Proszę o analizę hijack - win32:trojan-gen. (other)

**Posty:** 9 · przez **Merila** 08 Sty 2009, 16:32

Avast z każdym uruchomieniem komputera informuje o wirusie: Win32:Trojan-gen {Other}
Chciałabym prosić o pomoc, bo niestety nie mam zielonego pojęcia jak się tego pozbyć.
Oto log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:25:42, on 2009-01-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINNT\system32\wscntfy.exe C:\WINNT\System32\alg.exe C:\WINNT\system32\WgaTray.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\igfxpers.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe C:\WINNT\RTHDCPL.EXE C:\WINNT\system32\svchost.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\user\msiexec.exe C:\Program Files\Spyware Doctor\pctsGui.exe C:\Documents and Settings\user\Pulpit\HiJackThis.exe C:\WINNT\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ie7pro.com/firstrun/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.is.net.pl/auto.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) R3 - URLSearchHook: (no name) - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - (no file) R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing) O2 - BHO: (no name) - {20151E3B-F152-4502-A56A-37C99516702B} - C:\WINNT\system32\fccbBrOe.dll (file missing) O3 - Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) O3 - Toolbar: (no name) - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - (no file) O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O4 - HKLM\..\Run: [igfxhkcmd] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINNT\system32\igfxpers.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0 O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [3DNADesktop] "C:\Program Files\3DNA\Resources\3dnasys.exe" -open O4 - HKLM\..\Run: [NeroRebootSetup] "C:\Documents and Settings\user\Ustawienia lokalne\Temp\nro.tmp\SetupX.exe" SC -Reboot PROCESSMODE="1" O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\user\winlogon.exe O4 - HKLM\..\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [Anti-Trojan-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1045 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [EdHTML] C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000 O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\Program Files\FlashCapture\fciext.dll (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B0B329F6-25A4-4137-94F6-7939D775B845}: NameServer = 217.144.192.2,217.144.192.33 O20 - Winlogon Notify: awtsSlll - awtsSlll.dll (file missing) O20 - Winlogon Notify: iifgfeCr - iifgfeCr.dll (file missing) O20 - Winlogon Notify: vtUolJya - C:\WINNT\SYSTEM32\vtUolJya.dll O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 10617 bytes

**Posty:** 18165 · przez **wojtas** 08 Sty 2009, 21:06

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 9 · przez **Merila** 09 Sty 2009, 16:33

Log z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-01-08.05 - user 2009-01-09 15:05:06.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1015.474 [GMT 1:00] Running from: c:\documents and settings\user\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090108-0] *On-access scanning disabled* (Outdated) * Created a new restore point [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\FunWebProducts c:\program files\FunWebProducts\ScreenSaver\Images\[u]0[/u]28BA0A6.urr c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html c:\program files\FunWebProducts\Shared\Cache\MailStampBtn-new.html c:\program files\FunWebProducts\Shared\Cache\MailStampBtn.html c:\program files\FunWebProducts\Shared\Cache\MyStationeryBtn-new.html c:\program files\FunWebProducts\Shared\Cache\MyStationeryBtn.html c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html c:\program files\MyWebSearch c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0018D66 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]001A3AD c:\program files\MyWebSearch\bar\Cache\[u]0[/u]001AB7D c:\program files\MyWebSearch\bar\Cache\[u]0[/u]001C9B3 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]001E867 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]001F4DA c:\program files\MyWebSearch\bar\Cache\[u]0[/u]00236C5 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0025653 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0026DD3 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0032D99 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]00565B6 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0060E79 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01783B6 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01A06C7 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01E3C99.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01E3F1A.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01E4091.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01E4302.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]01F0028 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0490339 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0498932 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]04E73EC c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0553962 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0553C01.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0553E05.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0553EFF.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0554066.bin c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0611804 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]07A53FA c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0864172 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]0BC8DA7 c:\program files\MyWebSearch\bar\Cache\[u]0[/u]1120191 c:\program files\MyWebSearch\bar\Cache\files.ini c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S c:\program files\MyWebSearch\bar\Game\CHESS.F3S c:\program files\MyWebSearch\bar\Game\REVERSI.F3S c:\program files\MyWebSearch\bar\History\search3 c:\program files\MyWebSearch\bar\icons\CM.ICO c:\program files\MyWebSearch\bar\icons\MFC.ICO c:\program files\MyWebSearch\bar\icons\PSS.ICO c:\program files\MyWebSearch\bar\icons\SMILEY.ICO c:\program files\MyWebSearch\bar\icons\WB.ICO c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO c:\program files\MyWebSearch\bar\Message\COMMON.F3S c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S c:\program files\MyWebSearch\bar\Notifier\DOG.F3S c:\program files\MyWebSearch\bar\Notifier\FISH.F3S c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S c:\program files\MyWebSearch\bar\Notifier\MAID.F3S c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm c:\program files\MyWebSearch\bar\Settings\s_pid.dat c:\winnt\system32\aevggxxm.dll c:\winnt\system32\asxevmpi.dll c:\winnt\system32\cbXNFxUn.dll c:\winnt\system32\cuosoy.dll c:\winnt\system32\ddcCVNHa.dll c:\winnt\system32\efcASLeb.dll c:\winnt\system32\efcBrSjK.dll c:\winnt\system32\efcCrRiH.dll c:\winnt\system32\ELUuDcdd.ini c:\winnt\system32\ELUuDcdd.ini2 c:\winnt\system32\eOrBbccf.ini c:\winnt\system32\eOrBbccf.ini2 c:\winnt\system32\f3PSSavr.scr c:\winnt\system32\fccbYqQg.dll c:\winnt\system32\fgqckaji.dll c:\winnt\system32\fmlvgtxa.dll c:\winnt\system32\geBrOGwW.dll c:\winnt\system32\GhOVvyay.ini c:\winnt\system32\GhOVvyay.ini2 c:\winnt\system32\girpwgbg.dll c:\winnt\system32\hbbijvwy.dll c:\winnt\system32\iexvqseb.dll c:\winnt\system32\itxlky.dll c:\winnt\system32\khfEUoNg.dll c:\winnt\system32\kywwtaoq.dll c:\winnt\system32\mcrh.tmp c:\winnt\system32\myutupdv.dll c:\winnt\system32\nnnmjIaa.dll c:\winnt\system32\nnnmnLBs.dll c:\winnt\system32\ohymtbwc.dll c:\winnt\system32\pmnkLbyv.dll c:\winnt\system32\pmnoLfdB.dll c:\winnt\system32\qoMdASIB.dll c:\winnt\system32\qoMdEwXO.dll c:\winnt\system32\qoMgfefC.dll c:\winnt\system32\rqRJBUkk.dll c:\winnt\system32\uchvjouf.dll c:\winnt\system32\urqOETnm.dll c:\winnt\system32\urqPfEwV.dll c:\winnt\system32\urqPgdCu.dll c:\winnt\system32\urqPjGwv.dll c:\winnt\system32\urqPjGya.dll c:\winnt\system32\urqqqQhf.dll c:\winnt\system32\utkwmyae.dll c:\winnt\system32\VwEfPqru.ini c:\winnt\system32\VwEfPqru.ini2 c:\winnt\system32\wvULEUKe.dll c:\winnt\system32\xwbsxujh.dll c:\winnt\system32\xxyvuVoP.dll c:\winnt\system32\xybJlnmp.ini c:\winnt\system32\xybJlnmp.ini2 c:\winnt\system32\yayaWnOf.dll c:\winnt\system32\yayvSkkl.dll c:\winnt\system32\yayXponn.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MYWEBSEARCHSERVICE -------\Service_MyWebSearchService ((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 ))))))))))))))))))))))))))))))) . 2009-01-09 14:48 . 2009-01-09 15:17 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-01-09 14:48 . 2007-11-07 12:17 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-01-09 14:48 . 2009-01-09 14:53 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-01-09 14:48 . 2009-01-09 14:50 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-01-09 14:48 . 2009-01-09 14:48 <DIR> d-------- c:\documents and settings\Administrator 2009-01-09 14:40 . 2009-01-09 14:40 <DIR> d-------- c:\winnt\ERUNT 2009-01-09 14:32 . 2009-01-09 14:53 <DIR> d-------- C:\SDFix 2009-01-08 08:56 . 2009-01-08 08:56 112,356 --a------ c:\documents and settings\user\qyQvYuOvf.exe 2009-01-08 08:56 . 2009-01-08 08:56 46,080 --a------ c:\documents and settings\user\ZEHDXdv.exe 2009-01-07 14:43 . 2009-01-07 14:44 1,325,094 ---hs---- c:\winnt\system32\axtgvlmf.ini 2009-01-07 12:05 . 2009-01-07 12:05 1,326,186 ---hs---- c:\winnt\system32\gbgwprig.ini 2009-01-07 09:41 . 2009-01-07 09:41 8,192 --a------ C:\hiunflsp.exe 2009-01-07 09:41 . 2009-01-07 09:41 0 --a------ C:\-862554685 2009-01-07 09:40 . 2009-01-07 09:40 84,992 --a------ C:\ypooamfh.exe 2009-01-06 12:03 . 2009-01-07 12:04 1,326,186 ---hs---- c:\winnt\system32\fyyxddyl.ini 2009-01-05 21:44 . 2009-01-05 21:44 <DIR> d-------- c:\program files\software 2009-01-05 12:01 . 2009-01-05 12:01 1,310,577 ---hs---- c:\winnt\system32\vdputuym.ini 2009-01-04 18:07 . 2009-01-04 18:07 1,311,620 ---hs---- c:\winnt\system32\mxxggvea.ini 2009-01-03 18:14 . 2009-01-04 13:06 <DIR> d-------- c:\program files\Trojan Remover 2009-01-03 18:09 . 2009-01-09 15:26 <DIR> d-------- c:\program files\Anti-Trojan-55 2009-01-03 17:27 . 2009-01-03 17:27 289 --a------ c:\documents and settings\user\KNVZiU.bat 2009-01-03 16:45 . 2009-01-03 16:45 280,576 --a------ c:\documents and settings\user\[u]0[/u]eArwnaQqZ.exe 2009-01-02 18:05 . 2009-01-02 18:05 1,311,620 ---hs---- c:\winnt\system32\fjgsmbrt.ini 2009-01-02 17:52 . 2009-01-02 17:56 <DIR> d-------- C:\Temp 2009-01-02 17:52 . 2009-01-02 17:52 43,520 --a------ c:\winnt\system32\whSLD022328.exe 2009-01-02 17:51 . 2000-05-22 15:58 115,920 --a------ c:\winnt\system32\MSINET.OCX 2009-01-02 17:51 . 2009-01-02 17:51 72,192 --a------ c:\winnt\system32\mlJAPggD.dll 2009-01-02 17:49 . 2008-12-07 19:03 69,632 ---hs---- c:\documents and settings\user\winlogon.exe 2008-12-24 20:00 . 2008-12-24 20:00 <DIR> d-------- c:\program files\HCA . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-09 14:26 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-09 09:14 --------- d-----w c:\program files\Spyware Doctor 2009-01-08 14:04 --------- d-----w c:\program files\Common Files\Adobe 2009-01-04 17:06 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-04 17:00 --------- d-----w c:\program files\Norton Security Scan 2008-12-28 21:11 --------- d-----w c:\program files\Gadu-Gadu 2008-12-26 20:33 163,644 ----a-w c:\winnt\system32\drivers\secdrv.sys 2008-12-23 11:00 --------- d-----w c:\program files\Scooby-Doo (TM) i Miasto Duchów (TM) 2008-12-14 11:37 --------- d-----w c:\documents and settings\user\Dane aplikacji\ipla 2008-12-12 23:18 --------- d-----w c:\documents and settings\user\Dane aplikacji\IE7Pro 2008-12-07 08:04 --------- d-----w c:\program files\AskTBar 2008-12-06 20:01 --------- d-----w c:\program files\Zenek Zombie 2008-12-06 20:00 --------- d-----w c:\program files\Worms 3D - tapety 2008-12-06 19:59 --------- d-----w c:\program files\Electronic Arts 2008-12-06 19:51 --------- d-----w c:\program files\NCH Swift Sound 2008-12-06 15:32 --------- d-----w c:\program files\Common Files\Nero 2008-12-06 15:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-06 15:13 --------- d-----w c:\program files\Nero 2008-12-06 14:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound 2008-12-05 14:09 --------- d-----w c:\documents and settings\user\Dane aplikacji\Nero 2008-12-02 13:20 27,136 ----a-w c:\winnt\system32\drivers\nchssvad.sys 2008-12-02 13:20 --------- d-----w c:\documents and settings\user\Dane aplikacji\NCH Swift Sound 2008-12-01 19:21 --------- d-----w c:\program files\NCH Software 2008-11-22 14:26 --------- d-----w c:\program files\Santa Claus in Trouble 2008-11-16 12:22 --------- d-----w c:\program files\microsoft frontpage 2008-11-16 01:35 --------- d-----w c:\program files\Stardock 2008-11-16 01:11 --------- d-----w c:\program files\Common Files\Stardock 2008-11-16 00:05 --------- d-----w c:\documents and settings\user\Dane aplikacji\PC Tools 2008-05-14 15:11 13 ---h--w c:\documents and settings\All Users\Dane aplikacji\13.sys 2008-03-27 16:53 13 ---h--w c:\documents and settings\All Users\Dane aplikacji\ÝŮĂÄ3113›.sys 2008-01-11 21:11 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] "ares"="c:\program files\Ares\Ares.exe" [2007-05-04 961024] "EdHTML"="c:\program files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 1443328] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1694208] "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IPLA!"="c:\program files\ipla\ipla.exe" [2008-09-19 2438392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxhkcmd"="c:\winnt\system32\hkcmd.exe" [2005-11-28 77824] "igfxpers"="c:\winnt\system32\igfxpers.exe" [2005-11-28 118784] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" [2008-03-28 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264] "AT-Watch"="c:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2004-10-05 280720] "Anti-Trojan-Watch"="c:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\winnt\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\winnt\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=cuosoy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll "VIDC.MJPG"= pvmjpg21.dll "VIDC.PVW2"= pvwv220.dll "VIDC.PIMJ"= pvljpg20.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 c:\winnt\system32\urqPfEwV [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Documents and Settings\\user\\Dane aplikacji\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Anti-Trojan-55\\Anti-Trojan.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2008-04-04 111184] R4 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51:58 13560] R4 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2008-04-04 20560] R4 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-11-16 356920] S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt --> c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [?] --- Other Services/Drivers In Memory --- *Deregistered* - InCDRec *Deregistered* - mchInjDrv . Contents of the 'Scheduled Tasks' folder 2009-01-06 c:\winnt\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-01-04 c:\winnt\Tasks\Norton Security Scan for user.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 03:18] . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) BHO-{20151E3B-F152-4502-A56A-37C99516702B} - c:\winnt\system32\fccbBrOe.dll BHO-{3B6C002D-89AB-4E46-AA98-7A0F5243CF1F} - c:\winnt\system32\urqPfEwV.dll BHO-{5959c31d-705e-435c-a4e9-57ff6ba1a76e} - c:\winnt\system32\cuosoy.dll Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file) HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe HKLM-Run-3DNADesktop - c:\program files\3DNA\Resources\3dnasys.exe HKLM-Run-NeroRebootSetup - c:\documents and settings\user\Ustawienia lokalne\Temp\nro.tmp\SetupX.exe Notify-awtsSlll - awtsSlll.dll Notify-iifgfeCr - iifgfeCr.dll Notify-vtUolJya - vtUolJya.dll . ------- Supplementary Scan ------- . uStart Page = hxxp://www.onet.pl/ uInternet Connection Wizard,ShellNext = hxxp://www.ie7pro.com/firstrun/ IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000 IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 TCP: {B0B329F6-25A4-4137-94F6-7939D775B845} = 217.144.192.2,217.144.192.33 FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\j42wqlaq.default\ FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\documents and settings\user\Dane aplikacji\Mozilla\plugins\npPxPlay.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPFxViewer.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin6.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-09 15:26:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\winnt\TEMP\aswUpdSum.ini 107 bytes scan completed successfully hidden files: 1 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1993962763-813497703-1801674531-1003\Software\Microsoft\EventSystem\(F4693080-1C1D-12CE-45A7-1212ECEEF119)*NULL*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "VType"=hex:4e,59,69,47 "AType"=hex:4e,59,69,47 [HKEY_USERS\S-1-5-21-1993962763-813497703-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C78E6C60-24F3-AF53-DFB1-3A2FC4FABBC2}*NULL*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "oamnmcpkplldicphokdaohdclnajin"=hex:64,61,68,68,6c,6b,64,66,00,70 "oaaeejomahocplglccalmlaodgimhn"=hex:6a,61,6d,68,61,6a,68,64,66,6a,68,6f,67,6b, 67,6f,6d,66,68,62,00,cb "nakdchckbcnmogkidilcbmnglnoc"=hex:6a,61,68,68,6f,6a,61,68,63,6f,6b,69,64,63, 6b,65,62,6d,67,6f,00,cb . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\CyberLink\Shared files\RichVideo.exe c:\program files\Spyware Doctor\pctsSvc.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\program files\iPod\bin\iPodService.exe c:\winnt\system32\WgaTray.exe . ************************************************************************** . Completion time: 2009-01-09 15:29:32 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-09 14:29:27 Pre-Run: 23˙041˙265˙664 bajt˘w wolnych Post-Run: 34,184,929,280 bajt˘w wolnych 404 --- E O F --- 2008-12-19 11:04:09

Report.txt:

Kod: Zaznacz wszystko: [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-09 14:51:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:35,10,4d,11,27,d1,46,2d,c2,c4,25,e5,f3,41,24,8e,f4,7f,10,17,a0,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:04,fd,ca,b0,32,41,a2,78,d9,56,72,c4,a9,91,07,49,f7,16,cd,84,25,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7b,32,29,0d,f0,d6,fa,85,b7,dd,91,26,9d,68,49,cf,ad,.. "khjeh"=hex:1e,c5,b9,ca,21,30,8e,2b,94,11,fe,25,50,89,58,6e,2b,e3,0a,38,3c,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:8d,5d,90,5f,bb,cb,0b,64,40,a5,a7,30,fd,af,43,5a,73,4f,ef,76,73,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:35,10,4d,11,27,d1,46,2d,c2,c4,25,e5,f3,41,24,8e,f4,7f,10,17,a0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:04,fd,ca,b0,32,41,a2,78,d9,56,72,c4,a9,91,07,49,f7,16,cd,84,25,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7b,32,29,0d,f0,d6,fa,85,b7,dd,91,26,9d,68,49,cf,ad,.. "khjeh"=hex:1e,c5,b9,ca,21,30,8e,2b,94,11,fe,25,50,89,58,6e,2b,e3,0a,38,3c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:8d,5d,90,5f,bb,cb,0b,64,40,a5,a7,30,fd,af,43,5a,73,4f,ef,76,73,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"="C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe:*:Enabled:CyberLink PowerDVD" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "C:\\Program Files\\totalcmd\\TOTALCMD.EXE"="C:\\Program Files\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Documents and Settings\\user\\Dane aplikacji\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe"="C:\\Documents and Settings\\user\\Dane aplikacji\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe:*:Enabled:mDNSResponder" "C:\\Documents and Settings\\user\\Ustawienia lokalne\\Temp\\Rar$EX00.265\\Empires.exe"="C:\\Documents and Settings\\user\\Ustawienia lokalne\\Temp\\Rar$EX00.265\\Empires.exe:*:Enabled:Age of Empires" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer" "C:\\Program Files\\Sonic the Hedgehog Adventure 2\\Sonic the Hedgehog Adventure 2.exe"="C:\\Program Files\\Sonic the Hedgehog Adventure 2\\Sonic the Hedgehog Adventure 2.exe:*:Disabled:Sonic the Hedgehog Adventure 2" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "C:\\Program Files\\1701 A.D. Demo\\1701_Demo.exe"="C:\\Program Files\\1701 A.D. Demo\\1701_Demo.exe:*:Enabled:1701 A.D. Demo" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Documents and Settings\\user\\Ustawienia lokalne\\Temp\\Rar$EX00.562\\DCPlusPlus.exe"="C:\\Documents and Settings\\user\\Ustawienia lokalne\\Temp\\Rar$EX00.562\\DCPlusPlus.exe:*:Enabled:DC++" "C:\\Program Files\\Anti-Trojan-55\\Anti-Trojan.exe"="C:\\Program Files\\Anti-Trojan-55\\Anti-Trojan.exe:*:Enabled:Anti-Trojan 5.5 Professional" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 13 Aug 2008 918,045 A..H. --- "C:\DH Temp.tmp" Sun 7 Dec 2008 69,632 ..SH. --- "C:\Documents and Settings\user\winlogon.exe" Wed 21 Nov 2007 616,448 A.SH. --- "C:\WINNT\Temp\5zwcud7a.TMP" Wed 21 Nov 2007 589,824 A.SH. --- "C:\WINNT\Temp\643hizk4.TMP" Wed 14 May 2008 13 ...H. --- "C:\Documents and Settings\All Users\Dane aplikacji\13.sys" Thu 27 Mar 2008 13 ...H. --- "C:\Documents and Settings\All Users\Dane aplikacji\íŢĆŽ3113>.sys" Wed 7 Nov 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 29 Nov 2008 24,576 ...H. --- "C:\Documents and Settings\user\Pulpit\~WRL1550.tmp" Sat 29 Nov 2008 2,603,008 ...H. --- "C:\Documents and Settings\user\Pulpit\~WRL3697.tmp" Wed 2 May 2001 53,248 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATPS.dll" Thu 6 Sep 2001 40,960 A..H. --- "C:\Program Files\Anti-Trojan-55\DLL\ATRep.dll" Wed 16 Jan 2002 134,144 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATT.dll" Wed 16 Jan 2002 113,152 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATTexte.dll" Wed 16 Jan 2002 23,040 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\BetriebsSys.dll" Wed 2 May 2001 23,552 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileOp.dll" Wed 16 Jan 2002 40,960 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileSys.dll" Wed 2 May 2001 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ListBox.dll" Wed 2 May 2001 24,064 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\Registry.dll" Wed 2 May 2001 32,256 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\RegValues.dll" Wed 16 Jan 2002 27,648 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\SysIni.dll" Thu 12 Sep 2002 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\WinExit.dll" Tue 8 May 2001 88,576 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ATPClose.dll" Wed 2 May 2001 36,352 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ProcView.dll" Tue 2 Dec 2008 289 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti1E2.tmp" Fri 14 Nov 2008 206 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti2.tmp" Sun 20 Jan 2008 95 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti5.tmp" Thu 28 Aug 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" [b]Finished![/b]

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:32:57, on 2009-01-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\igfxpers.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINNT\RTHDCPL.EXE C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINNT\System32\alg.exe C:\WINNT\system32\WgaTray.exe C:\WINNT\system32\wuauclt.exe C:\WINNT\explorer.exe C:\WINNT\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINNT\system32\NOTEPAD.EXE C:\WINNT\system32\NOTEPAD.EXE C:\Documents and Settings\user\Pulpit\HiJackThis.exe C:\WINNT\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ie7pro.com/firstrun/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.is.net.pl/auto.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - (no file) O3 - Toolbar: (no name) - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - (no file) O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [igfxhkcmd] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINNT\system32\igfxpers.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [Anti-Trojan-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1045 O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [EdHTML] C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000 O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\Program Files\FlashCapture\fciext.dll (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B0B329F6-25A4-4137-94F6-7939D775B845}: NameServer = 217.144.192.2,217.144.192.33 O20 - AppInit_DLLs: cuosoy.dll O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 8159 bytes

**Posty:** 18165 · przez **wojtas** 09 Sty 2009, 20:17

skasuj:

R3 - URLSearchHook: (no name) - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - (no file)
O3 - Toolbar: (no name) - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - (no file)
O20 - AppInit_DLLs: cuosoy.dll

Otworz notatnik i wklej w nim to:

File::
c:\documents and settings\user\qyQvYuOvf.exe
c:\documents and settings\user\ZEHDXdv.exe
c:\winnt\system32\cuosoy.dll
c:\winnt\system32\axtgvlmf.ini
c:\winnt\system32\gbgwprig.ini
c:\hiunflsp.exe
C:\-862554685
C:\ypooamfh.exe
c:\winnt\system32\fyyxddyl.ini
c:\winnt\system32\vdputuym.ini
c:\winnt\system32\mxxggvea.ini
c:\winnt\system32\fjgsmbrt.ini
c:\winnt\system32\whSLD022328.exe
c:\winnt\system32\mlJAPggD.dll
c:\documents and settings\All Users\Dane aplikacji\13.sys
c:\documents and settings\All Users\Dane aplikacji\ÝŮĂÄ3113›.sys

Folder::
C:\Temp
c:\program files\AskTBar

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 9 · przez **Merila** 10 Sty 2009, 14:44

Log:

Kod: Zaznacz wszystko: ComboFix 09-01-09.03 - user 2009-01-10 13:36:24.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1015.572 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\user\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: C:\-862554685 c:\documents and settings\All Users\Dane aplikacji\13.sys c:\documents and settings\All Users\Dane aplikacji\ÝŮĂÄ3113›.sys c:\documents and settings\user\qyQvYuOvf.exe c:\documents and settings\user\ZEHDXdv.exe c:\hiunflsp.exe c:\winnt\system32\axtgvlmf.ini c:\winnt\system32\cuosoy.dll c:\winnt\system32\fjgsmbrt.ini c:\winnt\system32\fyyxddyl.ini c:\winnt\system32\gbgwprig.ini c:\winnt\system32\mlJAPggD.dll c:\winnt\system32\mxxggvea.ini c:\winnt\system32\vdputuym.ini c:\winnt\system32\whSLD022328.exe C:\ypooamfh.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\-862554685 c:\documents and settings\All Users\Dane aplikacji\13.sys c:\documents and settings\All Users\Dane aplikacji\ÝŮĂÄ3113›.sys c:\documents and settings\user\qyQvYuOvf.exe c:\documents and settings\user\ZEHDXdv.exe c:\hiunflsp.exe c:\program files\AskTBar C:\Temp c:\winnt\system32\axtgvlmf.ini c:\winnt\system32\fjgsmbrt.ini c:\winnt\system32\fyyxddyl.ini c:\winnt\system32\gbgwprig.ini c:\winnt\system32\mlJAPggD.dll c:\winnt\system32\mxxggvea.ini c:\winnt\system32\vdputuym.ini c:\winnt\system32\whSLD022328.exe C:\ypooamfh.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-10 do 2009-01-10 ))))))))))))))))))))))))))))))) . 2009-01-09 14:48 . 2009-01-10 13:38 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-01-09 14:48 . 2007-11-07 12:17 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-01-09 14:48 . 2009-01-09 14:53 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-01-09 14:48 . 2009-01-09 14:50 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-01-09 14:48 . 2009-01-09 14:48 <DIR> d-------- c:\documents and settings\Administrator 2009-01-09 14:40 . 2009-01-09 14:40 <DIR> d-------- c:\winnt\ERUNT 2009-01-09 14:32 . 2009-01-09 14:53 <DIR> d-------- C:\SDFix 2009-01-05 21:44 . 2009-01-05 21:44 <DIR> d-------- c:\program files\software 2009-01-03 18:14 . 2009-01-04 13:06 <DIR> d-------- c:\program files\Trojan Remover 2009-01-03 18:09 . 2009-01-10 13:40 <DIR> d-------- c:\program files\Anti-Trojan-55 2009-01-03 17:27 . 2009-01-03 17:27 289 --a------ c:\documents and settings\user\KNVZiU.bat 2009-01-03 16:45 . 2009-01-03 16:45 280,576 --a------ c:\documents and settings\user\[u]0[/u]eArwnaQqZ.exe 2009-01-02 17:51 . 2000-05-22 15:58 115,920 --a------ c:\winnt\system32\MSINET.OCX 2009-01-02 17:49 . 2008-12-07 19:03 69,632 ---hs---- c:\documents and settings\user\winlogon.exe 2008-12-24 20:00 . 2008-12-24 20:00 <DIR> d-------- c:\program files\HCA . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-10 12:40 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-09 17:06 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-09 17:01 --------- d-----w c:\program files\Norton Security Scan 2009-01-09 09:14 --------- d-----w c:\program files\Spyware Doctor 2009-01-08 14:04 --------- d-----w c:\program files\Common Files\Adobe 2008-12-28 21:11 --------- d-----w c:\program files\Gadu-Gadu 2008-12-26 20:33 163,644 ----a-w c:\winnt\system32\drivers\secdrv.sys 2008-12-23 11:00 --------- d-----w c:\program files\Scooby-Doo (TM) i Miasto Duchów (TM) 2008-12-14 11:37 --------- d-----w c:\documents and settings\user\Dane aplikacji\ipla 2008-12-12 23:18 --------- d-----w c:\documents and settings\user\Dane aplikacji\IE7Pro 2008-12-06 20:01 --------- d-----w c:\program files\Zenek Zombie 2008-12-06 20:00 --------- d-----w c:\program files\Worms 3D - tapety 2008-12-06 19:59 --------- d-----w c:\program files\Electronic Arts 2008-12-06 19:51 --------- d-----w c:\program files\NCH Swift Sound 2008-12-06 15:32 --------- d-----w c:\program files\Common Files\Nero 2008-12-06 15:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-06 15:13 --------- d-----w c:\program files\Nero 2008-12-06 14:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound 2008-12-05 14:09 --------- d-----w c:\documents and settings\user\Dane aplikacji\Nero 2008-12-02 13:20 27,136 ----a-w c:\winnt\system32\drivers\nchssvad.sys 2008-12-02 13:20 --------- d-----w c:\documents and settings\user\Dane aplikacji\NCH Swift Sound 2008-12-01 19:21 --------- d-----w c:\program files\NCH Software 2008-11-22 14:26 --------- d-----w c:\program files\Santa Claus in Trouble 2008-11-16 12:22 --------- d-----w c:\program files\microsoft frontpage 2008-11-16 01:35 --------- d-----w c:\program files\Stardock 2008-11-16 01:11 --------- d-----w c:\program files\Common Files\Stardock 2008-11-16 00:05 --------- d-----w c:\documents and settings\user\Dane aplikacji\PC Tools 2008-11-11 22:22 20,480 ----a-w c:\winnt\system32\scrnrdr.exe 2008-10-23 12:53 284,160 ----a-w c:\winnt\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\winnt\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\winnt\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\winnt\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\winnt\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\winnt\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\winnt\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\winnt\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\winnt\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\winnt\system32\wups.dll 2008-01-11 21:11 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-09_15.28.26.00 ))))))))))))))))))))))))))))))))))))))))) . + 2009-01-10 12:40:00 16,384 ----atw c:\winnt\Temp\Perflib_Perfdata_5cc.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] "ares"="c:\program files\Ares\Ares.exe" [2007-05-04 961024] "EdHTML"="c:\program files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 1443328] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1694208] "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IPLA!"="c:\program files\ipla\ipla.exe" [2008-09-19 2438392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxhkcmd"="c:\winnt\system32\hkcmd.exe" [2005-11-28 77824] "igfxpers"="c:\winnt\system32\igfxpers.exe" [2005-11-28 118784] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" [2008-03-28 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264] "AT-Watch"="c:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2004-10-05 280720] "Anti-Trojan-Watch"="c:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\winnt\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\winnt\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=cuosoy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll "VIDC.MJPG"= pvmjpg21.dll "VIDC.PVW2"= pvwv220.dll "VIDC.PIMJ"= pvljpg20.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Documents and Settings\\user\\Dane aplikacji\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Anti-Trojan-55\\Anti-Trojan.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2008-04-04 111184] R4 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51:58 13560] R4 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2008-04-04 20560] R4 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-11-16 356920] S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt --> c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [?] --- Other Services/Drivers In Memory --- *Deregistered* - InCDRec *Deregistered* - mchInjDrv . Zawartość folderu 'Zaplanowane zadania' 2009-01-06 c:\winnt\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-01-09 c:\winnt\Tasks\Norton Security Scan for user.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 03:18] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.onet.pl/ uInternet Connection Wizard,ShellNext = hxxp://www.ie7pro.com/firstrun/ IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000 IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 TCP: {B0B329F6-25A4-4137-94F6-7939D775B845} = 217.144.192.2,217.144.192.33 FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\j42wqlaq.default\ FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\documents and settings\user\Dane aplikacji\Mozilla\plugins\npPxPlay.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPFxViewer.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin6.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-10 13:40:55 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1993962763-813497703-1801674531-1003\Software\Microsoft\EventSystem\(F4693080-1C1D-12CE-45A7-1212ECEEF119)*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "VType"=hex:4e,59,69,47 "AType"=hex:4e,59,69,47 [HKEY_USERS\S-1-5-21-1993962763-813497703-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C78E6C60-24F3-AF53-DFB1-3A2FC4FABBC2}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "oamnmcpkplldicphokdaohdclnajin"=hex:64,61,68,68,6c,6b,64,66,00,70 "oaaeejomahocplglccalmlaodgimhn"=hex:6a,61,6d,68,61,6a,68,64,66,6a,68,6f,67,6b, 67,6f,6d,66,68,62,00,cb "nakdchckbcnmogkidilcbmnglnoc"=hex:6a,61,68,68,6f,6a,61,68,63,6f,6b,69,64,63, 6b,65,62,6d,67,6f,00,cb . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\CyberLink\Shared files\RichVideo.exe c:\program files\Spyware Doctor\pctsSvc.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\program files\iPod\bin\iPodService.exe c:\winnt\system32\WgaTray.exe . ************************************************************************** . Czas ukończenia: 2009-01-10 13:43:31 - komputer został uruchomiony ponownie [user] ComboFix-quarantined-files.txt 2009-01-10 12:43:11 ComboFix2.txt 2009-01-09 14:29:34 Przed: 33 804 578 816 bajtów wolnych Po: 34,082,103,296 bajtów wolnych 253 --- E O F --- 2008-12-19 11:04:09

**Posty:** 18165 · przez **wojtas** 10 Sty 2009, 19:07

Otworz notatnik i wklej w nim to:

File::
c:\documents and settings\user\KNVZiU.bat
c:\documents and settings\user\0eArwnaQqZ.exe
c:\documents and settings\user\winlogon.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 9 · przez **Merila** 11 Sty 2009, 10:51

Kod: Zaznacz wszystko: ComboFix 09-01-10.02 - user 2009-01-11 9:46:24.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1015.504 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\user\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: c:\documents and settings\user\[u]0[/u]eArwnaQqZ.exe c:\documents and settings\user\KNVZiU.bat c:\documents and settings\user\winlogon.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\user\[u]0[/u]eArwnaQqZ.exe c:\documents and settings\user\KNVZiU.bat c:\documents and settings\user\winlogon.exe c:\winnt\system32\msrdo20.dll c:\winnt\system32\rdocurs.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-11 do 2009-01-11 ))))))))))))))))))))))))))))))) . 2009-01-09 14:48 . 2009-01-11 09:48 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-01-09 14:48 . 2007-11-07 12:17 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-01-09 14:48 . 2009-01-09 14:53 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-01-09 14:48 . 2007-11-07 20:12 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-01-09 14:48 . 2009-01-09 14:50 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-01-09 14:48 . 2009-01-09 14:48 <DIR> d-------- c:\documents and settings\Administrator 2009-01-09 14:40 . 2009-01-09 14:40 <DIR> d-------- c:\winnt\ERUNT 2009-01-09 14:32 . 2009-01-09 14:53 <DIR> d-------- C:\SDFix 2009-01-05 21:44 . 2009-01-05 21:44 <DIR> d-------- c:\program files\software 2009-01-03 18:14 . 2009-01-04 13:06 <DIR> d-------- c:\program files\Trojan Remover 2009-01-03 18:09 . 2009-01-11 09:39 <DIR> d-------- c:\program files\Anti-Trojan-55 2009-01-02 17:51 . 2000-05-22 15:58 115,920 --a------ c:\winnt\system32\MSINET.OCX 2008-12-24 20:00 . 2008-12-24 20:00 <DIR> d-------- c:\program files\HCA . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-11 08:38 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-09 17:06 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-09 17:01 --------- d-----w c:\program files\Norton Security Scan 2009-01-09 09:14 --------- d-----w c:\program files\Spyware Doctor 2009-01-08 14:04 --------- d-----w c:\program files\Common Files\Adobe 2008-12-28 21:11 --------- d-----w c:\program files\Gadu-Gadu 2008-12-26 20:33 163,644 ----a-w c:\winnt\system32\drivers\secdrv.sys 2008-12-23 11:00 --------- d-----w c:\program files\Scooby-Doo (TM) i Miasto Duchów (TM) 2008-12-14 11:37 --------- d-----w c:\documents and settings\user\Dane aplikacji\ipla 2008-12-12 23:18 --------- d-----w c:\documents and settings\user\Dane aplikacji\IE7Pro 2008-12-06 20:01 --------- d-----w c:\program files\Zenek Zombie 2008-12-06 20:00 --------- d-----w c:\program files\Worms 3D - tapety 2008-12-06 19:59 --------- d-----w c:\program files\Electronic Arts 2008-12-06 19:51 --------- d-----w c:\program files\NCH Swift Sound 2008-12-06 15:32 --------- d-----w c:\program files\Common Files\Nero 2008-12-06 15:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-06 15:13 --------- d-----w c:\program files\Nero 2008-12-06 14:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound 2008-12-05 14:09 --------- d-----w c:\documents and settings\user\Dane aplikacji\Nero 2008-12-02 13:20 27,136 ----a-w c:\winnt\system32\drivers\nchssvad.sys 2008-12-02 13:20 --------- d-----w c:\documents and settings\user\Dane aplikacji\NCH Swift Sound 2008-12-01 19:21 --------- d-----w c:\program files\NCH Software 2008-11-22 14:26 --------- d-----w c:\program files\Santa Claus in Trouble 2008-11-16 12:22 --------- d-----w c:\program files\microsoft frontpage 2008-11-16 01:35 --------- d-----w c:\program files\Stardock 2008-11-16 01:11 --------- d-----w c:\program files\Common Files\Stardock 2008-11-16 00:05 --------- d-----w c:\documents and settings\user\Dane aplikacji\PC Tools 2008-11-11 22:22 20,480 ----a-w c:\winnt\system32\scrnrdr.exe 2008-10-23 12:53 284,160 ----a-w c:\winnt\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\winnt\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\winnt\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\winnt\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\winnt\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\winnt\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\winnt\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\winnt\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\winnt\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\winnt\system32\wups.dll 2008-01-11 21:11 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-09_15.28.26.00 ))))))))))))))))))))))))))))))))))))))))) . + 2009-01-11 08:38:11 16,384 ----atw c:\winnt\Temp\Perflib_Perfdata_5f0.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784] "ares"="c:\program files\Ares\Ares.exe" [2007-05-04 961024] "EdHTML"="c:\program files\Binboy\EdHTMLv5.0\EdHTML.exe" [2003-03-24 1443328] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1694208] "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IPLA!"="c:\program files\ipla\ipla.exe" [2008-09-19 2438392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxhkcmd"="c:\winnt\system32\hkcmd.exe" [2005-11-28 77824] "igfxpers"="c:\winnt\system32\igfxpers.exe" [2005-11-28 118784] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" [2008-03-28 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264] "AT-Watch"="c:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2004-10-05 280720] "Anti-Trojan-Watch"="c:\program files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 26624] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\winnt\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\winnt\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=cuosoy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll "VIDC.MJPG"= pvmjpg21.dll "VIDC.PVW2"= pvwv220.dll "VIDC.PIMJ"= pvljpg20.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Documents and Settings\\user\\Dane aplikacji\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Anti-Trojan-55\\Anti-Trojan.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2008-04-04 111184] R4 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51:58 13560] R4 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2008-04-04 20560] R4 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-11-16 356920] S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt --> c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [?] --- Other Services/Drivers In Memory --- *Deregistered* - InCDRec *Deregistered* - mchInjDrv . Zawartość folderu 'Zaplanowane zadania' 2009-01-06 c:\winnt\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] 2009-01-09 c:\winnt\Tasks\Norton Security Scan for user.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 03:18] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.onet.pl/ uInternet Connection Wizard,ShellNext = hxxp://www.ie7pro.com/firstrun/ IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000 IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 TCP: {B0B329F6-25A4-4137-94F6-7939D775B845} = 217.144.192.2,217.144.192.33 FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\j42wqlaq.default\ FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\documents and settings\user\Dane aplikacji\Mozilla\plugins\npPxPlay.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPFxViewer.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin6.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-11 09:48:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1993962763-813497703-1801674531-1003\Software\Microsoft\EventSystem\(F4693080-1C1D-12CE-45A7-1212ECEEF119)*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "VType"=hex:4e,59,69,47 "AType"=hex:4e,59,69,47 [HKEY_USERS\S-1-5-21-1993962763-813497703-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C78E6C60-24F3-AF53-DFB1-3A2FC4FABBC2}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "oamnmcpkplldicphokdaohdclnajin"=hex:64,61,68,68,6c,6b,64,66,00,70 "oaaeejomahocplglccalmlaodgimhn"=hex:6a,61,6d,68,61,6a,68,64,66,6a,68,6f,67,6b, 67,6f,6d,66,68,62,00,cb "nakdchckbcnmogkidilcbmnglnoc"=hex:6a,61,68,68,6f,6a,61,68,63,6f,6b,69,64,63, 6b,65,62,6d,67,6f,00,cb . Czas ukończenia: 2009-01-11 9:50:20 ComboFix-quarantined-files.txt 2009-01-11 08:49:57 ComboFix2.txt 2009-01-10 12:43:33 ComboFix3.txt 2009-01-09 14:29:34 Przed: 34 008 354 816 bajtów wolnych Po: 34,002,173,952 bajtów wolnych 211 --- E O F --- 2008-12-19 11:04:09

**Posty:** 18165 · przez **wojtas** 11 Sty 2009, 14:42

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 9 · przez **Merila** 16 Sty 2009, 16:53

FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7268 * * * ******************************************************************************** Created at 15:51:35 on Friday, January 16, 2009 Time Zone : Logged On User : user Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 Procesor Intel Pentium II System Drive : C:\ Windows Directory : C:\WINNT System Directory : C:\WINNT\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 52 GB System Drive Free : 34.02 GB Total Physical Memory: 1015 MB Free Physical Memory : 462 MB Total Page File : 1015 MB Free Page File : 1066 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1963 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINNT\system32\actskn45.ocx -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kod: Zaznacz wszystko: RAPORT KASPERSKY ONLINE SCANNER 7.0 czwartek, 15 styczeń 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Thursday, January 15, 2009 13:07:02 Liczba wpisów: 1625616 Ustawienia skanowania Typ bazy danych użytej do skanowania rozszerzona Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer C:\ D:\ E:\ F:\ Statystyki skanowania Przeskanowanych plików 64467 Nazwa zagrożenia 1 Zainfekowanych obiektów 1 Podejrzanych obiektów 0 Czas skanowania 02:42:15 Nazwa pliku Nazwa zagrożenia Liczba zagrożeń C:\Documents and Settings\user\Moje dokumenty\Gry\CursorManiaSetup2.3.50.19.ZCfox000.exe Zainfekowany: not-a-virus:AdTool.Win32.MyWebSearch.cb 1 Wybrany obszar został przeskanowany.

**Posty:** 18165 · przez **wojtas** 16 Sty 2009, 17:02

powinno byc ok

**Posty:** 9 · przez **Merila** 16 Sty 2009, 17:35

Dziękuję bardzo za pomoc

Kto jest na forum