Exinjs

Cezu1 · 20 Sierpień 2007 20:45

Mam w folderze TEMP pliki:

15exinjs.aa.exe.vir

32exinjs.aa.exe.vir

55exinjs.aa.exe.vir

Program ArcaVir wyszukuje mi je lecz gdy kilkam skasuj komputer sie resetuje. PLZ pomocy

Daje loga z HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 22:52:41, on 2007-08-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaUpdate\update.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\ArcaBit\Common\TaskScheduler.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\Documents and Settings\Czarek\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” O4 - HKLM…\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM…\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe O4 - HKLM…\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [EdHTML] C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe /none O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Monitor podłączenia telefonu.lnk = ? O8 - Extra context menu item: &Download Flash Files - C:\PROGRA~1\Leesoft\FLASHH~1\save.htm O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash Hunter - {6163F81A-7F01-45E1-996C-EDCA4388941E} - C:\PROGRA~1\Leesoft\FLASHH~1\save.htm (HKCU) O9 - Extra ‘Tools’ menuitem: &Flash Hunter - {6163F81A-7F01-45E1-996C-EDCA4388941E} - C:\PROGRA~1\Leesoft\FLASHH~1\save.htm (HKCU) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/sho … wflash.cab O17 - HKLM\System\CCS\Services\Tcpip…{8433349A-F02F-4BAA-919B-F3FE133EF527}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: TS_LogonListener - C:\WINDOWS\SYSTEM32\TS_LogonListener.dll O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit.TaskScheduler - ArcaBit sp. z o.o. - C:\Program Files\ArcaBit\Common\TaskScheduler.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\Program Files\ArcaBit\ArcaUpdate\update.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Gutek · 20 Sierpień 2007 20:58

usuń wpis HJT, plik ręcznie w trybie awaryjnym

Daj log z ComboFix

Pobierz program SDFix

Cezu1 · 20 Sierpień 2007 21:13

ComboFix scan :

ComboFix 07-08-17.2 - “Czarek” 2007-08-20 23:04:55.1 - NTFSx86 BĄd wejcia: Brak aparatu skrypt˘w dla plik˘w o rozszerzeniu “.vbs”. BĄd wejcia: Brak aparatu skrypt˘w dla plik˘w o rozszerzeniu “.vbs”. ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\nm ((((((((((((((((((((((((( Files Created from 2007-07-20 to 2007-08-20 ))))))))))))))))))))))))))))))) 2007-08-20 23:04 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-18 20:28 2007-08-18 20:28 2007-08-17 16:50 2007-08-16 14:59 2007-08-16 00:32 2007-08-13 20:43 2007-08-13 20:33 2007-08-11 10:21 2007-08-10 18:48 2007-08-10 10:13 2007-08-10 10:13 2007-08-08 23:07 2007-08-06 22:52 2007-08-01 12:34 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll 2007-08-01 12:34 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll 2007-08-01 12:34 6,144 --a------ C:\WINDOWS\system32\kbd106.dll 2007-08-01 12:34 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll 2007-08-01 12:34 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll 2007-08-01 12:34 5,632 --a------ C:\WINDOWS\system32\kbd103.dll 2007-07-30 18:29 2007-07-30 18:27 2007-07-30 18:24 2007-07-30 18:17 2007-07-29 10:46 2007-07-28 23:21 2007-07-28 22:29 2007-07-22 19:08 2007-07-22 14:21 89,872 -ra------ C:\WINDOWS\system32\drivers\k750mdm.sys 2007-07-22 14:21 81,728 -ra------ C:\WINDOWS\system32\drivers\k750mgmt.sys 2007-07-22 14:21 79,488 -ra------ C:\WINDOWS\system32\drivers\k750obex.sys 2007-07-22 14:21 6,576 -ra------ C:\WINDOWS\system32\drivers\k750mdfl.sys 2007-07-22 14:21 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cmnt.sys 2007-07-22 14:21 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cm.sys 2007-07-22 14:21 55,216 -ra------ C:\WINDOWS\system32\drivers\k750bus.sys 2007-07-22 14:21 5,744 -ra------ C:\WINDOWS\system32\drivers\k750whnt.sys 2007-07-22 14:21 5,744 -ra------ C:\WINDOWS\system32\drivers\k750wh.sys 2007-07-21 20:38 88,560 -ra------ C:\WINDOWS\system32\drivers\w200mgmt.sys 2007-07-21 14:04 86,368 -ra------ C:\WINDOWS\system32\drivers\w200obex.sys 2007-07-21 13:11 2007-07-21 13:10 2007-07-21 13:10 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-20 23:01 --------- d-------- C:\DOCUME~1\Czarek\DANEAP~1\Skype 2007-08-17 16:50 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-17 11:45 --------- d-------- C:\Program Files\eMule 2007-08-14 16:21 --------- d-------- C:\Program Files\Valve 2007-08-14 16:21 --------- d-------- C:\Program Files\sXe Injected 2007-08-10 21:31 --------- d-------- C:\DOCUME~1\Czarek\DANEAP~1\Free Download Manager 2007-08-06 15:18 --------- d-------- C:\DOCUME~1\Czarek\DANEAP~1\HP 2007-07-22 19:54 73 --a------ C:\WINDOWS\system32\ssprs.dll 2007-07-22 19:54 340 --a------ C:\WINDOWS\system32\lsprst7.dll 2007-07-21 13:10 --------- d-------- C:\Program Files\Sony Ericsson 2007-07-17 00:13 1025 --a------ C:\WINDOWS\system32\sysprs7.dll 2007-07-17 00:13 1025 --a------ C:\WINDOWS\system32\clauth2.dll 2007-07-17 00:13 1025 --a------ C:\WINDOWS\system32\clauth1.dll 2007-07-17 00:12 --------- d-------- C:\Program Files\PacketVideo 2007-07-16 23:17 --------- d-------- C:\Program Files\AudioConvert 2007-07-16 23:13 --------- d-------- C:\DOCUME~1\Czarek\DANEAP~1\Teleca 2007-07-16 23:12 --------- d-------- C:\DOCUME~1\Czarek\DANEAP~1\Sony Ericsson 2007-07-16 22:03 --------- d-------- C:\Program Files\Disc2Phone 2007-07-14 22:08 --------- d-------- C:\Program Files\Common Files\DirectX 2007-07-12 13:07 --------- d-------- C:\Program Files\Cell Phone Manager 2007-07-12 09:12 81920 --a------ C:\WINDOWS\system32\frapsvid.dll 2007-07-10 19:15 --------- d-------- C:\DOCUME~1\Czarek\DANEAP~1\teamspeak2 2007-07-06 16:10 --------- d-------- C:\Program Files\Audacity ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2004-08-12 22:10] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 12:50] “HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [2005-05-12 00:12] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” [2005-06-06 23:46] “Sony Ericsson PC Suite”=“C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” [2005-10-26 16:17] “ArcaCheck”=“C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe” [2007-07-27 13:57] “ABRegmon”=“C:\Program Files\ArcaBit\ArcaVir\ABregmon.exe” [2007-07-12 10:40] “AvMenu”=“C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe” [2007-06-28 10:00] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “EdHTML”=“C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe” [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TS_LogonListener] TS_LogonListener.dll 2007-01-12 16:41 101376 C:\WINDOWS\system32\TS_LogonListener.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7415c9fa-cbd1-11db-bc4e-4d6564696130}] AutoRun\command- D:\PlayDiskStart.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{9c8e918e-c97a-11db-bc45-4d6564696130}] AutoRun\command- D:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{f2bbbc57-98ec-11d7-bcc9-4d6564696130}] AutoRun\command- D:\Launch.exe Contents of the ‘Scheduled Tasks’ folder 2007-08-20 18:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-20 23:10:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-20 23:11:41 - machine was rebooted C:\ComboFix-quarantined-files.txt … 2007-08-20 23:11 — E O F —

Gutek · 20 Sierpień 2007 21:17

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.