przy starcie samoistnie uruchamia się explorator windows

**Posty:** 59 · przez **folken** 22 Lip 2008, 19:50

taki oto problem: Przy włączeniu komputera samoistnie uruchamia się explorator windows i folder Moje Dokumenty. Proszę o pomoc, oto logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:51, on 2008-07-22 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe E:\Program Files\D-Link\Air USB Utility\AirCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Program Files\uTorrent\uTorrent.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\explorer.exe C:\WINDOWS\explorer.exe E:\stary komp\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [D-Link Air USB Utility] E:\Program Files\D-Link\Air USB Utility\AirCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O8 - Extra context menu item: Download All by FlashGet - E:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} (WebLauncherX Control) - http://www.abra-meble.pl/cadprojekt/launcher.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://217.113.232.11/activex/AxisCamControl.cab O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - E:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Kod: Zaznacz wszystko: ComboFix 08-07-20.A0 - ntt 2008-07-22 19:49:11.12 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.210 [GMT 2:00] Running from: E:\stary komp\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . [color=purple]The following files were disabled during the run:[/color] E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll ((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 ))))))))))))))))))))))))))))))) . 2008-07-21 19:58 . 2008-07-21 19:58 <DIR> d-------- C:\!KillBox 2008-07-21 17:08 . 2008-07-21 17:08 90,922 --a------ C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe 2008-07-21 16:59 . 2008-07-21 16:59 152,243 --a------ C:\WINDOWS\system32\g76.exe 2008-07-21 16:59 . 2008-07-21 16:59 64,332 --a------ C:\WINDOWS\system32\nnoglpkxjm.exe 2008-07-21 16:58 . 2008-07-21 16:58 61,478 --a------ C:\WINDOWS\system32\rqwnw64l.exe 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\WINDOWS\system32\win1 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\WINDOWS\system32\sys3 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\WINDOWS\system32\carH04 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\Temp\btxv15 2008-07-21 14:44 . 2008-07-21 20:02 <DIR> d-------- C:\Temp 2008-07-21 14:44 . 2008-07-21 14:44 204,864 --a------ C:\WINDOWS\system32\mcntotdm.exe 2008-07-21 14:44 . 2008-07-21 14:44 88,186 --a------ C:\Temp\dpgFG87.exe 2008-07-09 16:02 . 2006-08-16 13:58 100,352 -----c--- C:\WINDOWS\system32\dllcache\6to4svc.dll 2008-07-06 22:26 . 2008-07-16 21:21 <DIR> d-------- C:\Documents and Settings\ntt\dwhelper 2008-07-03 16:45 . 2008-07-03 16:45 364,544 --a------ C:\WINDOWS\system32\xknamqmvsrkhig.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-22 17:47 --------- d-----w C:\Documents and Settings\ntt\Application Data\uTorrent 2008-06-26 10:49 --------- d-----w C:\Program Files\Spik 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-07 18:56 --------- d-----w C:\Documents and Settings\ntt\Application Data\concept design 2008-06-01 19:16 --------- d-----w C:\Documents and Settings\ntt\Application Data\ImgBurn 2008-05-07 04:55 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2006-10-21 19:22 81,920 ----a-w C:\Documents and Settings\ntt\Application Data\ezpinst.exe 2006-10-21 19:22 47,360 ----a-w C:\Documents and Settings\ntt\Application Data\pcouffin.sys 2006-07-01 21:41 114,308 -c--a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat 2008-03-01 18:58 88 --sh--r C:\WINDOWS\system32\E9D358A023.sys 2008-03-01 18:58 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2007-06-13 12:23 1042944 61cea4fcdb335dac5250df6ba66a4ba1 C:\WINDOWS\explorer.exe 2007-06-13 13:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-10 14:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 12:23 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-10 14:00 25088 c836fa011d3e7ba62c3d8709ec0129c0 C:\WINDOWS\system32\ctfmon.exe 2006-11-10 21:19 4952064 7a775b80a2015cbe75aa46bfa3a155be C:\WINDOWS\system32\dlg\ctfmon.exe 2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-11 01:53 67584 bdf85b12b9510742dc48716cbfc8ab44 C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((( snapshot_2008-07-21_20.04.04.50 ))))))))))))))))))))))))))))))))))))))))) . - 2005-08-05 12:56:28 65,536 -c--a-w C:\WINDOWS\ehome\ehRec.exe + 2005-08-05 12:56:28 75,264 -c--a-w C:\WINDOWS\ehome\ehRec.exe - 2008-07-21 17:53:28 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-07-22 17:47:18 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-07-21 17:53:28 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-07-22 17:47:18 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-07-21 17:53:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-07-22 17:47:18 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2004-08-10 12:00:00 5,120 -c--a-w C:\WINDOWS\system32\lodctr.exe + 2004-08-10 12:00:00 14,848 -c--a-w C:\WINDOWS\system32\lodctr.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-11 18:24 219952] "EXPLORER.EXE"="EXPLORER.EXE" [2007-06-13 12:23 1042944 C:\WINDOWS\explorer.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "D-Link Air USB Utility"="E:\Program Files\D-Link\Air USB Utility\AirCFG.exe" [2004-05-25 18:09 1028096] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-04-14 11:54 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 14:00 25088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme "SynchronousMachineGroupPolicy"= 1 (0x1) "SynchronousUserGroupPolicy"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) "NoResolveSearch"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoRecentDocsNetHood"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 16:13 49152 C:\PROGRA~1\COMMON~1\stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.imc"= imc32.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a--c--- 2004-08-10 14:00 25088 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "nwiz"=nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Spik\\Spik.exe"= "E:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "E:\\Program Files\\eMule\\emule.exe"= "E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe"= "E:\\Program Files\\Wapster\\WapSter AQQ\\AQQ.exe"= R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-10 14:00] R3 PRISM_USB;D-Link Air Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMUSB.sys [2003-10-02 14:47] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 04:12] S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [] S3 RivaTuner;RivaTuner;E:\Program Files\RivaTuner\RivaTuner.sys [] S3 Siemens_Sx1Swup;Siemens_Sx1Swup.SvcDesc%;C:\WINDOWS\system32\Drivers\Siemens_Sx1Swup.sys [2003-06-12 10:42] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb26462-b7cc-11dc-a121-00119591cb2b}] \Shell\AutoRun\command - H:\EXPLORER.EXE \Shell\explore\Command - H:\EXPLORER.EXE \Shell\open\Command - H:\EXPLORER.EXE . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = about:blank R0 -: HKLM-Main,Start Page = about:blank O8 -: Download All by FlashGet - E:\Program Files\FlashGet\jc_all.htm O18 -: Handler: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://arcaonline.arcabit.com/ArcaOnline.cab C:\WINDOWS\Downloaded Program Files\ArcaOnline.inf C:\WINDOWS\system32\ArcaMicroScanUpdater.exe C:\WINDOWS\system32\ArcaOnlineUninstall.exe C:\WINDOWS\system32\ArcaOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\system32\SkanerOnlineUninstall.exe C:\WINDOWS\system32\SkanerOnline.dll O16 -: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} - hxxp://www.abra-meble.pl/cadprojekt/launcher.cab C:\WINDOWS\Downloaded Program Files\WebLauncherProj1.ocx ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-22 19:50:10 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mchInjDrv] "ImagePath"="\??\C:\WINDOWS\TEMP\mc21.tmp" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\SYSTEM32\winlogon.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\system32\csrss.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll . Completion time: 2008-07-22 19:50:40 ComboFix-quarantined-files.txt 2008-07-22 17:50:37 ComboFix2.txt 2008-07-22 17:42:07 ComboFix3.txt 2008-07-21 18:04:15 ComboFix4.txt 2008-04-23 20:38:47 Pre-Run: 13,894,598,656 bytes free Post-Run: 13,894,680,576 bajtów wolnych 182 --- E O F --- 2008-07-09 14:07:27

**Posty:** 84 · przez **gloni** 22 Lip 2008, 19:56

W HijackThis na fix w trybie awaryjnym :

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

**Posty:** 8001 · przez **Okocza** 22 Lip 2008, 19:58

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe C:\WINDOWS\system32\g76.exe C:\WINDOWS\system32\nnoglpkxjm.exe C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\xknamqmvsrkhig.dll Folder:: C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\win1 C:\WINDOWS\system32\sys3 C:\WINDOWS\system32\carH04 C:\Temp\btxv15 Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb26462-b7cc-11dc-a121-00119591cb2b}]

na fix w hj

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

edit by D!

folken nie pisz laskawie pogrubiona czcionka

**Posty:** 59 · przez **folken** 22 Lip 2008, 20:18

okocza napisał(a):otwórz notatnik i wklej:

Kod: Zaznacz wszystko
File:: C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe C:\WINDOWS\system32\g76.exe C:\WINDOWS\system32\nnoglpkxjm.exe C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\xknamqmvsrkhig.dll Folder:: C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\win1 C:\WINDOWS\system32\sys3 C:\WINDOWS\system32\carH04 C:\Temp\btxv15 Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb26462-b7cc-11dc-a121-00119591cb2b}]

wkleić do notatnika i co dalej z tym mam zrobić?
w twarz po wyczyszczeniu tych dwóch wpisów w HJ notatnik mi się nie chce odpalić tylko mignie ikona i nic

**Posty:** 7956 · przez **Magik** 22 Lip 2008, 20:35

folken napisał(a):wkleić do notatnika i co dalej z tym mam zrobić?

zapisz jako CFScript.txt, przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

**Posty:** 59 · przez **folken** 22 Lip 2008, 20:38

Oto log z SDFixa:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.207 [/b] Run by ntt on 2008-07-22 at 20:33 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-22 20:37:35 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="E:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:36,b9,5f,68,da,33,75,bd,45,cc,90,3e,8e,f2,8b,1f,9c,d1,40,24,eb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="e:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:3b,e6,b8,87,9d,0d,ff,7b,7b,60,29,0d,7b,ca,cb,45,74,68,c2,c4,b6,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a8,1b,81,d5,19,8f,bd,b3,30,53,bb,61,4c,8d,98,ba,ae,.. "khjeh"=hex:38,37,13,e9,c8,47,40,ec,c7,87,26,25,f5,cb,2e,f1,c3,1b,42,a8,dd,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:51,42,93,30,3c,9f,74,5e,82,fb,58,49,24,71,e8,b3,aa,b4,d1,fb,ab,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:57,ee,42,bb,cb,5a,cc,35,df,0c,2e,89,a9,46,8a,79,8f,59,34,ab,00,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:e7,9a,ce,38,6f,50,ce,ec,f7,50,6b,b1,7b,dd,74,da,ca,bf,24,77,ff,.. "p0"="e:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:38,37,13,e9,c8,47,40,ec,c7,87,26,25,f5,cb,2e,f1,c3,1b,42,a8,dd,.. "a0"=hex:20,01,00,00,66,e6,7d,2f,3f,ee,d4,f1,c2,ac,bb,c9,f6,d5,f2,8f,08,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:a6,6f,f4,fd,a0,b1,0b,95,39,c8,1f,8d,13,7a,ee,a9,1c,dc,a6,32,5f,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:f4fce241 "s2"=dword:0f3fa921 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:57,ee,42,bb,cb,5a,cc,35,df,0c,2e,89,a9,46,8a,79,8f,59,34,ab,00,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:e7,9a,ce,38,6f,50,ce,ec,f7,50,6b,b1,7b,dd,74,da,ca,bf,24,77,ff,.. "p0"="e:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:38,37,13,e9,c8,47,40,ec,c7,87,26,25,f5,cb,2e,f1,c3,1b,42,a8,dd,.. "a0"=hex:20,01,00,00,66,e6,7d,2f,3f,ee,d4,f1,c2,ac,bb,c9,f6,d5,f2,8f,08,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:a6,6f,f4,fd,a0,b1,0b,95,39,c8,1f,8d,13,7a,ee,a9,1c,dc,a6,32,5f,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "E:\\Program Files\\Wapster\\AQQ\\AQQ.exe"="E:\\Program Files\\Wapster\\AQQ\\AQQ.exe:*:Enabled:AQQ" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Spik\\Spik.exe"="C:\\Program Files\\Spik\\Spik.exe:*:Enabled:Spik" "E:\\Program Files\\BearShare\\BearShare.exe"="E:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "E:\\Program Files\\eMule\\emule.exe"="E:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe"="E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe:*:Enabled:onlineTV" "E:\\Program Files\\Wapster\\WapSter AQQ\\AQQ.exe"="E:\\Program Files\\Wapster\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe"="E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe:*:Enabled:onlineTV" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sat 1 Mar 2008 2,828 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Fri 12 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\BIT2.tmp" [b]Finished![/b]

Loga z ComboFixa nie mogę wrzucić bo nie działa mi ten Notatnik wcale, poratujcie co z tym notatnikiem się stało??

**Posty:** 8001 · przez **Okocza** 22 Lip 2008, 20:39

folken napisał(a):poratujcie co z tym notatnikiem się stało??

to wklej do worda i tak zapisz :arrow:

**Posty:** 59 · przez **folken** 22 Lip 2008, 20:45

log z Combofixa nie kopiuje się do schowka nie ma go jak wkleić do innego programu,log otwiera się sam tylko pod notatnikiem

**Posty:** 8001 · przez **Okocza** 22 Lip 2008, 20:47

to otwórz worda i ręcznie otwórz ten plik przez otwórz ---> wybierasz plik

**Posty:** 59 · przez **folken** 22 Lip 2008, 20:54

log nie zapisuje sie na dysku, nie ma go nic z tym nie wykombinuje puki notatnik nie zatrybi, podesłałem tylko loga z SDFixa

**Posty:** 8001 · przez **Okocza** 22 Lip 2008, 20:55

folken napisał(a):log nie zapisuje sie na dysku

jak nie

jest na dysku C:\Combofix\ - tam go szukaj,.

**Posty:** 59 · przez **folken** 22 Lip 2008, 20:59

rzeczywiscie jest, combofixa wrzuciłem na inny dysk i na C: nie szukałem, oto log:

Kod: Zaznacz wszystko: ComboFix 08-07-20.A0 - ntt 2008-07-22 20:40:31.13 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.125 [GMT 2:00] Running from: E:\stary komp\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . [color=purple]The following files were disabled during the run:[/color] E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\mrofinu1001186.exe . ((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 ))))))))))))))))))))))))))))))) . 2008-07-21 19:58 . 2008-07-21 19:58 <DIR> d-------- C:\!KillBox 2008-07-21 17:08 . 2008-07-21 17:08 90,922 --a------ C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe 2008-07-21 16:59 . 2008-07-21 16:59 152,243 --a------ C:\WINDOWS\system32\g76.exe 2008-07-21 16:59 . 2008-07-21 16:59 64,332 --a------ C:\WINDOWS\system32\nnoglpkxjm.exe 2008-07-21 16:58 . 2008-07-21 16:58 61,478 --a------ C:\WINDOWS\system32\rqwnw64l.exe 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\WINDOWS\system32\win1 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\WINDOWS\system32\sys3 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\WINDOWS\system32\carH04 2008-07-21 14:44 . 2008-07-21 14:44 <DIR> d-------- C:\Temp\btxv15 2008-07-21 14:44 . 2008-07-21 20:02 <DIR> d-------- C:\Temp 2008-07-21 14:44 . 2008-07-21 14:44 204,864 --a------ C:\WINDOWS\system32\mcntotdm.exe 2008-07-21 14:44 . 2008-07-21 14:44 88,186 --a------ C:\Temp\dpgFG87.exe 2008-07-09 16:02 . 2006-08-16 13:58 100,352 -----c--- C:\WINDOWS\system32\dllcache\6to4svc.dll 2008-07-06 22:26 . 2008-07-16 21:21 <DIR> d-------- C:\Documents and Settings\ntt\dwhelper 2008-07-03 16:45 . 2008-07-03 16:45 364,544 --a------ C:\WINDOWS\system32\xknamqmvsrkhig.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-22 18:41 --------- d-----w C:\Documents and Settings\ntt\Application Data\uTorrent 2008-06-26 10:49 --------- d-----w C:\Program Files\Spik 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-07 18:56 --------- d-----w C:\Documents and Settings\ntt\Application Data\concept design 2008-06-01 19:16 --------- d-----w C:\Documents and Settings\ntt\Application Data\ImgBurn 2008-05-07 04:55 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2006-10-21 19:22 81,920 ----a-w C:\Documents and Settings\ntt\Application Data\ezpinst.exe 2006-10-21 19:22 47,360 ----a-w C:\Documents and Settings\ntt\Application Data\pcouffin.sys 2006-07-01 21:41 114,308 -c--a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat 2008-03-01 18:58 88 --sh--r C:\WINDOWS\system32\E9D358A023.sys 2008-03-01 18:58 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2007-06-13 12:23 1042944 61cea4fcdb335dac5250df6ba66a4ba1 C:\WINDOWS\explorer.exe 2007-06-13 13:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-10 14:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 12:23 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-10 14:00 25088 c836fa011d3e7ba62c3d8709ec0129c0 C:\WINDOWS\system32\ctfmon.exe 2006-11-10 21:19 4952064 7a775b80a2015cbe75aa46bfa3a155be C:\WINDOWS\system32\dlg\ctfmon.exe 2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-11 01:53 67584 bdf85b12b9510742dc48716cbfc8ab44 C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((( snapshot_2008-07-21_20.04.04.50 ))))))))))))))))))))))))))))))))))))))))) . - 2005-08-05 12:56:28 65,536 -c--a-w C:\WINDOWS\ehome\ehRec.exe + 2005-08-05 12:56:28 75,264 -c--a-w C:\WINDOWS\ehome\ehRec.exe - 2007-12-20 12:08:37 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-20 12:35:20 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE - 2008-02-01 16:58:55 11,370,496 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-22 18:31:51 12,509,184 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-02-01 16:58:55 106,496 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-07-22 18:31:51 114,688 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat - 2006-04-14 07:00:09 155,136 -c--a-r C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\accicons.exe + 2006-04-14 07:00:09 164,864 -c--a-r C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\accicons.exe - 2006-04-14 07:00:09 28,160 -c--a-r C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\misc.exe + 2006-04-14 07:00:09 37,888 -c--a-r C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\misc.exe - 2006-04-14 07:00:09 104,960 -c--a-r C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\outicon.exe + 2006-04-14 07:00:09 114,688 -c--a-r C:\WINDOWS\Installer\{00000415-78E1-11D2-B60F-006097C998E7}\outicon.exe - 2007-07-12 17:07:35 184,320 ----a-r C:\WINDOWS\Installer\{BDADEF11-F9EC-4A58-A54F-F492052FD779}\NewShortcut1_3B6E202F2D15431886BBCDE0D4B111E4.exe + 2007-07-12 17:07:35 196,608 ----a-r C:\WINDOWS\Installer\{BDADEF11-F9EC-4A58-A54F-F492052FD779}\NewShortcut1_3B6E202F2D15431886BBCDE0D4B111E4.exe - 2006-04-06 21:35:47 65,536 -c--a-r C:\WINDOWS\Installer\{C3C538E5-524C-4253-AA74-0EEEF34990EA}\Cdj.exe + 2006-04-06 21:35:47 77,824 -c--a-r C:\WINDOWS\Installer\{C3C538E5-524C-4253-AA74-0EEEF34990EA}\Cdj.exe - 2006-04-06 21:35:47 65,536 -c--a-r C:\WINDOWS\Installer\{C3C538E5-524C-4253-AA74-0EEEF34990EA}\pfcsrvc.exe + 2006-04-06 21:35:47 77,824 -c--a-r C:\WINDOWS\Installer\{C3C538E5-524C-4253-AA74-0EEEF34990EA}\pfcsrvc.exe - 1998-10-29 16:45:06 306,688 -c--a-w C:\WINDOWS\IsUninst.exe + 1998-10-29 16:45:06 316,416 -c--a-w C:\WINDOWS\IsUninst.exe - 2003-02-21 06:24:32 49,152 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe + 2003-02-21 06:24:32 61,440 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe - 2004-08-10 12:00:00 183,808 -c--a-w C:\WINDOWS\system32\accwiz.exe + 2004-08-10 12:00:00 193,536 -c--a-w C:\WINDOWS\system32\accwiz.exe - 2004-08-10 12:00:00 114,688 -c--a-w C:\WINDOWS\system32\calc.exe + 2004-08-10 12:00:00 124,416 -c--a-w C:\WINDOWS\system32\calc.exe - 2004-08-10 12:00:00 80,384 -c--a-w C:\WINDOWS\system32\charmap.exe + 2004-08-10 12:00:00 90,112 -c--a-w C:\WINDOWS\system32\charmap.exe - 2004-08-10 12:00:00 64,000 ----a-w C:\WINDOWS\system32\cleanmgr.exe + 2004-08-10 12:00:00 73,728 ----a-w C:\WINDOWS\system32\cleanmgr.exe - 2008-07-21 17:53:28 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-07-22 18:36:25 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-07-21 17:53:28 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-07-22 18:36:25 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-07-21 17:53:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-07-22 18:36:25 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2004-08-10 12:00:00 55,296 -c--a-w C:\WINDOWS\system32\freecell.exe + 2004-08-10 12:00:00 65,024 -c--a-w C:\WINDOWS\system32\freecell.exe - 2004-08-10 12:00:00 5,120 -c--a-w C:\WINDOWS\system32\lodctr.exe + 2004-08-10 12:00:00 14,848 -c--a-w C:\WINDOWS\system32\lodctr.exe - 2004-08-10 12:00:00 72,704 -c--a-w C:\WINDOWS\system32\magnify.exe + 2004-08-10 12:00:00 82,432 -c--a-w C:\WINDOWS\system32\magnify.exe - 2004-08-10 12:00:00 143,360 -c--a-w C:\WINDOWS\system32\mobsync.exe + 2004-08-10 12:00:00 153,088 -c--a-w C:\WINDOWS\system32\mobsync.exe - 2004-08-10 12:00:00 6,144 -c--a-w C:\WINDOWS\system32\msdtc.exe + 2004-08-10 12:00:00 15,872 -c--a-w C:\WINDOWS\system32\msdtc.exe - 2004-08-10 12:00:00 126,976 -c--a-w C:\WINDOWS\system32\mshearts.exe + 2004-08-10 12:00:00 136,704 -c--a-w C:\WINDOWS\system32\mshearts.exe - 2004-08-10 12:00:00 407,552 -c--a-w C:\WINDOWS\system32\mstsc.exe + 2004-08-10 12:00:00 417,280 -c--a-w C:\WINDOWS\system32\mstsc.exe - 2004-08-10 12:00:00 53,760 -c--a-w C:\WINDOWS\system32\narrator.exe + 2004-08-10 12:00:00 63,488 -c--a-w C:\WINDOWS\system32\narrator.exe - 2004-08-10 12:00:00 42,496 -c--a-w C:\WINDOWS\system32\net.exe + 2004-08-10 12:00:00 52,224 -c--a-w C:\WINDOWS\system32\net.exe - 2004-08-10 12:00:00 124,928 -c--a-w C:\WINDOWS\system32\net1.exe + 2004-08-10 12:00:00 134,656 -c--a-w C:\WINDOWS\system32\net1.exe - 2004-08-10 12:00:00 69,120 -c--a-w C:\WINDOWS\system32\notepad.exe + 2004-08-10 12:00:00 78,848 -c--a-w C:\WINDOWS\system32\notepad.exe - 2004-08-10 12:00:00 1,200,128 -c--a-w C:\WINDOWS\system32\ntbackup.exe + 2004-08-10 12:00:00 1,209,856 -c--a-w C:\WINDOWS\system32\ntbackup.exe - 2004-08-10 12:00:00 419,840 -c--a-w C:\WINDOWS\system32\ntvdm.exe + 2004-08-10 12:00:00 429,568 -c--a-w C:\WINDOWS\system32\ntvdm.exe - 2004-08-10 12:00:00 32,768 -c--a-w C:\WINDOWS\system32\odbcad32.exe + 2004-08-10 12:00:00 45,056 -c--a-w C:\WINDOWS\system32\odbcad32.exe - 2004-08-10 12:00:00 215,552 -c--a-w C:\WINDOWS\system32\osk.exe + 2004-08-10 12:00:00 225,280 -c--a-w C:\WINDOWS\system32\osk.exe - 2004-08-10 12:00:00 35,840 -c--a-w C:\WINDOWS\system32\rcimlby.exe + 2004-08-10 12:00:00 45,568 -c--a-w C:\WINDOWS\system32\rcimlby.exe - 2004-08-10 12:00:00 380,416 -c--a-w C:\WINDOWS\system32\Restore\rstrui.exe + 2004-08-10 12:00:00 390,144 -c--a-w C:\WINDOWS\system32\Restore\rstrui.exe - 2004-08-10 12:00:00 140,800 -c--a-w C:\WINDOWS\system32\sessmgr.exe + 2004-08-10 12:00:00 150,528 -c--a-w C:\WINDOWS\system32\sessmgr.exe - 2004-08-10 12:00:00 131,584 -c--a-w C:\WINDOWS\system32\sndrec32.exe + 2004-08-10 12:00:00 141,312 -c--a-w C:\WINDOWS\system32\sndrec32.exe - 2004-08-10 12:00:00 138,752 -c--a-w C:\WINDOWS\system32\sndvol32.exe + 2004-08-10 12:00:00 148,480 -c--a-w C:\WINDOWS\system32\sndvol32.exe - 2004-08-10 12:00:00 56,832 -c--a-w C:\WINDOWS\system32\sol.exe + 2004-08-10 12:00:00 66,560 -c--a-w C:\WINDOWS\system32\sol.exe - 2004-08-10 12:00:00 538,624 -c--a-w C:\WINDOWS\system32\spider.exe + 2004-08-10 12:00:00 548,352 -c--a-w C:\WINDOWS\system32\spider.exe - 2004-08-10 12:00:00 347,136 -c--a-w C:\WINDOWS\system32\tourstart.exe + 2004-08-10 12:00:00 356,864 -c--a-w C:\WINDOWS\system32\tourstart.exe - 2004-08-10 12:00:00 50,176 -c--a-w C:\WINDOWS\system32\utilman.exe + 2004-08-10 12:00:00 59,904 -c--a-w C:\WINDOWS\system32\utilman.exe - 2004-08-10 12:00:00 126,464 -c--a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe + 2004-08-10 12:00:00 136,192 -c--a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe - 2004-08-10 12:00:00 119,808 -c--a-w C:\WINDOWS\system32\winmine.exe + 2004-08-10 12:00:00 129,536 -c--a-w C:\WINDOWS\system32\winmine.exe - 2004-08-10 12:00:00 32,256 -c--a-w C:\WINDOWS\system32\wupdmgr.exe + 2004-08-10 12:00:00 41,984 -c--a-w C:\WINDOWS\system32\wupdmgr.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-11 18:24 219952] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 25088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "D-Link Air USB Utility"="E:\Program Files\D-Link\Air USB Utility\AirCFG.exe" [2004-05-25 18:09 1028096] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-04-14 11:54 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 14:00 25088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme "SynchronousMachineGroupPolicy"= 1 (0x1) "SynchronousUserGroupPolicy"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) "NoResolveSearch"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoRecentDocsNetHood"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 16:13 49152 C:\PROGRA~1\COMMON~1\stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.imc"= imc32.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a--c--- 2004-08-10 14:00 25088 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "nwiz"=nwiz.exe /install [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Spik\\Spik.exe"= "E:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "E:\\Program Files\\eMule\\emule.exe"= "E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe"= "E:\\Program Files\\Wapster\\WapSter AQQ\\AQQ.exe"= R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-10 14:00] R3 PRISM_USB;D-Link Air Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMUSB.sys [2003-10-02 14:47] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 04:12] S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [] S3 RivaTuner;RivaTuner;E:\Program Files\RivaTuner\RivaTuner.sys [] S3 Siemens_Sx1Swup;Siemens_Sx1Swup.SvcDesc%;C:\WINDOWS\system32\Drivers\Siemens_Sx1Swup.sys [2003-06-12 10:42] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb26462-b7cc-11dc-a121-00119591cb2b}] \Shell\AutoRun\command - H:\EXPLORER.EXE \Shell\explore\Command - H:\EXPLORER.EXE \Shell\open\Command - H:\EXPLORER.EXE . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = about:blank R0 -: HKLM-Main,Start Page = about:blank O8 -: Download All by FlashGet - E:\Program Files\FlashGet\jc_all.htm O18 -: Handler: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://arcaonline.arcabit.com/ArcaOnline.cab C:\WINDOWS\Downloaded Program Files\ArcaOnline.inf C:\WINDOWS\system32\ArcaMicroScanUpdater.exe C:\WINDOWS\system32\ArcaOnlineUninstall.exe C:\WINDOWS\system32\ArcaOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\system32\SkanerOnlineUninstall.exe C:\WINDOWS\system32\SkanerOnline.dll O16 -: {81E688E8-36A4-4FEF-B70B-8B0A1C5C1308} - hxxp://www.abra-meble.pl/cadprojekt/launcher.cab C:\WINDOWS\Downloaded Program Files\WebLauncherProj1.ocx ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-22 20:41:39 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mchInjDrv] "ImagePath"="\??\C:\WINDOWS\TEMP\mc21.tmp" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\SYSTEM32\winlogon.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\system32\csrss.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll . Completion time: 2008-07-22 20:42:13 ComboFix-quarantined-files.txt 2008-07-22 18:42:09 ComboFix2.txt 2008-07-22 17:50:40 ComboFix3.txt 2008-07-22 17:42:07 ComboFix4.txt 2008-07-21 18:04:15 ComboFix5.txt 2008-07-22 18:40:22 Pre-Run: 13,717,221,376 bytes free Post-Run: 13,700,689,920 bajtów wolnych 268 --- E O F --- 2008-07-09 14:07:27

**Posty:** 8001 · przez **Okocza** 22 Lip 2008, 21:02

w notatnik wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe C:\WINDOWS\system32\g76.exe C:\WINDOWS\system32\nnoglpkxjm.exe C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\xknamqmvsrkhig.dll Folder:: C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\win1 C:\WINDOWS\system32\sys3 C:\WINDOWS\system32\carH04 C:\Temp\btxv15 Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb26462-b7cc-11dc-a121-00119591cb2b}]

zapisz jako CFScrip.txt i przeciagnij na ikonke Combofix.exe

**Posty:** 59 · przez **folken** 22 Lip 2008, 21:10

notatnik mi nie działa:) ale poradze sobie, oto log:

Kod: Zaznacz wszystko: ComboFix 08-07-20.A0 - ntt 2008-07-22 21:09:25.14 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.120 [GMT 2:00] Running from: E:\stary komp\ComboFix.exe Command switches used :: E:\stary komp\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\g76.exe C:\WINDOWS\system32\nnoglpkxjm.exe C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\xknamqmvsrkhig.dll C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe . [color=purple]The following files were disabled during the run:[/color] E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Common Files\stem32~1 C:\Program Files\Common Files\stem32~1\??stem32\ C:\Program Files\Common Files\stem32~1\winlogon.exe C:\Program Files\Common Files\Yazzle1560OinUninstaller.exe C:\Program Files\inetget2 C:\Program Files\mjc C:\Program Files\mjc\mjc.exe C:\Program Files\outerinfo C:\Program Files\outerinfo\FF\chrome.manifest C:\Program Files\outerinfo\FF\components\FF.dll C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt C:\Program Files\outerinfo\FF\install.rdf C:\Temp\btxv15 C:\Temp\btxv15\carH.log C:\WINDOWS\b152.exe C:\WINDOWS\mrofinu1001186.exe C:\WINDOWS\system32\carH04 C:\WINDOWS\system32\carH04\carH041066.exe C:\WINDOWS\system32\crosof~1 C:\WINDOWS\system32\crosof~1\?ttrib.exe C:\WINDOWS\system32\g76.exe C:\WINDOWS\system32\nnoglpkxjm.exe C:\WINDOWS\system32\otyvqkq.dll C:\WINDOWS\system32\rqwnw64l.exe C:\WINDOWS\system32\rqwnw64l.exe\ C:\WINDOWS\system32\sys3 C:\WINDOWS\system32\sys3\setpack22.exe C:\WINDOWS\system32\win1 C:\WINDOWS\system32\win1\SFRuID2.exe C:\WINDOWS\system32\xknamqmvsrkhig.dll-uninst.exe C:\WINDOWS\system32\xknamqmvsrkhig.dll . ((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 ))))))))))))))))))))))))))))))) . 2008-07-21 19:58 . 2008-07-21 19:58 <DIR> d-------- C:\!KillBox 2008-07-21 14:44 . 2008-07-22 21:09 <DIR> d-------- C:\Temp 2008-07-21 14:44 . 2008-07-21 14:44 204,864 --a------ C:\WINDOWS\system32\mcntotdm.exe 2008-07-21 14:44 . 2008-07-21 14:44 88,186 --a------ C:\Temp\dpgFG87.exe 2008-07-09 16:02 . 2006-08-16 13:58 100,352 -----c--- C:\WINDOWS\system32\dllcache\6to4svc.dll 2008-07-06 22:26 . 2008-07-16 21:21 <DIR> d-------- C:\Documents and Settings\ntt\dwhelper . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-22 19:03 --------- d-----w C:\Documents and Settings\ntt\Application Data\Ahead 2008-07-22 19:00 --------- d-----w C:\Program Files\SkanerOnline 2008-07-22 18:49 --------- d-----w C:\Documents and Settings\ntt\Application Data\uTorrent 2008-06-26 10:49 --------- d-----w C:\Program Files\Spik 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-07 18:56 --------- d-----w C:\Documents and Settings\ntt\Application Data\concept design 2008-06-01 19:16 --------- d-----w C:\Documents and Settings\ntt\Application Data\ImgBurn 2006-10-21 19:22 81,920 ----a-w C:\Documents and Settings\ntt\Application Data\ezpinst.exe 2006-10-21 19:22 47,360 ----a-w C:\Documents and Settings\ntt\Application Data\pcouffin.sys 2006-07-01 21:41 114,308 -c--a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat 2008-03-01 18:58 88 --sh--r C:\WINDOWS\system32\E9D358A023.sys 2008-03-01 18:58 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2007-06-13 12:23 1042944 61cea4fcdb335dac5250df6ba66a4ba1 C:\WINDOWS\explorer.exe 2007-06-13 13:26 1042944 e05e8959380551337e352f272c99404e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-10 14:00 1041920 5d06dd0fa3d7d29297a77be8271c9132 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 12:23 1042944 aecef8db13bca1144165cdeb818f1772 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-10 14:00 25088 c836fa011d3e7ba62c3d8709ec0129c0 C:\WINDOWS\system32\ctfmon.exe 2006-11-10 21:19 4964352 05844a1af7ef55444dd912527b9b0040 C:\WINDOWS\system32\dlg\ctfmon.exe 2005-06-11 02:17 67584 a0787a368a497cdf0e483fcbbdb4f51d C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-11 01:53 67584 bdf85b12b9510742dc48716cbfc8ab44 C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((( snapshot_2008-07-22_20.42.00.76 ))))))))))))))))))))))))))))))))))))))))) . - 2000-08-31 06:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe + 2000-08-31 06:00:00 38,400 ----a-w C:\WINDOWS\Nircmd.exe - 2008-07-22 18:36:25 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-07-22 19:11:45 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-07-22 18:36:25 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-07-22 19:11:45 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-07-22 18:36:25 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-07-22 19:11:45 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2004-08-10 12:00:00 23,552 -c--a-w C:\WINDOWS\system32\sort.exe + 2004-08-10 12:00:00 33,280 -c--a-w C:\WINDOWS\system32\sort.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-11 18:24 219952] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 25088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "D-Link Air USB Utility"="E:\Program Files\D-Link\Air USB Utility\AirCFG.exe" [2004-05-25 18:09 1028096] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-04-14 11:54 57344] "runner1"="C:\WINDOWS\mrofinu1001186.exe" [2008-07-22 21:12 51712] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Dpp"="C:\WINDOWS\system32\??crosoft\?ttrib.exe" [?] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 14:00 25088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme "SynchronousMachineGroupPolicy"= 1 (0x1) "SynchronousUserGroupPolicy"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) "NoResolveSearch"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoRecentDocsNetHood"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 16:13 49152 C:\PROGRA~1\COMMON~1\stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.imc"= imc32.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a--c--- 2004-08-10 14:00 25088 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "nwiz"=nwiz.exe /install [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Spik\\Spik.exe"= "E:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "E:\\Program Files\\eMule\\emule.exe"= "E:\\Program Files\\concept design\\onlineTV 4\\onlineTV.exe"= "E:\\Program Files\\Wapster\\WapSter AQQ\\AQQ.exe"= R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-10 14:00] R3 PRISM_USB;D-Link Air Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMUSB.sys [2003-10-02 14:47] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [] S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-24 04:12] S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [] S3 RivaTuner;RivaTuner;E:\Program Files\RivaTuner\RivaTuner.sys [] S3 Siemens_Sx1Swup;Siemens_Sx1Swup.SvcDesc%;C:\WINDOWS\system32\Drivers\Siemens_Sx1Swup.sys [2003-06-12 10:42] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . - - - - ORPHANS REMOVED - - - - HKU-Default-Run-mjc - C:\Program Files\mjc\mjc.exe HKU-Default-Run-Traa - C:\PROGRA~1\COMMON~1\STEM32~1\winlogon.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-22 21:12:06 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv] "ImagePath"="\??\C:\WINDOWS\TEMP\mc21.tmp" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\SYSTEM32\winlogon.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\explorer.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll PROCESS: C:\WINDOWS\system32\csrss.exe -> E:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll . ------------------------ Other Running Processes ------------------------ . E:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\mrofinu1001186.exexe . ************************************************************************** . Completion time: 2008-07-22 21:13:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-22 19:13:34 ComboFix2.txt 2008-07-22 18:42:13 ComboFix3.txt 2008-07-22 17:50:40 ComboFix4.txt 2008-07-22 17:42:07 ComboFix5.txt 2008-07-22 19:08:56 Pre-Run: 13,672,517,632 bytes free Post-Run: 13,636,014,080 bajt˘w wolnych 208 --- E O F --- 2008-07-09 14:07:27

**Posty:** 7956 · przez **Magik** 22 Lip 2008, 21:14

czysty juz ten log------>

by Mariusz

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 8001 · przez **Okocza** 22 Lip 2008, 21:14

Wykonaj to co jest podane w tym temacie

1. Przeskanuj komputer pod względem Trojanów tym programem
2. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 59 · przez **folken** 22 Lip 2008, 21:56

zrobiłem wszystkie wasze wskazówki i pomogło jak na razie czysto, w msconfig jest też czysto wszystkie programy znam

przy starcie samoistnie uruchamia się explorator windows

przy starcie samoistnie uruchamia się explorator windows

Kto jest na forum