Lucomserver_3_4.exe

**Posty:** 35 · przez **Believer** 01 Lis 2008, 08:49

WIec mam server gry muonline jednak gdy odpala go pozniej mi super extra komp zamula(Ram 4gb , prcek 2.72ghz) patrza w menadzer urzadzen a tam taki plik LuComServer_3_4.EXE bierze mi 50% CPU , NIE wiemczy to WIUS czy co , powiedzcie mi jak sie tego pozbyc , albo jak to naprawic (usunac sie nie da) .

ZALEZY MI NA SZYBKIM ROZWIAZANIU PROBLEMU!! :cry:

Antywirus: Norton 2008 PL z Licencja

WYkaz z hijackloga:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:45:22, on 2008-11-01 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\AppServ\Apache2\bin\Apache.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\AppServ\MySQL\bin\mysqld-nt.exe C:\AppServ\Apache2\bin\Apache.exe C:\Program Files\TeamViewer3\TeamViewer_Service.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\TeamViewer3\TeamViewer.exe C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DNSUpdate] C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: Norton Internet Security.lnk = C:\Program Files\Common Files\Symantec Shared\NPC\2.0\uiStub2.exe O4 - Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BB3C3DF0-54C4-4AE3-BA54-196CD6D01FDD}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache2 - Apache Software Foundation - C:\AppServ\Apache2\bin\Apache.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Service.exe -- End of file - 5600 bytes

**Posty:** 300 · przez **sgsman** 01 Lis 2008, 11:30

1. Wsadź loga w tagi code.
2. Skoro podejrzewasz, że to wirus, to wrzuć loga z combofixa.

**Posty:** 35 · przez **Believer** 01 Lis 2008, 11:49

Prosze, w hijackthis zaznaczylem wszystko i dalem fix checked dobrze zrobilem??

**Posty:** 18165 · przez **wojtas** 01 Lis 2008, 12:34

jak wszystko?
zobacz tu i postaraj sie odzyskac wpisy usuniete i daj loga z combofixa...

**Posty:** 35 · przez **Believer** 01 Lis 2008, 13:32

W zakladnce Backup zaznaczylem wszystlko i dalem Restore , a oto nowy wykaz :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:15:11, on 2008-11-01 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\TeamViewer3\TeamViewer_Service.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\TeamViewer3\TeamViewer.exe C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Killak - {1F88A6F5-908C-4C28-9A81-829953C5F5C5} - C:\WINDOWS\system32\MSYSAM~1.DLL (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [DNSUpdate] C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Startup: Gadu-Gadu.lnk = C:\Program Files\Gadu-Gadu\gg.exe O4 - Startup: Krasnal START.lnk = C:\usr\Krasnal Start.exe O4 - Startup: Norton Internet Security.lnk = C:\Program Files\Common Files\Symantec Shared\NPC\2.0\uiStub2.exe O4 - Startup: Service Manager (2).lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O4 - Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Dyn.pl DNSUpdate.lnk = C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{798DF77F-ECEE-46C6-A461-9650AE8C3EA9}: NameServer = 194.204.159.1,194.204.159.64 O17 - HKLM\System\CCS\Services\Tcpip\..\{7E9400E4-951C-414F-839C-8EB308C95C61}: NameServer = 194.204.159.1,104.204.159.64 O17 - HKLM\System\CCS\Services\Tcpip\..\{BB3C3DF0-54C4-4AE3-BA54-196CD6D01FDD}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache2 - Apache Software Foundation - C:\AppServ\Apache2\bin\Apache.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Service.exe -- End of file - 8605 bytes

LOG Z COMBOFIXA

Kod: Zaznacz wszystko: ComboFix 08-10-31.02 - Server 2008-11-01 12:21:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2784 [GMT 1:00] Uruchomiony z: C:\Documents and Settings\Server\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Server\Menu Start\Cheap Pharmacy Online.url C:\Documents and Settings\Server\Menu Start\Search Online.url C:\Documents and Settings\Server\Menu Start\VIP Casino.url C:\Documents and Settings\Server\Ulubione\Cheap Pharmacy Online.url C:\Documents and Settings\Server\Ulubione\Search Online.url C:\Documents and Settings\Server\Ulubione\VIP Casino.url C:\WINDOWS\k.txt C:\WINDOWS\system32\c.ico C:\WINDOWS\system32\m.ico C:\WINDOWS\system32\s.ico C:\WINDOWS\system32\setup.ini . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-01 do 2008-11-01 ))))))))))))))))))))))))))))))) . 2008-10-31 18:58 . 2007-09-18 21:25 1,032,657 --a------ C:\WINDOWS\system32\libxml2.dll 2008-10-31 18:58 . 2007-09-18 21:25 126,976 --a------ C:\WINDOWS\system32\sqlapi.dll 2008-10-31 18:58 . 2005-05-08 16:56 55,808 --a------ C:\WINDOWS\system32\zlib1.dll 2008-10-31 18:38 . 2008-10-31 18:38 <DIR> dr------- C:\Documents and Settings\LocalService\Moje dokumenty 2008-10-31 18:30 . 2008-10-31 18:30 124 --a------ C:\WINDOWS\ODBC.INI 2008-10-31 15:31 . 2008-10-31 15:31 <DIR> d-------- C:\Program Files\Kerio 2008-10-31 15:11 . 2008-10-31 15:11 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-31 14:47 . 2008-10-31 14:56 <DIR> d-------- C:\Program Files\AutoConnect 2008-10-23 21:23 . 2008-10-23 21:42 <DIR> d-------- C:\AppServ 2008-10-16 00:56 . 2008-09-08 11:41 333,824 --------- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-16 00:56 . 2008-08-14 11:04 138,496 --------- C:\WINDOWS\system32\dllcache\afd.sys 2008-10-16 00:55 . 2008-08-14 14:26 2,190,464 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-16 00:55 . 2008-08-14 14:26 2,146,816 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-16 00:55 . 2008-08-14 14:26 2,067,328 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-16 00:55 . 2008-08-14 14:26 2,025,472 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-16 00:55 . 2008-09-15 16:27 1,846,656 --------- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-12 07:52 . 2008-10-12 07:54 <DIR> d-------- C:\Program Files\Dyn.pl DNSUpdate 2008-10-12 07:37 . 2008-10-12 07:37 <DIR> d-------- C:\Program Files\Windows Sidebar 2008-10-12 07:36 . 2008-10-12 07:38 <DIR> d-------- C:\Program Files\Norton Internet Security 2008-10-12 07:34 . 2008-10-12 07:47 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-12 07:34 . 2008-10-12 07:47 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-10-12 07:34 . 2008-10-12 07:47 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-10-12 07:34 . 2008-10-12 07:47 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-10-12 01:12 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2008-10-12 00:45 . 2008-10-12 00:45 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-11 23:47 . 2008-10-12 00:50 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-10-11 18:56 . 2008-10-23 22:39 196 --a------ C:\WINDOWS\wcx_ftp.ini 2008-10-11 18:55 . 2008-10-23 22:39 <DIR> d-------- C:\totalcmd 2008-10-11 18:55 . 2008-10-23 22:47 1,126 --a------ C:\WINDOWS\wincmd.ini 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\UC.PIF 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\RAR.PIF 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\LHA.PIF 2008-10-11 18:55 . 2008-08-08 06:04 545 --a------ C:\WINDOWS\ARJ.PIF 2008-10-11 14:34 . 2008-10-11 14:34 <DIR> d-------- C:\Documents and Settings\Server\Dane aplikacji\Noth2 2008-10-11 14:33 . 2008-10-11 14:33 <DIR> d-------- C:\Program Files\NotH 2008-10-11 13:22 . 2008-10-11 13:22 146 --a------ C:\WINDOWS\DelMR.bat 2008-10-11 13:13 . 2008-11-01 01:40 <DIR> d-------- C:\Program Files\TeamViewer3 2008-10-11 09:59 . 2008-10-11 09:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2008-10-11 08:58 . 2008-10-11 08:59 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-09 22:11 . 2008-10-09 22:11 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\TeamViewer 2008-10-09 15:46 . 2004-08-04 03:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-10-09 15:45 . 2008-10-09 15:45 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-10-09 15:45 . 2008-10-09 15:45 <DIR> d-------- C:\WINDOWS\srchasst 2008-10-09 15:45 . 2008-10-09 15:45 <DIR> d-------- C:\WINDOWS\msagent 2008-10-09 15:45 . 2008-10-09 15:45 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-10-08 21:35 . 2008-10-08 21:35 <DIR> d-------- C:\WINDOWS\system32\pl 2008-10-08 21:35 . 2008-10-08 21:35 <DIR> d-------- C:\WINDOWS\system32\bits 2008-10-08 21:35 . 2008-10-08 21:35 <DIR> d-------- C:\WINDOWS\l2schemas 2008-10-08 21:33 . 2008-10-08 21:35 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-10-06 23:25 . 2008-04-14 18:20 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-10-06 14:08 . 2000-07-07 11:20 81,920 --a------ C:\WINDOWS\system32\mdt2fw95.dll 2008-10-06 14:08 . 2000-08-06 00:50 36,939 --a------ C:\WINDOWS\system32\insrepim.exe 2008-10-06 14:08 . 2000-08-06 00:51 28,734 --a------ C:\WINDOWS\system32\dbmslpcn.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-01 11:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-10-31 14:12 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\uTorrent 2008-10-31 13:49 --------- d-----w C:\Program Files\neostrada tp 2008-10-18 22:21 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\TeamViewer 2008-10-13 18:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-10-12 06:47 --------- d-----w C:\Program Files\Symantec 2008-10-11 23:37 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\skypePM 2008-10-11 23:37 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Skype 2008-10-11 21:42 --------- d-----w C:\Program Files\Sony Ericsson 2008-10-11 12:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-11 12:22 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-10-11 12:22 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Teleca 2008-10-11 12:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-10-11 12:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2008-10-11 12:15 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Sony 2008-10-11 09:00 --------- d-----w C:\Program Files\Common Files\Adobe 2008-10-11 07:53 --------- d-----w C:\Program Files\Winamp Remote 2008-10-11 07:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2008-10-03 16:23 6,068,224 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2008-09-30 14:10 --------- d-----w C:\Program Files\Reference Assemblies 2008-09-30 14:10 --------- d-----w C:\Program Files\MSBuild 2008-09-29 17:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony 2008-09-29 17:57 --------- d-----w C:\Program Files\Common Files\Sony Shared 2008-09-29 17:57 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Apple Computer 2008-09-29 17:56 --------- d-----w C:\Program Files\QuickTime 2008-09-29 17:56 --------- d-----w C:\Program Files\Common Files\Apple 2008-09-29 17:56 --------- d-----w C:\Program Files\Apple Software Update 2008-09-29 17:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-09-29 17:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-09-29 17:52 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Sony Setup 2008-09-29 17:51 --------- d-----w C:\Program Files\Sony Setup 2008-09-29 15:44 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Sony Ericsson 2008-09-29 15:43 --------- d-----w C:\Program Files\MSXML 6.0 2008-09-28 10:45 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2008-09-27 04:44 --------- d-----w C:\Program Files\Real 2008-09-27 04:44 --------- d-----w C:\Program Files\Common Files\xing shared 2008-09-27 04:44 --------- d-----w C:\Program Files\Common Files\Real 2008-09-26 04:58 --------- d-----w C:\Program Files\Skype 2008-09-26 04:58 --------- d-----w C:\Program Files\Common Files\Skype 2008-09-26 04:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-09-25 13:56 --------- d-----w C:\Program Files\Microsoft SQL Server 2008-09-25 06:14 --------- d-----w C:\Program Files\ZTE ZXDSL 852 2008-09-25 06:04 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\AdobeUM 2008-09-24 14:27 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Winamp 2008-09-24 14:11 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Gadu-Gadu 2008-09-24 13:13 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-24 12:46 --------- d-----w C:\Program Files\Java 2008-09-22 19:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla! 2008-09-22 19:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\SITEguard 2008-09-22 19:22 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-22 19:20 --------- d-----w C:\Program Files\Common Files\iS3 2008-09-22 18:46 --------- d-----w C:\Documents and Settings\Server\Dane aplikacji\Symantec 2008-09-22 18:28 --------- d-----w C:\Program Files\Usługi online 2008-09-22 18:26 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-25 08:43 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-08-25 08:43 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-12 21741864] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "DNSUpdate"="C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe" [2007-04-08 290816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 7630848] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 86016] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-02-06 718704] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-25 51048] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-27 185872] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "nwiz"="nwiz.exe" [2006-08-11 C:\WINDOWS\system32\nwiz.exe] "AdslTaskBar"="stmctrl.dll" [2006-06-02 C:\WINDOWS\system32\stmctrl.dll] "RTHDCPL"="RTHDCPL.EXE" [2007-10-17 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2008-08-26 C:\WINDOWS\system32\advpack.dll] C:\Documents and Settings\Server\Menu Start\Programy\Autostart\ Gadu-Gadu.lnk - C:\Program Files\Gadu-Gadu\gg.exe [2008-03-20 2127296] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] Dyn.pl DNSUpdate.lnk - C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe [2008-10-12 290816] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-10-06 69632] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "D:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "80:TCP"= 80:TCP:Enabled "6112:TCP"= 6112:TCP:war R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-09-26 286720] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-09-26 81920] R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-25 149864] R2 TeamViewer;TeamViewer 3;C:\Program Files\TeamViewer3\TeamViewer_Service.exe [2008-10-07 185640] R3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888] R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255] R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 684265] S3 LNE100;Linksys LNE100TX(v5) Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\LNE100V5.sys [2007-10-17 36224] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69ba6903-88d5-11dd-bd06-00508db7ee34}] \Shell\AutoRun\command - G:\USBNB.exe *Newly Created Service* - COMHOST *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-10-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-01 C:\WINDOWS\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - Server.job - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 07:05] . - - - - USUNIĘTO PUSTE WPISY - - - - Toolbar-SITEguard - (no file) HKCU-Run-AutoConnect - C:\Program Files\AutoConnect\AutoConnect.exe HKLM-Run-WOOTASKBARICON - C:\PROGRA~1\NEOSTR~1\GestMaj.exe HKLM-Run-ISTray - C:\Program Files\Spyware Doctor\pctsTray.exe HKLM-Run-WOOWATCH - C:\PROGRA~1\NEOSTR~1\Watch.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Server\Dane aplikacji\Mozilla\Firefox\Profiles\tm353g5o.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPOJI610.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava11.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava12.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava13.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJava32.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPJPI140_03.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPOJI610.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll FF -: plugin - D:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - D:\Program Files\RealPlayer\Netscape6\nppl3260.dll FF -: plugin - D:\Program Files\RealPlayer\Netscape6\nprjplug.dll FF -: plugin - D:\Program Files\RealPlayer\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 12:29:18 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mysql] "ImagePath"="C:\AppServ\MySQL\bin\mysqld-nt --defaults-file=C:\AppServ\MySQL\my.ini mysql" . Czas ukończenia: 2008-11-01 12:31:09 ComboFix-quarantined-files.txt 2008-11-01 11:31:03 Przed: 83 447 136 256 bajtów wolnych Po: 83,672,252,416 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 279 --- E O F --- 2008-10-16 02:01:02

**Posty:** 7956 · przez **Magik** 01 Lis 2008, 14:28

W hijacku na fix:

Kod: Zaznacz wszystko: O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

Believer napisał(a):LuComServer_3_4.EXE bierze mi 50% CPU , NIE wiemczy to WIUS czy co

to skladnik nortona-->zmien antywirusa

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69ba6903-88d5-11dd-bd06-00508db7ee34}]

zpisz jako fix.reg i odpal

i ten plik przeskanuj na virustotal.com

Kod: Zaznacz wszystko: C:\WINDOWS\DelMR.bat

**Posty:** 35 · przez **Believer** 01 Lis 2008, 14:32

Bog zaplac

Dodano 01.11.2008 14:33:09:
Brawo

Kto jest na forum