Jak to usunąć? TrojanProxy.DlenaTrojan

Cnr · 29 Listopad 2007 13:29

Witam, od wczoraj coś mi się zepsuło z system a mianowicie gdy włączam komputer znikają wszystkie ikony z pulpitu i nic się nie da zrobić Nie wyłącza się jedynie przeglądarka internetowa i gg.Antyvir odnalazł Trojana,

TrojanProxy.DlenaTrojan.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:02:12, on 2007-08-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\tcpsvcs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\UAService7.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM…\Run: [iSUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe – End of file - 5021 bytes

Tutaj daje loga z HiJackThis i proszę o pomoc

Gutek · 29 Listopad 2007 23:07

usuń wpis HJT

Daj log z ComboFix

Cnr · 1 Grudzień 2007 13:59

Oto log z combofix

ComboFix 07-11-19.4C - Konrad 2007-08-19 14:55:31.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.509 [GMT 2:00] Running from: C:\Documents and Settings\Konrad\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\OPTIONS\CABS_desktop.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_IPRIP -------\Iprip ((((((((((((((((((((((((( Files Created from 2007-10-19 to 2007-11-19 ))))))))))))))))))))))))))))))) . 2007-11-22 17:31 2007-11-20 23:25 2007-11-20 20:58 2007-11-15 14:28 2007-11-15 14:28 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-11-15 14:28 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2007-11-15 14:28 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd 2007-11-15 14:28 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2007-11-15 14:28 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2007-11-15 14:25 2007-11-15 14:21 2007-11-15 14:21 2007-11-15 14:20 2007-11-15 14:17 12,288 --a------ C:\WINDOWS\system32\drivers\EIO.sys 2007-11-15 14:16 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-11-15 14:16 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-11-15 14:15 54,784 --a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll 2007-11-15 14:15 12,416 --a------ C:\WINDOWS\system32\drivers\asusgsb.sys 2007-11-08 14:23 2007-11-06 13:51 2007-11-06 13:46 2007-11-05 15:06 2007-11-04 23:04 2007-11-03 19:34 2007-11-03 19:33 2007-11-03 19:20 2007-11-03 18:18 2007-11-02 21:38 2007-11-02 16:45 2007-11-01 21:15 2007-11-01 21:08 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg 2007-11-01 21:03 2007-11-01 20:08 2007-11-01 12:06 2007-10-30 14:42 2007-10-30 14:39 2007-10-28 18:23 2007-10-28 10:58 2007-10-28 10:57 2007-10-28 10:25 2007-10-28 10:25 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-25 14:15 2007-10-25 14:15 2007-10-25 14:15 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-10-25 14:09 2007-10-22 15:59 2007-10-22 15:58 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-10-21 10:27 2007-10-21 08:42 2007-10-20 11:26 2007-10-20 10:57 2007-10-20 10:57 217,118 -----c— C:\WINDOWS\system32\dllcache\apphelp.sdb 2007-10-20 10:56 2007-10-20 10:56 2007-10-20 10:56 2007-10-20 09:37 2007-10-20 09:37 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2007-10-20 09:37 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-10-20 09:37 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2007-10-20 08:46 2007-10-19 21:56 2007-10-19 21:39 1,747 --a------ C:\WINDOWS\mozver.dat 2007-10-19 21:00 22,016 --a------ C:\WINDOWS\system32\drivers\MSIRCOMM.sys 2007-10-19 18:23 13,746 --a------ C:\WINDOWS\system32\wpa.bak 2007-10-19 18:23 0 --a------ C:\WINDOWS\nsreg.dat 2007-10-19 18:09 2007-10-19 18:09 2007-10-19 17:52 153,088 --a------ C:\WINDOWS\system32\irftp.exe 2007-10-19 17:52 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys 2007-10-19 17:52 27,648 --a------ C:\WINDOWS\system32\irmon.dll 2007-10-19 17:52 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2007-10-19 17:52 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2007-10-19 17:52 8,192 --a–c— C:\WINDOWS\system32\dllcache\wshirda.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-19 13:55 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\skypePM 2007-11-15 13:20 15,600 ----a-w C:\WINDOWS\gdrv.sys 2007-10-30 13:47 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-28 15:55 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Ahead 2007-10-19 16:54 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-18 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2007-10-18 11:14 --------- d-----w C:\Program Files\Realtek 2007-10-17 18:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-10-17 17:24 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\InstallShield 2007-10-17 15:43 --------- d-----w C:\Program Files\Creative 2007-10-17 15:12 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-10-17 14:42 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-17 12:45 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-10-17 12:44 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-17 12:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2007-10-17 12:42 --------- d-----w C:\Program Files\Nero 2007-10-17 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-10-17 12:31 --------- d-----w C:\Program Files\EA GAMES 2007-10-17 12:24 --------- d-----w C:\Program Files\Yahoo! 2007-10-17 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2007-10-17 11:45 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-17 11:43 --------- d-----w C:\Program Files\Usługi online 2007-08-19 12:07 737,280 ----a-w C:\WINDOWS\iun6002.exe 2006-11-26 21:53 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{ED203331-9C33-49D8-8714-D24A366A04EC}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “LightScribe Control Panel”=“C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe” [2007-05-15 16:12] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2007-06-01 09:21] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 08:39] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-11-12 15:48] “ASUS SmartDoctor”=“C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe” [2007-07-18 14:20] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-08-11 09:30] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2007-03-01 14:57] “RTHDCPL”=“RTHDCPL.EXE” [2007-04-12 10:33 C:\WINDOWS\RTHDCPL.exe] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2006-09-14 21:09] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2007-06-28 17:43 C:\WINDOWS\system32\nwiz.exe] “ASUSGamerOSD”=“C:\Program Files\ASUS\GamerOSD\GamerOSD.exe” [2007-07-12 10:03] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2006-11-28 15:11] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “GameFace Messenger”=“C:\Program Files\GameFace Messenger\GameFace.exe” [2006-11-01 13:50] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “RunStartupScriptSync”= 0 (0x0) “SynchronousMachineGroupPolicy”= 0 (0x0) “SynchronousUserGroupPolicy”= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoStrCmpLogical”= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSMBalloonTip”= 1 (0x1) “NoRecentDocsHistory”= 1 (0x1) “MemCheckBoxInRunDlg”= 0 (0x0) “NoAutoTrayNotify”= 0 (0x0) “NoResolveTrack”= 0 (0x0) “NoResolveSearch”= 1 (0x1) “NoWelcomeScreen”= 1 (0x1) “NoRecentDocsNetHood”= 1 (0x1) “NoDesktopCleanupWizard”= 1 (0x1) “NoSharedDocuments”= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efccccb] efccccb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winkve32] winkve32.dll R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys S3 ddsxeiservice;ddsxeiservice;??\C:\Program Files\sXe Injected\ddsxei.sys S3 gdrv;gdrv;??\C:\WINDOWS\gdrv.sys S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}] “C:\Program Files\Common Files\LightScribe\LSRunOnce.exe” . Contents of the ‘Scheduled Tasks’ folder “2006-11-24 16:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-19 14:57:54 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-19 14:58:46 - machine was rebooted . — E O F —

Gutek · 2 Grudzień 2007 00:23

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

Cnr · 2 Grudzień 2007 13:13

ComboFix 07-11-19.4C - Konrad 2007-12-01 14:11:55.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.590 [GMT 1:00] Running from: C:\Documents and Settings\Konrad\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-01 to 2007-12-01 ))))))))))))))))))))))))))))))) . 2007-12-01 11:47 2007-12-01 11:08 2007-11-22 17:31 2007-11-20 23:25 2007-11-20 20:58 2007-11-15 14:28 2007-11-15 14:28 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-11-15 14:28 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-11-15 14:25 2007-11-15 14:21 2007-11-15 14:21 2007-11-15 14:20 2007-11-15 14:16 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-11-15 14:16 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-11-15 14:15 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2007-11-15 14:15 54,784 --a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll 2007-11-15 14:14 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-11-08 14:23 2007-11-06 13:51 2007-11-06 13:46 2007-11-05 15:06 2007-11-04 23:04 2007-11-04 23:04 4 --a------ C:\WINDOWS\system32\proc-1037709799.bin 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-04 18:50 2007-11-03 19:34 2007-11-03 19:33 2007-11-03 19:20 2007-11-03 18:18 2007-11-02 21:38 2007-11-02 16:45 2007-11-01 21:15 2007-11-01 21:03 2007-11-01 20:08 2007-11-01 12:06 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-01 13:11 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Skype 2007-12-01 10:06 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-01 09:36 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin 2007-12-01 09:04 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\skypePM 2007-11-15 13:20 15,600 ----a-w C:\WINDOWS\gdrv.sys 2007-11-06 12:51 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-11-02 09:13 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Hamachi 2007-10-31 21:25 --------- d-----w C:\Program Files\Lineage II 2007-10-30 13:47 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-30 13:39 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-28 15:55 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Ahead 2007-10-28 11:06 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-28 11:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-10-28 09:25 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-25 13:15 --------- d-----w C:\Program Files\Java 2007-10-25 13:09 --------- d-----w C:\Program Files\Common Files\Java 2007-10-22 14:59 --------- d-----w C:\Program Files\Alcohol Soft 2007-10-22 14:58 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-21 09:27 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Media Player Classic 2007-10-21 07:42 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\Gadu-Gadu 2007-10-20 09:57 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-20 08:37 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-19 16:54 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-18 13:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2007-10-18 11:14 --------- d-----w C:\Program Files\Realtek 2007-10-17 18:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-10-17 17:24 --------- d-----w C:\Documents and Settings\Konrad\Dane aplikacji\InstallShield 2007-10-17 15:43 --------- d-----w C:\Program Files\Creative 2007-10-17 15:12 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-10-17 14:44 135,168 ----a-w C:\WINDOWS\system32\UAService7.exe 2007-10-17 14:42 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-17 12:45 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-10-17 12:44 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-17 12:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2007-10-17 12:42 --------- d-----w C:\Program Files\Nero 2007-10-17 12:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-10-17 12:31 --------- d-----w C:\Program Files\EA GAMES 2007-10-17 12:24 --------- d-----w C:\Program Files\Yahoo! 2007-10-17 12:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2007-10-17 11:45 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-17 11:43 --------- d-----w C:\Program Files\Usługi online 2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\divx.dll 2007-09-04 16:56 164,352 ----a-w C:\WINDOWS\system32\unrar.dll 2006-11-26 21:53 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{ED203331-9C33-49D8-8714-D24A366A04EC}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “LightScribe Control Panel”=“C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe” [2007-05-15 16:12] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2007-06-01 09:21] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 08:39] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-11-12 15:48] “ASUS SmartDoctor”=“C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe” [2007-07-18 14:20] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-08-11 09:30] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2007-03-01 14:57] “RTHDCPL”=“RTHDCPL.EXE” [2007-04-12 10:33 C:\WINDOWS\RTHDCPL.exe] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2006-09-14 21:09] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2007-06-28 17:43 C:\WINDOWS\system32\nwiz.exe] “ASUSGamerOSD”=“C:\Program Files\ASUS\GamerOSD\GamerOSD.exe” [2007-07-12 10:03] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2006-11-28 15:11] “GameFace Messenger”=“C:\Program Files\GameFace Messenger\GameFace.exe” [2006-11-01 13:50] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “RunStartupScriptSync”= 0 (0x0) “SynchronousMachineGroupPolicy”= 0 (0x0) “SynchronousUserGroupPolicy”= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoStrCmpLogical”= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSMBalloonTip”= 1 (0x1) “NoRecentDocsHistory”= 1 (0x1) “MemCheckBoxInRunDlg”= 0 (0x0) “NoAutoTrayNotify”= 0 (0x0) “NoResolveTrack”= 0 (0x0) “NoResolveSearch”= 1 (0x1) “NoWelcomeScreen”= 1 (0x1) “NoRecentDocsNetHood”= 1 (0x1) “NoDesktopCleanupWizard”= 1 (0x1) “NoSharedDocuments”= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efccccb] efccccb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winkve32] winkve32.dll S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys S3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys S3 ddsxeiservice;ddsxeiservice;??\C:\Program Files\sXe Injected\ddsxei.sys S3 gdrv;gdrv;??\C:\WINDOWS\gdrv.sys S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}] “C:\Program Files\Common Files\LightScribe\LSRunOnce.exe” . Contents of the ‘Scheduled Tasks’ folder “2006-11-24 16:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-01 14:12:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-01 14:13:03 C:\ComboFix2.txt … 2007-11-19 14:58 . — E O F —

Gutek · 2 Grudzień 2007 17:18

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.