008-03-16 10:27 <DIR> d-------- C:\Program Files\DFX 2008-03-16 10:27 . 2008-03-16 10:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DFX 2008-03-16 10:26 . 2008-03-16 10:26 <DIR> d-------- C:\Program Files\Software Remove Master 2008-03-16 10:26 . 2008-03-16 10:26 <DIR> d-------- C:\Program Files\Atomic Alarm Clock . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-16 11:58 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-03-04 19:36 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-03-04 19:36 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-02-28 22:53 --------- d-----w C:\Program Files\VDOTool 2008-02-28 22:26 155,995 ----a-w C:\WINDOWS\java\Packages\9JJBHRZ5.ZIP 2008-02-28 22:24 --------- d-----w C:\Program Files\Lavasoft 2008-02-28 22:16 --------- d-----w C:\Program Files\microsoft frontpage 2008-02-28 22:15 --------- d-----w C:\Program Files\Usługi online . ------- Sigcheck ------- 2001-10-26 18:30 12800 b3c95bfeef6781a82a1c429f466a3a11 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\ServicePackFiles\i386\svchost.exe 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\svchost.exe 2002-09-20 18:04 561664 3a4892a57cfe05d61e4bbc3ec3e24a63 C:\WINDOWS\$NtServicePackUninstall$\user32.dll 2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\ServicePackFiles\i386\user32.dll 2004-08-04 00:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\system32\user32.dll 2001-10-26 18:29 75264 9b7d1c56cc12d806314b853bf52ecb4c C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll 2002-09-20 18:05 601600 4965c02574610e9b2d1e18d63d11a772 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll 2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\ServicePackFiles\i386\wininet.dll 2004-08-04 00:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\system32\wininet.dll 2002-08-29 01:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys 2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys 2002-09-20 18:05 519168 8b6e6bb5d451f8bbc0621203b687d993 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\winlogon.exe 2002-08-29 02:09 167552 3b350e5a2a5e951453f3993275a4523a C:\WINDOWS\$NtServicePackUninstall$\ndis.sys 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\ServicePackFiles\i386\ndis.sys 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\ServicePackFiles\i386\ip6fw.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys 2002-09-20 17:12 1949184 79d262478c985e736deb38ce2224fc75 C:\WINDOWS\$NtServicePackUninstall$\ntkrnlpa.exe 2004-08-04 00:38 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe 2004-08-04 00:38 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\system32\ntkrnlpa.exe 2002-09-20 17:12 2043520 ae94ae0da6ed874ce08912fc63f8c6c2 C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe 2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe 2004-08-04 00:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\system32\ntoskrnl.exe 2004-08-04 00:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\explorer.exe 2002-09-20 18:05 1005568 f4af85d918e83d71341fce2aa5318181 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-08-04 00:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\ServicePackFiles\i386\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "LOVE NEW"="C:\DOCUME~1\a\DANEAP~1\VIEWNA~1\Ref fork grid.exe" [2008-03-20 16:19 457728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 18:07 8491008] "nwiz"="nwiz.exe" [2007-09-16 18:07 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-16 18:07 81920] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2006-04-05 18:19 122880] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-05-04 07:38 291760] "lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-03-05 08:40 20480] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-05-04 07:40 312240] "BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\bootskin.exe" [2004-04-26 16:21 270336] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44 159744] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 C:\PROGRA~1\COMMON~1\stardock\MCPStub.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^SnagIt 8.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\SnagIt 8.lnk backup=C:\WINDOWS\pss\SnagIt 8.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^a^Menu Start^Programy^Autostart^VirtuaGirl HD.LNK] path=C:\Documents and Settings\a\Menu Start\Programy\Autostart\VirtuaGirl HD.LNK backup=C:\WINDOWS\pss\VirtuaGirl HD.LNKStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-squared] --a------ 2008-03-16 13:13 1959056 C:\Program Files\a-squared Anti-Malware\a2guard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323Domino] --a------ 2007-01-09 12:56 49152 C:\WINDOWS\Domino.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323VMSnap] --a------ 2007-01-09 12:57 212992 C:\WINDOWS\VMSnap23.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] --a------ 2006-05-24 05:20 17920 C:\WINDOWS\CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp] --a------ 2006-05-24 05:20 18944 C:\WINDOWS\system32\CTXFIHLP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward] --a------ 2007-11-01 13:25 2165272 C:\Program Files\VDOTool\TBPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NortonAntiBot] -ra------ 2007-06-29 20:40 1727000 C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-03-04 20:55 1266936 c:\program files\valve\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] --a------ 2006-05-24 19:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperRam] --a------ 2008-03-16 13:11 1636824 C:\Program Files\SuperRam\SuperRam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"= R1 sdpiosys;sdpiosys;C:\WINDOWS\system32\drivers\sdpiosys.sys [2004-11-30 12:10] R2 lxdd_device;lxdd_device;C:\WINDOWS\system32\lxddcoms.exe [2007-04-26 06:21] R2 lxddCATSCustConnectService;lxddCATSCustConnectService;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe [2007-04-26 06:21] R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-05-24 04:40] R3 vmfilter323;323 filter service, Normal;C:\WINDOWS\system32\drivers\vmfilter323.sys [2006-08-08 11:25] R3 ZSMC326;Vimicro USB2.0 PC Camera(VC0323);C:\WINDOWS\system32\Drivers\usbvm323.sys [2007-04-03 16:22] S3 dsnpfd;DeskSoft Service;C:\WINDOWS\system32\DRIVERS\dsnpfd.sys [2008-03-16 13:14] . Contents of the 'Scheduled Tasks' folder "2008-03-20 15:19:48 C:\WINDOWS\Tasks\AC5550669B1AC8F2.job" - c:\docume~1\a\daneap~1\viewna~1\Web ante tool.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-23 12:13:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-23 12:14:13 ComboFix-quarantined-files.txt 2008-03-23 11:13:58

**Posty:** 18165 · przez **wojtas** 23 Mar 2008, 13:24

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
C:\WINDOWS\system32\adzgalore-remove.exe
C:\WINDOWS\system32\cpmsky-uninst.exe
C:\WINDOWS\Tasks\AC5550669B1AC8F2.job

Folder::
C:\Program Files\viewnamedefy
C:\Documents and Settings\All Users\Dane aplikacji\Bags Plus
C:\Documents and Settings\a\Dane aplikacji\viewnamedefy
C:\Program Files\Adzgalore Games Collection

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LOVE NEW"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz

Kuba1 napisał(a):Wracasz z nowym logiem z Hijackthis, oraz raporty ze skanowania.

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum