złapałerm jakiegoś wirusa! zniana tapey na jakiś napishelp!

**Posty:** 117 · przez **mysia117** 16 Gru 2007, 17:29

od woczraj moja taopeta zmieniła sie na czqarne tło z jakims napisem o ip:
http://img507.imageshack.us/img507/1939/sdfgsdfgsdfgsdfgsdfgsdfau7.png
oprócz tego niemoge włączyć menadżera zadań po przez alt cntr delete a z pasku menu start cały czas wyskakują jakies komunikaty i gdy na nie klikam wyświetlają sie jakies strony. a strona startowa zmieniła sie o jakąś o adresie MSN.com

bardzo proszę o pomoc! jestem zielony w tycjh sprawach więc proszę o bardzo dokładne i szczegółowe porady

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 18:05

Wykonaj to co jest podane w tym temacie

daj loga z hijack this wg. opisu:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html oraz z combofixa . logi musza byc w tagach o ktorych dowiesz sie czytajac pierwszy link

**Posty:** 117 · przez **mysia117** 16 Gru 2007, 20:47

Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1 Scan saved at 19:42:19, on 2007-12-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\Quic Time\qttask.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\BearShare\BearShare.exe D:\Daemon tools\daemon.exe D:\Spyware Doctor\SDTrayApp.exe D:\Tlen.pl\tlen.exe C:\WINDOWS\system32\ctfmon.exe D:\Gadu-Gadu\gg.exe D:\a-squared Anti-Malware\a2service.exe D:\ad adware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe D:\Spyware Doctor\svcntaux.exe D:\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Documents and Settings\Mackiewicz\Menu Start\Programy\Autostart\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe D:\HijackThis\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\userinit.exe O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file) O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file) O2 - BHO: IE7pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file) O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file) O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file) O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file) O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file) O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: egmulhxk.msdn_hlp - {477840F3-BA52-44D9-8E41-38D61CAA010F} - C:\WINDOWS\system32\egmulhxk.dll O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file) O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file) O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file) O2 - BHO: Microsoft copyright - {5DF6AFEE-2291-4041-9A74-354624861746} - judgemq.dll (file missing) O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file) O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file) O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file) O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file) O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file) O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file) O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file) O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file) O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file) O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file) O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file) O2 - BHO: dc_ie_monitor.ie_monitor - {DA517E05-A1DD-4CB8-801B-9B630F9122D2} - C:\Program Files\DioCleaner\dc_ie_monitor.dll (file missing) O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file) O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file) O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll O3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file) O4 - HKLM\..\Run: [QuickTime Task] "D:\Quic Time\qttask.exe" -atboottime O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [BearShare] "D:\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S O4 - HKLM\..\Run: [DioCleaner] C:\Program Files\DioCleaner\DioCleaner.exe O4 - HKLM\..\Run: [a-squared] "D:\a-squared Anti-Malware\a2guard.exe" O4 - HKLM\..\Run: [SDTray] "D:\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Dzieńdobry!] D:\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Komunikator] D:\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] D:\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Startup Manager] "D:\Advanced System Optimizer\startUp manager.exe" O4 - HKCU\..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe O4 - Startup: Eurobarre.lnk = ? O4 - Startup: ctfmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\MS office XP\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\OPENOF~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165953595953 O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: Explorer - C:\WINDOWS\system32\gp4ml3h11.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\a-squared Anti-Malware\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\ad adware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing)

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 21:03

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 117 · przez **mysia117** 16 Gru 2007, 22:58

rozpakowałem ten sdfix, ścuągnełemm i uruchomiłem ten porgram

smitfraudfix wyświetliiła się jakieś niebieskie okno po czym je zamknołem. lecz nie udało mi się włączyć komputera w trybie awaryjny kilkałem f8 przez cały czas trwania włączania kompa i sie nie udało próbowałem tez stukac f5 oraz f4 ale też to nic nie dalo, może ten wirus zablokował dostęp do trybu awar.? jest jakiśinny sposób aby włączyć awaryjny?

Ps nie bardzo rozumiem tego zdania: Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka jak możesz napisz dokładniej o co ci chodziiło.

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 23:00

to daj loga z combofixa (sciagnij i odpal i czekaj na loga) oraz nowego z hijack this

**Posty:** 117 · przez **mysia117** 17 Gru 2007, 18:24

Kod: Zaznacz wszystko
ComboFix 07-12-17.1 - Mackiewicz 2007-12-17 16:57:00.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.147 [GMT 1:00] Running from: C:\Documents and Settings\Mackiewicz\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\Program Files\3721 C:\Program Files\3721\assist\asbar.dll C:\Program Files\3721\helper.dll C:\Program Files\Accoona C:\Program Files\Accoona\ASearchAssist.dll C:\Program Files\akl C:\Program Files\akl\akl.dll C:\Program Files\akl\akl.exe C:\Program Files\akl\curlog.htm C:\Program Files\akl\keylog.txt C:\Program Files\akl\readme.txt C:\Program Files\akl\uninstall.exe C:\Program Files\akl\unsetup.dat C:\Program Files\akl\unsetup.exe C:\Program Files\amsys C:\Program Files\amsys\awmsg.dat C:\Program Files\amsys\guid.dat C:\Program Files\amsys\ijl15.dll C:\Program Files\amsys\mfc42.dll C:\Program Files\amsys\msvcrt.dll C:\Program Files\amsys\unins000.dat C:\Program Files\amsys\unis000.exe C:\Program Files\amsys\winam.dat C:\Program Files\Common Files\{43B41~1 C:\Program Files\DioCleaner C:\Program Files\DioCleaner\config.dat C:\Program Files\DioCleaner\filesbase.bin C:\Program Files\DioCleaner\global_virus_table.bin C:\Program Files\DioCleaner\ignoredomainsbase.bin C:\Program Files\DioCleaner\ignorefilesbase.bin C:\Program Files\DioCleaner\ignoreregsbase.bin C:\Program Files\DioCleaner\regbase.bin C:\Program Files\DioCleaner\stat.bin C:\Program Files\DioCleaner\uninstall.exe C:\Program Files\DioCleaner\uninstall.log C:\Program Files\DioCleaner\urlbase.bin C:\Program Files\e-zshopper C:\Program Files\e-zshopper\BarLcher.dll C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\p2pnetworks C:\Program Files\p2pnetworks\amp2pl.exe C:\Program Files\printview C:\Program Files\printview\chnlist.dat C:\Program Files\printview\hotlist.dat C:\Program Files\printview\remlist.dat C:\WINDOWS\764.exe C:\WINDOWS\7search.dll C:\WINDOWS\absolute key logger.lnk C:\WINDOWS\aconti.exe C:\WINDOWS\aconti.ini C:\WINDOWS\aconti.log C:\WINDOWS\aconti.sdb C:\WINDOWS\acontidialer.txt C:\WINDOWS\adbar.dll C:\WINDOWS\cbinst$.exe C:\WINDOWS\daxtime.dll C:\WINDOWS\default.htm C:\WINDOWS\dp0.dll C:\WINDOWS\eventlowg.dll C:\WINDOWS\fhfmm-Uninstaller.exe C:\WINDOWS\fhfmm.exe C:\WINDOWS\flt.dll C:\WINDOWS\g32.txt C:\WINDOWS\hcwprn.exe C:\WINDOWS\hotporn.exe C:\WINDOWS\ie_32.exe C:\WINDOWS\iexplorr23.dll C:\WINDOWS\jd2002.dll C:\WINDOWS\kkcomp$.exe C:\WINDOWS\kkcomp.dll C:\WINDOWS\kkcomp.exe C:\WINDOWS\kvnab$.exe C:\WINDOWS\kvnab.dll C:\WINDOWS\kvnab.exe C:\WINDOWS\liqad$.exe C:\WINDOWS\liqad.dll C:\WINDOWS\liqad.exe C:\WINDOWS\liqui-Uninstaller.exe C:\WINDOWS\liqui.dll C:\WINDOWS\liqui.exe C:\WINDOWS\ngd.dll C:\WINDOWS\pbar.dll C:\WINDOWS\pbsysie.dll C:\WINDOWS\settn.dll C:\WINDOWS\spredirect.dll C:\WINDOWS\system32\ace16win.dll C:\WINDOWS\system32\acespy C:\WINDOWS\system32\acespy\__acelog.ndx C:\WINDOWS\system32\acespy\systune.exe C:\WINDOWS\system32\dpqaqlqx.bin C:\WINDOWS\system32\drivers\blank.gif C:\WINDOWS\system32\drivers\box_2.gif C:\WINDOWS\system32\drivers\button_buynow.gif C:\WINDOWS\system32\drivers\button_freescan.gif C:\WINDOWS\system32\drivers\cell_bg.gif C:\WINDOWS\system32\drivers\cell_footer.gif C:\WINDOWS\system32\drivers\cell_header_block.gif C:\WINDOWS\system32\drivers\cell_header_remove.gif C:\WINDOWS\system32\drivers\cell_header_scan.gif C:\WINDOWS\system32\drivers\download_btn.jpg C:\WINDOWS\system32\drivers\download_now_btn.gif C:\WINDOWS\system32\drivers\footer_back.jpg C:\WINDOWS\system32\drivers\header_1.gif C:\WINDOWS\system32\drivers\header_2.gif C:\WINDOWS\system32\drivers\header_3.gif C:\WINDOWS\system32\drivers\header_4.gif C:\WINDOWS\system32\drivers\header_red_bg.gif C:\WINDOWS\system32\drivers\header_red_free_scan.gif C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif C:\WINDOWS\system32\drivers\infected.gif C:\WINDOWS\system32\drivers\main_back.gif C:\WINDOWS\system32\drivers\product_2_header.gif C:\WINDOWS\system32\drivers\product_2_name_small.gif C:\WINDOWS\system32\drivers\product_features.gif C:\WINDOWS\system32\drivers\rating.gif C:\WINDOWS\system32\drivers\screenshot.jpg C:\WINDOWS\system32\drivers\sep_hor.gif C:\WINDOWS\system32\drivers\sep_vert.gif C:\WINDOWS\system32\drivers\shadow.jpg C:\WINDOWS\system32\drivers\shadow_bg.gif C:\WINDOWS\system32\drivers\spacer.gif C:\WINDOWS\system32\drivers\star.gif C:\WINDOWS\system32\drivers\star_gray.gif C:\WINDOWS\system32\drivers\star_gray_small.gif C:\WINDOWS\system32\drivers\star_small.gif C:\WINDOWS\system32\drivers\style.css C:\WINDOWS\system32\drivers\v.gif C:\WINDOWS\system32\drivers\warning_icon.gif C:\WINDOWS\system32\drivers\win_logo.gif C:\WINDOWS\system32\drivers\x.gif C:\WINDOWS\system32\egmulhxk.dll C:\WINDOWS\system32\ESHOPEE.exe C:\WINDOWS\system32\guard.tmp C:\WINDOWS\system32\lpcywinp.exe C:\WINDOWS\system32\msole32.exe C:\WINDOWS\system32\stfv.bin C:\WINDOWS\system32\sznf.ascii C:\WINDOWS\system32\vxddsk.exe C:\WINDOWS\system32\wml.exe C:\WINDOWS\vxddsk.exe C:\WINDOWS\wbeCheck.exe C:\WINDOWS\wbeInst$.exe C:\WINDOWS\wml.exe C:\WINDOWS\xadbrk.dll C:\WINDOWS\xadbrk.exe C:\WINDOWS\xadbrk_.exe C:\WINDOWS\xxxvideo.exe D:\Autorun.inf E:\Autorun.inf F:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-11-17 to 2007-12-17 ))))))))))))))))))))))))))))))) . 2007-12-17 17:02 . 2007-12-17 17:02 123 -r-hs---- C:\autorun.inf 2007-12-17 14:11 . 2007-12-17 14:11 <DIR> d--hs---- C:\FOUND.005 2007-12-16 21:29 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-16 21:29 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-16 21:29 . 2007-12-13 19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-16 21:29 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-16 21:29 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-16 21:29 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-16 19:18 . 2007-12-16 19:18 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-12-16 15:35 . 2007-12-16 15:35 <DIR> d-------- C:\Documents and Settings\Mackiewicz\.housecall6.6 2007-12-16 15:19 . 2007-12-16 18:49 18,432 --a------ C:\WINDOWS\fkwggshm.exe 2007-12-16 15:03 . 2007-12-16 15:03 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 14:40 . 2007-12-16 14:40 <DIR> d-------- C:\Documents and Settings\Mackiewicz\Dane aplikacji\PC Tools 2007-12-16 12:09 . 2007-12-16 12:09 5,632 --ahs---- C:\WINDOWS\system32\drivers\Thumbs.db 2007-12-16 00:17 . 2007-12-16 00:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-16 00:17 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-16 00:17 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-16 00:17 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-16 00:17 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-16 00:16 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 21:51 . 2007-12-15 21:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-12-15 20:50 . 2007-12-15 20:50 11 --a------ C:\WINDOWS\system32\lt.res 2007-12-15 20:43 . 2007-12-15 20:43 25,600 --a------ C:\WINDOWS\system32\judgemq.dll 2007-12-15 20:43 . 2007-12-16 21:42 4,517 --a------ C:\WINDOWS\system32\sft.res 2007-12-14 07:44 . 2007-12-14 07:45 1,393 --a------ C:\WINDOWS\imsins.BAK 2007-12-06 21:21 . 2007-12-06 21:21 <DIR> d--h----- C:\WINDOWS\PIF 2007-12-03 11:19 . 2007-12-16 12:09 10,240 --ahs---- C:\WINDOWS\system32\Thumbs.db 2007-11-25 20:53 . 2007-11-25 20:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-11-25 20:53 . 2007-11-25 20:53 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-11-25 20:52 . 2007-11-25 20:52 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-24 12:42 . 2007-11-24 12:42 <DIR> d-------- C:\Documents and Settings\Mackiewicz\Dane aplikacji\Simple Sudoku 2007-11-22 16:48 . 2007-11-30 20:19 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-11-22 16:48 . 2007-11-23 15:58 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-11-22 16:48 . 2007-11-30 20:19 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-22 16:25 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-22 16:25 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-11-22 16:25 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-11-22 16:25 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-11-22 16:25 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-22 16:25 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-11-22 16:25 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-22 16:25 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-11-22 16:25 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-11-22 16:25 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-11-17 22:51 . 2007-11-17 22:51 <DIR> d-------- C:\Downloads . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-15 16:18 --------- d-----w C:\Documents and Settings\Mackiewicz\Dane aplikacji\Sports Interactive 2007-11-15 16:11 --------- d-----w C:\Program Files\Sports Interactive 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-06 16:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-11-06 16:17 --------- d-----w C:\Documents and Settings\Mackiewicz\Dane aplikacji\Hamachi 2007-10-30 23:26 3,590,656 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll 2007-10-10 23:52 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-10-10 23:52 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-10-10 23:52 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-10-10 23:52 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-10-10 23:52 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-10-10 23:52 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-10-10 23:52 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-10-10 23:52 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-10-10 23:52 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-10-10 23:52 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-10-10 23:52 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-10-10 23:52 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-10-10 23:52 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-10-10 23:52 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-10-10 23:52 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-10-10 23:52 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-10-10 23:52 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-10-10 23:52 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-10-10 23:52 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-10-10 23:52 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-10-10 23:52 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-10-10 23:52 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-10-10 11:03 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-10-10 11:03 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-10-10 05:46 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-03-12 17:26 27,240 ----a-w C:\Documents and Settings\Mackiewicz\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-01-17 11:34 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2006-08-07 22:19 55 ----a-w C:\Documents and Settings\Mackiewicz\ALA.BAT 2006-07-18 13:41 1,019,094 --sha-r C:\Program Files\serial.zip 2006-07-18 13:41 1,019,094 --sha-r C:\Program Files\serial.tde 2006-05-28 16:46 397,306 --sha-r C:\Program Files\wunauclt.zip 2006-05-28 16:46 397,306 --sha-r C:\Program Files\wunauclt.tbe 2005-12-31 19:48 0 ----a-w C:\Documents and Settings\Mackiewicz\WebExcl.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4

i log z hajcthis 2.0.2

Kod: Zaznacz wszystko
ogfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:22:43, on 2007-12-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\a-squared Anti-Malware\a2service.exe D:\ad adware\aawservice.exe D:\Quic Time\qttask.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\BearShare\BearShare.exe D:\Daemon tools\daemon.exe D:\Spyware Doctor\SDTrayApp.exe D:\Tlen.pl\tlen.exe C:\WINDOWS\system32\ctfmon.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe D:\Spyware Doctor\svcntaux.exe D:\Spyware Doctor\swdsvc.exe C:\Documents and Settings\Mackiewicz\Menu Start\Programy\Autostart\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\MozillaPL Firefox\firefox.exe C:\Program Files\internet explorer\iexplore.exe D:\BitComet\BitComet.exe C:\WINDOWS\system32\wuauclt.exe D:\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IE7pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Microsoft copyright - {5DF6AFEE-2291-4041-9A74-354624861746} - judgemq.dll (file missing) O2 - BHO: dc_ie_monitor.ie_monitor - {DA517E05-A1DD-4CB8-801B-9B630F9122D2} - C:\Program Files\DioCleaner\dc_ie_monitor.dll (file missing) O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll O3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file) O4 - HKLM\..\Run: [QuickTime Task] "D:\Quic Time\qttask.exe" -atboottime O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [BearShare] "D:\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S O4 - HKLM\..\Run: [DioCleaner] C:\Program Files\DioCleaner\DioCleaner.exe O4 - HKLM\..\Run: [a-squared] "D:\a-squared Anti-Malware\a2guard.exe" O4 - HKLM\..\Run: [SDTray] "D:\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Dzieńdobry!] D:\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Komunikator] D:\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] D:\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Startup Manager] "D:\Advanced System Optimizer\startUp manager.exe" O4 - HKCU\..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Eurobarre.lnk = ? O4 - Startup: ctfmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\MS office XP\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\OPENOF~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165953595953 O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\a-squared Anti-Malware\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\ad adware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing) -- End of file - 7983 bytes

[ Dodano: Dzisiaj o 17:55 ]
co prawda tapetka z tym dziwnym napisem już mi znikła ale komp i net strasznie wolno chodzi a oprócz tego co chwile wyskakują mi jakieś okienka z komunikatami oraz puste strony w IE :
http://img140.imageshack.us/my.php?image=kurde.png

**Posty:** 18165 · przez **wojtas** 17 Gru 2007, 19:09

skasuj te wpisy w hijacku:

O2 - BHO: Microsoft copyright - {5DF6AFEE-2291-4041-9A74-354624861746} - judgemq.dll (file missing)
O2 - BHO: dc_ie_monitor.ie_monitor - {DA517E05-A1DD-4CB8-801B-9B630F9122D2} - C:\Program Files\DioCleaner\dc_ie_monitor.dll (file missing)
O3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)
O4 - HKLM\..\Run: [DioCleaner] C:\Program Files\DioCleaner\DioCleaner.exe
O4 - Startup: ctfmon.exe

Otworz notatnik i wklej w nim to:

File::
C:\autorun.inf
C:\WINDOWS\system32\lt.res
C:\WINDOWS\system32\judgemq.dll
C:\WINDOWS\system32\sft.res
C:\WINDOWS\imsins.BAK
C:\Documents and Settings\Mackiewicz\ALA.BAT
C:\Program Files\serial.zip
C:\Program Files\serial.tde
C:\Program Files\wunauclt.zip
C:\Program Files\wunauclt.tbe
C:\Documents and Settings\Mackiewicz\Menu Start\Programy\Autostart\ctfmon.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa (tylko caly bo ten jest uciety)

**Posty:** 117 · przez **mysia117** 17 Gru 2007, 21:06

wpisy z hijacka usunąłem, lecz po przeciągnieciu na ikone combofixa nacisnołem 1 komputer sie nie zresetował. i cąły czas wykakują mi te puste okna, mam wrzucić tego loga który pojawiił się po zakonczeniu operacji z combofixa?

**Posty:** 18165 · przez **wojtas** 18 Gru 2007, 16:42

mam wrzucić tego loga który pojawiił się po zakonczeniu operacji z combofixa?

tak i nowy z hijacka

**Posty:** 117 · przez **mysia117** 18 Gru 2007, 17:25

Kod: Zaznacz wszystko: [quote]ComboFix 07-12-17.1 - Mackiewicz 2007-12-17 19:59:23.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.159 [GMT 1:00] Running from: C:\Documents and Settings\Mackiewicz\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Mackiewicz\Pulpit\CFScript.txt * Created a new restore point FILE C:\autorun.inf C:\Documents and Settings\Mackiewicz\ALA.BAT C:\Documents and Settings\Mackiewicz\Menu Start\Programy\Autostart\ctfmon.exe C:\Program Files\serial.tde C:\Program Files\serial.zip C:\Program Files\wunauclt.tbe C:\Program Files\wunauclt.zip C:\WINDOWS\imsins.BAK C:\WINDOWS\system32\judgemq.dll C:\WINDOWS\system32\lt.res C:\WINDOWS\system32\sft.res . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Documents and Settings\Mackiewicz\ALA.BAT C:\Documents and Settings\Mackiewicz\Menu Start\Programy\Autostart\ctfmon.exe C:\Program Files\serial.tde C:\Program Files\serial.zip C:\Program Files\wunauclt.tbe C:\Program Files\wunauclt.zip C:\WINDOWS\imsins.BAK C:\WINDOWS\system32\judgemq.dll C:\WINDOWS\system32\lt.res C:\WINDOWS\system32\sft.res D:\Autorun.inf E:\Autorun.inf F:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-11-17 to 2007-12-17 ))))))))))))))))))))))))))))))) . 2007-12-17 14:11 . 2007-12-17 14:11 <DIR> d--hs---- C:\FOUND.005 2007-12-16 21:29 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-16 21:29 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-16 21:29 . 2007-12-13 19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-16 21:29 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-16 21:29 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-16 21:29 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-16 19:18 . 2007-12-16 19:18 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-12-16 15:35 . 2007-12-16 15:35 <DIR> d-------- C:\Documents and Settings\Mackiewicz\.housecall6.6 2007-12-16 15:19 . 2007-12-16 18:49 18,432 --a------ C:\WINDOWS\fkwggshm.exe 2007-12-16 15:03 . 2007-12-16 15:03 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 14:40 . 2007-12-16 14:40 <DIR> d-------- C:\Documents and Settings\Mackiewicz\Dane aplikacji\PC Tools 2007-12-16 12:09 . 2007-12-16 12:09 5,632 --ahs---- C:\WINDOWS\system32\drivers\Thumbs.db 2007-12-16 00:17 . 2007-12-16 00:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-16 00:17 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-16 00:17 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-16 00:17 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-16 00:17 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-16 00:16 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 21:51 . 2007-12-15 21:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-12-06 21:21 . 2007-12-06 21:21 <DIR> d--h----- C:\WINDOWS\PIF 2007-12-03 11:19 . 2007-12-16 12:09 10,240 --ahs---- C:\WINDOWS\system32\Thumbs.db 2007-11-25 20:53 . 2007-11-25 20:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-11-25 20:53 . 2007-11-25 20:53 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-11-25 20:52 . 2007-11-25 20:52 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-24 12:42 . 2007-11-24 12:42 <DIR> d-------- C:\Documents and Settings\Mackiewicz\Dane aplikacji\Simple Sudoku 2007-11-22 16:48 . 2007-11-30 20:19 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-11-22 16:48 . 2007-11-23 15:58 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-11-22 16:48 . 2007-11-30 20:19 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-22 16:25 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-22 16:25 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-11-22 16:25 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-11-22 16:25 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-11-22 16:25 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-22 16:25 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-11-22 16:25 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-22 16:25 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-11-22 16:25 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-11-22 16:25 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-11-17 22:51 . 2007-11-17 22:51 <DIR> d-------- C:\Downloads . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-15 16:18 --------- d-----w C:\Documents and Settings\Mackiewicz\Dane aplikacji\Sports Interactive 2007-11-15 16:11 --------- d-----w C:\Program Files\Sports Interactive 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-06 16:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-11-06 16:17 --------- d-----w C:\Documents and Settings\Mackiewicz\Dane aplikacji\Hamachi 2007-10-30 23:26 3,590,656 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll 2007-10-10 23:52 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-10-10 23:52 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-10-10 23:52 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-10-10 23:52 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-10-10 23:52 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-10-10 23:52 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-10-10 23:52 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-10-10 23:52 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-10-10 23:52 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-10-10 23:52 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-10-10 23:52 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-10-10 23:52 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-10-10 23:52 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-10-10 23:52 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-10-10 23:52 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-10-10 23:52 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-10-10 23:52 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-10-10 23:52 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-10-10 23:52 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-10-10 23:52 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-10-10 23:52 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-10-10 23:52 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-10-10 11:03 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-10-10 11:03 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-10-10 05:46 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-03-12 17:26 27,240 ----a-w C:\Documents and Settings\Mackiewicz\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-01-17 11:34 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2005-12-31 19:48 0 ----a-w C:\Documents and Settings\Mackiewicz\WebExcl.dat . ((((((((((((((((((((((((((((( snapshot@2007-12-17_17.02.58.56 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE - 2007-12-15 23:18:48 52,900 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-17 16:06:52 52,900 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-15 23:18:48 67,298 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-12-17 16:06:52 67,298 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-12-15 23:18:48 380,486 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-17 16:06:52 380,486 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-12-15 23:18:48 436,322 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-12-17 16:06:52 436,322 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Dzieńdobry!"="D:\Dzieńdobry!\dziendobry.exe" [2006-09-20 20:36] "Komunikator"="D:\Tlen.pl\tlen.exe" [2006-12-08 18:22] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "Odkurzacz-MCD"="D:\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02] "Startup Manager"="D:\Advanced System Optimizer\startUp manager.exe" [2007-06-22 11:56] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="D:\Quic Time\qttask.exe" [2006-09-01 15:57] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41] "BearShare"="D:\BearShare\BearShare.exe" [2006-07-31 11:36] "DAEMON Tools-1033"="D:\Daemon tools\daemon.exe" [2004-08-22 17:05] "Red Swoosh"="C:\Program Files\RSSoft\RedSwoosh.exe" [] "a-squared"="D:\a-squared Anti-Malware\a2guard.exe" [2007-07-17 09:49] "SDTray"="D:\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - D:\MS office XP\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr1"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys [2005-04-12 19:21] R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys [2005-04-12 19:21] S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [2006-01-01 08:54] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2005-12-29 19:16] S3 GT680x;GrandTechICNameNT;C:\WINDOWS\system32\Drivers\gt680x.sys [2001-11-08 09:53] S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 18:08] S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 18:11] S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 18:11] S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 18:13] S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 18:15] S3 nocashio;nocashio;C:\WINDOWS\system32\drivers\nocashio.sys [2007-04-25 19:19] S3 PPJoyBus;Parallel Port Joystick Bus device driver;C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-10-24 08:11] S3 PPortJoystick;Parallel Port Joystick device driver;C:\WINDOWS\system32\drivers\PPortJoy.sys [2004-10-24 08:11] S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2004-08-12 03:18] S3 usb2vcom;USB Data Cable;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys [2005-05-25 05:24] S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys [2005-04-12 19:21] S3 WmHidLo;Logitech Gaming USB Filter Driver;C:\WINDOWS\system32\drivers\WmHidLo.sys [2005-04-12 19:21] S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [2005-04-12 19:21] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - F:\Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbd4d106-8dbd-11da-a651-001485b55fae}] \Shell\AutoRun\command - L:\autorun.exe . Contents of the 'Scheduled Tasks' folder "2007-08-12 09:00:02 C:\WINDOWS\Tasks\At1.job" - C:\WINDOWS\system32\wunauclt.exe "2007-12-12 19:00:02 C:\WINDOWS\Tasks\At2.job" - C:\WINDOWS\system32\wunauclt.exe "2007-11-12 13:00:02 C:\WINDOWS\Tasks\At3.job" "2007-12-14 18:00:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-17 20:01:20 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-17 20:01:56 C:\ComboFix2.txt ... 2007-12-17 17:04 . 2007-12-14 06:46:14 --- E O F --- i hijacka Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:24:49, on 2007-12-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\Quic Time\qttask.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\BearShare\BearShare.exe D:\Daemon tools\daemon.exe D:\Spyware Doctor\SDTrayApp.exe D:\Dzieńdobry!\dziendobry.exe D:\Tlen.pl\tlen.exe C:\WINDOWS\system32\ctfmon.exe D:\a-squared Anti-Malware\a2service.exe D:\ad adware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe D:\Spyware Doctor\svcntaux.exe D:\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\System32\alg.exe D:\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\Explorer.EXE D:\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IE7pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll O4 - HKLM\..\Run: [QuickTime Task] "D:\Quic Time\qttask.exe" -atboottime O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [BearShare] "D:\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S O4 - HKLM\..\Run: [a-squared] "D:\a-squared Anti-Malware\a2guard.exe" O4 - HKLM\..\Run: [SDTray] "D:\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Dzieńdobry!] D:\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Komunikator] D:\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] D:\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Startup Manager] "D:\Advanced System Optimizer\startUp manager.exe" O4 - HKCU\..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Eurobarre.lnk = ? O4 - Global Startup: Microsoft Office.lnk = D:\MS office XP\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\OPENOF~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165953595953 O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\a-squared Anti-Malware\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\ad adware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing) -- End of file - 7473 bytes[/quote]

**Posty:** 18165 · przez **wojtas** 18 Gru 2007, 18:49

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\fkwggshm.exe
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\system32\wunauclt.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbd4d106-8dbd-11da-a651-001485b55fae}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 117 · przez **mysia117** 18 Gru 2007, 19:29

Kod: Zaznacz wszystko
ComboFix 07-12-17.1 - Mackiewicz 2007-12-18 18:24:55.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.221 [GMT 1:00] Running from: C:\Documents and Settings\Mackiewicz\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Mackiewicz\Pulpit\CFScript.txt * Created a new restore point FILE C:\WINDOWS\fkwggshm.exe C:\WINDOWS\system32\wunauclt.exe C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\At2.job C:\WINDOWS\Tasks\At3.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\fkwggshm.exe C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\At2.job C:\WINDOWS\Tasks\At3.job . ((((((((((((((((((((((((( Files Created from 2007-11-18 to 2007-12-18 ))))))))))))))))))))))))))))))) . 2007-12-17 14:11 . 2007-12-17 14:11 <DIR> d--hs---- C:\FOUND.005 2007-12-16 21:29 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-16 21:29 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-16 21:29 . 2007-12-13 19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-12-16 21:29 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-16 21:29 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-16 21:29 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-16 19:18 . 2007-12-16 19:18 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-12-16 15:35 . 2007-12-16 15:35 <DIR> d-------- C:\Documents and Settings\Mackiewicz\.housecall6.6 2007-12-16 15:03 . 2007-12-16 15:03 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 14:40 . 2007-12-16 14:40 <DIR> d-------- C:\Documents and Settings\Mackiewicz\Dane aplikacji\PC Tools 2007-12-16 12:09 . 2007-12-16 12:09 5,632 --ahs---- C:\WINDOWS\system32\drivers\Thumbs.db 2007-12-16 00:17 . 2007-12-16 00:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-16 00:17 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-16 00:17 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-16 00:17 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-16 00:17 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-16 00:16 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 21:51 . 2007-12-15 21:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2007-12-06 21:21 . 2007-12-06 21:21 <DIR> d--h----- C:\WINDOWS\PIF 2007-12-03 11:19 . 2007-12-16 12:09 10,240 --ahs---- C:\WINDOWS\system32\Thumbs.db 2007-11-25 20:53 . 2007-11-25 20:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-11-25 20:53 . 2007-11-25 20:53 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-11-25 20:52 . 2007-11-25 20:52 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-24 12:42 . 2007-11-24 12:42 <DIR> d-------- C:\Documents and Settings\Mackiewicz\Dane aplikacji\Simple Sudoku 2007-11-22 16:48 . 2007-11-30 20:19 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-11-22 16:48 . 2007-11-23 15:58 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-11-22 16:48 . 2007-11-30 20:19 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-22 16:25 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-11-22 16:25 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-11-22 16:25 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-11-22 16:25 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-11-22 16:25 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-11-22 16:25 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-11-22 16:25 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-11-22 16:25 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-11-22 16:25 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-11-22 16:25 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-15 16:18 --------- d-----w C:\Documents and Settings\Mackiewicz\Dane aplikacji\Sports Interactive 2007-11-15 16:11 --------- d-----w C:\Program Files\Sports Interactive 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-06 16:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-11-06 16:17 --------- d-----w C:\Documents and Settings\Mackiewicz\Dane aplikacji\Hamachi 2007-10-30 23:26 3,590,656 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll 2007-10-10 23:52 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-10-10 23:52 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-10-10 23:52 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-10-10 23:52 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-10-10 23:52 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-10-10 23:52 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-10-10 23:52 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-10-10 23:52 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-10-10 23:52 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-10-10 23:52 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-10-10 23:52 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-10-10 23:52 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-10-10 23:52 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-10-10 23:52 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-10-10 23:52 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-10-10 23:52 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-10-10 23:52 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-10-10 23:52 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-10-10 23:52 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-10-10 23:52 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-10-10 23:52 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-10-10 23:52 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-10-10 11:03 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-10-10 11:03 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-10-10 05:46 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-03-12 17:26 27,240 ----a-w C:\Documents and Settings\Mackiewicz\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-01-17 11:34 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2005-12-31 19:48 0 ----a-w C:\Documents and Settings\Mackiewicz\WebExcl.dat . ((((((((((((((((((((((((((((( snapshot@2007-12-17_17.02.58.56 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE - 2007-12-15 23:18:48 52,900 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-17 16:06:52 52,900 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-15 23:18:48 67,298 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-12-17 16:06:52 67,298 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-12-15 23:18:48 380,486 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-17 16:06:52 380,486 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-12-15 23:18:48 436,322 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-12-17 16:06:52 436,322 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Dzieńdobry!"="D:\Dzieńdobry!\dziendobry.exe" [2006-09-20 20:36] "Komunikator"="D:\Tlen.pl\tlen.exe" [2006-12-08 18:22] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "Odkurzacz-MCD"="D:\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02] "Startup Manager"="D:\Advanced System Optimizer\startUp manager.exe" [2007-06-22 11:56] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="D:\Quic Time\qttask.exe" [2006-09-01 15:57] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41] "BearShare"="D:\BearShare\BearShare.exe" [2006-07-31 11:36] "DAEMON Tools-1033"="D:\Daemon tools\daemon.exe" [2004-08-22 17:05] "Red Swoosh"="C:\Program Files\RSSoft\RedSwoosh.exe" [] "a-squared"="D:\a-squared Anti-Malware\a2guard.exe" [2007-07-17 09:49] "SDTray"="D:\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - D:\MS office XP\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr1"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys [2005-04-12 19:21] R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys [2005-04-12 19:21] S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [2006-01-01 08:54] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2005-12-29 19:16] S3 GT680x;GrandTechICNameNT;C:\WINDOWS\system32\Drivers\gt680x.sys [2001-11-08 09:53] S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 18:08] S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 18:11] S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 18:11] S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 18:13] S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 18:15] S3 nocashio;nocashio;C:\WINDOWS\system32\drivers\nocashio.sys [2007-04-25 19:19] S3 PPJoyBus;Parallel Port Joystick Bus device driver;C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-10-24 08:11] S3 PPortJoystick;Parallel Port Joystick device driver;C:\WINDOWS\system32\drivers\PPortJoy.sys [2004-10-24 08:11] S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2004-08-12 03:18] S3 usb2vcom;USB Data Cable;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys [2005-05-25 05:24] S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys [2005-04-12 19:21] S3 WmHidLo;Logitech Gaming USB Filter Driver;C:\WINDOWS\system32\drivers\WmHidLo.sys [2005-04-12 19:21] S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [2005-04-12 19:21] . Contents of the 'Scheduled Tasks' folder "2007-12-14 18:00:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-18 18:26:45 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-18 18:27:16 C:\ComboFix3.txt ... 2007-12-17 17:04 C:\ComboFix2.txt ... 2007-12-17 20:02 . 2007-12-14 06:46:14 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:29:17, on 2007-12-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe D:\Quic Time\qttask.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\Daemon tools\daemon.exe D:\Spyware Doctor\SDTrayApp.exe D:\Tlen.pl\tlen.exe C:\WINDOWS\system32\ctfmon.exe D:\a-squared Anti-Malware\a2service.exe D:\ad adware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe D:\Spyware Doctor\svcntaux.exe D:\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe D:\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\BitComet\BitComet.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\explorer.exe D:\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: IE7pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll O4 - HKLM\..\Run: [QuickTime Task] "D:\Quic Time\qttask.exe" -atboottime O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [BearShare] "D:\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [Red Swoosh] C:\Program Files\RSSoft\RedSwoosh.exe /S O4 - HKLM\..\Run: [a-squared] "D:\a-squared Anti-Malware\a2guard.exe" O4 - HKLM\..\Run: [SDTray] "D:\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [Dzieńdobry!] D:\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Komunikator] D:\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] D:\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Startup Manager] "D:\Advanced System Optimizer\startUp manager.exe" O4 - HKCU\..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Eurobarre.lnk = ? O4 - Global Startup: Microsoft Office.lnk = D:\MS office XP\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\OPENOF~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165953595953 O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\a-squared Anti-Malware\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\ad adware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing) -- End of file - 7434 bytes

**Posty:** 18165 · przez **wojtas** 18 Gru 2007, 19:36

jest juz czysto

Autor postu otrzymał pochwałę

**Posty:** 117 · przez **mysia117** 18 Gru 2007, 23:30

wojtas naprawdę dziięki!!!! komp chodzi już bardzo ładnie gdyby niue ty pewnie bym zmieniał windowsa. dodam ci pochwałe bo inaczej odwdzięczyć się nie moge naprawde dzięki!!
Można zamknąć tenn temat.

**Posty:** 3854 · przez **Dzi@dek** 19 Gru 2007, 02:11

Możesz usunąć katalogi:

c:\WINDOWS\ERUNT\
c:\WINDOWS\erdnt\

złapałerm jakiegoś wirusa! zniana tapey na jakiś napishelp!

złapałerm jakiegoś wirusa! zniana tapey na jakiś napisHELP!

Kto jest na forum