Adware.win32.onestep.z :(

**Posty:** 11 · przez **deadrat7** 09 Lis 2008, 13:42

Witam,
Mam problem z tym virusem, po zainstalowaniu programu do przerabiania filmików na komórke zaatakował mnie ów virus - tutaj scrn z Kasprzaka - http://img128.imageshack.us/img128/3351/kasperskyfj1.jpg
nie moglem otwrzyc przez niego taskmgr.exe i innych progamow po czym zrestartowal mi się komp

Proszę o sprawdzenie logów w celu zneutralizowania virusa.
Dziękuje.

HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:41:23, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Advanced Registry Doctor\RegManServ.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspee.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspee.dll O3 - Toolbar: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspee.dll O4 - HKLM\..\Run: [SkyTel] C:\Documents and Settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA1D68C-62E9-434E-AEF9-A08C246E012C}: NameServer = 217.30.129.149,217.30.137.200 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6172 bytes

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - Ferson 2008-11-09 12:27:16.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.299 [GMT 1:00] Uruchomiony z: c:\documents and settings\Ferson\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 12:22 . 2008-11-09 12:22 <DIR> d-------- c:\program files\Trend Micro 2008-11-09 11:01 . 2008-11-09 12:28 <DIR> d-------- c:\program files\SearchIn1Step 2008-11-09 10:58 . 2008-11-09 10:58 <DIR> d-------- c:\program files\speedapps 2008-11-09 10:58 . 2008-11-09 10:58 <DIR> d-------- c:\program files\Conduit 2008-11-07 18:26 . 2008-11-07 18:26 <DIR> d-------- c:\program files\BestGameEver 2008-11-05 17:26 . 2008-11-05 17:26 83 --a------ c:\windows\wa.INI 2008-11-04 18:35 . 1998-10-07 13:54 327,168 --a------ c:\windows\IsUn0415.exe 2008-11-04 18:34 . 2008-11-05 17:54 <DIR> d-------- c:\program files\Worms Armageddon 2008-11-03 16:35 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-03 16:35 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-03 16:35 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-02 22:55 . 2008-11-02 22:55 0 -ra------ C:\logwmemory.bin 2008-11-02 22:54 . 2008-11-02 22:54 <DIR> d-------- C:\Soldat 2008-11-02 22:54 . 2008-11-02 22:54 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\Soldat 2008-11-02 20:44 . 2008-11-09 12:00 <DIR> d-------- c:\program files\mIRC 2008-11-02 20:44 . 2008-11-09 12:02 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\mIRC 2008-11-02 16:33 . 2008-11-09 12:00 116 --a------ c:\windows\NeroDigital.ini 2008-11-02 15:33 . 2004-03-02 17:37 125,184 --------- c:\windows\system32\drivers\imagesrv.sys 2008-11-02 15:33 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll 2008-11-02 15:33 . 2004-03-02 17:37 5,504 --------- c:\windows\system32\drivers\imagedrv.sys 2008-11-02 15:32 . 2008-11-02 15:32 <DIR> d-------- c:\program files\Common Files\Ahead 2008-11-02 15:32 . 2008-11-02 15:33 <DIR> d-------- c:\program files\Ahead 2008-11-02 15:32 . 2004-07-26 17:16 1,568,768 --------- c:\windows\system32\ImagX7.dll 2008-11-02 15:32 . 2004-07-26 17:16 476,320 --------- c:\windows\system32\ImagXpr7.dll 2008-11-02 15:32 . 2004-07-26 17:16 471,040 --------- c:\windows\system32\ImagXRA7.dll 2008-11-02 15:32 . 2004-07-26 17:16 262,144 --------- c:\windows\system32\ImagXR7.dll 2008-11-02 15:32 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe 2008-11-02 10:57 . 2008-11-02 11:05 <DIR> d-------- c:\program files\SHOUTcast 2008-11-02 10:53 . 2008-11-02 10:53 <DIR> d-------- C:\shtcs 2008-10-31 22:33 . 2008-10-31 22:33 <DIR> d-------- c:\windows\Sun 2008-10-30 17:21 . 2008-10-30 17:31 100,000,000 --a------ C:\MS.Office.2007_pl.part2.rar 2008-10-30 17:21 . 2008-10-30 17:33 100,000,000 --a------ C:\MS.Office.2007_pl.part1.rar 2008-10-29 19:59 . 2008-10-29 20:00 <DIR> d-------- c:\documents and settings\Gość\Dane aplikacji\Winamp 2008-10-27 18:22 . 2008-10-27 18:22 <DIR> d-------- c:\program files\Common Files\Adobe AIR 2008-10-27 18:20 . 2008-10-27 18:20 <DIR> d-------- c:\program files\Common Files\Adobe 2008-10-26 13:36 . 2008-11-02 15:36 <DIR> d-------- C:\FL.Studio.XXL.v8.0.2-DOA 2008-10-22 21:56 . 2008-10-25 15:01 <DIR> d-------- C:\Dj Doboy Vocal Editions 2008-10-20 23:22 . 2008-10-20 23:22 <DIR> d-------- c:\program files\PC Inspector File Recovery 2008-10-20 23:22 . 2002-02-18 17:40 6,200 --a------ c:\windows\system32\INT13EXT.VXD 2008-10-20 22:17 . 2008-10-20 22:17 <DIR> d-------- c:\program files\Ontrack 2008-10-20 22:17 . 2001-03-02 09:41 634 --a------ c:\windows\system32\MAPISVC.INF 2008-10-20 15:56 . 2008-10-20 15:56 <DIR> d-------- C:\Audio 2008-10-20 15:56 . 2000-11-08 00:52 53,248 --a------ c:\windows\system32\stu.dll 2008-10-20 15:54 . 2008-10-20 15:54 <DIR> d-------- c:\program files\rgcaudio 2008-10-20 15:53 . 2008-10-20 15:53 <DIR> d-------- c:\windows\IDJ Groove & Phrase Synth 2008-10-18 22:13 . 2008-10-18 22:13 <DIR> d-------- c:\program files\CzasoWyłącznik 2008-10-17 21:28 . 2008-10-17 21:28 <DIR> d-------- c:\program files\PhotoFiltre Studio 2008-10-17 21:28 . 2008-10-17 21:28 45 ---h----- c:\windows\dsez9457.dat 2008-10-16 21:28 . 2008-10-16 21:28 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\MixMeister Technology 2008-10-16 21:26 . 2008-10-16 21:28 <DIR> d-------- c:\program files\MixMeister Fusion + Video 2008-10-15 05:53 . 2008-08-14 14:40 2,187,264 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,144,256 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,064,256 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,022,400 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-12 20:13 . 2008-10-12 20:14 5,116,910 --a------ C:\Wideo-0003.mp4 2008-10-09 14:27 . 2008-10-09 14:27 <DIR> d-------- c:\windows\Easy CD-DA Extractor 2008-10-09 14:27 . 2008-10-09 14:54 <DIR> d-------- c:\program files\Easy CD-DA Extractor 8 2008-10-09 14:04 . 2008-10-09 14:04 <DIR> d-------- c:\program files\Java 2008-10-09 14:04 . 2008-10-09 14:04 <DIR> d-------- c:\program files\Common Files\Java 2008-10-09 14:04 . 2008-06-10 01:32 73,728 --a------ c:\windows\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 11:30 606,240 --sha-w c:\windows\system32\drivers\fidbox2.dat 2008-11-09 11:30 6,296 --sha-w c:\windows\system32\drivers\fidbox2.idx 2008-11-09 11:30 3,050,016 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-11-09 11:30 28,052 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-11-09 11:29 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\foobar2000 2008-11-09 11:04 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-11-09 10:51 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\uTorrent 2008-11-04 17:34 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-04 07:14 --------- d-----w c:\program files\Opera 2008-11-02 12:17 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\Winamp 2008-11-02 09:57 --------- d-----w c:\program files\Winamp 2008-10-26 12:49 --------- d-----w c:\program files\Image-Line 2008-10-25 19:51 --------- d-----w c:\program files\VstPlugins 2008-10-20 05:41 --------- d-----w c:\program files\GSC Game World 2008-09-29 19:50 --------- d-----w c:\program files\Native Instruments 2008-09-28 12:19 --------- d-----w c:\program files\TP 2008-09-27 21:19 --------- d-----w c:\program files\Advanced Registry Doctor 2008-09-26 21:16 --------- d-----w c:\program files\Marvell 2008-09-23 21:06 --------- d-----w c:\program files\SubEdit-Player 2008-09-23 13:36 --------- d-----w c:\program files\Alcohol Soft 2008-09-23 13:32 685,816 ----a-w c:\windows\system32\drivers\sptd.sys 2008-09-22 20:55 --------- d-----w c:\program files\Lavalys 2008-09-22 17:22 --------- d-----w c:\program files\Realtek 2008-09-22 16:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI 2008-09-22 16:57 --------- d-----w c:\program files\My Company Name 2008-09-22 16:56 --------- d-----w c:\program files\ATI Technologies 2008-09-22 16:53 --------- d-----w c:\program files\Common Files\ATI Technologies 2008-09-15 15:17 1,847,168 ----a-w c:\windows\system32\win32k.sys 2008-09-14 18:48 --------- d-----w c:\program files\Winamp Remote 2008-09-14 18:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2008-09-14 12:53 --------- d-----w c:\program files\Google 2008-09-14 11:46 --------- d-----w c:\program files\Real Alternative 2008-09-14 11:46 --------- d-----w c:\program files\Media Player Classic 2008-09-14 09:29 --------- d-----w c:\program files\ASIO4ALL v2 2008-09-14 09:28 --------- d-----w c:\program files\Outsim 2008-09-11 19:20 --------- d-----w c:\program files\coolpro2 2008-09-09 06:31 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\ATI 2008-09-07 20:10 2,853,630 ----a-w C:\foobar2000_0.9.5.5.exe 2008-09-07 20:09 8,215,056 ----a-w C:\Firefox Setup 3.0.1.exe 2008-09-07 20:07 23,510,720 ----a-w C:\dotnetfx.exe 2008-08-26 09:12 827,904 ----a-w c:\windows\system32\wininet.dll 2008-08-14 13:40 2,144,256 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 13:40 2,022,400 ----a-w c:\windows\system32\ntkrnlpa.exe 2008-08-10 22:09 97,288 ----a-w C:\DSETUP.dll 2008-08-10 22:09 528,392 ----a-w C:\DXSETUP.exe 2008-08-10 22:09 1,694,728 ----a-w C:\dsetup32.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{d9c9a8c9-460d-4343-888e-ae02bcc3ce57}"= "c:\program files\speedapps\tbspee.dll" [2008-08-20 1780248] [HKEY_CLASSES_ROOT\clsid\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d9c9a8c9-460d-4343-888e-ae02bcc3ce57}] 2008-08-20 23:03 1780248 --a------ c:\program files\speedapps\tbspee.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{d9c9a8c9-460d-4343-888e-ae02bcc3ce57}"= "c:\program files\speedapps\tbspee.dll" [2008-08-20 1780248] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "Google Update"="c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-10-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="c:\documents and settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe" [2006-05-16 2879488] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088] "RTHDCPL"="RTHDCPL.EXE" [2005-05-25 c:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a------ 2008-08-12 18:05 1582064 c:\progra~1\WapSter\WAPSTE~1\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592] R3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2005-08-30 58320] R3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304] R3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000] . Zawartość folderu 'Zaplanowane zadania' 2008-11-09 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-10-08 17:26] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\ FF -: plugin - c:\documents and settings\Ferson\Dane aplikacji\Mozilla\plugins\npoctoshape.dll FF -: plugin - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.131.25\npGoogleOneClick6.dll FF -: plugin - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Octoshape\Octoshape Streaming Services\octoprogram-L03-NMS0808050_SUA_900\npoctoshape.dll FF -: plugin - c:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - c:\program files\Opera\program\plugins\npdivx32.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 12:31:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Advanced Registry Doctor\RegManServ.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-11-09 12:34:23 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-09 11:34:18 Przed: 3 286 286 336 bajtów wolnych Po: 3,496,550,400 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 215 --- E O F --- 2008-10-24 01:00:28

SilentRunners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "Google Update" = ""C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c" ["Google Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "SkyTel" = "C:\Documents and Settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe" ["Realtek Semiconductor Corp."] "StartCCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"" [null data] "WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."] "Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"" ["Kaspersky Lab"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {18DF081C-E8AD-4283-A596-FA578C2EBDC3}\(Default) = "AcroIEHelperStub" -> {HKLM...CLSID} = "Adobe PDF Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll" ["Adobe Systems Incorporated"] {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\(Default) = "IEVkbdBHO" -> {HKLM...CLSID} = "IEVkbdBHO Class" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll" ["Kaspersky Lab"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {d9c9a8c9-460d-4343-888e-ae02bcc3ce57}\(Default) = "A_*fa*H*" (unwritable string) -> {HKLM...CLSID} = "speedapps Toolbar" \InProcServer32\(Default) = "C:\Program Files\speedapps\tbspee.dll" ["Conduit Ltd."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{10677009-C23C-4FC2-A62C-29323A2201F0}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\AQQ\System\AQQSHE~1.DLL" [null data] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Web traffic protection statistics" -> {HKLM...CLSID} = "Web traffic protection statistics" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll" ["Kaspersky Lab"] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real Alternative\rpshell.dll" ["RealNetworks, Inc."] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" [empty string] "{46E22146-59C0-4136-9233-52E412E2B428}" = "EzCddax extension" -> {HKLM...CLSID} = "EzCddax Class" \InProcServer32\(Default) = "C:\Program Files\Easy CD-DA Extractor 8\ezcddax8.dll" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshserviceobj.dll" [MS] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ AQQFileTransfer\(Default) = "{10677009-C23C-4FC2-A62C-29323A2201F0}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] EzCddax\(Default) = "{46E22146-59C0-4136-9233-52E412E2B428}" -> {HKLM...CLSID} = "EzCddax Class" \InProcServer32\(Default) = "C:\Program Files\Easy CD-DA Extractor 8\ezcddax8.dll" [null data] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ AlcoholAutoPlayV2.BurnDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "BurnDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\BurnDisc\command\(Default) = ""C:\Program Files\Alcohol Soft\Alcohol 120\_Alcohol.exe" %1" ["Alcohol Soft Development Team"] AlcoholAutoPlayV2.ReadDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "ReadDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\ReadDisc\command\(Default) = ""C:\Program Files\Alcohol Soft\Alcohol 120\_Alcohol.exe" %1" ["Alcohol Soft Development Team"] EZCDDAXAutoPlayAudioCD\ "Provider" = "Easy CD-DA Extractor 8" "InvokeProgID" = "ezcddax.AutoPlay" "InvokeVerb" = "AudioCD" HKLM\SOFTWARE\Classes\ezcddax.AutoPlay\shell\AudioCD\command\(Default) = ""C:\Program Files\Easy CD-DA Extractor 8\ezcddax.exe" -nn" ["Jukka Poikolainen"] EZCDDAXAutoPlayBlankCD\ "Provider" = "Easy CD-DA Extractor 8" "InvokeProgID" = "ezcddax.AutoPlay" "InvokeVerb" = "EmptyCD" HKLM\SOFTWARE\Classes\ezcddax.AutoPlay\shell\EmptyCD\command\(Default) = ""C:\Program Files\Easy CD-DA Extractor 8\ezcddax.exe" -nn" ["Jukka Poikolainen"] FunMultiMediaHandler\ "Provider" = "MultiMedia Manager" "ProgID" = "FUNBOX.Autoplay" HKLM\SOFTWARE\Classes\FUNBOX.Autoplay\CLSID\(Default) = "{DF866F1F-10DF-4694-94A9-7F526FC8800A}" -> {HKLM...CLSID} = "FUNBOX Autoplay Sample 2" \LocalServer32\(Default) = "C:\Program Files\Samsung\Samsung PC Studio 3\Share_autoplay.exe" ["TODO: <** **>" (unwritable string)] MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] NeroAutoPlay2AudioToNeroDigital\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "PlayCDAudioOnArrival_AudioToNeroDigital" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_AudioToNeroDigital\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /Dialog:SaveTracks /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_CDAudio" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /New:AudioCD /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2CopyCD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "PlayCDAudioOnArrival_CopyCD" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_CopyCD\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /Dialog:DiscCopy /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2DataDisc\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_DataDisc" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_DataDisc\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /w /New:ISODisc /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2LaunchNeroStartSmart\ "Provider" = "Nero StartSmart" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_LaunchNeroStartSmart" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_LaunchNeroStartSmart\command\(Default) = "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart.exe /AutoPlay /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2RipCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "PlayCDAudioOnArrival_RipCD" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_RipCD\command\(Default) = "C:\Program Files\Ahead\nero\nero.exe /Dialog:SaveTracks /Drive:%L" ["Ahead Software AG"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Enabled Scheduled Tasks: ------------------------ "GoogleUpdateTaskUser" -> launches: "C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe /c" ["Google Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{D9C9A8C9-460D-4343-888E-AE02BCC3CE57}" = "speedapps Toolbar" -> {HKLM...CLSID} = "speedapps Toolbar" \InProcServer32\(Default) = "C:\Program Files\speedapps\tbspee.dll" ["Conduit Ltd."] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Web traffic protection statistics" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll" ["Kaspersky Lab"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ "ButtonText" = "Web traffic protection statistics" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{d9c9a8c9-460d-4343-888e-ae02bcc3ce57}" = (no title provided) -> {HKLM...CLSID} = "speedapps Toolbar" \InProcServer32\(Default) = "C:\Program Files\speedapps\tbspee.dll" ["Conduit Ltd."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Kaspersky Anti-Virus, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" -r" ["Kaspersky Lab"] Registry Management Service, RegManServ, "C:\Program Files\Advanced Registry Doctor\RegManServ.exe" [null data] StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] ---------- (launch time: 2008-11-09 12:37:00) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 88 seconds. ---------- (total run time: 129 seconds)

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 14:01

na fix:

Kod: Zaznacz wszystko: R3 - URLSearchHook: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspee.dll O2 - BHO: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspee.dll O3 - Toolbar: speedapps Toolbar - {d9c9a8c9-460d-4343-888e-ae02bcc3ce57} - C:\Program Files\speedapps\tbspee.dll O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

jako, ze siedzi Trojan.Downloader-Gen odpal

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będšc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierd czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartoć pliku Report.txt + log z combofixa

**Posty:** 11 · przez **deadrat7** 09 Lis 2008, 14:45

Zrobiłem to co mi nakazałeś, czekam na kolejne wskazówki,

SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Ferson on 2008-11-09 at 13:20 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 13:31:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:3a,2a,bc,ef,cf,ba,1d,98,86,a8,21,66,16,da,92,5f,ab,b7,08,ae,f7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:3a,2a,bc,ef,cf,ba,1d,98,86,a8,21,66,16,da,92,5f,ab,b7,08,ae,f7,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"="C:\\Program Files\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Fri 27 Feb 2004 233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll" [b]Finished![/b]

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - Ferson 2008-11-09 13:38:55.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.517 [GMT 1:00] Uruchomiony z: c:\documents and settings\Ferson\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 13:18 . 2008-11-09 13:18 <DIR> d-------- c:\windows\ERUNT 2008-11-09 13:14 . 2008-11-09 13:14 <DIR> d-------- c:\documents and settings\Administrator 2008-11-09 13:06 . 2008-11-09 13:34 <DIR> d-------- C:\SDFix 2008-11-09 13:05 . 2008-11-09 13:05 2,359,350 --a------ C:\bez tytułu.bmp 2008-11-09 12:45 . 2008-11-09 12:45 <DIR> d-------- C:\rsit 2008-11-09 12:22 . 2008-11-09 12:22 <DIR> d-------- c:\program files\Trend Micro 2008-11-09 11:01 . 2008-11-09 12:28 <DIR> d-------- c:\program files\SearchIn1Step 2008-11-09 10:58 . 2008-11-09 13:17 <DIR> d-------- c:\program files\speedapps 2008-11-09 10:58 . 2008-11-09 10:58 <DIR> d-------- c:\program files\Conduit 2008-11-07 18:26 . 2008-11-07 18:26 <DIR> d-------- c:\program files\BestGameEver 2008-11-05 17:26 . 2008-11-05 17:26 83 --a------ c:\windows\wa.INI 2008-11-04 18:35 . 1998-10-07 13:54 327,168 --a------ c:\windows\IsUn0415.exe 2008-11-04 18:34 . 2008-11-05 17:54 <DIR> d-------- c:\program files\Worms Armageddon 2008-11-03 16:35 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-03 16:35 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-03 16:35 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-02 22:55 . 2008-11-02 22:55 0 -ra------ C:\logwmemory.bin 2008-11-02 22:54 . 2008-11-02 22:54 <DIR> d-------- C:\Soldat 2008-11-02 22:54 . 2008-11-02 22:54 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\Soldat 2008-11-02 20:44 . 2008-11-09 12:00 <DIR> d-------- c:\program files\mIRC 2008-11-02 20:44 . 2008-11-09 12:02 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\mIRC 2008-11-02 16:33 . 2008-11-09 12:45 116 --a------ c:\windows\NeroDigital.ini 2008-11-02 15:33 . 2004-03-02 17:37 125,184 --------- c:\windows\system32\drivers\imagesrv.sys 2008-11-02 15:33 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll 2008-11-02 15:33 . 2004-03-02 17:37 5,504 --------- c:\windows\system32\drivers\imagedrv.sys 2008-11-02 15:32 . 2008-11-02 15:32 <DIR> d-------- c:\program files\Common Files\Ahead 2008-11-02 15:32 . 2008-11-02 15:33 <DIR> d-------- c:\program files\Ahead 2008-11-02 15:32 . 2004-07-26 17:16 1,568,768 --------- c:\windows\system32\ImagX7.dll 2008-11-02 15:32 . 2004-07-26 17:16 476,320 --------- c:\windows\system32\ImagXpr7.dll 2008-11-02 15:32 . 2004-07-26 17:16 471,040 --------- c:\windows\system32\ImagXRA7.dll 2008-11-02 15:32 . 2004-07-26 17:16 262,144 --------- c:\windows\system32\ImagXR7.dll 2008-11-02 15:32 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe 2008-11-02 10:57 . 2008-11-02 11:05 <DIR> d-------- c:\program files\SHOUTcast 2008-11-02 10:53 . 2008-11-02 10:53 <DIR> d-------- C:\shtcs 2008-10-31 22:33 . 2008-10-31 22:33 <DIR> d-------- c:\windows\Sun 2008-10-30 17:21 . 2008-10-30 17:31 100,000,000 --a------ C:\MS.Office.2007_pl.part2.rar 2008-10-30 17:21 . 2008-10-30 17:33 100,000,000 --a------ C:\MS.Office.2007_pl.part1.rar 2008-10-29 19:59 . 2008-10-29 20:00 <DIR> d-------- c:\documents and settings\Gość\Dane aplikacji\Winamp 2008-10-27 18:22 . 2008-10-27 18:22 <DIR> d-------- c:\program files\Common Files\Adobe AIR 2008-10-27 18:20 . 2008-10-27 18:20 <DIR> d-------- c:\program files\Common Files\Adobe 2008-10-26 13:36 . 2008-11-02 15:36 <DIR> d-------- C:\FL.Studio.XXL.v8.0.2-DOA 2008-10-22 21:56 . 2008-10-25 15:01 <DIR> d-------- C:\Dj Doboy Vocal Editions 2008-10-20 23:22 . 2008-10-20 23:22 <DIR> d-------- c:\program files\PC Inspector File Recovery 2008-10-20 23:22 . 2002-02-18 17:40 6,200 --a------ c:\windows\system32\INT13EXT.VXD 2008-10-20 22:17 . 2008-10-20 22:17 <DIR> d-------- c:\program files\Ontrack 2008-10-20 22:17 . 2001-03-02 09:41 634 --a------ c:\windows\system32\MAPISVC.INF 2008-10-20 15:56 . 2008-10-20 15:56 <DIR> d-------- C:\Audio 2008-10-20 15:56 . 2000-11-08 00:52 53,248 --a------ c:\windows\system32\stu.dll 2008-10-20 15:54 . 2008-10-20 15:54 <DIR> d-------- c:\program files\rgcaudio 2008-10-20 15:53 . 2008-10-20 15:53 <DIR> d-------- c:\windows\IDJ Groove & Phrase Synth 2008-10-18 22:13 . 2008-10-18 22:13 <DIR> d-------- c:\program files\CzasoWyłącznik 2008-10-17 21:28 . 2008-10-17 21:28 <DIR> d-------- c:\program files\PhotoFiltre Studio 2008-10-17 21:28 . 2008-10-17 21:28 45 ---h----- c:\windows\dsez9457.dat 2008-10-16 21:28 . 2008-10-16 21:28 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\MixMeister Technology 2008-10-16 21:26 . 2008-10-16 21:28 <DIR> d-------- c:\program files\MixMeister Fusion + Video 2008-10-15 05:53 . 2008-08-14 14:40 2,187,264 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,144,256 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,064,256 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,022,400 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-12 20:13 . 2008-10-12 20:14 5,116,910 --a------ C:\Wideo-0003.mp4 2008-10-09 14:27 . 2008-10-09 14:27 <DIR> d-------- c:\windows\Easy CD-DA Extractor 2008-10-09 14:27 . 2008-10-09 14:54 <DIR> d-------- c:\program files\Easy CD-DA Extractor 8 2008-10-09 14:04 . 2008-10-09 14:04 <DIR> d-------- c:\program files\Java 2008-10-09 14:04 . 2008-10-09 14:04 <DIR> d-------- c:\program files\Common Files\Java 2008-10-09 14:04 . 2008-06-10 01:32 73,728 --a------ c:\windows\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 12:37 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-11-09 12:13 606,240 --sha-w c:\windows\system32\drivers\fidbox2.dat 2008-11-09 12:13 6,296 --sha-w c:\windows\system32\drivers\fidbox2.idx 2008-11-09 12:13 3,050,016 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-11-09 12:13 28,052 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-11-09 11:29 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\foobar2000 2008-11-09 10:51 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\uTorrent 2008-11-04 17:34 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-04 07:14 --------- d-----w c:\program files\Opera 2008-11-02 12:17 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\Winamp 2008-11-02 09:57 --------- d-----w c:\program files\Winamp 2008-10-26 12:49 --------- d-----w c:\program files\Image-Line 2008-10-25 19:51 --------- d-----w c:\program files\VstPlugins 2008-10-20 05:41 --------- d-----w c:\program files\GSC Game World 2008-09-29 19:50 --------- d-----w c:\program files\Native Instruments 2008-09-28 12:19 --------- d-----w c:\program files\TP 2008-09-27 21:19 --------- d-----w c:\program files\Advanced Registry Doctor 2008-09-26 21:16 --------- d-----w c:\program files\Marvell 2008-09-23 21:06 --------- d-----w c:\program files\SubEdit-Player 2008-09-23 13:36 --------- d-----w c:\program files\Alcohol Soft 2008-09-23 13:32 685,816 ----a-w c:\windows\system32\drivers\sptd.sys 2008-09-22 20:55 --------- d-----w c:\program files\Lavalys 2008-09-22 17:22 --------- d-----w c:\program files\Realtek 2008-09-22 16:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI 2008-09-22 16:57 --------- d-----w c:\program files\My Company Name 2008-09-22 16:56 --------- d-----w c:\program files\ATI Technologies 2008-09-22 16:53 --------- d-----w c:\program files\Common Files\ATI Technologies 2008-09-15 15:17 1,847,168 ----a-w c:\windows\system32\win32k.sys 2008-09-14 18:48 --------- d-----w c:\program files\Winamp Remote 2008-09-14 18:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2008-09-14 12:53 --------- d-----w c:\program files\Google 2008-09-14 11:46 --------- d-----w c:\program files\Real Alternative 2008-09-14 11:46 --------- d-----w c:\program files\Media Player Classic 2008-09-14 09:29 --------- d-----w c:\program files\ASIO4ALL v2 2008-09-14 09:28 --------- d-----w c:\program files\Outsim 2008-09-11 19:20 --------- d-----w c:\program files\coolpro2 2008-09-09 06:31 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\ATI 2008-09-07 20:10 2,853,630 ----a-w C:\foobar2000_0.9.5.5.exe 2008-09-07 20:09 8,215,056 ----a-w C:\Firefox Setup 3.0.1.exe 2008-09-07 20:07 23,510,720 ----a-w C:\dotnetfx.exe 2008-08-26 09:12 827,904 ----a-w c:\windows\system32\wininet.dll 2008-08-14 13:40 2,144,256 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 13:40 2,022,400 ----a-w c:\windows\system32\ntkrnlpa.exe 2008-08-10 22:09 97,288 ----a-w C:\DSETUP.dll 2008-08-10 22:09 528,392 ----a-w C:\DXSETUP.exe 2008-08-10 22:09 1,694,728 ----a-w C:\dsetup32.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-09_12.33.50.57 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-11-09 12:18:19 4,341,760 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-09 12:18:19 192,512 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-11-09 12:18:10 4,341,760 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-09 12:18:10 192,512 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "Google Update"="c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-10-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="c:\documents and settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe" [2006-05-16 2879488] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088] "RTHDCPL"="RTHDCPL.EXE" [2005-05-25 c:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a------ 2008-08-12 18:05 1582064 c:\progra~1\WapSter\WAPSTE~1\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592] R3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2005-08-30 58320] R3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304] R3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000] . Zawartość folderu 'Zaplanowane zadania' 2008-11-09 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-10-08 17:26] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\ FF -: plugin - c:\documents and settings\Ferson\Dane aplikacji\Mozilla\plugins\npoctoshape.dll FF -: plugin - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.131.25\npGoogleOneClick6.dll FF -: plugin - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Octoshape\Octoshape Streaming Services\octoprogram-L03-NMS0808050_SUA_900\npoctoshape.dll FF -: plugin - c:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - c:\program files\Opera\program\plugins\npdivx32.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 13:41:15 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-09 13:42:44 ComboFix-quarantined-files.txt 2008-11-09 12:42:22 ComboFix2.txt 2008-11-09 11:34:25 Przed: 3 433 660 416 bajtów wolnych Po: 3,435,171,840 bajtów wolnych 201 --- E O F --- 2008-10-24 01:00:28

HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:44:08, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Advanced Registry Doctor\RegManServ.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SkyTel] C:\Documents and Settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA1D68C-62E9-434E-AEF9-A08C246E012C}: NameServer = 217.30.129.149,217.30.137.200 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 5519 bytes

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 14:52

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: c:\windows\system32\stu.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

ten plik przeskanuj na virustotal.com

Kod: Zaznacz wszystko: c:\windows\dsez9457.dat

http://www.kaspersky.com/virusscanner
przeskanuj i wklej raport

w HJT pozostal wpis

Kod: Zaznacz wszystko: O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')

**Posty:** 11 · przez **deadrat7** 09 Lis 2008, 15:24

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - Ferson 2008-11-09 14:18:48.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.568 [GMT 1:00] Uruchomiony z: c:\documents and settings\Ferson\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Ferson\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: c:\windows\system32\stu.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\stu.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 13:18 . 2008-11-09 13:18 <DIR> d-------- c:\windows\ERUNT 2008-11-09 13:14 . 2008-11-09 13:14 <DIR> d-------- c:\documents and settings\Administrator 2008-11-09 13:06 . 2008-11-09 13:34 <DIR> d-------- C:\SDFix 2008-11-09 13:05 . 2008-11-09 13:05 2,359,350 --a------ C:\bez tytułu.bmp 2008-11-09 12:45 . 2008-11-09 12:45 <DIR> d-------- C:\rsit 2008-11-09 12:22 . 2008-11-09 12:22 <DIR> d-------- c:\program files\Trend Micro 2008-11-09 11:01 . 2008-11-09 12:28 <DIR> d-------- c:\program files\SearchIn1Step 2008-11-09 10:58 . 2008-11-09 13:17 <DIR> d-------- c:\program files\speedapps 2008-11-09 10:58 . 2008-11-09 10:58 <DIR> d-------- c:\program files\Conduit 2008-11-07 18:26 . 2008-11-07 18:26 <DIR> d-------- c:\program files\BestGameEver 2008-11-05 17:26 . 2008-11-05 17:26 83 --a------ c:\windows\wa.INI 2008-11-04 18:35 . 1998-10-07 13:54 327,168 --a------ c:\windows\IsUn0415.exe 2008-11-04 18:34 . 2008-11-05 17:54 <DIR> d-------- c:\program files\Worms Armageddon 2008-11-03 16:35 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-03 16:35 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-03 16:35 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-02 22:55 . 2008-11-02 22:55 0 -ra------ C:\logwmemory.bin 2008-11-02 22:54 . 2008-11-02 22:54 <DIR> d-------- C:\Soldat 2008-11-02 22:54 . 2008-11-02 22:54 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\Soldat 2008-11-02 20:44 . 2008-11-09 12:00 <DIR> d-------- c:\program files\mIRC 2008-11-02 20:44 . 2008-11-09 12:02 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\mIRC 2008-11-02 16:33 . 2008-11-09 14:06 116 --a------ c:\windows\NeroDigital.ini 2008-11-02 15:33 . 2004-03-02 17:37 125,184 --------- c:\windows\system32\drivers\imagesrv.sys 2008-11-02 15:33 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll 2008-11-02 15:33 . 2004-03-02 17:37 5,504 --------- c:\windows\system32\drivers\imagedrv.sys 2008-11-02 15:32 . 2008-11-02 15:32 <DIR> d-------- c:\program files\Common Files\Ahead 2008-11-02 15:32 . 2008-11-02 15:33 <DIR> d-------- c:\program files\Ahead 2008-11-02 15:32 . 2004-07-26 17:16 1,568,768 --------- c:\windows\system32\ImagX7.dll 2008-11-02 15:32 . 2004-07-26 17:16 476,320 --------- c:\windows\system32\ImagXpr7.dll 2008-11-02 15:32 . 2004-07-26 17:16 471,040 --------- c:\windows\system32\ImagXRA7.dll 2008-11-02 15:32 . 2004-07-26 17:16 262,144 --------- c:\windows\system32\ImagXR7.dll 2008-11-02 15:32 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe 2008-11-02 10:57 . 2008-11-02 11:05 <DIR> d-------- c:\program files\SHOUTcast 2008-11-02 10:53 . 2008-11-02 10:53 <DIR> d-------- C:\shtcs 2008-10-31 22:33 . 2008-10-31 22:33 <DIR> d-------- c:\windows\Sun 2008-10-30 17:21 . 2008-10-30 17:31 100,000,000 --a------ C:\MS.Office.2007_pl.part2.rar 2008-10-30 17:21 . 2008-10-30 17:33 100,000,000 --a------ C:\MS.Office.2007_pl.part1.rar 2008-10-29 19:59 . 2008-10-29 20:00 <DIR> d-------- c:\documents and settings\Gość\Dane aplikacji\Winamp 2008-10-27 18:22 . 2008-10-27 18:22 <DIR> d-------- c:\program files\Common Files\Adobe AIR 2008-10-27 18:20 . 2008-10-27 18:20 <DIR> d-------- c:\program files\Common Files\Adobe 2008-10-26 13:36 . 2008-11-02 15:36 <DIR> d-------- C:\FL.Studio.XXL.v8.0.2-DOA 2008-10-22 21:56 . 2008-10-25 15:01 <DIR> d-------- C:\Dj Doboy Vocal Editions 2008-10-20 23:22 . 2008-10-20 23:22 <DIR> d-------- c:\program files\PC Inspector File Recovery 2008-10-20 23:22 . 2002-02-18 17:40 6,200 --a------ c:\windows\system32\INT13EXT.VXD 2008-10-20 22:17 . 2008-10-20 22:17 <DIR> d-------- c:\program files\Ontrack 2008-10-20 22:17 . 2001-03-02 09:41 634 --a------ c:\windows\system32\MAPISVC.INF 2008-10-20 15:56 . 2008-10-20 15:56 <DIR> d-------- C:\Audio 2008-10-20 15:54 . 2008-10-20 15:54 <DIR> d-------- c:\program files\rgcaudio 2008-10-20 15:53 . 2008-10-20 15:53 <DIR> d-------- c:\windows\IDJ Groove & Phrase Synth 2008-10-18 22:13 . 2008-10-18 22:13 <DIR> d-------- c:\program files\CzasoWyłącznik 2008-10-17 21:28 . 2008-10-17 21:28 <DIR> d-------- c:\program files\PhotoFiltre Studio 2008-10-17 21:28 . 2008-10-17 21:28 45 ---h----- c:\windows\dsez9457.dat 2008-10-16 21:28 . 2008-10-16 21:28 <DIR> d-------- c:\documents and settings\Ferson\Dane aplikacji\MixMeister Technology 2008-10-16 21:26 . 2008-10-16 21:28 <DIR> d-------- c:\program files\MixMeister Fusion + Video 2008-10-15 05:53 . 2008-08-14 14:40 2,187,264 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,144,256 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,064,256 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-15 05:53 . 2008-08-14 14:40 2,022,400 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-12 20:13 . 2008-10-12 20:14 5,116,910 --a------ C:\Wideo-0003.mp4 2008-10-09 14:27 . 2008-10-09 14:27 <DIR> d-------- c:\windows\Easy CD-DA Extractor 2008-10-09 14:27 . 2008-10-09 14:54 <DIR> d-------- c:\program files\Easy CD-DA Extractor 8 2008-10-09 14:04 . 2008-10-09 14:04 <DIR> d-------- c:\program files\Java 2008-10-09 14:04 . 2008-10-09 14:04 <DIR> d-------- c:\program files\Common Files\Java 2008-10-09 14:04 . 2008-06-10 01:32 73,728 --a------ c:\windows\system32\javacpl.cpl . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 13:21 3,053,600 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-11-09 13:20 28,080 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-11-09 13:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-11-09 12:13 606,240 --sha-w c:\windows\system32\drivers\fidbox2.dat 2008-11-09 12:13 6,296 --sha-w c:\windows\system32\drivers\fidbox2.idx 2008-11-09 11:29 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\foobar2000 2008-11-09 10:51 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\uTorrent 2008-11-04 17:34 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-04 07:14 --------- d-----w c:\program files\Opera 2008-11-02 12:17 --------- d-----w c:\documents and settings\Ferson\Dane aplikacji\Winamp 2008-11-02 09:57 --------- d-----w c:\program files\Winamp 2008-10-26 12:49 --------- d-----w c:\program files\Image-Line 2008-10-25 19:51 --------- d-----w c:\program files\VstPlugins 2008-10-20 05:41 --------- d-----w c:\program files\GSC Game World 2008-09-29 19:50 --------- d-----w c:\program files\Native Instruments 2008-09-28 12:19 --------- d-----w c:\program files\TP 2008-09-27 21:19 --------- d-----w c:\program files\Advanced Registry Doctor 2008-09-26 21:16 --------- d-----w c:\program files\Marvell 2008-09-23 21:06 --------- d-----w c:\program files\SubEdit-Player 2008-09-23 13:36 --------- d-----w c:\program files\Alcohol Soft 2008-09-23 13:32 685,816 ----a-w c:\windows\system32\drivers\sptd.sys 2008-09-22 20:55 --------- d-----w c:\program files\Lavalys 2008-09-22 17:22 --------- d-----w c:\program files\Realtek 2008-09-22 16:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI 2008-09-22 16:57 --------- d-----w c:\program files\My Company Name 2008-09-22 16:56 --------- d-----w c:\program files\ATI Technologies 2008-09-22 16:53 --------- d-----w c:\program files\Common Files\ATI Technologies 2008-09-15 15:17 1,847,168 ----a-w c:\windows\system32\win32k.sys 2008-09-14 18:48 --------- d-----w c:\program files\Winamp Remote 2008-09-14 18:48 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2008-09-14 12:53 --------- d-----w c:\program files\Google 2008-09-14 11:46 --------- d-----w c:\program files\Real Alternative 2008-09-14 11:46 --------- d-----w c:\program files\Media Player Classic 2008-09-14 09:29 --------- d-----w c:\program files\ASIO4ALL v2 2008-09-14 09:28 --------- d-----w c:\program files\Outsim 2008-09-11 19:20 --------- d-----w c:\program files\coolpro2 2008-09-09 06:31 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\ATI 2008-09-07 20:10 2,853,630 ----a-w C:\foobar2000_0.9.5.5.exe 2008-09-07 20:09 8,215,056 ----a-w C:\Firefox Setup 3.0.1.exe 2008-09-07 20:07 23,510,720 ----a-w C:\dotnetfx.exe 2008-08-26 09:12 827,904 ----a-w c:\windows\system32\wininet.dll 2008-08-14 13:40 2,144,256 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 13:40 2,022,400 ----a-w c:\windows\system32\ntkrnlpa.exe 2008-08-10 22:09 97,288 ----a-w C:\DSETUP.dll 2008-08-10 22:09 528,392 ----a-w C:\DXSETUP.exe 2008-08-10 22:09 1,694,728 ----a-w C:\dsetup32.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-09_12.33.50.57 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-11-09 12:18:19 4,341,760 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-09 12:18:19 192,512 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-11-09 12:18:10 4,341,760 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-09 12:18:10 192,512 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "Google Update"="c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-10-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="c:\documents and settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe" [2006-05-16 2879488] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088] "RTHDCPL"="RTHDCPL.EXE" [2005-05-25 c:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a------ 2008-08-12 18:05 1582064 c:\progra~1\WapSter\WAPSTE~1\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592] R3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);c:\windows\system32\DRIVERS\ss_bus.sys [2005-08-30 58320] R3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;c:\windows\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304] R3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;c:\windows\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000] . Zawartość folderu 'Zaplanowane zadania' 2008-11-09 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-10-08 17:26] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 14:21:07 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-09 14:22:27 ComboFix-quarantined-files.txt 2008-11-09 13:22:01 ComboFix2.txt 2008-11-09 12:42:45 ComboFix3.txt 2008-11-09 11:34:25 Przed: 3 377 848 320 bajtów wolnych Po: 3,409,911,808 bajtów wolnych 197 --- E O F --- 2008-10-24 01:00:28

VirusTotal

Kod: Zaznacz wszystko: Plik dsez9457.dat otrzymany 2008.11.09 14:00:24 (CET) Obecny status: zakończono Wynik: 0/36 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.11.7.1 2008.11.09 - AntiVir 7.9.0.26 2008.11.07 - Authentium 5.1.0.4 2008.11.08 - Avast 4.8.1248.0 2008.11.08 - AVG 8.0.0.161 2008.11.09 - BitDefender 7.2 2008.11.09 - CAT-QuickHeal 9.50 2008.11.08 - ClamAV 0.94.1 2008.11.09 - DrWeb 4.44.0.09170 2008.11.09 - eSafe 7.0.17.0 2008.11.06 - eTrust-Vet 31.6.6199 2008.11.08 - Ewido 4.0 2008.11.09 - F-Prot 4.4.4.56 2008.11.06 - F-Secure 8.0.14332.0 2008.11.09 - Fortinet 3.117.0.0 2008.11.09 - GData 19 2008.11.09 - Ikarus T3.1.1.45.0 2008.11.09 - K7AntiVirus 7.10.520 2008.11.08 - Kaspersky 7.0.0.125 2008.11.09 - McAfee 5428 2008.11.08 - Microsoft 1.4104 2008.11.09 - NOD32 3597 2008.11.08 - Norman 5.80.02 2008.11.07 - Panda 9.0.0.4 2008.11.09 - PCTools 4.4.2.0 2008.11.09 - Prevx1 V2 2008.11.09 - Rising 21.02.62.00 2008.11.09 - SecureWeb-Gateway 6.7.6 2008.11.09 - Sophos 4.35.0 2008.11.08 - Sunbelt 3.1.1785.2 2008.11.08 - Symantec 10 2008.11.09 - TheHacker 6.3.1.1.146 2008.11.08 - TrendMicro 8.700.0.1004 2008.11.07 - VBA32 3.12.8.9 2008.11.09 - ViRobot 2008.11.7.1457 2008.11.07 - VirusBuster 4.5.11.0 2008.11.08 - Dodatkowe informacje File size: 45 bytes MD5...: 54cde9028f8dbf8fa7a241b276df0fd3 SHA1..: c89f6188e0844808f0bbbd28e1cdf18543108f0d SHA256: 4496f65e1dda004c399dbc5e770a947ff6367abff4ee4ed723765480c42d868b SHA512: 0aabbd9b98c6f483dfff17fadba94e88eb43bf8eca0a976681c970f27fee6abd 9c67c9e666b4162fe3a4dcb3622d71fd3b931836c773b81e8e0ed59215000fa9 PEiD..: - TrID..: File type identification Generic INI configuration (100.0%) PEInfo: -

na kasprzaku mi się zwiesił system i restart

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 15:30

czyli plik czysty

co do loga podobnie

przeskanuj OS'a

http://www.programosy.pl/program,avg-anti-spyware.html

Autor postu otrzymał pochwałę

**Posty:** 11 · przez **deadrat7** 09 Lis 2008, 16:44

z AVG

Kod: Zaznacz wszystko: --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 15:42:54 2008-11-09 + Scan result: :mozilla.143:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.143:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.147:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.147:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.148:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.148:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.149:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.149:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.202:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.202:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Gość\Cookies\gość@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.233:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.233:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.234:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.234:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.235:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.235:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.356:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.356:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.497:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.497:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.500:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.500:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.501:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.501:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.622:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.622:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Gość\Cookies\gość@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.312:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Bbmedia : Cleaned. :mozilla.312:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Bbmedia : Cleaned. :mozilla.313:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Bbmedia : Cleaned. :mozilla.313:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Bbmedia : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.376:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.376:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.379:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.379:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.380:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.380:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.381:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.381:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.382:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.382:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.135:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.135:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.540:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.540:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.541:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.541:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.227:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.227:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.228:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.228:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.229:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.229:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.12:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.12:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.13:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.13:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.21:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.21:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@hit.gemius[2].txt -> TrackingCookie.Gemius : Cleaned. C:\Documents and Settings\Gość\Cookies\gość@hit.gemius[2].txt -> TrackingCookie.Gemius : Cleaned. :mozilla.479:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.479:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.480:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.480:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.453:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.453:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Information : Cleaned. :mozilla.666:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.666:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.623:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.623:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.539:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Planetactive : Cleaned. :mozilla.539:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Planetactive : Cleaned. :mozilla.315:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.315:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.316:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.316:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.317:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.317:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.218:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.218:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.219:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.219:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.220:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.220:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.224:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.224:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.225:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.225:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.51:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.51:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.52:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.52:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.53:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.53:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.54:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.54:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.55:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.55:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Gość\Cookies\gość@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.521:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.521:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\Gość\Cookies\gość@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.491:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.491:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.221:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.221:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.163:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.163:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.164:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.164:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.165:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.165:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.166:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.166:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.167:C:\Documents and Settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.167:F:\fdsfdsfsdf\Mozilla\Firefox\Profiles\rt3a685b.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\Ferson\Cookies\ferson@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned. F:\N_O_D.rar/NOD 32\setup.exe -> Trojan.Autoit.bg : Cleaned. ::Report end

w HiJackThis tez usunalem, ale daje jeszcze log

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:44:24, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Advanced Registry Doctor\RegManServ.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\foobar2000\foobar2000.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Opera\opera.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SkyTel] C:\Documents and Settings\Ferson\Pulpit\ALC88x_V51005286\32bit\2K_XP\WDM\SkyTel.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ferson\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA1D68C-62E9-434E-AEF9-A08C246E012C}: NameServer = 217.30.129.149,217.30.137.200 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 5911 bytes

Dzięki

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 16:47

Hijack wzorowo czysty

1.sciagnij ATF_Cleaner

zaznacz

Windows Temp

All users Temp

Temporary internet files

Recycle Bin

i wcisnij EMPTY SELECTED

2.Wyłšcz przywracanie systemu ( właciwoci mój komputer-zakładka przywracanie - wyłšcz przywracanie na wszystkich dyskach). Po chwili włšcz je powrotem

**Posty:** 11 · przez **deadrat7** 09 Lis 2008, 17:28

Wszystko śmiga jak należy !

dziękuje

Kto jest na forum