Proszę o sprawdzenie loga - wyskakujące okna z reklamami

**Posty:** 5 · przez **kasia_wl** 16 Lis 2008, 11:28

Witam!
Mój problem polega na tym że podczas używania komputera wyskakują mi nowe okna z reklamami. Dzieje się tak nawet jeśli nie włączam przeglądarki. Nie znam się na jakichś skomplikowanych antywirusach dlatego proszę o pomoc.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:08:15, on 2008-11-16 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16711) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Power Manager\PM.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Windows\system32\taskeng.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Winamp\winamp.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\kasia\Downloads\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O13 - Gopher Prefix: O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 5564 bytes

Kod: Zaznacz wszystko: ComboFix 08-11-14.01 - kasia 2008-11-16 12:37:54.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.1.1045.18.344 [GMT 1:00] Uruchomiony z: c:\users\kasia\Downloads\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\myglobalsearch c:\program files\myglobalsearch\bar\History\search . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-16 do 2008-11-16 ))))))))))))))))))))))))))))))) . Nie utworzono żadnych nowych plików w tym okresie . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-16 11:37 1,048,576 --sha-w c:\users\Gość\NTUSER.DAT 2008-11-16 11:37 1,048,576 --sha-w c:\users\Gość\NTUSER.DAT 2008-11-16 11:30 13,025 ----a-w c:\users\kasia\AppData\Roaming\nvModes.dat 2008-11-16 11:29 --------- d-----w c:\program files\Mass Downloader 2008-11-16 08:12 --------- d-----w c:\programdata\Megaupload 2008-11-16 08:12 --------- d-----w c:\programdata\EmailNotifier 2008-11-15 23:52 --------- d-----w c:\users\kasia\AppData\Roaming\BitTorrent 2008-11-15 13:56 --------- d-----w c:\programdata\Lavasoft 2008-11-15 13:56 --------- d-----w c:\program files\Lavasoft 2008-11-15 13:54 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-15 13:42 --------- d-----w c:\program files\pdf995 2008-11-14 18:59 --------- d-----w c:\users\kasia\AppData\Roaming\Skype 2008-11-14 18:13 --------- d-----w c:\users\kasia\AppData\Roaming\skypePM 2008-11-14 16:45 --------- d-----w c:\program files\JPEGCrops 2008-11-14 10:25 --------- d-----w c:\program files\Sprzedaż Art.Foto-Papierniczych Lucjan Wójcik 2008-10-27 08:57 --------- d-----w c:\programdata\pdf995 2008-10-27 08:54 --------- d-----w c:\users\kasia\AppData\Roaming\pdf995 2008-10-27 08:51 51,716 ----a-w c:\windows\System32\pdf995mon.dll 2008-10-27 08:51 249,856 ----a-w c:\windows\System32\pdfmona.dll 2008-10-24 16:02 --------- d-----w c:\program files\NAPI-PROJEKT 2008-10-24 15:06 --------- d---a-w c:\programdata\TEMP 2008-10-21 11:54 --------- d-----w c:\program files\Real Alternative 2008-10-21 11:21 --------- d-----w c:\users\kasia\AppData\Roaming\MetaProducts 2008-10-21 10:28 --------- d-----w c:\program files\BitTorrent 2008-09-21 12:29 --------- d-----w c:\users\Gość\AppData\Roaming\WinRAR 2008-09-21 10:42 12,978 ----a-w c:\users\Gość\AppData\Roaming\nvModes.dat 2008-09-19 22:21 --------- d-----w c:\users\Gość\AppData\Roaming\Adobe 2008-09-18 15:37 --------- d-----w c:\users\Gość\AppData\Roaming\Mozilla 2008-09-12 07:04 2,560 ----a-w c:\windows\_MSRSTRT.EXE 2008-07-11 10:55 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-07-11 10:55 56 ---ha-w c:\programdata\ezsidmv.dat 2008-07-10 04:40 174 --sha-w c:\program files\desktop.ini 2008-04-22 22:02 53,744 ----a-w c:\users\kasia\AppData\Roaming\GDIPFONTCACHEV1.DAT 2008-03-20 19:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-03-20 19:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-03-20 19:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-10 90191] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-10 7766016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-10 81920] "PowerManager"="c:\program files\Power Manager\PM.exe" [2006-11-06 26112] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497] "BearShare"="c:\program files\BearShare\BearShare.exe" [2006-08-01 3313664] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 c:\windows\RtHDVCpl.exe] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-10 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4241669379-753133919-2355590433-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{202B409F-3F7E-4C23-A9D3-6A90A585F117}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{91A09247-DDE1-4655-8DD3-AFADAC008AFA}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "{CA7ED01A-11A5-47FB-92A6-74888F6721FD}"= UDP:c:\program files\uTorrent\utorrent.exe:µTorrent "{D44E8175-2154-4389-8865-511664644F0B}"= TCP:c:\program files\uTorrent\utorrent.exe:µTorrent "TCP Query User{4457395F-E13F-43C9-B96B-3C50B0F80478}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{86A66B17-7A38-4DC1-B3C9-BD95CAC3A135}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "TCP Query User{FF1FBEAA-DF9A-4EF1-9362-858324C5E7AD}c:\\program files\\bearshare\\bearshare.exe"= UDP:c:\program files\bearshare\bearshare.exe:BearShare "UDP Query User{9B8FF450-16CF-4DD1-851D-32C58586FD05}c:\\program files\\bearshare\\bearshare.exe"= TCP:c:\program files\bearshare\bearshare.exe:BearShare "{299227FA-7D96-4031-B46A-B525D509C765}"= UDP:c:\program files\DNA\btdna.exe:DNA "{F9AC25AC-A9A5-4DAB-B037-803253FBA971}"= TCP:c:\program files\DNA\btdna.exe:DNA "{CAD88980-0941-4423-B6F0-724968D55188}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent "{E1B928B2-6C44-42E9-8D00-77C53E1B5792}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent "TCP Query User{32BF24EB-5DFC-4AC1-8A07-BE4B23097B55}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{D19374FD-2223-4DFA-9263-B2FBDF3EF7FB}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{7EA0BA44-67F4-4CE3-8D26-F6148732277C}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{285C94DF-6051-4019-B5B3-BC1FB038BCF4}c:\\program files\\wapster\\aqq\\aqq.exe"= UDP:c:\program files\wapster\aqq\aqq.exe:AQQ "UDP Query User{F919F16F-BA20-4B78-82CA-7FC8179E9655}c:\\program files\\wapster\\aqq\\aqq.exe"= TCP:c:\program files\wapster\aqq\aqq.exe:AQQ "TCP Query User{E2459C96-9412-4299-8EC3-46ED91D55F7C}c:\\program files\\nowe gadu-gadu\\gg.exe"= UDP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu beta "UDP Query User{08061B23-4C0C-4506-855A-A7718FCF38CD}c:\\program files\\nowe gadu-gadu\\gg.exe"= TCP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu beta "TCP Query User{96D8D555-5DFF-4B50-A867-4218C06D3377}c:\\program files\\bearshare\\bearshare.exe"= UDP:c:\program files\bearshare\bearshare.exe:BearShare "UDP Query User{4326AC18-71FA-4CF4-9944-7F185877EB23}c:\\program files\\bearshare\\bearshare.exe"= TCP:c:\program files\bearshare\bearshare.exe:BearShare "TCP Query User{09AE02B7-01CA-4C55-9A52-C2724A9C8D7F}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{02FE563B-A09A-45E9-ABF7-DCEA6B96944A}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{63FB430A-D523-4BFF-BC52-BD70AB8319A2}"= Disabled:UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{DFA16F4C-713C-4BAA-BCD6-10158F4EFE5B}"= Disabled:TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{63248B05-37A5-4E83-BFCC-A8763301ECAD}"= Disabled:UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{8B1D56ED-D8EF-4C68-ADBC-330C75215C35}"= Disabled:TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{47E0D6CC-F128-4D04-AB73-DA9E3BC3BF51}"= Disabled:UDP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR "{D73DD64D-3D71-4A62-8FBA-DEE73BF5B1A5}"= Disabled:TCP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR "{4C2DD66D-4196-4C9E-A254-DBC86A46E55C}"= Disabled:UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{CA593772-B535-4049-8ED5-F2471AD0A67D}"= Disabled:TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{8F2F5914-8861-48E6-9ECE-DF2E6D25A758}"= UDP:c:\program files\DNA\btdna.exe:DNA "{774F6BB6-ABB1-44B8-A528-DD0AAB1E8961}"= TCP:c:\program files\DNA\btdna.exe:DNA [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "c:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= c:\program files\WapSter\AQQ\AQQ.exe:*:Enabled:P2P AQQ S3 fspad_wlh32;AVC Finger-sensing Pad Driver for Windows 2000/XP/Vista_wlh32;c:\windows\system32\DRIVERS\fspad_wlh32.sys [2007-03-14 22528] S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;c:\windows\system32\DRIVERS\MRVW225.sys [2008-05-31 299904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - G:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c23adb3-2af1-11dd-9ccc-00140b0cd357}] \shell\AutoRun\command - 22wcb21o.exe \shell\explore\Command - 22wcb21o.exe \shell\open\Command - 22wcb21o.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8302528-83a4-11dc-95e2-00140b0cd357}] \shell\AutoRun\command - F:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa900e87-4421-11dd-81eb-00140b0cd357}] \shell\AutoRun\command - t.com \shell\explore\Command - t.com \shell\open\Command - t.com *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-11-15 c:\windows\Tasks\User_Feed_Synchronization-{7187C005-EB07-4CDE-BA81-EDD38D409681}.job - c:\windows\system32\msfeedssync.exe [2006-11-02 10:45] . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\users\kasia\AppData\Roaming\Mozilla\Firefox\Profiles\7fbrtwrl.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.onet.pl FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-16 12:43:42 Windows 6.0.6000 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-16 12:46:13 ComboFix-quarantined-files.txt 2008-11-16 11:46:07 Przed: System nie może znaleźć komunikatu dla numeru komunikatu 0x2379 w pliku komunikatów dla Application. Po: 22,235,672,576 bajtów wolnych 172 --- E O F --- 2008-10-13 06:29:34

**Posty:** 300 · przez **sgsman** 16 Lis 2008, 13:15

1. Wstaw loga w tagi "code".
2. Wrzuć loga z Combfixa.

**Posty:** 7956 · przez **Magik** 16 Lis 2008, 14:43

kasia_wl, wiesz co to znaczy edytowac swoj post?? wiec w swoim pierwszym poscie wybierz "edytuj" i wstaw ten log poprawnie

uruchom smitfraudfix z opcji 2

specjalne-narzedzia-czyszczace-vt96631.html

nastepnie
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa

**Posty:** 5 · przez **kasia_wl** 16 Lis 2008, 16:02

A przepraszam, nie wiedziałam że wystarczy edytować.

Jest jeden problem. Kiedy uruchamiam SDFixa znika mi cały pulpit i nic więcej się już nie dzieje.

**Posty:** 7956 · przez **Magik** 16 Lis 2008, 16:10

rozumiem, ze smitfrauda uruchomilas juz z opcja 2 czyli clean...

kasia_wl napisał(a):Jest jeden problem. Kiedy uruchamiam SDFixa znika mi cały pulpit i nic więcej się już nie dzieje.

coz, Vista.......pod nia nic skutecznego nie dziala poprawnie

nie masz zadnego firewalla.......A ta Avira to eghm.......

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: c:\program files\desktop.ini REGISTRY:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c23adb3-2af1-11dd-9ccc-00140b0cd357}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8302528-83a4-11dc-95e2-00140b0cd357}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa900e87-4421-11dd-81eb-00140b0cd357}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

i przeskanuj kompa
program-szukajacy-trojanow-i-malware-vt97108.html

**Posty:** 5 · przez **kasia_wl** 16 Lis 2008, 16:57

Tak, Smitfrauda uruchowiłam opcją clean. Rozumiem, że zmienić Avirę i zainstalować jakiegoś firewall'a

Tymczasem wrzuciłam plik do Combofixa i:

Kod: Zaznacz wszystko: ComboFix 08-11-14.01 - kasia 2008-11-16 15:18:15.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.1.1045.18.351 [GMT 1:00] Uruchomiony z: c:\users\kasia\Downloads\ComboFix.exe Użyto następujących komend :: c:\users\kasia\Desktop\CFScript.txt FILE :: c:\program files\desktop.ini . /wow section - STAGE 8 System nie może znaleźć komunikatu dla numeru komunikatu 0x20 w pliku komunikatów dla System. ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\desktop.ini . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-16 do 2008-11-16 ))))))))))))))))))))))))))))))) . Nie utworzono żadnych nowych plików w tym okresie . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-16 14:17 1,048,576 --sha-w c:\users\Gość\ntuser.dat 2008-11-16 14:17 1,048,576 --sha-w c:\users\Gość\ntuser.dat 2008-11-16 14:09 13,025 ----a-w c:\users\kasia\AppData\Roaming\nvModes.dat 2008-11-16 11:29 --------- d-----w c:\program files\Mass Downloader 2008-11-16 08:12 --------- d-----w c:\programdata\Megaupload 2008-11-16 08:12 --------- d-----w c:\programdata\EmailNotifier 2008-11-15 23:52 --------- d-----w c:\users\kasia\AppData\Roaming\BitTorrent 2008-11-15 13:56 --------- d-----w c:\programdata\Lavasoft 2008-11-15 13:56 --------- d-----w c:\program files\Lavasoft 2008-11-15 13:54 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-15 13:42 --------- d-----w c:\program files\pdf995 2008-11-14 18:59 --------- d-----w c:\users\kasia\AppData\Roaming\Skype 2008-11-14 18:13 --------- d-----w c:\users\kasia\AppData\Roaming\skypePM 2008-11-14 16:45 --------- d-----w c:\program files\JPEGCrops 2008-11-14 10:25 --------- d-----w c:\program files\Sprzedaż Art.Foto-Papierniczych Lucjan Wójcik 2008-10-27 08:57 --------- d-----w c:\programdata\pdf995 2008-10-27 08:54 --------- d-----w c:\users\kasia\AppData\Roaming\pdf995 2008-10-27 08:51 51,716 ----a-w c:\windows\System32\pdf995mon.dll 2008-10-27 08:51 249,856 ----a-w c:\windows\System32\pdfmona.dll 2008-10-24 16:02 --------- d-----w c:\program files\NAPI-PROJEKT 2008-10-24 15:06 --------- d---a-w c:\programdata\TEMP 2008-10-21 11:54 --------- d-----w c:\program files\Real Alternative 2008-10-21 11:21 --------- d-----w c:\users\kasia\AppData\Roaming\MetaProducts 2008-10-21 10:28 --------- d-----w c:\program files\BitTorrent 2008-09-21 12:29 --------- d-----w c:\users\Gość\AppData\Roaming\WinRAR 2008-09-21 10:42 12,978 ----a-w c:\users\Gość\AppData\Roaming\nvModes.dat 2008-09-19 22:21 --------- d-----w c:\users\Gość\AppData\Roaming\Adobe 2008-09-18 15:37 --------- d-----w c:\users\Gość\AppData\Roaming\Mozilla 2008-09-12 07:04 2,560 ----a-w c:\windows\_MSRSTRT.EXE 2008-07-11 10:55 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-07-11 10:55 56 ---ha-w c:\programdata\ezsidmv.dat 2008-04-22 22:02 53,744 ----a-w c:\users\kasia\AppData\Roaming\GDIPFONTCACHEV1.DAT 2008-03-20 19:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-03-20 19:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-03-20 19:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-10 90191] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-10 7766016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-10 81920] "PowerManager"="c:\program files\Power Manager\PM.exe" [2006-11-06 26112] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497] "BearShare"="c:\program files\BearShare\BearShare.exe" [2006-08-01 3313664] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 c:\windows\RtHDVCpl.exe] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-10 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4241669379-753133919-2355590433-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{202B409F-3F7E-4C23-A9D3-6A90A585F117}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{91A09247-DDE1-4655-8DD3-AFADAC008AFA}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "{CA7ED01A-11A5-47FB-92A6-74888F6721FD}"= UDP:c:\program files\uTorrent\utorrent.exe:µTorrent "{D44E8175-2154-4389-8865-511664644F0B}"= TCP:c:\program files\uTorrent\utorrent.exe:µTorrent "TCP Query User{4457395F-E13F-43C9-B96B-3C50B0F80478}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{86A66B17-7A38-4DC1-B3C9-BD95CAC3A135}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "TCP Query User{FF1FBEAA-DF9A-4EF1-9362-858324C5E7AD}c:\\program files\\bearshare\\bearshare.exe"= UDP:c:\program files\bearshare\bearshare.exe:BearShare "UDP Query User{9B8FF450-16CF-4DD1-851D-32C58586FD05}c:\\program files\\bearshare\\bearshare.exe"= TCP:c:\program files\bearshare\bearshare.exe:BearShare "{299227FA-7D96-4031-B46A-B525D509C765}"= UDP:c:\program files\DNA\btdna.exe:DNA "{F9AC25AC-A9A5-4DAB-B037-803253FBA971}"= TCP:c:\program files\DNA\btdna.exe:DNA "{CAD88980-0941-4423-B6F0-724968D55188}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent "{E1B928B2-6C44-42E9-8D00-77C53E1B5792}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent "TCP Query User{32BF24EB-5DFC-4AC1-8A07-BE4B23097B55}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{D19374FD-2223-4DFA-9263-B2FBDF3EF7FB}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{7EA0BA44-67F4-4CE3-8D26-F6148732277C}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{285C94DF-6051-4019-B5B3-BC1FB038BCF4}c:\\program files\\wapster\\aqq\\aqq.exe"= UDP:c:\program files\wapster\aqq\aqq.exe:AQQ "UDP Query User{F919F16F-BA20-4B78-82CA-7FC8179E9655}c:\\program files\\wapster\\aqq\\aqq.exe"= TCP:c:\program files\wapster\aqq\aqq.exe:AQQ "TCP Query User{E2459C96-9412-4299-8EC3-46ED91D55F7C}c:\\program files\\nowe gadu-gadu\\gg.exe"= UDP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu beta "UDP Query User{08061B23-4C0C-4506-855A-A7718FCF38CD}c:\\program files\\nowe gadu-gadu\\gg.exe"= TCP:c:\program files\nowe gadu-gadu\gg.exe:Nowe Gadu-Gadu beta "TCP Query User{96D8D555-5DFF-4B50-A867-4218C06D3377}c:\\program files\\bearshare\\bearshare.exe"= UDP:c:\program files\bearshare\bearshare.exe:BearShare "UDP Query User{4326AC18-71FA-4CF4-9944-7F185877EB23}c:\\program files\\bearshare\\bearshare.exe"= TCP:c:\program files\bearshare\bearshare.exe:BearShare "TCP Query User{09AE02B7-01CA-4C55-9A52-C2724A9C8D7F}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{02FE563B-A09A-45E9-ABF7-DCEA6B96944A}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{63FB430A-D523-4BFF-BC52-BD70AB8319A2}"= Disabled:UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{DFA16F4C-713C-4BAA-BCD6-10158F4EFE5B}"= Disabled:TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{63248B05-37A5-4E83-BFCC-A8763301ECAD}"= Disabled:UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{8B1D56ED-D8EF-4C68-ADBC-330C75215C35}"= Disabled:TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{47E0D6CC-F128-4D04-AB73-DA9E3BC3BF51}"= Disabled:UDP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR "{D73DD64D-3D71-4A62-8FBA-DEE73BF5B1A5}"= Disabled:TCP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR "{4C2DD66D-4196-4C9E-A254-DBC86A46E55C}"= Disabled:UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{CA593772-B535-4049-8ED5-F2471AD0A67D}"= Disabled:TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{8F2F5914-8861-48E6-9ECE-DF2E6D25A758}"= UDP:c:\program files\DNA\btdna.exe:DNA "{774F6BB6-ABB1-44B8-A528-DD0AAB1E8961}"= TCP:c:\program files\DNA\btdna.exe:DNA [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "c:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= c:\program files\WapSter\AQQ\AQQ.exe:*:Enabled:P2P AQQ S3 fspad_wlh32;AVC Finger-sensing Pad Driver for Windows 2000/XP/Vista_wlh32;c:\windows\system32\DRIVERS\fspad_wlh32.sys [2007-03-14 22528] S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;c:\windows\system32\DRIVERS\MRVW225.sys [2008-05-31 299904] *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-11-15 c:\windows\Tasks\User_Feed_Synchronization-{7187C005-EB07-4CDE-BA81-EDD38D409681}.job - c:\windows\system32\msfeedssync.exe [2006-11-02 10:45] . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-16 15:22:46 Windows 6.0.6000 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-16 15:24:36 ComboFix-quarantined-files.txt 2008-11-16 14:24:30 ComboFix2.txt 2008-11-16 11:46:14 Przed: System nie może znaleźć komunikatu dla numeru komunikatu 0x2379 w pliku komunikatów dla Application. Po: 20,499,120,128 bajtów wolnych 155 --- E O F --- 2008-10-13 06:29:34

Potem FixIEDef'a:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6773 * * * ******************************************************************************** Created at 15:38:55 on Sunday, November 16, 2008 Time Zone : (GMT+01:00) Sarajewo, Skopie, Warszawa, Zagrzeb Logged On User : kasia Operating System : Microsoft® Windows Vista™ Home Premium OS Version : 6.0.6000 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Turion(tm) 64 X2 Mobile Technology TL-52 System Drive : C:\ Windows Directory : C:\Windows System Directory : C:\Windows\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : SYSTEM System Drive Size : 110.65 GB System Drive Free : 18.97 GB Total Physical Memory: 1022 MB Free Physical Memory : 447 MB Total Page File : 1022 MB Free Page File : 1489 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1964 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

To już wszystko>?

**Posty:** 7956 · przez **Magik** 16 Lis 2008, 17:00

kasia_wl napisał(a):Rozumiem, że zmienić Avirę

jesli masz takowa mozliwosc to zmien na cos solidniejszego typu NOD, Kaspersky

kasia_wl napisał(a):i zainstalować jakiegoś firewall'a

ehe, Kerio lub Comodo

pod Internet Explorer zrob skan
http://www.kaspersky.com/virusscanner
i wklej raport

**Posty:** 5 · przez **kasia_wl** 16 Lis 2008, 20:45

Raport:

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, November 16, 2008 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, November 16, 2008 13:43:47 Records in database: 1387799 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 78636 Threat name: 2 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 02:44:52 File name / Threat name / Threats count C:\Users\kasia\Documents\Downloads\Lavasoft Ad-Aware Pro 2009.rar Infected: Trojan.Win32.Buzus.aaqz 1 C:\Users\kasia\Downloads\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 C:\Users\kasia\Downloads\SmitfraudFix.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 The selected area was scanned.

**Posty:** 7956 · przez **Magik** 16 Lis 2008, 20:48

komputer czysty

te alerty dotycza nielegalnej wersji adaware i smitfrauda, wiec jest ok

Pozdrawiam

usun z dysku recznie folder C:\Qoobox

**Posty:** 5 · przez **kasia_wl** 16 Lis 2008, 22:12

dziękuję za pomoc