Mam problem " Win32/TrojanDownloader.Zlob trojan"

gulczyk · 6 Czerwiec 2007 23:46

Witam!

Bardzo bym prosił osprawdzenie poniższego loga. Mój problem zawarłem w tytule. A wykrywa go NOD32 lecz nie mam możliwości usunięcia tego pliku ani “wyleczenia” go. A że jestem “zielony” to sam nie dam sobie rady. Pomóżcie!

Logfile of HijackThis v1.99.1 Scan saved at 01:23:02, on 2007-06-07 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\LClock\LClock.exe C:\Program Files\Xtras\VisualTaskTips\VisualTaskTips.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Eset\nod32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://picasa.google.com/support/bin/re … tallhl=pl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.online.no/proxy.pac R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {B8C5186E-EC37-4889-9C2E-F73649FFB7BB} - (no file) O3 - Toolbar: Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: (no name) - {31615D5C-5126-448A-818A-A7CDFEE85A9B} - (no file) O4 - HKLM…\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM…\Run: [VisualTaskTips] C:\Program Files\Xtras\VisualTaskTips\VisualTaskTips.exe O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Philips SNU5600 Wireless USB Adapter.lnk = C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)

Złączono Posta : 07.06.2007 (Czw) 1:04

Zapomniałem podać że wirus znajduje się w tej lokacji:

C:\System Volume Information_restore{2961D163-FC99-437C-945B-5944A4C3EF83}\RP149\A0030030.exe »NSIS »StartMenu.dll - error occurred while reading archive

Gutek · 7 Czerwiec 2007 16:06

daruj sobie takie posty

usuń wpisy HJT

Skan AVG Anti-Spyware 7.5 po update

Daj log z Combofix

gulczyk · 8 Czerwiec 2007 16:04

log z Combofix

“Administrator” - 2007-06-08 17:43:28 Service Pack 2 NTFS ComboFix 07-06-3B - Running from: “C:\Documents and Settings\Administrator\Desktop\ComboFix” ((((((((((((((((((((((((( Files Created from 2007-05-08 to 2007-06-08 ))))))))))))))))))))))))))))))) 2007-06-08 17:41 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-05 11:44 2007-06-03 20:14 2007-06-03 20:11 2007-05-24 14:57 2007-05-17 16:19 502,208 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\amon.sys 2007-05-17 16:19 270,336 --a------ C:\WINDOWS\SYSTEM32\imon.dll 2007-05-17 12:37 24 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\wnmsav.dat 2007-05-17 09:24 9,488 --a------ C:\WINDOWS\SYSTEM32\sporder.dll 2007-05-17 09:20 2007-05-17 08:21 2007-05-17 07:02 2007-05-17 07:00 2007-05-17 06:56 24,064 --a------ C:\WINDOWS\SYSTEM32\msxml3a.dll 2007-05-17 06:45 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-08 15:32:45 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype 2007-05-24 12:57:22 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia 2007-05-22 18:01:16 -------- d-----w C:\Program Files\TuneUp Utilities 2006 2007-05-17 19:33:34 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\OpenOffice.org2 2007-05-17 14:14:22 -------- d-----w C:\Program Files\Common Files\Panda Software 2007-05-17 13:32:16 -------- d-----w C:\Program Files\PC Connectivity Solution 2007-05-17 13:24:24 -------- d-----w C:\Program Files\LClock 2007-05-17 13:15:53 -------- d-----w C:\Program Files\Gadu-Gadu 2007-05-17 07:24:03 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-17 06:35:38 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Free Download Manager 2007-05-17 00:46:28 1,744 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-04-30 07:01:26 -------- d-----w C:\Program Files\Nokia 2007-04-25 20:10:36 1,632 ----a-w C:\WINDOWS\system32\d3d8caps.dat 2007-04-20 18:14:25 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\PC Suite 2007-04-19 18:36:25 -------- d-----w C:\Program Files\DIFX 2007-04-19 18:35:07 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-04-19 18:34:28 -------- d-----w C:\Program Files\Common Files\Nokia 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-09 15:45:45 408,064 ----a-r C:\WINDOWS\system32\drivers\CPWGU.sys 2007-04-09 15:44:35 -------- d-----w C:\Program Files\philips 2007-04-08 14:20:25 4,372 ----a-w C:\WINDOWS\mozver.dat 2007-04-08 14:20:23 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\GanymedeNet 2007-03-27 01:39:14 20,480 ----a-w C:\WINDOWS\system32\ac3config.exe 2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2006-10-18 00:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “LClock”=“C:\Program Files\LClock\LClock.exe” [2004-09-19 21:27] “VisualTaskTips”=“C:\Program Files\Xtras\VisualTaskTips\VisualTaskTips.exe” [2006-05-28 19:07] “BluetoothAuthenticationAgent”=“bthprops.cpl” [2006-08-06 08:09 C:\WINDOWS\SYSTEM32\bthprops.cpl] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2005-11-15 11:48] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe” [2006-10-28 13:44] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-08-14 19:50] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-01-16 10:41] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2006-08-06 08:09] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “RAM Medic”=C:\Program Files\Iomatic\RAM Medic\RAMMedic.exe “googletalk”=“C:\Program Files\Google\Google Talk\googletalk.exe” /autostart “ATnotes.exe”=C:\Program Files\ATnotes\ATnotes.exe “Yahoo! Pager”=“C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe” -quiet “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized “Free Download Manager”=C:\Program Files\Free Download Manager\fdm.exe -autorun “Nokia.PCSync”=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] “user32.dll”=C:\Program Files\Video ActiveX Access\iesmn.exe “rare”=C:\Program Files\Video ActiveX Access\imsmain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Rainlendar.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Rainlendar.lnk backup=C:\WINDOWS\pss\Rainlendar.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATnotes.exe] C:\Program Files\ATnotes\ATnotes.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] “C:\Program Files\Unlocker\UnlockerAssistant.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WudfServiceGroup hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00 bthsvcs BthServ HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* UxTuneUp Contents of the ‘Scheduled Tasks’ folder 2007-06-08 15:20:25 C:\WINDOWS\tasks\1-Click Maintenance.job ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-08 17:46:35 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001000-0000-1000-8000-00805f9b34fb}] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001115-0000-1000-8000-00805f9b34fb}] Completion time: 2007-06-08 17:48:47 C:\ComboFix-quarantined-files.txt … 2007-06-08 17:48 C:\ComboFix2.txt … 2007-06-08 17:41 — E O F —

Gutek · 8 Czerwiec 2007 16:07

Użyj SmitFraudFix wybierz opcji nr 2 , oczywiście w trybie awaryjnym i po tym nowy log

gulczyk · 8 Czerwiec 2007 18:38

Zadanie wykonane

Wklejam log-i z Combofix i HijackThis

log Combofix

“Administrator” - 2007-06-08 20:22:12 Service Pack 2 NTFS ComboFix 07-06-3B - Running from: “C:\Documents and Settings\Administrator\Desktop\ComboFix” ((((((((((((((((((((((((( Files Created from 2007-05-08 to 2007-06-08 ))))))))))))))))))))))))))))))) 2007-06-08 20:14 960 --a------ C:\WINDOWS\SYSTEM32\tmp.reg 2007-06-08 17:41 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-05 11:44 2007-06-03 20:14 2007-06-03 20:11 2007-05-24 14:57 2007-05-17 16:19 502,208 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\amon.sys 2007-05-17 16:19 270,336 --a------ C:\WINDOWS\SYSTEM32\imon.dll 2007-05-17 12:37 24 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\wnmsav.dat 2007-05-17 09:24 9,488 --a------ C:\WINDOWS\SYSTEM32\sporder.dll 2007-05-17 09:20 2007-05-17 08:21 2007-05-17 07:02 2007-05-17 07:00 2007-05-17 06:56 24,064 --a------ C:\WINDOWS\SYSTEM32\msxml3a.dll 2007-05-17 06:45 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-08 18:20:11 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype 2007-05-24 12:57:22 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia 2007-05-22 18:01:16 -------- d-----w C:\Program Files\TuneUp Utilities 2006 2007-05-17 19:33:34 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\OpenOffice.org2 2007-05-17 14:14:22 -------- d-----w C:\Program Files\Common Files\Panda Software 2007-05-17 13:32:16 -------- d-----w C:\Program Files\PC Connectivity Solution 2007-05-17 13:24:24 -------- d-----w C:\Program Files\LClock 2007-05-17 13:15:53 -------- d-----w C:\Program Files\Gadu-Gadu 2007-05-17 07:24:03 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-17 06:35:38 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Free Download Manager 2007-05-17 00:46:28 1,744 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-04-30 07:01:26 -------- d-----w C:\Program Files\Nokia 2007-04-25 20:10:36 1,632 ----a-w C:\WINDOWS\system32\d3d8caps.dat 2007-04-20 18:14:25 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\PC Suite 2007-04-19 18:36:25 -------- d-----w C:\Program Files\DIFX 2007-04-19 18:35:07 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-04-19 18:34:28 -------- d-----w C:\Program Files\Common Files\Nokia 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-09 15:45:45 408,064 ----a-r C:\WINDOWS\system32\drivers\CPWGU.sys 2007-04-09 15:44:35 -------- d-----w C:\Program Files\philips 2007-04-08 14:20:25 4,372 ----a-w C:\WINDOWS\mozver.dat 2007-04-08 14:20:23 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\GanymedeNet 2007-03-27 01:39:14 20,480 ----a-w C:\WINDOWS\system32\ac3config.exe 2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2006-10-18 00:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “LClock”=“C:\Program Files\LClock\LClock.exe” [2004-09-19 21:27] “VisualTaskTips”=“C:\Program Files\Xtras\VisualTaskTips\VisualTaskTips.exe” [2006-05-28 19:07] “BluetoothAuthenticationAgent”=“bthprops.cpl” [2006-08-06 08:09 C:\WINDOWS\SYSTEM32\bthprops.cpl] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2005-11-15 11:48] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe” [2006-10-28 13:44] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-08-14 19:50] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-01-16 10:41] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2006-08-06 08:09] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “RAM Medic”=C:\Program Files\Iomatic\RAM Medic\RAMMedic.exe “googletalk”=“C:\Program Files\Google\Google Talk\googletalk.exe” /autostart “ATnotes.exe”=C:\Program Files\ATnotes\ATnotes.exe “Yahoo! Pager”=“C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe” -quiet “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized “Free Download Manager”=C:\Program Files\Free Download Manager\fdm.exe -autorun “Nokia.PCSync”=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Rainlendar.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Rainlendar.lnk backup=C:\WINDOWS\pss\Rainlendar.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATnotes.exe] C:\Program Files\ATnotes\ATnotes.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] “C:\Program Files\Unlocker\UnlockerAssistant.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WudfServiceGroup hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00 bthsvcs BthServ HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* UxTuneUp Contents of the ‘Scheduled Tasks’ folder 2007-06-08 15:20:25 C:\WINDOWS\tasks\1-Click Maintenance.job ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-08 20:27:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001000-0000-1000-8000-00805f9b34fb}] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services{00001115-0000-1000-8000-00805f9b34fb}] Completion time: 2007-06-08 20:30:25 C:\ComboFix-quarantined-files.txt … 2007-06-08 20:29 C:\ComboFix2.txt … 2007-06-08 17:48 C:\ComboFix3.txt … 2007-06-08 17:41 — E O F —

log HijackThis

Logfile of HijackThis v1.99.1 Scan saved at 20:37:18, on 2007-06-08 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\LClock\LClock.exe C:\Program Files\Xtras\VisualTaskTips\VisualTaskTips.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\Desktop\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://picasa.google.com/support/bin/re … tall&hl=pl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.online.no/proxy.pac O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM…\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM…\Run: [VisualTaskTips] C:\Program Files\Xtras\VisualTaskTips\VisualTaskTips.exe O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Philips SNU5600 Wireless USB Adapter.lnk = C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)

Złączono Posta : 08.06.2007 (Pią) 21:28

Czy to już wszystko? Czy mam zrobić coś jeszcze?

Gutek · 9 Czerwiec 2007 09:02

Już powinno być Ok

gulczyk · 9 Czerwiec 2007 10:09

Wielkie dzięki!

Złączono Posta : 09.06.2007 (Sob) 15:43

A jednak to nie koniec moich problemów.

Przeskanowałem ponownie kompa NOD32 i trojan nadal

jest w kompie.

A oprócz tego pojawił się nowy problem.

qrczak13 · 9 Czerwiec 2007 15:15

Wyłącz na chwile przywracanie i potem włącz.

Jak nie pójdzie to >>>

Jak uzyskać dostęp do folderu System Volume Information i usuń.

gulczyk · 11 Czerwiec 2007 10:34

Wielkie dzięki!

Pozbyłem się “zbója”