Log wolno chodzi komp.

**Posty:** 69 · przez **KiweK** 01 Maj 2009, 13:53

Witam
Nie wiem co jest ale komp mi wolno chodzi i nod co jakiś czas mi pokazuje komunikat że mam jakiegoś trojan Win32/genetic
Wrzucam Loga

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2009-05-01 at 13:28 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-01 13:32:46 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:018410b4 "s2"=dword:00d7a1ff "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:91,f5,33,b9,df,53,0d,4b,50,7d,43,d5,39,98,20,0e,12,f5,7b,73,d8,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,c7,cd,90,79,1c,3f,50,88,9b,d7,ac,74,59,3d,2a,9e,99,.. "khjeh"=hex:08,9b,2c,84,5f,23,0b,5c,5f,65,a8,05,95,48,3a,96,c0,7c,fd,f5,74,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:27,8b,03,72,c2,96,70,95,53,e6,d5,32,5f,70,5b,1e,0a,fe,11,73,b7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:91,f5,33,b9,df,53,0d,4b,50,7d,43,d5,39,98,20,0e,12,f5,7b,73,d8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,c7,cd,90,79,1c,3f,50,88,9b,d7,ac,74,59,3d,2a,9e,99,.. "khjeh"=hex:08,9b,2c,84,5f,23,0b,5c,5f,65,a8,05,95,48,3a,96,c0,7c,fd,f5,74,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:27,8b,03,72,c2,96,70,95,53,e6,d5,32,5f,70,5b,1e,0a,fe,11,73,b7,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Disabled:Orb" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"="C:\\Program Files\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"="C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"="C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe:*:Disabled:Java(TM) Platform SE binary" "C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"="C:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"="C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Fri 31 Oct 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 7 Apr 2009 0 A..H. --- "C:\Documents and Settings\w\Ustawienia lokalne\Temp\BIT2.tmp" Tue 7 Apr 2009 0 A..H. --- "C:\Documents and Settings\w\Ustawienia lokalne\Temp\BIT3.tmp" Tue 7 Apr 2009 0 A..H. --- "C:\Documents and Settings\w\Ustawienia lokalne\Temp\BIT4.tmp" Tue 7 Apr 2009 0 A..H. --- "C:\Documents and Settings\w\Ustawienia lokalne\Temp\BIT5.tmp" Tue 7 Apr 2009 0 A..H. --- "C:\Documents and Settings\w\Ustawienia lokalne\Temp\BIT7.tmp" Wed 8 Apr 2009 0 A..H. --- "C:\Documents and Settings\w\Ustawienia lokalne\Temp\BIT9.tmp" Tue 16 Sep 2008 31,232 ...H. --- "C:\Documents and Settings\w\Dane aplikacji\Microsoft\Word\~WRL0004.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:38:48, on 2009-05-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe" O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [HP SchedIndexer] C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe O4 - HKLM\..\Run: [HP AutoIndexer] C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [LCheck] C:\Program Files\Beniamin\LCheck.exe /check O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP LaserJet Director.lnk = C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 5084 bytes

Bede wdzieczny za pomoc
Pozdrawaim

**Posty:** 8001 · przez **Okocza** 01 Maj 2009, 13:54

KiweK, wstaw log z combofixa

**Posty:** 69 · przez **KiweK** 01 Maj 2009, 21:48

Logo z combofixa

Kod: Zaznacz wszystko: ComboFix 09-05-01.1 - w 2009-05-01 21:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.767.426 [GMT 2:00] Uruchomiony z: C:\ComboFix.exe AV: Eset NOD32 antivirus system 2.50 *On-access scanning enabled* (Outdated) * Resident AV is active UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\w\Dane aplikacji\.# c:\documents and settings\w\Dane aplikacji\.#\MBX@61C@3C3C18.### c:\documents and settings\w\Dane aplikacji\.#\MBX@96C@3C3C18.### c:\windows\IE4 Error Log.txt c:\windows\system32\setup.ini . ((((((((((((((((((((((((( Pliki utworzone od 2009-04-01 do 2009-05-01 ))))))))))))))))))))))))))))))) . 2009-05-01 19:27 . 2009-05-01 19:28 3012587 ----a-r C:\ComboFix.exe 2009-05-01 11:55 . 2009-03-10 20:18 455048 ----a-w c:\windows\system32\KB905474\wgasetup.exe 2009-05-01 11:55 . 2009-05-01 11:55 -------- d-----w c:\windows\system32\KB905474 2009-05-01 11:55 . 2009-03-10 20:26 1436544 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe 2009-05-01 11:26 . 2009-05-01 11:26 -------- d-----w c:\windows\ERUNT 2009-05-01 11:19 . 2009-05-01 11:19 401720 ----a-w C:\HiJackThis.exe 2009-05-01 11:11 . 2009-05-01 11:34 -------- d-----w C:\SDFix 2009-04-23 16:54 . 2009-04-23 16:54 -------- d--h--w c:\documents and settings\w\Dane aplikacji\Chromeflower 2009-04-23 16:54 . 2009-04-23 16:54 -------- d--h--w c:\documents and settings\w\Dane aplikacji\CrystalSpace 2009-04-23 16:54 . 2009-04-23 16:54 -------- d-----w c:\program files\ICE-land 2009-04-16 15:16 . 2005-07-26 04:42 60416 -c----w c:\windows\system32\dllcache\colbact.dll 2009-04-16 15:16 . 2009-02-06 16:39 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 15:16 . 2009-03-06 14:47 285184 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 15:16 . 2009-02-09 10:22 473088 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 15:16 . 2009-02-09 10:22 399360 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 15:16 . 2009-02-09 10:10 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 15:16 . 2009-02-09 10:22 686080 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 15:16 . 2009-02-09 10:22 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-16 15:16 . 2009-02-09 10:22 722944 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 15:15 . 2008-04-21 21:28 218112 -c----w c:\windows\system32\dllcache\wordpad.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-01 19:36 . 2008-05-26 16:46 -------- d-----w c:\program files\Kalendarz XP 2009-05-01 19:23 . 2008-06-06 20:42 -------- d-----w c:\program files\lg_fwupdate 2009-05-01 11:07 . 2008-05-21 22:58 -------- d-----w c:\program files\Save 2009-05-01 10:59 . 2008-08-02 17:02 -------- d-----w c:\program files\Tipser 2009-04-17 16:52 . 2001-10-30 12:00 83266 ----a-w c:\windows\system32\perfc015.dat 2009-04-17 16:52 . 2001-10-30 12:00 487982 ----a-w c:\windows\system32\perfh015.dat 2009-04-02 17:59 . 2009-04-01 15:01 -------- d-----w c:\program files\YouTube Video Downloader 2009-03-09 16:41 . 2009-03-09 16:41 -------- d-----w c:\program files\uTorrent 2009-03-06 14:47 . 2001-10-30 12:00 285184 ----a-w c:\windows\system32\pdh.dll 2009-03-04 17:31 . 2009-03-04 17:31 -------- d-----w c:\program files\Słownik Języka Polskiego GoNaomi 1.4 2009-03-04 17:01 . 2008-05-25 15:55 -------- d-----w c:\program files\Gadu-Gadu 2009-03-03 16:58 . 2009-03-03 16:58 -------- d-----w c:\program files\Nowe Gadu-Gadu 2009-02-20 08:32 . 2001-10-30 12:00 662016 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:32 . 2008-05-21 21:16 81920 ------w c:\windows\system32\ieencode.dll 2009-02-12 18:08 . 2009-02-12 18:08 7168 ----a-w C:\chp.exe 2009-02-12 18:08 . 2009-02-12 18:08 123 ----a-w C:\DelMe.bat 2009-02-09 14:19 . 2001-10-30 12:00 1846528 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:52 . 2001-10-26 16:50 2017280 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:52 . 2001-10-30 12:00 2137600 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 10:22 . 2001-10-30 12:00 725504 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:22 . 2001-10-30 12:00 686080 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:22 . 2001-10-30 12:00 399360 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:22 . 2001-10-30 12:00 722944 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 10:10 . 2001-10-30 12:00 111104 ----a-w c:\windows\system32\services.exe 2009-02-07 14:09 . 2008-05-21 21:24 347136 ----a-w c:\documents and settings\w\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-02-06 16:54 . 2001-10-30 12:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-03 20:11 . 2001-10-30 12:00 55808 ----a-w c:\windows\system32\secur32.dll 2004-10-01 13:00 . 2008-06-06 20:35 40960 ----a-w c:\program files\Uninstall_CDS.exe . ------- Sigcheck ------- [-] 2001-10-30 12:00 12800 B3C95BFEEF6781A82A1C429F466A3A11 c:\windows\$NtServicePackUninstall$\svchost.exe [-] 2004-08-03 22:44 14336 BA98327E90022DBD6EE76490E0622E2E c:\windows\ServicePackFiles\i386\svchost.exe [-] 2008-04-14 17:21 14336 8607D35D92528E2DF386F19A960D23CE c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\svchost.exe [-] 2004-08-03 22:44 14336 BA98327E90022DBD6EE76490E0622E2E c:\windows\system32\svchost.exe [-] 2001-10-30 12:00 75264 9B7D1C56CC12D806314B853BF52ECB4C c:\windows\$NtServicePackUninstall$\ws2_32.dll [-] 2004-08-03 22:44 82944 AB82237486B727DD7DAB36A76F38A3A2 c:\windows\ServicePackFiles\i386\ws2_32.dll [-] 2008-04-14 17:20 82432 C0AA2AB856680C44739B41E01F5BD4E9 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ws2_32.dll [-] 2004-08-03 22:44 82944 AB82237486B727DD7DAB36A76F38A3A2 c:\windows\system32\ws2_32.dll [-] 2001-10-30 12:00 432640 306530C12F412868E2E85431250E68A1 c:\windows\$NtServicePackUninstall$\winlogon.exe [-] 2004-08-03 22:44 504832 0344407089B08548D4FEBA62BB0F32D0 c:\windows\ServicePackFiles\i386\winlogon.exe [-] 2008-04-14 17:21 510464 51FD2E13D723857B9CA239AE77150F48 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\winlogon.exe [-] 2004-08-03 22:44 504832 0344407089B08548D4FEBA62BB0F32D0 c:\windows\system32\winlogon.exe [-] 2001-10-30 12:00 161536 3EFD4F59BA0A340DE0A3AB984001DBF7 c:\windows\$NtServicePackUninstall$\ndis.sys [-] 2004-08-03 21:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\ServicePackFiles\i386\ndis.sys [-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ndis.sys [-] 2004-08-03 21:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\drivers\ndis.sys [-] 2004-08-03 21:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\ServicePackFiles\i386\ip6fw.sys [-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ip6fw.sys [-] 2004-08-03 21:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys [-] 2001-10-30 12:00 11776 5CC79CFE660DD720739FB9ADB03F2275 c:\windows\$NtServicePackUninstall$\lsass.exe [-] 2004-08-03 22:44 13312 F485FEFC8CC4FD29243D800BE5D275D1 c:\windows\ServicePackFiles\i386\lsass.exe [-] 2008-04-14 17:21 13312 88296F7943F30A1EE3AF735440B92268 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\lsass.exe [-] 2004-08-03 22:44 13312 F485FEFC8CC4FD29243D800BE5D275D1 c:\windows\system32\lsass.exe [-] 2001-10-30 12:00 13312 106E93E7EEAD4F0797FC1A30BD53FA3D c:\windows\$NtServicePackUninstall$\ctfmon.exe [-] 2004-08-03 22:44 15360 CBFA30492D70CE3938D8A7783D0C0436 c:\windows\ServicePackFiles\i386\ctfmon.exe [-] 2008-04-14 17:21 15360 1BD41EDA5B869AFC99895C39A8DE36E1 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ctfmon.exe [-] 2004-08-03 22:44 15360 CBFA30492D70CE3938D8A7783D0C0436 c:\windows\system32\ctfmon.exe [-] 2001-10-30 12:00 22016 9F95EC57E3AB4876AC7A6495FF289EC7 c:\windows\$NtServicePackUninstall$\userinit.exe [-] 2004-08-03 22:44 25088 BD768099B4C44AA631728CB74EB54396 c:\windows\ServicePackFiles\i386\userinit.exe [-] 2008-04-14 17:21 26624 2A5B37D520508BE6570A3EA79695F5B5 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\userinit.exe [-] 2004-08-03 22:44 25088 BD768099B4C44AA631728CB74EB54396 c:\windows\system32\userinit.exe [-] 2001-10-30 12:00 198656 9CD7EBEC636E21C5E4ADEA2FC0427785 c:\windows\$NtServicePackUninstall$\termsrv.dll [-] 2004-08-03 22:44 296448 2C28157229925280916B3041CCC5FE4B c:\windows\ServicePackFiles\i386\termsrv.dll [-] 2008-04-14 17:20 296448 52E0505408EDD4AB5CCC7F83B67B4299 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\termsrv.dll [-] 2004-08-03 22:44 296448 2C28157229925280916B3041CCC5FE4B c:\windows\system32\termsrv.dll [-] 2001-10-30 12:00 14848 CF06FF4307712677DD2EA86921CCD52F c:\windows\$NtServicePackUninstall$\powrprof.dll [-] 2004-08-03 22:44 17408 B20BB2A65349EF132FA7F2EB51A29E5C c:\windows\ServicePackFiles\i386\powrprof.dll [-] 2008-04-14 17:20 17408 414C17A2958AEDAC700BBAAFBF999F94 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\powrprof.dll [-] 2004-08-03 22:44 17408 B20BB2A65349EF132FA7F2EB51A29E5C c:\windows\system32\powrprof.dll [-] 2001-10-30 12:00 96768 00003EB4947FBFBD8A0BE1CDD7627A69 c:\windows\$NtServicePackUninstall$\imm32.dll [-] 2004-08-03 22:44 110080 BDB679C04273B19BF46BD0D591FDEEC3 c:\windows\ServicePackFiles\i386\imm32.dll [-] 2008-04-14 17:20 110080 2E9A03268E609917B83921EE16FD9CFB c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\imm32.dll [-] 2004-08-03 22:44 110080 BDB679C04273B19BF46BD0D591FDEEC3 c:\windows\system32\imm32.dll [-] 2001-10-30 12:00 1564160 FFCECC0A321985719C72E9BED0CB184C c:\windows\$NtServicePackUninstall$\sfcfiles.dll [-] 2004-08-03 22:44 1548288 F044A12CFFB8E58BC044A2605283A636 c:\windows\ServicePackFiles\i386\sfcfiles.dll [-] 2008-04-14 17:20 1571840 A9ED600F08A92143253C10EDB5651ECF c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\sfcfiles.dll [-] 2004-08-03 22:44 1548288 F044A12CFFB8E58BC044A2605283A636 c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "WhenUSave"="c:\program files\Save\Save.exe" [2006-08-25 803184] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "Google Update"="c:\documents and settings\w\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-09-03 133104] "Save"="c:\program files\Save\Save.exe" [2006-08-25 803184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2005-05-18 917504] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "Norton Ghost 12.0"="c:\program files\Norton Ghost\Agent\VProTray.exe" [2007-03-28 2037352] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-03-14 233472] "HP SchedIndexer"="c:\program files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe" [2001-02-19 86016] "HP AutoIndexer"="c:\program files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe" [2001-02-19 77824] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016] "RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2006-03-14 1397760] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2008-11-29 548864] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "AdslTaskBar"="stmctrl.dll" - c:\windows\system32\stmctrl.dll [2006-06-02 151552] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP LaserJet Director.lnk - c:\program files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe [2008-5-25 212992] Kalendarz XP.lnk - c:\program files\Kalendarz XP\Kalendarz.exe [2008-5-26 882176] Picture Package Menu.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2008-6-16 151552] Picture Package VCD Maker.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2008-6-16 106496] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\DRIVERS\torususb.sys [2006-07-05 683791] S3 Stmatm;ATM/ADSL miniport;c:\windows\system32\DRIVERS\stmatm.sys [2003-08-12 60255] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72c7d54f-4e91-11dd-89ec-00196652a446}] \Shell\AutoRun\command - K:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8148775-8f07-11dd-ba2f-00196652a446}] \Shell\AutoRun\command - setup.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1123561945-573735546-725345543-1003.job - c:\documents and settings\w\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-03 19:01] 2009-05-01 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-01 20:18] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-PowerBar - (no file) HKCU-Run-fsm - (no file) HKLM-Run-LCheck - c:\program files\Beniamin\LCheck.exe HKLM-Run-Cmaudio - cmicnfg.cpl Notify-WgaLogon - (no file) . ------- Skan uzupełniający ------- . uStart Page = hxxp://interia.pl/ IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: imon.dll FF - ProfilePath - c:\documents and settings\w\Dane aplikacji\Mozilla\Firefox\Profiles\14ijjaar.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - www.onet.pl FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= FF - component: c:\documents and settings\w\Dane aplikacji\Mozilla\Firefox\Profiles\14ijjaar.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - component: c:\documents and settings\w\Dane aplikacji\Mozilla\Firefox\Profiles\14ijjaar.default\extensions\bkmrksync@nokia.com\components\BkMrkExt.dll FF - plugin: c:\documents and settings\w\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-01 21:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run PowerBar = ????????????l?@?l?@?D?????6~??????????????6~l?@?l?@????? ???????????W?9~??6~??????6~K?6~x???????[?6~???????? ??????????????|x???0???????????? nt??6~???????????????? VR?????@???????l?@?l?@?????Q?7~????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@ skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(708) c:\windows\system32\imon.dll . Czas ukończenia: 2009-05-01 21:45 ComboFix-quarantined-files.txt 2009-05-01 19:45 Przed: 6 127 300 608 bajtów wolnych Po: 6 617 296 896 bajtów wolnych 221 --- E O F --- 2009-05-01 11:55

**Posty:** 18165 · przez **wojtas** 03 Maj 2009, 22:47

odinstaluj w dodaj usun programy Save

znasz te pliki??

C:\chp.exe
C:\DelMe.bat

jesli nie skasuj je...

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 69 · przez **KiweK** 04 Maj 2009, 23:45

Mam problem z wyłaczeniem nie potrzebnych procesów wszystko robie jak należy a przy nastepnym włączeniu kompa znowu sie uruchamiają. Nie wiem czemu

Oto loga

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 poniedziałek, 4 maj 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Monday, May 04, 2009 18:42:47 Liczba wpisów: 2129449 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Statystyki skanowania: Przeskanowanych plików: 68950 Nazwa zagrożenia: 1 Zainfekowanych obiektów: 1 Podejrzanych obiektów: 0 Czas skanowania: 01:35:29 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\Program Files\DAEMON Tools\SetupDTSB.exe Zainfekowany: not-a-virus:WebToolbar.Win32.WhenU.a 1 Wybrany obszar został przeskanowany.

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 23:41:50 on Monday, May 04, 2009 Time Zone : Logged On User : w Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 2.80GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 6.23 GB Total Physical Memory: 767 MB Free Physical Memory : 502 MB Total Page File : 767 MB Free Page File : 1571 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1969 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Chyba już czysto ??
bo jakoś odzewu nie ma

Pozdr