bardzo proszę o sprawdzenie

**Posty:** 11 · przez **jakotako14** 11 Lis 2007, 17:25

Mam internet 1M od Neti i ten internet czasami strasznie zwalnia, do takiego stopnia że na otwarcie interi potrzebuje ok 1 minuty, po chwili wszystko działa tak jak powinno. Podobnie jest z filmikami na youtube. Transwer tak ogólnie to jest taki jak powinien (D:~130 U:~30). Wrzucam log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:08:16, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\cFosSpeed\spd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Netia\Net\netianet.exe E:\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O1 - Hosts: 80.190.241.30 home.edonkey.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\akrobat reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [kav] "E:\Kaspersky Anti-Virus\avp.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "G:\se\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "G:\se pc suite\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe -auto O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [CS Smieciarek NxG] "F:\Smieciarek NxG\Smieciarek.exe" O4 - HKCU\..\Run: [Spamihilator] "H:\Spamihilator\spamihilator.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = G:\Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://G:\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Kaspersky Anti-Virus\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} (Ganymede Sudoku) - http://67.15.101.33/g_bin/pl/sudoku_2_0_0_15.cab O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.33/g_bin/pl/breakout_2_0_0_29.cab O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/pl/mahjong_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{775F74EB-24E7-4B81-A4C3-0972D23D3F07}: NameServer = 83.238.255.76 213.241.79.37 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: rpcc - C:\WINDOWS\ O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - E:\Kaspersky Anti-Virus\avp.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6418 bytes

Z góry dziękuje.

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 19:12

skasuj te wpisy"

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O20 - Winlogon Notify: rpcc - C:\WINDOWS\

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 11 · przez **jakotako14** 11 Lis 2007, 19:55

Zawartość z pliku Report.txt:

Kod: Zaznacz wszystko: SDFix: Version 1.114 Run by Dom on 2007-11-11 at 18:26 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFx\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system32\~.exe - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 18:35:11 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run PowerBar = ????????????l?@?l?@?D??????w???????????????wl?@?l?@????? ??????????????w???w???????w?m?wx????????m?w???????? ??????????????|x???0???????????? nt???w????????????????4???????Z???????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@ scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "E:\\BitLord\\BitLord.exe"="E:\\BitLord\\BitLord.exe:*:Disabled:BitLord" "E:\\Gadu-Gadu\\gg.exe"="E:\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "G:\\eDonkey2000\\edonkey2000.exe"="G:\\eDonkey2000\\edonkey2000.exe:*:Enabled:edonkey2000" "E:\\Kaspersky Anti-Virus\\kavsvc.exe"="E:\\Kaspersky Anti-Virus\\kavsvc.exe:*:Enabled:Kaspersky Anti-Virus Service" "E:\\Istall\\utorrent.exe"="E:\\Istall\\utorrent.exe:*:Enabled:uTorrent" "E:\\Gry 2\\MotoGP URT 3\\motogp.exe"="E:\\Gry 2\\MotoGP URT 3\\motogp.exe:*:Enabled:motogp" "D:\\fifa 2007\\fifa07.exe"="D:\\fifa 2007\\fifa07.exe:*:Enabled:fifa07" "F:\\eDonkey2000\\edonkey2000.exe"="F:\\eDonkey2000\\edonkey2000.exe:*:Enabled:edonkey2000" "F:\\Moje dokumenty\\PROemule 3.2 Neostrada PL\\PROemule.exe"="F:\\Moje dokumenty\\PROemule 3.2 Neostrada PL\\PROemule.exe:*:Enabled:PROemule" "G:\\DC++\\DCPlusPlus.exe"="G:\\DC++\\DCPlusPlus.exe:*:Enabled:DC++" "G:\\eDonkey2000 Lite\\eDonkey2000.exe"="G:\\eDonkey2000 Lite\\eDonkey2000.exe:*:Enabled:eDonkey2000" "G:\\LimeWire\\LimeWire.exe"="G:\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "G:\\Soldat\\Soldat.exe"="G:\\Soldat\\Soldat.exe:*:Enabled:Soldat" "F:\\Smieciarek NxG\\Smieciarek.exe"="F:\\Smieciarek NxG\\Smieciarek.exe:*:Enabled:Sprytny spos˘b na niechcianĄ poczt©" "D:\\csi\\Czero\\czero.exe"="D:\\csi\\Czero\\czero.exe:*:Enabled:Condition Zero Launcher" "D:\\Soldat\\Soldat.exe"="D:\\Soldat\\Soldat.exe:*:Enabled:Soldat" "E:\\NAPI-PROJEKT\\napisy.exe"="E:\\NAPI-PROJEKT\\napisy.exe:*:Enabled:www.napiprojekt.pl" "D:\\ Polyphonic Wizard\\cwpolywz.exe"="D:\\ Polyphonic Wizard\\cwpolywz.exe:*:Enabled:Coding Workshop Polyphonic Wizard" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "D:\\Soccerlive\\pplive\\PPLive.exe"="D:\\Soccerlive\\pplive\\PPLive.exe:*:Enabled:PPLive" "D:\\Soccerlive\\PPStream\\PPStream.exe"="D:\\Soccerlive\\PPStream\\PPStream.exe:*:Enabled:PPStream" "D:\\Soccerlive\\SopCast\\SopCast.exe"="D:\\Soccerlive\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "D:\\Soccerlive\\TVAnts\\Tvants.exe"="D:\\Soccerlive\\TVAnts\\Tvants.exe:*:Enabled:TVAnts" "D:\\SOCCER~1\\PODCAS~1\\PODCAS~2.EXE"="D:\\SOCCER~1\\PODCAS~1\\PODCAS~2.EXE:*:Enabled:Share Streaming" "D:\\Soccerlive\\PodcastbarMini\\PodcastBarMini.exe"="D:\\Soccerlive\\PodcastbarMini\\PodcastBarMini.exe:*:Enabled:Share Streaming" "C:\\Documents and Settings\\Dom\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\Dom\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "D:\\cs\\hl.exe"="D:\\cs\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\cs\\hlds.exe"="D:\\cs\\hlds.exe:*:Enabled:HLDS Launcher" "E:\\Gry 2\\MotoGP URT 3\\spyarcade\\Aphex.exe"="E:\\Gry 2\\MotoGP URT 3\\spyarcade\\Aphex.exe:*:Enabled:GameSpy Arcade" "D:\\Soccerlive\\ppmate\\ppmate.exe"="D:\\Soccerlive\\ppmate\\ppmate.exe:*:Enabled:PPMate" "E:\\Kaspersky Anti-Virus\\avp.exe"="E:\\Kaspersky Anti-Virus\\avp.exe:*:Enabled:Kaspersky Anti-Virus" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. The whole world can talk for free." "G:\\pes2008\\PES2008.exe"="G:\\pes2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- File Backups: - C:\SDFx\SDFix\backups\backups.zip Files with Hidden Attributes: Thu 3 Aug 2006 14 ..SH. --- "C:\WINDOWS\mswtpdxp.dll" Thu 3 Aug 2006 21 ..SH. --- "C:\WINDOWS\prwttrxp.dll" Thu 3 Aug 2006 2 ..SH. --- "C:\WINDOWS\system32\verwttxp.dll" Thu 3 Aug 2006 14 ..SH. --- "C:\WINDOWS\system32\mswtpaxp.dll" Thu 3 Aug 2006 21 ..SH. --- "C:\WINDOWS\system32\dpwttaxp.dll" Sun 16 Jul 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Finished!

Log z combofixa:

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Dom 2007-11-11 18:46:43.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.375 [GMT 1:00] Running from: C:\Documents and Settings\Dom\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 ))))))))))))))))))))))))))))))) . 2007-11-11 18:42 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-11 18:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-11 18:20 <DIR> d-------- C:\SDFx 2007-11-11 12:35 <DIR> d--hs---- C:\FOUND.014 2007-11-07 19:09 706,512 -ra------ C:\WINDOWS\system32\drivers\cfosspeed.sys 2007-11-07 19:08 281,552 --a------ C:\WINDOWS\system32\cfosspeed.dll 2007-11-07 18:56 <DIR> d-------- C:\Program Files\cFosSpeed 2007-10-25 20:21 <DIR> d-------- C:\Program Files\uTorrent . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-11 17:22 3,476 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-11 17:22 25,120 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-11 17:22 2,848 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-11 17:22 2,168 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-03 14:35 --------- d-----w C:\Program Files\Netia 2007-05-06 15:43 18,616 ----a-w C:\Documents and Settings\Dom\Dane aplikacji\GDIPFONTCACHEV1.DAT 2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2006-08-03 19:04:54 14 --sh--w C:\WINDOWS\mswtpdxp.dll 2006-08-03 19:05:08 21 --sh--w C:\WINDOWS\prwttrxp.dll 2006-08-03 19:04:48 2 --sh--w C:\WINDOWS\system32\verwttxp.dll 2006-08-03 19:04:54 14 --sh--w C:\WINDOWS\system32\mswtpaxp.dll 2006-08-03 19:04:54 21 --sh--w C:\WINDOWS\system32\dpwttaxp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-09-20 09:09] "nwiz"="nwiz.exe" [2004-09-20 09:09 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-09-20 09:09] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 17:35] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-09-07 15:25] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 16:46] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 19:55] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "kav"="E:\Kaspersky Anti-Virus\avp.exe" [2006-03-24 19:09] "Adobe Photo Downloader"="G:\se\3.0\Apps\apdproxy.exe" [] "Sony Ericsson PC Suite"="G:\se pc suite\Application Launcher\Application Launcher.exe" [2005-10-26 16:17] "NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-09-30 14:35] "cFosSpeed"="C:\Program Files\cFosSpeed\cFosSpeed.exe" [2007-10-29 18:02] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PowerBar"="" [] "CS Smieciarek NxG"="F:\Smieciarek NxG\Smieciarek.exe" [] "Spamihilator"="H:\Spamihilator\spamihilator.exe" [] "Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2006-11-14 10:12] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] C:\Documents and Settings\Dom\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - G:\Office\Office10\OSA.EXE [2001-02-13 10:01:04] S3 ntportio;ntportio;\??\F:\Moje dokumenty\ntportio.sys *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 18:48:38 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run PowerBar = ????????????l?@?l?@?D??????w???????????????wl?@?l?@????? ??????????????w???w???????w?m?wx????????m?w???????? ??????????????|x???0???????????? nt???w????????????????4???????Z???????l?@?l?@????????w????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-11 18:49:35 . --- E O F ---

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:53:58, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\cFosSpeed\spd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\explorer.exe E:\Kaspersky Anti-Virus\avp.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\akrobat reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [kav] "E:\Kaspersky Anti-Virus\avp.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "G:\se\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "G:\se pc suite\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe -auto O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [CS Smieciarek NxG] "F:\Smieciarek NxG\Smieciarek.exe" O4 - HKCU\..\Run: [Spamihilator] "H:\Spamihilator\spamihilator.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = G:\Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://G:\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Kaspersky Anti-Virus\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} (Ganymede Sudoku) - http://67.15.101.33/g_bin/pl/sudoku_2_0_0_15.cab O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.33/g_bin/pl/breakout_2_0_0_29.cab O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/pl/mahjong_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{775F74EB-24E7-4B81-A4C3-0972D23D3F07}: NameServer = 83.238.255.76 213.241.79.37 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - E:\Kaspersky Anti-Virus\avp.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6180 bytes

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 20:09

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\mswtpdxp.dll
C:\WINDOWS\prwttrxp.dll
C:\WINDOWS\system32\verwttxp.dll
C:\WINDOWS\system32\mswtpaxp.dll
C:\WINDOWS\system32\dpwttaxp.dll
C:\Documents and Settings\Dom\Dane aplikacji\GDIPFONTCACHEV1.DAT

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 11 · przez **jakotako14** 11 Lis 2007, 20:26

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:24:23, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\cFosSpeed\spd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe E:\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\akrobat reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [kav] "E:\Kaspersky Anti-Virus\avp.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "G:\se pc suite\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe -auto O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://G:\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Kaspersky Anti-Virus\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} (Ganymede Sudoku) - http://67.15.101.33/g_bin/pl/sudoku_2_0_0_15.cab O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.33/g_bin/pl/breakout_2_0_0_29.cab O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/pl/mahjong_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{775F74EB-24E7-4B81-A4C3-0972D23D3F07}: NameServer = 83.238.255.76 213.241.79.37 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - E:\Kaspersky Anti-Virus\avp.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5334 bytes

Log z combofixa:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:24:23, on 2007-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\cFosSpeed\spd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Kaspersky Anti-Virus\avp.exe C:\Program Files\cFosSpeed\cFosSpeed.exe E:\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\akrobat reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [kav] "E:\Kaspersky Anti-Virus\avp.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "G:\se pc suite\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe -auto O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://G:\Office\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Kaspersky Anti-Virus\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} (Ganymede Sudoku) - http://67.15.101.33/g_bin/pl/sudoku_2_0_0_15.cab O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://67.15.101.33/g_bin/pl/breakout_2_0_0_29.cab O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://67.15.101.3/g_bin/pl/mahjong_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{775F74EB-24E7-4B81-A4C3-0972D23D3F07}: NameServer = 83.238.255.76 213.241.79.37 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - E:\Kaspersky Anti-Virus\avp.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5334 bytes

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 20:28

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

skasuj ten wpis i daj loga z combofixa

**Posty:** 11 · przez **jakotako14** 11 Lis 2007, 20:38

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Dom 2007-11-11 19:33:06.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.417 [GMT 1:00] Running from: C:\Documents and Settings\Dom\Pulpit\Nowy folder\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 ))))))))))))))))))))))))))))))) . 2007-11-11 18:59 <DIR> d-------- C:\WINDOWS\pss 2007-11-11 18:42 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-11 18:25 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-11 18:20 <DIR> d-------- C:\SDFx 2007-11-11 12:35 <DIR> d--hs---- C:\FOUND.014 2007-11-07 19:09 706,512 -ra------ C:\WINDOWS\system32\drivers\cfosspeed.sys 2007-11-07 19:08 281,552 --a------ C:\WINDOWS\system32\cfosspeed.dll 2007-11-07 18:56 <DIR> d-------- C:\Program Files\cFosSpeed 2007-10-25 20:21 <DIR> d-------- C:\Program Files\uTorrent . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-11 18:18 3,500 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-11 18:18 26,912 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-11 18:18 2,848 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-11 18:18 2,168 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-03 14:35 --------- d-----w C:\Program Files\Netia 2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-11_18.48.52.85 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-09-20 09:09] "nwiz"="nwiz.exe" [2004-09-20 09:09 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-09-20 09:09] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 16:46] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "kav"="E:\Kaspersky Anti-Virus\avp.exe" [2006-03-24 19:09] "Sony Ericsson PC Suite"="G:\se pc suite\Application Launcher\Application Launcher.exe" [2005-10-26 16:17] "NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-09-30 14:35] "cFosSpeed"="C:\Program Files\cFosSpeed\cFosSpeed.exe" [2007-10-29 18:02] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PowerBar"="" [] "Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2006-11-14 10:12] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Dom\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "G:\se\3.0\Apps\apdproxy.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CS Smieciarek NxG] "F:\Smieciarek NxG\Smieciarek.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spamihilator] "H:\Spamihilator\spamihilator.exe" S3 ntportio;ntportio;\??\F:\Moje dokumenty\ntportio.sys . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 19:35:12 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-11 19:36:07 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 11 Lis 2007, 20:39

czysto juz

**Posty:** 11 · przez **jakotako14** 11 Lis 2007, 20:43

Wielkie dzięki

bardzo proszę o sprawdzenie

Bardzo proszę o sprawdzenie

Kto jest na forum