Internet Explorer - wyskakujące strony z wirusami

G1T (Michalogr) 2007-05-02 13:42:20 UTC #1

Witam!

Podczas uruchamiania, a także korzystania z IE (korzystam z niej tylko, gdy muszę!) otwierają się strony z komunikatami, że mam wirusy, błędy w systemie i rejestrze.

Log:

Logfile of HijackThis v1.99.1 Scan saved at 14:55:31, on 2007-05-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\WINDOWS\runservice.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Documents and Settings\Michał\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM..\Run: [infoData] rundll32.exe "C:\WINDOWS\system32\rvsjsidy.dll",realset O4 - HKLM..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g\_bin/pl/roulette\_2\_0\_0\_21.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g\_bin/pl/words\_2\_0\_0\_47.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g\_bin/pl/billard8\_2\_0\_0\_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g\_bin/pl/billardt\_2\_0\_0\_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g\_bin/pl/snooker\_2\_0\_0\_28.cab O17 - HKLM\System\CCS\Services\Tcpip..{02B0FF9F-F47F-461C-B3F3-FDA7EB35D0A3}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip..{02B0FF9F-F47F-461C-B3F3-FDA7EB35D0A3}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: APSHook.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Co i jak zrobić? Podzrawiam.

adam9870 (adam9870) 2007-05-02 18:56:48 UTC #2

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.

Plik usuń ręcznie w trybie awaryjnym natomiast wpisy HijackThis.

Użyj VundoFix + FixVundo + VirtumundoBeGone. Wszystkie narzędzia należy uruchomić w trybie awaryjnym.

Po wykonaniu pokaż nowy log z hjt, SilentRunners + log numer 1 z L2Mfix.

G1T (Michalogr) 2007-05-03 09:07:44 UTC #3

Logfile of HijackThis v1.99.1 Scan saved at 10:57:45, on 2007-05-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\WINDOWS\runservice.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Michał\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O4 - HKLM..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g\_bin/pl/roulette\_2\_0\_0\_21.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g\_bin/pl/words\_2\_0\_0\_47.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g\_bin/pl/billard8\_2\_0\_0\_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g\_bin/pl/billardt\_2\_0\_0\_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g\_bin/pl/snooker\_2\_0\_0\_28.cab O17 - HKLM\System\CCS\Services\Tcpip..{02B0FF9F-F47F-461C-B3F3-FDA7EB35D0A3}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip..{02B0FF9F-F47F-461C-B3F3-FDA7EB35D0A3}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: APSHook.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

kurde, dzisiaj wyskoczyły mi stronki z gołymi babskami.

Złączono Posta : 03.05.2007 (Czw) 11:08

Logfile of HijackThis v1.99.1 Scan saved at 10:57:45, on 2007-05-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\WINDOWS\runservice.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Michał\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O4 - HKLM..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g\_bin/pl/roulette\_2\_0\_0\_21.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g\_bin/pl/words\_2\_0\_0\_47.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g\_bin/pl/billard8\_2\_0\_0\_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g\_bin/pl/billardt\_2\_0\_0\_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g\_bin/pl/snooker\_2\_0\_0\_28.cab O17 - HKLM\System\CCS\Services\Tcpip..{02B0FF9F-F47F-461C-B3F3-FDA7EB35D0A3}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip..{02B0FF9F-F47F-461C-B3F3-FDA7EB35D0A3}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: APSHook.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

kurde, dzisiaj wyskoczyły mi stronki z gołymi babskami.

Gutek (Gutek) 2007-05-03 10:39:30 UTC #4

Daj log z Combofix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

G1T (Michalogr) 2007-05-03 17:16:11 UTC #5

"Micha" - 07-05-03 18:34:09 Dodatek Service Pack 2 ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\Micha\Pulpit\" (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\hxgpqutw.dll C:\WINDOWS\system32\greltutf.dll C:\WINDOWS\system32\sckybbjt.dll C:\WINDOWS\system32\ejjsagwc.dll C:\WINDOWS\system32\bimrbqvy.dll C:\WINDOWS\system32\jyoyfgkp.dll C:\WINDOWS\system32\oowreuvb.dll C:\WINDOWS\system32\rrqss.ini C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\ssqrr.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((( Files Created from 2007-04-03 to 2007-05-03 )))))))))))))))))))))))))))))))))) 2007-04-30 16:38 2007-04-29 08:47 2007-04-28 21:36 2007-04-28 15:05 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-25 21:59 132,660 --a------ C:\WINDOWS\system32\rvsjsidy.dll 2007-04-24 21:41 2007-04-24 21:37 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-04-24 21:35 2007-04-23 16:15 2007-04-22 10:33 2007-04-09 11:03 2007-04-06 21:09 2007-04-06 17:07 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-03 19:10 561 --ahs---- C:\WINDOWS\system32\mmf.sys 2007-05-02 19:10 2518 --a------ C:\WINDOWS\unins000.dat 2007-04-22 12:29 2864 --a------ C:\WINDOWS\system32\winsock.dll 2007-04-18 18:17 733824 --a------ C:\WINDOWS\system32\aswboot.exe 2007-04-18 18:12 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-18 18:12 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-18 18:10 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-18 18:09 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-18 18:07 90112 --a------ C:\WINDOWS\system32\avastss.scr 2007-04-18 18:07 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-06 21:09 -------- d-------- C:\DOCUME~1\Micha\DANEAP~1\tlen.pl 2007-04-06 17:58 -------- d-------- C:\DOCUME~1\Micha\DANEAP~1\mojosoft 2007-03-31 15:17 -------- d-------- C:\DOCUME~1\Micha\DANEAP~1\krylack password recovery 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-11 18:03 49910 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-11 18:03 356068 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-11 18:02 21419 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-07 11:14 36441 --a------ C:\WINDOWS\system32\spoonuninstall-dbpoweramp music converter.dat 2007-03-07 11:14 131072 --a------ C:\WINDOWS\system32\spoonuninstall.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {D651AFF4-9590-424d-BD1E-8E33E090DFB3} C:\WINDOWS\system32\oowreuvb.dll [x] {DF21F1DB-80C6-11D3-9483-B03D0EC10000} C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "CognizanceTS"="rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Gadu-Gadu"="\"C:\Program Files\Gadu-Gadu\gg.exe\" /tray" "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000001 [HKEY\_CURRENT\_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY\_LOCAL\_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="APSHook.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0ASWLNPkg\0\0 [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] "path"="C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk" "backup"="C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE " "item"="Adobe Gamma Loader" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk" "backup"="C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ALCMTR" "hkey"="HKLM" "command"="ALCMTR.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ashDisp" "hkey"="HKLM" "command"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ASTSVCC" "hkey"="HKLM" "command"="rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="daemon" "hkey"="HKLM" "command"="\"C:\Program Files\DAEMON Tools\daemon.exe\" -lang 1033" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControl] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="HControl" "hkey"="HKLM" "command"="C:\WINDOWS\ATK0100\HControl.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="hkcmd" "hkey"="HKLM" "command"="C:\WINDOWS\system32\hkcmd.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="igfxpers" "hkey"="HKLM" "command"="C:\WINDOWS\system32\igfxpers.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="igfxtray" "hkey"="HKLM" "command"="C:\WINDOWS\system32\igfxtray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ifrmewrk" "hkey"="HKLM" "command"="\"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe\" /tf Intel PROSet/Wireless" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ZCfgSvc" "hkey"="HKLM" "command"="\"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="tlen" "hkey"="HKCU" "command"="C:\Program Files\Tlen.pl\tlen.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="lxbkbmgr" "hkey"="HKLM" "command"="\"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\WINDOWS\system32\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="PDVDServ" "hkey"="HKLM" "command"="\"C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="RTHDCPL" "hkey"="HKLM" "command"="RTHDCPL.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="SkyTel" "hkey"="HKLM" "command"="SkyTel.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="SynTPEnh" "hkey"="HKLM" "command"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="AdobeUpdateManager" "hkey"="HKCU" "command"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\Program Files\Winamp\winampa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wireless Console 2] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="wcourier" "hkey"="HKLM" "command"="C:\Program Files\Wireless Console 2\wcourier.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="CnxMon" "hkey"="HKLM" "command"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="TaskbarIcon" "hkey"="HKLM" "command"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="Watch" "hkey"="HKLM" "command"="C:\PROGRA~1\NEOSTR~1\Watch.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 Cognizance REG_MULTI_SZ ASChannel\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{a9a67212-8c8f-11db-9e3c-806d6172696f}] Shell\AutoRun\command E:\setup.exe ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-03 19:11:13 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-05-03 19:11:44 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 07-05-03 19:11

Log z Vundofix:

Gutek (Gutek) 2007-05-03 22:13:47 UTC #6

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart). Po tym nowy log z Combo

G1T (Michalogr) 2007-05-04 06:55:41 UTC #7

"Micha" - 07-05-04 8:51:53 Dodatek Service Pack 2 ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\Micha\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-04 to 2007-05-04 )))))))))))))))))))))))))))))))))) 2007-05-04 08:51 2007-05-03 19:11 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-04-30 16:38 2007-04-29 08:47 2007-04-28 21:36 2007-04-28 15:05 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-28 15:05 2007-04-24 21:41 2007-04-24 21:37 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-04-24 21:35 2007-04-23 16:15 2007-04-22 10:33 2007-04-09 11:03 2007-04-06 21:09 2007-04-06 17:07 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-04 08:50 561 --ahs---- C:\WINDOWS\system32\mmf.sys 2007-05-02 19:10 2518 --a------ C:\WINDOWS\unins000.dat 2007-04-22 12:29 2864 --a------ C:\WINDOWS\system32\winsock.dll 2007-04-18 18:17 733824 --a------ C:\WINDOWS\system32\aswboot.exe 2007-04-18 18:12 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-18 18:12 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-18 18:10 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-18 18:09 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-18 18:07 90112 --a------ C:\WINDOWS\system32\avastss.scr 2007-04-18 18:07 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-06 21:09 -------- d-------- C:\DOCUME~1\Micha\DANEAP~1\tlen.pl 2007-04-06 17:58 -------- d-------- C:\DOCUME~1\Micha\DANEAP~1\mojosoft 2007-03-31 15:17 -------- d-------- C:\DOCUME~1\Micha\DANEAP~1\krylack password recovery 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-11 18:03 49910 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-11 18:03 356068 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-11 18:02 21419 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-07 11:14 36441 --a------ C:\WINDOWS\system32\spoonuninstall-dbpoweramp music converter.dat 2007-03-07 11:14 131072 --a------ C:\WINDOWS\system32\spoonuninstall.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {D651AFF4-9590-424d-BD1E-8E33E090DFB3} C:\WINDOWS\system32\oowreuvb.dll [x] {DF21F1DB-80C6-11D3-9483-B03D0EC10000} C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "CognizanceTS"="rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Gadu-Gadu"="\"C:\Program Files\Gadu-Gadu\gg.exe\" /tray" "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000001 [HKEY\_CURRENT\_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY\_LOCAL\_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="APSHook.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0ASWLNPkg\0\0 [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] "path"="C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk" "backup"="C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE " "item"="Adobe Gamma Loader" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk" "backup"="C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ALCMTR" "hkey"="HKLM" "command"="ALCMTR.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ashDisp" "hkey"="HKLM" "command"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ASTSVCC" "hkey"="HKLM" "command"="rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="daemon" "hkey"="HKLM" "command"="\"C:\Program Files\DAEMON Tools\daemon.exe\" -lang 1033" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControl] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="HControl" "hkey"="HKLM" "command"="C:\WINDOWS\ATK0100\HControl.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="hkcmd" "hkey"="HKLM" "command"="C:\WINDOWS\system32\hkcmd.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="igfxpers" "hkey"="HKLM" "command"="C:\WINDOWS\system32\igfxpers.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="igfxtray" "hkey"="HKLM" "command"="C:\WINDOWS\system32\igfxtray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ifrmewrk" "hkey"="HKLM" "command"="\"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe\" /tf Intel PROSet/Wireless" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="ZCfgSvc" "hkey"="HKLM" "command"="\"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="tlen" "hkey"="HKCU" "command"="C:\Program Files\Tlen.pl\tlen.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="lxbkbmgr" "hkey"="HKLM" "command"="\"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\WINDOWS\system32\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="PDVDServ" "hkey"="HKLM" "command"="\"C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="RTHDCPL" "hkey"="HKLM" "command"="RTHDCPL.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="SkyTel" "hkey"="HKLM" "command"="SkyTel.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="SynTPEnh" "hkey"="HKLM" "command"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="AdobeUpdateManager" "hkey"="HKCU" "command"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\Program Files\Winamp\winampa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wireless Console 2] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="wcourier" "hkey"="HKLM" "command"="C:\Program Files\Wireless Console 2\wcourier.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="CnxMon" "hkey"="HKLM" "command"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="TaskbarIcon" "hkey"="HKLM" "command"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] "key"="SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "item"="Watch" "hkey"="HKLM" "command"="C:\PROGRA~1\NEOSTR~1\Watch.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 Cognizance REG_MULTI_SZ ASChannel\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{a9a67212-8c8f-11db-9e3c-806d6172696f}] Shell\AutoRun\command E:\setup.exe ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-04 08:53:25 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-05-04 8:53:29 C:\ComboFix-quarantined-files.txt ... 07-05-04 08:53

adam9870 (adam9870) 2007-05-04 08:28:04 UTC #8

Ściągnij program KillBox, zaznacz Delete on reboot , w polu full path of file wklej ścieżkę:

C:\WINDOWS\system32\oowreuvb.dll

Kliknij czerwonego iksa i reset. Jeśli pokaże się jakiś błąd to nie przejmuj się nim tylko przejdź do wykonywania dalszych czynności.

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Po wykonaniu możesz dla pewności wkleić nowy log z ComboFixa.

Oparte na Discourse, najlepiej oglądać z włączonym JavaScriptem