mała prędkość łącza

**Posty:** 165 · przez **gtavc** 23 Cze 2008, 18:53

Witam. Ostatnio strasznie zwolnił mi internet. Zainstalowałem NOD'a (znalazł prawie 300 infekcjii :O [głównie pliki .dll]) Lecz to nie pomogło.

Oto Log z HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:20:21, on 2008-06-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe E:\Program Files\Winamp\winampa.exe E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\CursorXP\CursorXP.exe C:\WINDOWS\system32\drivers\svchost.exe E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {398C9B84-4EF7-47B5-9862-DE29543B3C42} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: oohxbbyt.dll - {3B1AEF69-DDAE-FDAD-DCAB-698F026ABDB3} - C:\WINDOWS\system32\oohxbbyt.dll (file missing) O2 - BHO: oohxcbyt.dll - {4B1AEF69-DDAE-FDAD-DCAB-698F026ABDB4} - C:\WINDOWS\system32\oohxcbyt.dll (file missing) O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqr.exe] C:\WINDOWS\system32\kdxqr.exe O4 - HKLM\..\Run: [egui] "E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s O4 - HKCU\..\Run: [Dzieńdobry!] E:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [BitComet] "E:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDEG32] LYLoader.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDWG32] LYLoadbr.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDCG32 ] LYLeador.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDOG32] LYLoador.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDSG32] LYLoadar.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDHG32] LYLoadhr.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDQG32] LYLoadqr.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Download with GetRight - E:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - E:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O20 - AppInit_DLLs: wfhyt.dll,kghk.dll,ethsh.dll,stehs.dll,sthth.dll,frntrn.dll,qrhhb.dll,drghszd.dll, O20 - Winlogon Notify: winool32 - C:\WINDOWS\SYSTEM32\winool32.dll O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- End of file - 6322 bytes

**Posty:** 7956 · przez **Magik** 23 Cze 2008, 18:58

Siema

na fix w awaryjnym

Kod: Zaznacz wszystko: C:\WINDOWS\system32\drivers\svchost.exe O2 - BHO: (no name) - {398C9B84-4EF7-47B5-9862-DE29543B3C42} - (no file) O2 - BHO: oohxbbyt.dll - {3B1AEF69-DDAE-FDAD-DCAB-698F026ABDB3} - C:\WINDOWS\system32\oohxbbyt.dll (file missing) O2 - BHO: oohxcbyt.dll - {4B1AEF69-DDAE-FDAD-DCAB-698F026ABDB4} - C:\WINDOWS\system32\oohxcbyt.dll (file missing) O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O20 - AppInit_DLLs: wfhyt.dll,kghk.dll,ethsh.dll,stehs.dll,sthth.dll,frntrn.dll,qrhhb.dll,drghszd.dl l,fngn.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzi jj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.d ll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg .dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll ,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,setrhes.dll,cdxbfxdb. dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxn fnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll ,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,msepbe.dll, O4 - HKLM\..\Policies\Explorer\Run: [MSDEG32] LYLoader.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDWG32] LYLoadbr.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDCG32 ] LYLeador.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDOG32] LYLoador.exe \..\Policies\Explorer\Run: [MSDSG32] LYLoadar.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDHG32] LYLoadhr.exe O4 - HKLM\..\Policies\Explorer\Run: [MSDQG32] LYLoadqr.exe

i KONIECZNIE log z combofix'a
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

**Posty:** 165 · przez **gtavc** 23 Cze 2008, 19:06

emo Magik napisał(a):na fix w awaryjnym

Mam to zfixować w HiJack This? i jak w trybie awaryjnym ?

**Posty:** 7956 · przez **Magik** 23 Cze 2008, 19:08

gtavc napisał(a):Mam to zfixować w HiJack This? i jak w trybie awaryjnym ?

tak, te wpisy masz dac na fix
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html
podpunkt 4--->usuwanie

tryb awaryjny-->przy starcie kompa wciskasz F8

potem wklej na forum log z combo'

**Posty:** 165 · przez **gtavc** 26 Cze 2008, 13:22

Teraz się pojawił Inny problem tamten już został naprawiony.

A nowy to duże mulenie sie kompa przez Kasperskiego, i strasznie długo się uruchamia komputer.

Log z Combofix'a

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Łukasz 2008-06-26 11:16:12.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.355 [GMT 2:00] Running from: E:\ComboFix.exe * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\WINDOWS\dxtmechk C:\WINDOWS\Fonts\syn00-40-F4-C2-1F-89\system C:\WINDOWS\Fonts\syn00-40-F4-C2-1F-89\system\SYSTEM128.vxd C:\WINDOWS\system32\back.exe.exe C:\WINDOWS\system32\bjrvm.cfg C:\WINDOWS\system32\crugd.cfg C:\WINDOWS\system32\drivers\hapdrv2.sys C:\WINDOWS\system32\drivers\ReloadAnti.sys C:\WINDOWS\system32\drivers\svchost.exe C:\WINDOWS\system32\drivers\XNGAnti.sys C:\WINDOWS\system32\ektvm.cfg C:\WINDOWS\system32\fjyjy.cfg C:\WINDOWS\system32\frntrn.dll C:\WINDOWS\system32\hfjg.cfg C:\WINDOWS\system32\ijatnaw.cfg C:\WINDOWS\system32\kdxqr.exe C:\WINDOWS\system32\lariytrz.cfg C:\WINDOWS\system32\msosdohs.dat C:\WINDOWS\system32\msosdrop.dat C:\WINDOWS\system32\msosmnsf.dat C:\WINDOWS\system32\nicozftp.dat C:\WINDOWS\system32\oqrthc.cfg C:\WINDOWS\system32\rhs.cfg C:\WINDOWS\system32\SHQ.DLL C:\WINDOWS\system32\smhxabyt.sys C:\WINDOWS\system32\smhxbbyt.sys C:\WINDOWS\system32\svcp.csv C:\WINDOWS\system32\winsub.xml C:\WINDOWS\system32\xgnfn.cfg D:\Autorun.inf E:\Autorun.inf E:\RECYCLER\desktop.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MSFPFIS64 -------\Legacy_MSP2P32 -------\Service_dohs -------\Service_drop -------\Service_mnsf -------\Service_msfpfis64 -------\Service_msp2p32 -------\Service_zftp ((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))) . 2008-06-25 10:42 . 2008-06-25 10:42 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-06-25 10:42 . 2008-06-25 10:42 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-06-25 10:41 . 2008-06-26 11:32 2,269,216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-25 10:41 . 2008-06-26 11:29 28,640 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-25 10:41 . 2008-06-26 11:31 22,304 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-06-25 10:41 . 2008-06-26 11:29 4,184 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-06-23 15:09 . 2008-06-23 15:09 <DIR> d-------- E:\Program Files\ESET 2008-06-23 15:09 . 2008-06-23 15:09 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ESET 2008-06-23 15:04 . 2008-06-23 15:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-06-23 15:04 . 2008-06-25 10:41 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab 2008-06-23 11:49 . 2008-06-25 10:41 <DIR> d-------- E:\Program Files\Kaspersky Lab 2008-06-22 16:26 . 2008-06-22 17:40 65,765 --a------ C:\WINDOWS\msvupdater.config 2008-06-22 16:25 . 2008-06-22 16:24 118,272 --a------ C:\WINDOWS\msvupdater.exe 2008-06-22 10:37 . 1994-08-24 00:00 188,960 --a------ C:\WINDOWS\system32\WINGDE.DLL 2008-06-22 10:37 . 1994-09-21 00:00 92,208 --a------ C:\WINDOWS\system32\WING.DLL 2008-06-22 10:37 . 1994-09-21 00:00 12,800 --a------ C:\WINDOWS\system32\WING32.DLL 2008-06-22 10:37 . 1994-09-21 00:00 6,736 --a------ C:\WINDOWS\system32\WINGDIB.DRV 2008-06-22 10:37 . 1994-09-21 00:00 5,024 --a------ C:\WINDOWS\system32\WINGPAL.WND 2008-06-19 11:37 . 2008-06-19 11:37 33,280 --a------ C:\WINDOWS\system32\winool32.dll 2008-06-19 11:36 . 2008-06-19 11:36 33,280 --a------ C:\WINDOWS\system32\winzsr32.dll 2008-06-19 11:36 . 2008-06-19 11:36 33,280 --a------ C:\WINDOWS\system32\wintlr32.dll 2008-06-15 14:38 . 2008-06-15 14:38 <DIR> d-------- E:\Program Files\microsoft frontpage 2008-06-15 11:27 . 2008-06-15 11:27 <DIR> d--h----- E:\Program Files\InstallShield Installation Information 2008-06-14 16:14 . 2008-06-14 16:14 <DIR> d-------- E:\Program Files\OLYMPUS 2008-06-06 17:15 . 2008-06-26 10:04 <DIR> d-------- E:\Program Files\7-Zip 2008-06-06 16:58 . 2008-06-06 16:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\platform dupe draw memo 2008-06-04 23:45 . 2008-06-04 23:45 <DIR> d-------- E:\Program Files\Audacity 2008-06-03 18:46 . 2008-06-03 18:46 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-06-03 18:46 . 2008-06-03 18:46 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-05-29 21:06 . 2008-05-29 21:06 <DIR> d-------- C:\Downloads 2008-05-28 18:42 . 2000-05-22 02:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2008-05-28 18:42 . 2006-10-06 00:17 53,248 --------- C:\WINDOWS\Ctregrun.exe 2008-05-28 18:41 . 2003-03-18 21:20 1,060,864 --------- C:\WINDOWS\system32\mfc71.dll 2008-05-28 18:41 . 2003-03-18 20:14 499,712 --------- C:\WINDOWS\system32\msvcp71.dll 2008-05-28 18:38 . 2008-05-28 19:44 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Creative 2008-05-28 18:15 . 2006-09-16 01:05 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-05-27 23:12 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll 2008-05-27 23:12 . 2001-05-16 17:54 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2008-05-27 23:12 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax 2008-05-27 23:11 . 2008-05-27 23:11 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-05-27 23:10 . 2008-05-27 23:10 <DIR> d-------- E:\Program Files\WinFast . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 09:29 262,144 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT 2008-06-26 09:29 262,144 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT 2008-06-26 09:29 262,144 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT 2008-06-26 09:29 262,144 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT 2008-06-26 08:05 --------- d-----w E:\Program Files\eMule 2008-06-26 08:05 --------- d-----w E:\Program Files\CursorXP 2008-06-26 08:05 --------- d-----w E:\Program Files\ChrisTV 2008-06-26 08:04 --------- d-----w E:\Program Files\BearShare Pro 2008-06-26 08:04 --------- d-----w E:\Program Files\BearShare 2008-06-25 20:01 --------- d-----w E:\Program Files\Winamp 2008-06-25 19:59 --------- d-----w E:\Program Files\Total Video Converter 2008-06-25 19:58 --------- d-----w E:\Program Files\Rockstar Games 2008-06-25 19:57 --------- d-----w E:\Program Files\Real Alternative 2008-05-30 18:29 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DVD Shrink 2008-05-28 17:53 --------- d-----w E:\Program Files\Team17 2008-05-22 12:06 --------- d-----w E:\Program Files\EA GAMES 2008-05-22 11:27 --------- d-----w E:\Program Files\XnView 2008-05-18 21:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help 2008-05-14 14:42 2,688 ----a-w C:\WINDOWS\system32\drivers\hapdrv.sys 2008-05-13 18:37 --------- d-----w E:\Program Files\VSD Software 2008-05-13 18:29 --------- d-----w E:\Program Files\K-Lite Codec Pack 2008-05-11 19:22 --------- d-----w E:\Program Files\Arjaloc 2008-05-08 17:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\NFS Underground 2008-05-07 18:51 --------- d-----w C:\Program Files\Common Files\DirectX 2008-05-07 18:46 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-05-07 13:46 --------- d-----w E:\Program Files\GetRight 2008-05-01 21:39 --------- d-----w E:\Program Files\BitComet 2008-05-01 09:00 47,104 ----a-w C:\WINDOWS\system32\KMVIDC32.DLL 2008-04-30 12:52 2,437 --s-a-w C:\WINDOWS\system32\ytf.dll 2008-04-28 17:53 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-04-22 21:46 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll 2008-04-22 21:22 504,832 ----a-w C:\WINDOWS\system32\winlogon.exe 2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll 2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll . ------- Sigcheck ------- 2008-04-22 23:22 504832 381221f69d1248864861889a64f100b6 C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:34 128000] "Dzieńdobry!"="E:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe" [ ] "BitComet"="E:\Program Files\BitComet\BitComet.exe" [2008-02-01 09:20 2194744] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C:\WINDOWS\system32\kdxqr.exe"="C:\WINDOWS\system32\kdxqr.exe" [ ] "WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{d21ac220-ebb3-4110-9817-37aa0cce636b}"= C:\WINDOWS\system32\dqSADSAD1040.dll [ ] "{6a4c8648-b38c-4f16-84ac-90df19880383}"= C:\WINDOWS\system32\dqSUCSUC1042.dll [ ] "{ea034451-03fa-4438-bd52-ff0446afa96c}"= C:\WINDOWS\system32\hhLSLLSL1040.dll [ ] "{a7aac22d-0bc2-48fa-9196-f43fef7f8cda}"= C:\WINDOWS\system32\MMHADPQG1076.dll [ ] "{5d605b2b-d1f8-4897-8ca4-cd8e1491b624}"= C:\WINDOWS\system32\MMMYSBDR1059.dll [ ] "{9ed93b14-8d71-45cb-970b-0b8a22449f48}"= C:\WINDOWS\system32\ttBAIBAI1069.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winool32] winool32.dll 2008-06-19 11:37 33280 C:\WINDOWS\system32\winool32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ĐŢ¸´ą¤ľß.exe] Debugger=net [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^InterVideo WinCinema Manager.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\InterVideo WinCinema Manager.lnk backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPSrv] C:\WINDOWS\AVPSrv.exE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bincdwsa] C:\WINDOWS\bincdwsa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dbhlp32] C:\WINDOWS\dbhlp32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dionpis] C:\WINDOWS\dionpis.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\draw memo up hide] --a------ 2008-06-23 12:01 877056 C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\platform dupe draw memo\Poke Anti.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting] --a------ 2005-04-25 13:45 36040 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui] --a------ 2008-03-13 16:48 1443072 E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fiosectc] C:\WINDOWS\fiosectc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmbiost] C:\WINDOWS\fmbiost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmsbbqi] C:\WINDOWS\fmsbbqi.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmsiocps] C:\WINDOWS\fmsiocps.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmsjhif] C:\WINDOWS\fmsjhif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] --a------ 2007-09-19 22:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\locksbags] C:\DOCUME~1\UKASZ~1.DOM\DANEAP~1\LOVEPL~1\Browse Road.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LotusHlp] C:\WINDOWS\LotusHlp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mfchlp64] C:\WINDOWS\mfchlp64.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msvupdater] --a------ 2008-06-22 16:24 118272 C:\WINDOWS\msvupdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAVMon64] C:\WINDOWS\NAVMon64.exE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM2_Monitor] --a------ 2007-02-08 20:43 95800 E:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ptshell] C:\WINDOWS\ptshell.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tciocp64] C:\WINDOWS\tciocp64.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ticisms] C:\WINDOWS\ticisms.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\upxdnd] C:\WINDOWS\upxdnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinRemote] --a------ 2008-06-26 10:06 131072 E:\Program Files\InterVideo\WinDVR\WinRemote.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINSCHEDULER] --a------ 2008-03-21 11:25 139264 E:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSockDrv32] C:\WINDOWS\oowluj.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "E:\\Program Files\\BitComet\\BitComet.exe"= "E:\\Program Files\\InterActive Vision\\Road Wars Demo\\RoadWars.exe"= "E:\\Program Files\\BearShare Pro\\Bearshare.exe"= "C:\\WINDOWS\\system32\\winver.exe"= "C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19215:TCP"= 19215:TCP:BitComet 19215 TCP "19215:UDP"= 19215:UDP:BitComet 19215 UDP R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] S3 obj2;obj2;C:\WINDOWS\system32\DRIVERS\obj2.sys [] S3 sys_flt;sys_flt;C:\DOCUME~1\UKASZ~1.DOM\USTAWI~1\Temp\~90.tmp [] S3 XDva136;XDva136;C:\WINDOWS\system32\XDva136.sys [] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder "2008-06-26 09:00:00 C:\WINDOWS\Tasks\A38C8BBA90673E5E.job" - c:\docume~1\ukasz~1.dom\daneap~1\lovepl~1\Boldinsideshow.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-26 11:31:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sys_flt] "ImagePath"="\??\C:\DOCUME~1\UKASZ~1.DOM\USTAWI~1\Temp\~90.tmp" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\winool32.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Gadu-Gadu\ggwhook.dll . ------------------------ Other Running Processes ------------------------ . E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\dwwin.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE . ************************************************************************** . Completion time: 2008-06-26 11:36:45 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-26 09:36:31 Pre-Run: 496,816,128 bajtów wolnych Post-Run: 500,469,760 bajt˘w wolnych 292

**Posty:** 7956 · przez **Magik** 26 Cze 2008, 14:16

wrzuc jeszcze screen z msconfig, zakladka autostart bo duzo softu Ci sie uruchamia na starcie//trzeba troche przezedzic ten autostart :arrow:

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\fiosectc.exe C:\WINDOWS\fmsbbqi.exe C:\WINDOWS\fmsiocps.exe C:\WINDOWS\fmsjhif.exe C:\WINDOWS\fmbiost.exe C:\WINDOWS\mfchlp64.exe C:\WINDOWS\LotusHlp.exe C:\WINDOWS\dionpis.exe C:\WINDOWS\dbhlp32.exe

zapisz jako CFScript.txt . Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

by Mario
:wink:

**Posty:** 165 · przez **gtavc** 26 Cze 2008, 16:46

Zrobilem z tym notatnikiem jak mówiłeś ComboFix na nowo mi zrobił Log oto on

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Łukasz 2008-06-26 15:35:24.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.431 [GMT 2:00] Running from: E:\ComboFix.exe Command switches used :: E:\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\dbhlp32.exe C:\WINDOWS\dionpis.exe C:\WINDOWS\fiosectc.exe C:\WINDOWS\fmbiost.exe C:\WINDOWS\fmsbbqi.exe C:\WINDOWS\fmsiocps.exe C:\WINDOWS\fmsjhif.exe C:\WINDOWS\LotusHlp.exe C:\WINDOWS\mfchlp64.exe . ((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))) . 2008-06-26 11:36 . 2008-06-26 11:36 <DIR> d-------- C:\Documents and Settings\úukasz.DOM-EF40A7CDDB9 2008-06-26 11:36 . 2008-06-26 11:36 <DIR> d-------- C:\Documents and Settings\úukasz 2008-06-25 10:42 . 2008-06-26 15:25 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-06-25 10:42 . 2008-06-26 15:25 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-06-25 10:41 . 2008-06-26 15:26 2,316,320 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-25 10:41 . 2008-06-26 15:26 29,144 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-25 10:41 . 2008-06-26 15:41 27,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-06-25 10:41 . 2008-06-26 15:26 4,472 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-06-23 15:09 . 2008-06-23 15:09 <DIR> d-------- E:\Program Files\ESET 2008-06-23 15:09 . 2008-06-23 15:09 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ESET 2008-06-23 15:04 . 2008-06-23 15:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-06-23 15:04 . 2008-06-26 15:29 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab 2008-06-23 11:49 . 2008-06-25 10:41 <DIR> d-------- E:\Program Files\Kaspersky Lab 2008-06-22 16:26 . 2008-06-22 17:40 65,765 --a------ C:\WINDOWS\msvupdater.config 2008-06-22 16:25 . 2008-06-22 16:24 118,272 --a------ C:\WINDOWS\msvupdater.exe 2008-06-22 10:37 . 1994-08-24 00:00 188,960 --a------ C:\WINDOWS\system32\WINGDE.DLL 2008-06-22 10:37 . 1994-09-21 00:00 92,208 --a------ C:\WINDOWS\system32\WING.DLL 2008-06-22 10:37 . 1994-09-21 00:00 12,800 --a------ C:\WINDOWS\system32\WING32.DLL 2008-06-22 10:37 . 1994-09-21 00:00 6,736 --a------ C:\WINDOWS\system32\WINGDIB.DRV 2008-06-22 10:37 . 1994-09-21 00:00 5,024 --a------ C:\WINDOWS\system32\WINGPAL.WND 2008-06-19 11:37 . 2008-06-19 11:37 33,280 --a------ C:\WINDOWS\system32\winool32.dll 2008-06-19 11:36 . 2008-06-19 11:36 33,280 --a------ C:\WINDOWS\system32\winzsr32.dll 2008-06-19 11:36 . 2008-06-19 11:36 33,280 --a------ C:\WINDOWS\system32\wintlr32.dll 2008-06-15 14:38 . 2008-06-15 14:38 <DIR> d-------- E:\Program Files\microsoft frontpage 2008-06-15 11:27 . 2008-06-15 11:27 <DIR> d--h----- E:\Program Files\InstallShield Installation Information 2008-06-14 16:14 . 2008-06-14 16:14 <DIR> d-------- E:\Program Files\OLYMPUS 2008-06-06 17:15 . 2008-06-26 10:04 <DIR> d-------- E:\Program Files\7-Zip 2008-06-06 16:58 . 2008-06-06 16:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\platform dupe draw memo 2008-06-04 23:45 . 2008-06-04 23:45 <DIR> d-------- E:\Program Files\Audacity 2008-06-03 18:46 . 2008-06-03 18:46 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-06-03 18:46 . 2008-06-03 18:46 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-05-29 21:06 . 2008-05-29 21:06 <DIR> d-------- C:\Downloads 2008-05-28 19:43 . 2008-05-28 19:43 <DIR> d-------- C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Creative 2008-05-28 19:43 . 2008-05-28 19:43 <DIR> d-------- C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Creative 2008-05-28 19:43 . 2008-05-28 19:43 <DIR> d-------- C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Creative 2008-05-28 18:42 . 2000-05-22 02:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2008-05-28 18:42 . 2006-10-06 00:17 53,248 --------- C:\WINDOWS\Ctregrun.exe 2008-05-28 18:41 . 2003-03-18 21:20 1,060,864 --------- C:\WINDOWS\system32\mfc71.dll 2008-05-28 18:41 . 2003-03-18 20:14 499,712 --------- C:\WINDOWS\system32\msvcp71.dll 2008-05-28 18:38 . 2008-05-28 19:44 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Creative 2008-05-28 18:15 . 2006-09-16 01:05 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-05-27 23:12 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll 2008-05-27 23:12 . 2001-05-16 17:54 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2008-05-27 23:12 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax 2008-05-27 23:11 . 2008-05-27 23:11 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-05-27 23:10 . 2008-05-27 23:10 <DIR> d-------- E:\Program Files\WinFast 2008-05-26 08:23 . 2008-05-26 08:23 20 --a------ C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\mhsha1.dat 2008-05-26 08:23 . 2008-05-26 08:23 20 --a------ C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\mhsha1.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 13:26 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys 2008-06-26 08:05 --------- d-----w E:\Program Files\eMule 2008-06-26 08:05 --------- d-----w E:\Program Files\CursorXP 2008-06-26 08:05 --------- d-----w E:\Program Files\ChrisTV 2008-06-26 08:04 --------- d-----w E:\Program Files\BearShare Pro 2008-06-26 08:04 --------- d-----w E:\Program Files\BearShare 2008-06-25 20:01 --------- d-----w E:\Program Files\Winamp 2008-06-25 19:59 --------- d-----w E:\Program Files\Total Video Converter 2008-06-25 19:58 --------- d-----w E:\Program Files\Rockstar Games 2008-06-25 19:57 --------- d-----w E:\Program Files\Real Alternative 2008-06-14 18:27 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\MegauploadToolbar 2008-06-14 18:27 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\MegauploadToolbar 2008-06-14 18:27 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\MegauploadToolbar 2008-06-06 14:59 216 ----a-w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\ani.ani.bat 2008-06-06 14:59 216 ----a-w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\ani.ani.bat 2008-05-30 20:56 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\XnView 2008-05-30 20:56 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\XnView 2008-05-30 20:56 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\XnView 2008-05-30 18:29 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DVD Shrink 2008-05-28 17:53 --------- d-----w E:\Program Files\Team17 2008-05-22 12:06 --------- d-----w E:\Program Files\EA GAMES 2008-05-22 11:27 --------- d-----w E:\Program Files\XnView 2008-05-20 21:39 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\WNR 2008-05-20 21:39 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\WNR 2008-05-20 21:39 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\WNR 2008-05-18 21:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help 2008-05-17 21:18 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Media Player Classic 2008-05-17 21:18 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Media Player Classic 2008-05-17 21:18 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Media Player Classic 2008-05-14 14:42 2,688 ----a-w C:\WINDOWS\system32\drivers\hapdrv.sys 2008-05-13 18:37 --------- d-----w E:\Program Files\VSD Software 2008-05-13 18:29 --------- d-----w E:\Program Files\K-Lite Codec Pack 2008-05-11 19:22 --------- d-----w E:\Program Files\Arjaloc 2008-05-08 17:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\NFS Underground 2008-05-07 18:51 --------- d-----w C:\Program Files\Common Files\DirectX 2008-05-07 18:46 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-05-07 14:50 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\GetRight 2008-05-07 14:50 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\GetRight 2008-05-07 14:50 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\GetRight 2008-05-07 13:46 --------- d-----w E:\Program Files\GetRight 2008-05-01 21:39 --------- d-----w E:\Program Files\BitComet 2008-05-01 09:00 47,104 ----a-w C:\WINDOWS\system32\KMVIDC32.DLL 2008-04-30 12:52 2,437 --s-a-w C:\WINDOWS\system32\ytf.dll 2008-04-29 16:16 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Tibia 2008-04-29 16:16 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Tibia 2008-04-29 16:16 --------- d-----w C:\Documents and Settings\Łukasz.DOM-EF40A7CDDB9\Dane aplikacji\Tibia 2008-04-28 17:53 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-04-22 21:46 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll 2008-04-22 21:22 504,832 ----a-w C:\WINDOWS\system32\winlogon.exe 2008-04-22 18:53 168 ----a-w C:\Documents and Settings\Łukasz\ani.ani.bat 2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll 2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll . ------- Sigcheck ------- 2008-04-22 23:22 504832 381221f69d1248864861889a64f100b6 C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((( snapshot@2008-06-26_11.35.40.57 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-26 09:30:46 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-26 13:28:05 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:34 128000] "Dzieńdobry!"="E:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe" [2008-06-25 22:00 753664] "BitComet"="E:\Program Files\BitComet\BitComet.exe" [2008-02-01 09:20 2194744] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C:\WINDOWS\system32\kdxqr.exe"="C:\WINDOWS\system32\kdxqr.exe" [ ] "WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{d21ac220-ebb3-4110-9817-37aa0cce636b}"= C:\WINDOWS\system32\dqSADSAD1040.dll [ ] "{6a4c8648-b38c-4f16-84ac-90df19880383}"= C:\WINDOWS\system32\dqSUCSUC1042.dll [ ] "{ea034451-03fa-4438-bd52-ff0446afa96c}"= C:\WINDOWS\system32\hhLSLLSL1040.dll [ ] "{a7aac22d-0bc2-48fa-9196-f43fef7f8cda}"= C:\WINDOWS\system32\MMHADPQG1076.dll [ ] "{5d605b2b-d1f8-4897-8ca4-cd8e1491b624}"= C:\WINDOWS\system32\MMMYSBDR1059.dll [ ] "{9ed93b14-8d71-45cb-970b-0b8a22449f48}"= C:\WINDOWS\system32\ttBAIBAI1069.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winool32] winool32.dll 2008-06-19 11:37 33280 C:\WINDOWS\system32\winool32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ĐŢ¸´ą¤ľß.exe] Debugger=net [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^InterVideo WinCinema Manager.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\InterVideo WinCinema Manager.lnk backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPSrv] C:\WINDOWS\AVPSrv.exE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bincdwsa] C:\WINDOWS\bincdwsa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dbhlp32] C:\WINDOWS\dbhlp32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dionpis] C:\WINDOWS\dionpis.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\draw memo up hide] --a------ 2008-06-23 12:01 877056 C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\platform dupe draw memo\Poke Anti.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting] --a------ 2005-04-25 13:45 36040 C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui] --a------ 2008-03-13 16:48 1443072 E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fiosectc] C:\WINDOWS\fiosectc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmbiost] C:\WINDOWS\fmbiost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmsbbqi] C:\WINDOWS\fmsbbqi.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmsiocps] C:\WINDOWS\fmsiocps.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fmsjhif] C:\WINDOWS\fmsjhif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] --a------ 2007-09-19 22:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\locksbags] C:\DOCUME~1\UKASZ~1.DOM\DANEAP~1\LOVEPL~1\Browse Road.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LotusHlp] C:\WINDOWS\LotusHlp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mfchlp64] C:\WINDOWS\mfchlp64.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msvupdater] --a------ 2008-06-22 16:24 118272 C:\WINDOWS\msvupdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAVMon64] C:\WINDOWS\NAVMon64.exE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM2_Monitor] --a------ 2007-02-08 20:43 95800 E:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ptshell] C:\WINDOWS\ptshell.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tciocp64] C:\WINDOWS\tciocp64.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ticisms] C:\WINDOWS\ticisms.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\upxdnd] C:\WINDOWS\upxdnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinRemote] --a------ 2008-06-26 10:06 131072 E:\Program Files\InterVideo\WinDVR\WinRemote.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINSCHEDULER] --a------ 2008-03-21 11:25 139264 E:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSockDrv32] C:\WINDOWS\oowluj.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "E:\\Program Files\\BitComet\\BitComet.exe"= "E:\\Program Files\\InterActive Vision\\Road Wars Demo\\RoadWars.exe"= "E:\\Program Files\\BearShare Pro\\Bearshare.exe"= "C:\\WINDOWS\\system32\\winver.exe"= "C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"= "E:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "19215:TCP"= 19215:TCP:BitComet 19215 TCP "19215:UDP"= 19215:UDP:BitComet 19215 UDP R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] S3 obj2;obj2;C:\WINDOWS\system32\DRIVERS\obj2.sys [] S3 sys_flt;sys_flt;C:\DOCUME~1\UKASZ~1.DOM\USTAWI~1\Temp\~90.tmp [] S3 XDva136;XDva136;C:\WINDOWS\system32\XDva136.sys [] *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder "2008-06-26 13:00:00 C:\WINDOWS\Tasks\A38C8BBA90673E5E.job" - c:\docume~1\ukasz~1.dom\daneap~1\lovepl~1\Boldinsideshow.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-26 15:41:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\sys_flt] "ImagePath"="\??\C:\DOCUME~1\UKASZ~1.DOM\USTAWI~1\Temp\~90.tmp" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\winool32.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Gadu-Gadu\ggwhook.dll . Completion time: 2008-06-26 15:44:17 ComboFix-quarantined-files.txt 2008-06-26 13:44:05 ComboFix2.txt 2008-06-26 09:36:48 Pre-Run: 433,053,696 bajtów wolnych Post-Run: 425,893,888 bajtów wolnych 278

a Tu log z SDFix

Kod: Zaznacz wszystko: http://wklej.org/id/1183a4873a

Screen z msconfig

Dorzucam jeszcze log'a z HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:52:34, on 2008-06-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe E:\Program Files\Winamp\winampa.exe E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\CursorXP\CursorXP.exe E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Windows Media Player\wmplayer.exe E:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Gadu-Gadu\gg.exe E:\Program Files\Internet Explorer\IEXPLORE.EXE E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqr.exe] C:\WINDOWS\system32\kdxqr.exe O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s O4 - HKCU\..\Run: [Dzieńdobry!] E:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [BitComet] "E:\Program Files\BitComet\BitComet.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Download with GetRight - E:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - E:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- End of file - 5102 bytes

**Posty:** 7956 · przez **Magik** 26 Cze 2008, 16:56

hmm wszystko ladnie pieknie tylko combofix nie usunal tych plikow a to pliki trojana :arrow:

hmmm............zabij te procesy i usun pliki za pomoca gmer'a
http://www.gmer.net/index.php?lang=pl

Kod: Zaznacz wszystko: C:\WINDOWS\fiosectc.exe C:\WINDOWS\fmsbbqi.exe C:\WINDOWS\fmsiocps.exe C:\WINDOWS\fmsjhif.exe C:\WINDOWS\fmbiost.exe C:\WINDOWS\mfchlp64.exe C:\WINDOWS\LotusHlp.exe C:\WINDOWS\dionpis.exe C:\WINDOWS\dbhlp32.exe

na sdfix'a zawsze mozna liczyc

co do msconfig
:arrow:

rozumiem ze ponizej tej listy wszystko masz odhaczone.........bo z tego co podswietliles to wszystko jest ok

jedynie to ta aplikacja "dzien dobry" chyba ze uzywasz :arrow:

**Posty:** 165 · przez **gtavc** 26 Cze 2008, 17:06

w Gmer'ze niema tych porcesów ani plików

a co do DzieńDobry to używam

**Posty:** 18165 · przez **wojtas** 26 Cze 2008, 17:22

daj nowego loga jeszcze z combofixa

**Posty:** 84 · przez **gloni** 26 Cze 2008, 18:49

co do msconfig

to mozesz spokojnie jeszcze wyłączyć winampa , Nerocheck, bitcomet- po co ci sie mają ładować przy starcie.

System długo ci sie ładuje jak nie masz duzo pamięci słaby procek i stary komp to kasperski troche muli kompa , do słabszych kompów , aby nie mulił bardzo dobry jest NOD.

A na twoim to jest chyba 2x antywirus :
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

Zostaw 1

mała prędkość łącza

mała prędkość łącza

Kto jest na forum