trojany i komp muli

**Posty:** 3 · przez **19pwz88** 21 Gru 2007, 20:49

Skanowalem dwukrotnie komputer i za kazdym razem wykrywa te same wirusy

dwoma roznymi programami antywirusowymi

zamieszcam log

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:47:08, on 2007-12-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\PROGRA~1\WAVTOM~1\MTHREE~1.EXE C:\Program Files\OpenOffice.ux.pl 2.0.2\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.0.2\program\soffice.BIN C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Piotr\Pulpit\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\RunOnce: [eZstub] C:\PROGRA~1\WAVTOM~1\MTHREE~1.EXE O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.ux.pl 2.0.2.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.2\program\quickstart.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.allegro.pl O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://217.117.128.162/activex/AxisCamControl.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{832B86F4-2413-4B2B-86E1-9E29CE88193C}: NameServer = 80.85.224.2,80.85.224.50 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6626 bytes

**Posty:** 18165 · przez **wojtas** 21 Gru 2007, 21:39

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 3 · przez **19pwz88** 21 Gru 2007, 22:51

SDFIX

Kod: Zaznacz wszystko: SDFix: Version 1.119 Run by Piotr on 2007-12-21 at 21:27 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Name: runtime Path: \??\C:\WINDOWS\System32\drivers\runtime.sys runtime - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system32\1_exception.nls - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-21 21:33:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Red Faction\\Rf.exe"="C:\\Program Files\\Red Faction\\Rf.exe:*:Enabled:Red Faction" "D:\\pare film˘w\\Return to Castle Wolfenstein\\WolfMP.exe"="D:\\pare film˘w\\Return to Castle Wolfenstein\\WolfMP.exe:*:Enabled:WolfMP" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"="C:\\Program Files\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVU Player Component" "C:\\Program Files\\Red Faction\\RedFaction.exe"="C:\\Program Files\\Red Faction\\RedFaction.exe:*:Disabled:Red Faction Launcher" "C:\\WINDOWS\\system32\\~.exe"="C:\\WINDOWS\\system32\\~.exe:*:Enabled:Control" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Fri 4 May 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 26 Jun 2007 27,136 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL0027.tmp" Tue 26 Jun 2007 32,768 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL0300.tmp" Tue 26 Jun 2007 32,768 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL0569.tmp" Tue 26 Jun 2007 25,088 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL0630.tmp" Tue 26 Jun 2007 23,552 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL0998.tmp" Tue 26 Jun 2007 20,992 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL1367.tmp" Tue 26 Jun 2007 23,552 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL1424.tmp" Tue 26 Jun 2007 36,864 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL1767.tmp" Tue 26 Jun 2007 28,672 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL1862.tmp" Tue 26 Jun 2007 22,016 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL2114.tmp" Tue 26 Jun 2007 19,968 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL2230.tmp" Tue 26 Jun 2007 19,456 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL2259.tmp" Tue 26 Jun 2007 25,600 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL2651.tmp" Tue 26 Jun 2007 30,720 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL3274.tmp" Tue 26 Jun 2007 34,816 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL3309.tmp" Tue 26 Jun 2007 29,696 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL3499.tmp" Tue 26 Jun 2007 32,768 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL3558.tmp" Tue 26 Jun 2007 37,376 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL3585.tmp" Tue 26 Jun 2007 35,840 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL3712.tmp" Tue 26 Jun 2007 35,840 ...H. --- "C:\Documents and Settings\Piotr\Pulpit\~WRL4008.tmp" Wed 21 Mar 2007 19,456 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL0005.tmp" Thu 15 Mar 2007 157,184 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL0088.tmp" Wed 21 Mar 2007 20,480 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL1237.tmp" Wed 21 Mar 2007 19,968 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL1316.tmp" Wed 21 Mar 2007 20,480 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL1819.tmp" Wed 21 Mar 2007 19,968 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL2140.tmp" Wed 21 Mar 2007 19,456 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL2292.tmp" Wed 21 Mar 2007 19,968 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL2441.tmp" Wed 21 Mar 2007 19,456 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL3165.tmp" Wed 21 Mar 2007 20,992 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL3223.tmp" Wed 21 Mar 2007 19,968 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL3700.tmp" Wed 21 Mar 2007 20,480 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL3997.tmp" Wed 21 Mar 2007 19,968 A..H. --- "C:\Documents and Settings\Piotr\Moje dokumenty\MGR Kasia\~WRL4068.tmp" Mon 30 Apr 2007 479,232 A.SH. --- "C:\Documents and Settings\Piotr\Pulpit\zakopane 07\SIV42B.tmp" Finished!

ComboFix

Kod: Zaznacz wszystko: ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-18 17:32] "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-03-29 07:13] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 14:58] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 17:15] "Cmaudio"="RunDll32 cmicnfg.cpl" [] "nwiz"="nwiz.exe" [2004-10-29 15:50 C:\WINDOWS\system32\nwiz.exe] "PD0620 STISvc"="RunDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 12:20] "Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 14:58] C:\Documents and Settings\Piotr\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.0.2.lnk - C:\Program Files\OpenOffice.ux.pl 2.0.2\program\quickstart.exe [2006-03-20 15:22:50] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Fjm58.sys] @="Driver" R0 Fjm58;Fjm58;C:\WINDOWS\system32\Drivers\Fjm58.sys [2007-12-19 20:48] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-21 21:46:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-21 21:48:16 - machine was rebooted . 2007-12-21 17:47:39 --- E O F ---

**Posty:** 237 · przez **Kuba1** 22 Gru 2007, 00:59

Log z ComboFix jest ucięty.

trojany i komp muli

Trojany i komp muli

Kto jest na forum