nie mogę usunąć trojana

**Posty:** 19 · przez **Luis_gno** 30 Maj 2008, 12:56

Mam antywirusa NOD32 i wykrył mi trojana w C:/recycler i nie mogę go usunąć w żaden sposób ;/ Co parę minut wyskakuje mi Zone Alarm, że pliki o dziwnej nazwie żądają dostępu do internetu. Znajdują się one w c:/documents and settings/administrator/ustawienia lokalne/temp/45exhmunmlclr12
Co parę minut zmieniają się tylko cyfry w nazwie pliku 45exhmunmlclr12.
Oto log z programu HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:52:59, on 2008-05-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe E:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\HHVcdV7Sys\VC7SecS.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\HHVcdV7Sys\VC7Play.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe e:\Program Files\Virtual CD v7\System\VC7Tray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe E:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar_pl_4.0.1601-big.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar_pl_4.0.1601-big.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [VC7Player] C:\Program Files\HHVcdV7Sys\VC7Play.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [devenv] C:\WINDOWS\system\smvss.exe /w O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1.62-big/GoogleNav.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe (file missing) O23 - Service: Virtual CD v7 Management Service (VC7SecS) - H+H Software GmbH - C:\Program Files\HHVcdV7Sys\VC7SecS.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 7074 bytes

Proszę o pomoc, pozdrawiam

**Posty:** 7838 · przez **Lukesh** 30 Maj 2008, 13:07

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
:arrow:

na sam koniec wstaw logi z HJ: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 19 · przez **Luis_gno** 30 Maj 2008, 13:19

I zanim zacznę jeszcze robić to co napisałeś to początkowy log z Combo Fix:

Kod: Zaznacz wszystko: ComboFix 08-05-29.1 - Administrator 2008-05-30 13:06:51.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.192 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Dane aplikacji\macromedia\Flash Player\#SharedObjects\VRS6ZXY2\www.broadcaster.com C:\Documents and Settings\Administrator\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Administrator\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\WINDOWS\system\smvss.exe . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-30 ))))))))))))))))))))))))))))))) . 2008-05-30 12:35 . 2008-05-30 12:35 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-30 09:48 . 2008-05-30 10:56 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-30 09:48 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-05-30 09:48 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-05-30 09:48 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-05-30 09:48 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-05-30 09:47 . 2008-05-30 10:29 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-05-30 09:47 . 2008-05-30 09:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\PC Tools 2008-05-28 20:54 . 2008-05-28 21:04 <DIR> d-------- C:\Program Files\SkanerOnline 2008-05-24 12:30 . 2008-05-24 12:30 <DIR> d-------- C:\Program Files\Common Files\L&H 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft Office Visio 2003 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-04-26 15:04 . 2008-04-26 15:02 691,545 --a------ C:\WINDOWS\unins000.exe 2008-04-26 15:04 . 2008-04-26 15:04 2,545 --a------ C:\WINDOWS\unins000.dat 2008-04-24 15:58 . 2008-04-24 15:58 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\ABBYY 2008-04-24 15:51 . 2008-04-24 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ABBYY . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-30 11:11 97,122,336 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-05-30 09:06 99,568 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-05-29 20:50 1,139,696 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-05-29 20:49 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\foobar2000 2008-05-28 20:29 2,192 ----a-w C:\WINDOWS\system32\tmp.reg 2008-05-24 10:17 --------- d-----w C:\Program Files\eMule 2008-05-22 18:09 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\mIRC 2008-05-01 14:07 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-26 13:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-04-26 13:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-04-24 14:30 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-04-21 05:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Ahead 2008-03-20 15:52 6,116,498 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-03-13 20:49 111,987 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_13_13_40_15_small.dmp.zip 2008-03-05 22:12 112,190 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_19_39_31_small.dmp.zip 2008-03-05 08:59 124,044 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_00_02_36_small.dmp.zip 2008-02-27 21:44 108,532 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_02_27_16_55_32_small.dmp.zip . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12 1849032] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-02 09:11 68856] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49 153136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE] "VC7Player"="C:\Program Files\HHVcdV7Sys\VC7Play.exe" [2005-03-02 16:04 233472] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03 36975] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-22 20:21 949376] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54 919016] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-22 16:00 1838592] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 10:37 28672] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2004-09-29 10:37 28672 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2004-09-29 07:15 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] --a------ 2004-06-28 04:33 57344 e:\Program Files\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 E:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2007-03-12 18:53 1055792 E:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] --a------ 2005-05-24 23:41 503808 C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-09 18:53 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-31 20:42 32768 e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCDEmuApp.exe] --a------ 2005-10-16 03:15 167936 E:\Program Files\PowerISO\SCDEmuApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] --a------ 2007-03-12 18:54 1626160 E:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 E:\Program Files\Telefon\Sony Ericsson K750i\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ATI Smart"=2 (0x2) "wscsvc"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "SharedAccess"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Defrag32b;Defrag32Boot;C:\WINDOWS\system32\drivers\Defrag32b.sys [2005-05-12 09:47] R1 vdrv7000;vdrv7000;C:\WINDOWS\system32\DRIVERS\vdrv7000.sys [2005-01-31 13:54] R2 Defrag32;Defrag32;C:\WINDOWS\system32\drivers\Defrag32.sys [2005-05-12 09:47] R2 VC7SecS;Virtual CD v7 Management Service;C:\Program Files\HHVcdV7Sys\VC7SecS.exe [2005-03-02 16:04] S2 PDSched;PDScheduler;"C:\Program Files\Raxco\PerfectDisk\PDSched.exe" [2005-05-12 12:43] S3 actvcomm;actvcomm;C:\WINDOWS\system32\drivers\actvcomm.sys [2004-04-28 12:30] S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2004-05-07 14:38] S3 SPAInfoDrv;SPAInfoDrv;E:\PROGRA~1\Telefon\MOBILE~1\bin\SPAInfoDrv.sys [2004-05-05 17:39] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] *Newly Created Service* - CATCHME *Newly Created Service* - IKFILESEC *Newly Created Service* - IKSYSFLT *Newly Created Service* - IKSYSSEC *Newly Created Service* - MCHINJDRV *Newly Created Service* - SDAUXSERVICE *Newly Created Service* - SDCORESERVICE . Contents of the 'Scheduled Tasks' folder "2007-09-29 16:06:10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 13:11:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-05-30 13:12:52 ComboFix-quarantined-files.txt 2008-05-30 11:12:46 Pre-Run: 1,927,593,984 bajtów wolnych Post-Run: 1,907,224,576 bajtów wolnych 168

**Posty:** 8001 · przez **Okocza** 30 Maj 2008, 14:42

Luis_gno napisał(a):C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_13_13_40_15_small.dmp.zip
C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_19_39_31_small.dmp.zip
C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_00_02_36_small.dmp.zip
C:\WINDOWS\Internet Logs\vsmon_2nd_2008_02_27_16_55_32_small.dmp.zip

te pliki przeskanuj na www.virustotal.com

i daj raport na forum...

**Posty:** 19 · przez **Luis_gno** 30 Maj 2008, 15:08

To najpierw wrzucę to co poradził mi zrobić Lukesh

Plik z SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.187 [/b] Run by Administrator on 2008-05-30 at 14:26 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 14:37:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:42483aee "s2"=dword:083a659d "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:79,5a,03,3e,00,39,27,a3,fb,88,bf,72,fb,99,bb,7f,20,c6,83,7c,99,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:8f,d9,2e,96,98,a3,1a,20,51,87,b0,87,34,00,b1,24,e6,e7,fa,15,f9,.. "p0"="e:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:d9,65,25,0b,55,73,5d,6b,7d,2b,09,5a,ca,b5,35,78,bd,1b,cb,40,8b,.. "a0"=hex:20,01,00,00,72,b0,33,cc,cb,5e,53,53,c6,15,6f,8a,72,f8,ac,34,c4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:b4,be,9e,8e,78,fe,a7,73,47,f8,4a,67,50,72,01,eb,b3,74,27,08,92,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrv7000] "ServiceBinary"="C:\WINDOWS\system32\drivers\VDRV7000.SYS" "Group"="SCSI Miniport" "ImagePath"=str(2):"system32\DRIVERS\vdrv7000.sys" "ErrorControl"=dword:00000001 "Start"=dword:00000001 "Type"=dword:00000001 "Tag"=dword:00000022 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrv7000\Enum] "0"="ROOT\SCSIADAPTER\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrv7000\parameters] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrv7000\security] "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:79,5a,03,3e,00,39,27,a3,fb,88,bf,72,fb,99,bb,7f,20,c6,83,7c,99,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:8f,d9,2e,96,98,a3,1a,20,51,87,b0,87,34,00,b1,24,e6,e7,fa,15,f9,.. "p0"="e:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:d9,65,25,0b,55,73,5d,6b,7d,2b,09,5a,ca,b5,35,78,bd,1b,cb,40,8b,.. "a0"=hex:20,01,00,00,72,b0,33,cc,cb,5e,53,53,c6,15,6f,8a,72,f8,ac,34,c4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:b4,be,9e,8e,78,fe,a7,73,47,f8,4a,67,50,72,01,eb,b3,74,27,08,92,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdrv7000] "ServiceBinary"="C:\WINDOWS\system32\drivers\VDRV7000.SYS" "Group"="SCSI Miniport" "ImagePath"=str(2):"system32\DRIVERS\vdrv7000.sys" "ErrorControl"=dword:00000001 "Start"=dword:00000001 "Type"=dword:00000001 "Tag"=dword:00000022 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdrv7000\Enum] "0"="ROOT\SCSIADAPTER\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdrv7000\parameters] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdrv7000\security] "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,.. scanning hidden registry entries ... scanning hidden files ... C:\WINDOWS\Internet Logs\bu_tosave.rdb 2074112 bytes C:\Documents and Settings\Administrator\Moje dokumenty\Nauka\Państwowa Wyższa Szkoła Zawodowa w Gnieźnie - PWSZ\Materiały - poszczególne semestry\V semestr\Makroekonomia\Zdjęcia na egzamin z książki Begga\02. 20 - Wprowadzenie do makroekonomii i rachunku dochodu narodowego\Thumbs.db:encryptable 0 bytes hidden from API C:\Documents and Settings\Administrator\Moje dokumenty\Nauka\Państwowa Wyższa Szkoła Zawodowa w Gnieźnie - PWSZ\Materiały - poszczególne semestry\V semestr\Makroekonomia\Zdjęcia na egzamin z książki Begga\05. 23 - Pieniądz i współczesny system bankowy\Thumbs.db:encryptable 0 bytes hidden from API C:\Documents and Settings\Administrator\Moje dokumenty\Nauka\Państwowa Wyższa Szkoła Zawodowa w Gnieźnie - PWSZ\Materiały - poszczególne semestry\V semestr\Makroekonomia\Zdjęcia na egzamin z książki Begga\08. 26 - Podaż globalna, poziom cen i tempo dostosowań\Thumbs.db:encryptable 0 bytes hidden from API C:\Documents and Settings\Administrator\Moje dokumenty\Nauka\Państwowa Wyższa Szkoła Zawodowa w Gnieźnie - PWSZ\Materiały - poszczególne semestry\V semestr\Zarządzanie produkcją\Wykłady\Zarządzanie produkcją - foty\Zarządzanie produkcją\Formy organizacji produkcji\Thumbs.db:encryptable 0 bytes hidden from API scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 5 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Sat 9 Sep 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 7 Oct 2007 1,301 ...HR --- "C:\Documents and Settings\Administrator\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Sat 17 Nov 2007 226,816 A..H. --- "C:\Documents and Settings\Administrator\Moje dokumenty\Nauka\Paästwowa Wyľsza Szkoˆa Zawodowa w Gnie«nie - PWSZ\Praktyki\Praktyki Belux\Praktyki Belux 02-20.VII.2007\17 listopad 2007\~WRL0005.tmp" [b]Finished![/b]

Log z programu ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-05-29.1 - Administrator 2008-05-30 14:59:21.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.72 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-30 ))))))))))))))))))))))))))))))) . 2008-05-30 14:22 . 2008-05-30 14:23 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-30 13:53 . 2008-05-30 13:53 <DIR> d-------- C:\SDFix 2008-05-30 12:35 . 2008-05-30 12:35 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-30 09:48 . 2008-05-30 10:56 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-30 09:48 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-05-30 09:48 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-05-30 09:48 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-05-30 09:48 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-05-30 09:47 . 2008-05-30 13:22 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-05-30 09:47 . 2008-05-30 09:47 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\PC Tools 2008-05-28 20:54 . 2008-05-28 21:04 <DIR> d-------- C:\Program Files\SkanerOnline 2008-05-24 12:30 . 2008-05-24 12:30 <DIR> d-------- C:\Program Files\Common Files\L&H 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft Office Visio 2003 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-04-26 15:04 . 2008-04-26 15:02 691,545 --a------ C:\WINDOWS\unins000.exe 2008-04-26 15:04 . 2008-04-26 15:04 2,545 --a------ C:\WINDOWS\unins000.dat 2008-04-24 15:58 . 2008-04-24 15:58 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\ABBYY 2008-04-24 15:51 . 2008-04-24 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ABBYY . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-30 13:03 97,277,984 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-05-30 12:20 1,143,848 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-05-30 11:22 8,431,289 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-05-30 11:17 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\foobar2000 2008-05-30 09:06 99,568 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-05-28 20:29 2,192 ----a-w C:\WINDOWS\system32\tmp.reg 2008-05-24 10:17 --------- d-----w C:\Program Files\eMule 2008-05-22 18:09 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\mIRC 2008-05-01 14:07 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-26 13:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-04-26 13:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-04-24 14:30 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-04-21 05:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Ahead 2008-03-13 20:49 111,987 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_13_13_40_15_small.dmp.zip 2008-03-05 22:12 112,190 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_19_39_31_small.dmp.zip 2008-03-05 08:59 124,044 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_00_02_36_small.dmp.zip 2008-02-27 21:44 108,532 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_02_27_16_55_32_small.dmp.zip . ((((((((((((((((((((((((((((( snapshot@2008-05-30_13.12.16,23 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-30 07:07:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-30 12:35:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2006-07-11 07:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll + 2008-05-30 02:36:20 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-05-30 12:23:27 15,048,704 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-05-30 12:23:27 143,360 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-05-30 02:36:20 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-05-30 12:23:08 15,048,704 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-05-30 12:23:09 143,360 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-05-30 07:49:18 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-05-30 12:42:13 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-05-30 07:49:18 67,078 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-05-30 12:42:13 67,078 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-05-30 07:49:18 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-05-30 12:42:13 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-05-30 07:49:18 435,978 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-05-30 12:42:13 435,978 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12 1849032] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-02 09:11 68856] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49 153136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE] "VC7Player"="C:\Program Files\HHVcdV7Sys\VC7Play.exe" [2005-03-02 16:04 233472] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03 36975] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-22 20:21 949376] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54 919016] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-22 16:00 1838592] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 10:37 28672] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2004-09-29 10:37 28672 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2004-09-29 07:15 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] --a------ 2004-06-28 04:33 57344 e:\Program Files\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 E:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2007-03-12 18:53 1055792 E:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] --a------ 2005-05-24 23:41 503808 C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-09 18:53 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-31 20:42 32768 e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCDEmuApp.exe] --a------ 2005-10-16 03:15 167936 E:\Program Files\PowerISO\SCDEmuApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] --a------ 2007-03-12 18:54 1626160 E:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 E:\Program Files\Telefon\Sony Ericsson K750i\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ATI Smart"=2 (0x2) "wscsvc"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "SharedAccess"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Defrag32b;Defrag32Boot;C:\WINDOWS\system32\drivers\Defrag32b.sys [2005-05-12 09:47] R1 vdrv7000;vdrv7000;C:\WINDOWS\system32\DRIVERS\vdrv7000.sys [2005-01-31 13:54] R2 Defrag32;Defrag32;C:\WINDOWS\system32\drivers\Defrag32.sys [2005-05-12 09:47] R2 VC7SecS;Virtual CD v7 Management Service;C:\Program Files\HHVcdV7Sys\VC7SecS.exe [2005-03-02 16:04] S2 PDSched;PDScheduler;"C:\Program Files\Raxco\PerfectDisk\PDSched.exe" [2005-05-12 12:43] S3 actvcomm;actvcomm;C:\WINDOWS\system32\drivers\actvcomm.sys [2004-04-28 12:30] S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2004-05-07 14:38] S3 SPAInfoDrv;SPAInfoDrv;E:\PROGRA~1\Telefon\MOBILE~1\bin\SPAInfoDrv.sys [2004-05-05 17:39] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . Contents of the 'Scheduled Tasks' folder "2007-09-29 16:06:10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 15:02:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-05-30 15:04:23 ComboFix-quarantined-files.txt 2008-05-30 13:04:15 ComboFix2.txt 2008-05-30 11:12:54 Pre-Run: 1,771,212,800 bajtów wolnych Post-Run: 1,750,843,392 bajtów wolnych 176

Log z programu HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:58:17, on 2008-05-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe E:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\Program Files\HHVcdV7Sys\VC7SecS.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\HHVcdV7Sys\VC7Play.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe e:\Program Files\Virtual CD v7\System\VC7Tray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [VC7Player] C:\Program Files\HHVcdV7Sys\VC7Play.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/pl/big/1.1.62-big/GoogleNav.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe (file missing) O23 - Service: Virtual CD v7 Management Service (VC7SecS) - H+H Software GmbH - C:\Program Files\HHVcdV7Sys\VC7SecS.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 6870 bytes

**Posty:** 8001 · przez **Okocza** 30 Maj 2008, 15:11

Luis_gno napisał(a):O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

w hijacku fix a combo czyste

**Posty:** 19 · przez **Luis_gno** 30 Maj 2008, 15:21

Skanowanie pliku C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_13_13_40_15_small.dmp.zip :

Kod: Zaznacz wszystko: http://www.virustotal.com/pl/analisis/f15eaebd51fb6bd72be2700849b35ec0

PLik: C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_19_39_31_small.dmp.zip :

Kod: Zaznacz wszystko: http://www.virustotal.com/pl/analisis/e85486948cc2febadd5bebbac969b4df

Plik: C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_05_00_02_36_small.dmp.zip :

Kod: Zaznacz wszystko: http://www.virustotal.com/pl/analisis/bfde03f34c1355bec1b64b037f335e2d

Plik: C:\WINDOWS\Internet Logs\vsmon_2nd_2008_02_27_16_55_32_small.dmp.zip :

Kod: Zaznacz wszystko: http://www.virustotal.com/pl/analisis/4038726c42fd1052315cda04b6f243f6

Wszędzie był wynik 0/32 (0%)

**Posty:** 8001 · przez **Okocza** 30 Maj 2008, 15:23

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 19 · przez **Luis_gno** 30 Maj 2008, 16:13

Usunąłem O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) i tak jak opisałeś w ostatnim poście Okocza.
Zobaczę co się będzie działo dalej, czy znowu będą mi wyskakiwały te komunikaty co wcześniej.
Z góry dzięki za udzieloną dotychczasową pomoc! Macie dużą wiedzę:) jeszcze raz dzięki i jeszcze się odezwę, hej

**Posty:** 8001 · przez **Okocza** 30 Maj 2008, 16:15

jeśli zrobiłeś wszystko co było zalecone + zdrowy rozsądek (a teraz nic Ci nie wyskakuje) to będzie wszystko ok.

**Posty:** 19 · przez **Luis_gno** 30 Maj 2008, 18:24

A mam jeszcze takie pytanie: Lukesh zalecił mi zablokowanie portów programem Windows Worms Doors Cleaner 1.4.1 to czy teraz opcję 1 i 3 mogę odblokować już? czy zostawić?
Pozdrawiam

**Posty:** 8001 · przez **Okocza** 30 Maj 2008, 18:27

zostaw zamknięte - nie będą się dostawać robaki wtedy przez te porty.

**Posty:** 3854 · przez **Dzi@dek** 30 Maj 2008, 18:28

Luis_gno napisał(a):czy teraz opcję 1 i 3 mogę odblokować już? czy zostawić

Nic nie odblokowywać - zostawić.

**Posty:** 19 · przez **Luis_gno** 05 Cze 2008, 12:49

Ok dzięki za info, na razie wszystko jest ok, jeszcze jak pisałem wyżej dam znać czy dziś lub jutro nie wyskoczy jakieś dziwne powiadomienie co wcześniej.
Heja

[ Dodano: Dzisiaj o 12:48 ]
Po kilku dniach wszystko jest ok i nie mam już żadnego problemu z trojanem. Jeszcze raz wielkie dzięki

Jeszcze mam problem innego rodzaju, nie wiem tylko czy zakładać odrębny temat czy mogę tu napisać, ale przynajmniej na razie tu napisze, w razie czego wydzieli się wątek. Mianowicie chodzi mi o to, że w moich dokumentach przechowuję zwykłe pliki: word, excel, powerpoint itp. Chodzi o to, że jak wrzucę to do folderu Moje dokumenty/nauka/.... i jeszcze kilka folderów w głąb to później nie mogę otworzyć tych plików. Klikam na nie i nic się nie dzieje. Nazwy nie mogę zmienić, ani skopiować. Jak przeniose dowolny plik na pulpit (bez zmiany nazwy pliku) to normalnie mogę otworzyć pliki. Inny sposób na otwarcie to zmiana nazwy ostatniego folderu na jednocyfrową lub jednoliterową. Czy jest jakiś sposób, aby bez kombinowania ze zmianą nazw normalnie otwierać te pliki? Bo to trochę upierdliwe

Pozdrawiam.

**Posty:** 8001 · przez **Okocza** 05 Cze 2008, 12:51

daj log z CF, bo coś mi się wydaje że coś siedzi w środku..

**Posty:** 19 · przez **Luis_gno** 06 Cze 2008, 10:10

Oto log z Combo Fixa:

Kod: Zaznacz wszystko: ComboFix 08-06-04.5 - Administrator 2008-06-06 9:59:15.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.118 [GMT 2:00] Running from: D:\Instalka\Programy\Programy bardzo pomocne\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 ))))))))))))))))))))))))))))))) . 2008-05-30 14:22 . 2008-05-30 14:23 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-30 12:35 . 2008-05-30 12:35 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-30 09:48 . 2008-05-30 16:22 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-28 20:54 . 2008-05-28 21:04 <DIR> d-------- C:\Program Files\SkanerOnline 2008-05-24 12:30 . 2008-05-24 12:30 <DIR> d-------- C:\Program Files\Common Files\L&H 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft Office Visio 2003 2008-05-24 12:29 . 2008-05-24 12:29 <DIR> d-------- C:\Program Files\Microsoft ActiveSync . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-06 08:03 99,606,560 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-05 22:22 1,170,776 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-05 22:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\foobar2000 2008-05-30 11:22 8,431,289 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-05-30 09:06 99,568 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-05-24 10:17 --------- d-----w C:\Program Files\eMule 2008-05-22 18:09 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\mIRC 2008-05-01 14:07 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-26 13:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-04-26 13:09 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-04-26 13:02 691,545 ----a-w C:\WINDOWS\unins000.exe 2008-04-24 14:30 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-04-24 13:58 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\ABBYY 2008-04-24 13:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ABBYY 2008-04-21 05:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Ahead 2008-03-13 20:49 111,987 ----a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2008_03_13_13_40_15_small.dmp.zip . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12 1849032] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-02 09:11 68856] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49 153136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE] "VC7Player"="C:\Program Files\HHVcdV7Sys\VC7Play.exe" [2005-03-02 16:04 233472] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03 36975] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-22 20:21 949376] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54 919016] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-22 16:00 1838592] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 10:37 28672] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.3iv2"= 3ivxVfWCodec.dll "VIDC.HFYU"= huffyuv.dll "VIDC.VP31"= vp31vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST System Tray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST System Tray.lnk backup=C:\WINDOWS\pss\ATI CATALYST System Tray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2004-09-29 10:37 28672 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2004-09-29 07:15 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] --a------ 2004-06-28 04:33 57344 e:\Program Files\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 E:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2007-03-12 18:53 1055792 E:\Program Files\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] --a------ 2005-05-24 23:41 503808 C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-09 18:53 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-31 20:42 32768 e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCDEmuApp.exe] --a------ 2005-10-16 03:15 167936 E:\Program Files\PowerISO\SCDEmuApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] --a------ 2007-03-12 18:54 1626160 E:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 E:\Program Files\Telefon\Sony Ericsson K750i\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ATI Smart"=2 (0x2) "wscsvc"=2 (0x2) "Ati HotKey Poller"=2 (0x2) "SharedAccess"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Defrag32b;Defrag32Boot;C:\WINDOWS\system32\drivers\Defrag32b.sys [2005-05-12 09:47] R1 vdrv7000;vdrv7000;C:\WINDOWS\system32\DRIVERS\vdrv7000.sys [2005-01-31 13:54] R2 Defrag32;Defrag32;C:\WINDOWS\system32\drivers\Defrag32.sys [2005-05-12 09:47] R2 VC7SecS;Virtual CD v7 Management Service;C:\Program Files\HHVcdV7Sys\VC7SecS.exe [2005-03-02 16:04] S2 PDSched;PDScheduler;"C:\Program Files\Raxco\PerfectDisk\PDSched.exe" [2005-05-12 12:43] S3 actvcomm;actvcomm;C:\WINDOWS\system32\drivers\actvcomm.sys [2004-04-28 12:30] S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2004-05-07 14:38] S3 SPAInfoDrv;SPAInfoDrv;E:\PROGRA~1\Telefon\MOBILE~1\bin\SPAInfoDrv.sys [2004-05-05 17:39] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . Contents of the 'Scheduled Tasks' folder "2007-09-29 16:06:10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-06 10:03:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-06-06 10:05:20 ComboFix-quarantined-files.txt 2008-06-06 08:05:10 Pre-Run: 411,947,008 bajtów wolnych Post-Run: 407,678,976 bajtów wolnych 144

**Posty:** 8001 · przez **Okocza** 06 Cze 2008, 11:40

przeskanuj system programem Ewido... ja nic groźnego w logu nie widzę i IMHO nie będzie to wina syfu ale konfiguracji samego Windowsa...

nie mogę usunąć trojana

Nie mogę usunąć trojana

Kto jest na forum