Od kilku dni mam problem z komputerem w prawym dolnym rogu pojawiają się chmurki z informacjami o wirusach:
Spywere found
Trojan-Spy.win32@mx
Networm-i.Virus@fp
Malware threats
Warning
Pojawiają się strony internetowe na których proszą mnie o zainstalowanie programu antywirusowego, pojawiają się również reklamy. Komputer zawiesza się a żaden antywirós nie może sobie poradzić z wirusami.
To mój HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:30:00, on 2007-11-09
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\rundll32.exe
C:\DOCUME~1\AGATA\USTAWI~1\Temp\sheqipoi.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\cmxjbuny.dll
O4 - HKLM…\Run: [AVP] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe”
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: FreshDownload - {6DE606F2-3C28-4F55-860B-CB181EA35A92} - C:\Program Files\FreshDevices\FreshDownload\fd.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://220.227.116.204/activex/AMC.cab
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O24 - Desktop Component 0: (no name) - file:///C:/Documents%20and%20Settings/AGATA/Pulpit/THE%20RASMUS_LOST_ZAGUBIENI_pliki/reynaldo0145ew7qu1.jpg
O24 - Desktop Component 1: (no name) - http://espanol.geocities.com/latinsoaps … lo/001.jpg
O24 - Desktop Component 2: (no name) - http://www.geocities.com/yadhiracarrill … rillo1.jpg
O24 - Desktop Component 3: (no name) - http://www.latin.cz/uvod/odkazy/foto_he … rro/45.jpg
O24 - Desktop Component 4: (no name) - http://www.latin.cz/uvod/odkazy/foto_he … rro/50.jpg
O24 - Desktop Component 5: (no name) - http://www.latin.cz/uvod/odkazy/foto_he … rro/28.jpg
–
End of file - 4296 bytes
A to ComboFix:
ComboFix 07-11-08.1 - AGATA 2007-11-09 1:29:44.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.96 [GMT 1:00]
Running from: C:\Documents and Settings\AGATA\Pulpit\ComboFix.exe
.
Unable to gain System Privileges
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\AGATA\Pulpit\Live Safety Center.lnk
C:\Documents and Settings\AGATA\Pulpit\Online Security Guide.lnk
C:\Documents and Settings\AGATA\Ulubione\Online Security Guide.lnk
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Live Safety Center.lnk
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Online Security Guide.lnk
C:\WINDOWS\system32\cmxjbuny.dllbox
C:\WINDOWS\system32\jkklk.dll
.
---- Previous Run -------
.
C:\Documents and Settings\AGATA\Pulpit\Live Safety Center.lnk
C:\Documents and Settings\AGATA\Pulpit\Online Security Guide.lnk
C:\Documents and Settings\AGATA\Ulubione\Online Security Guide.lnk
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Live Safety Center.lnk
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Online Security Guide.lnk
C:\Program Files\Common Files\inetget
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\tclock\tclock_install.exe
C:\Program Files\Temporary
C:\Program Files\Temporary\wininstall.exe
C:\Program Files\WinAble
C:\Program Files\windows
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cmxjbuny.dllbox
C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\klkkj.bak2
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\klkkj.tmp
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\m2
C:\WINDOWS\system32\o1
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\v4
C:\WINDOWS\Temp\84060345.exe
C:\WINDOWS\winshow.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
-------\LEGACY_DOMAINSERVICE
-------\DomainService
((((((((((((((((((((((((( Files Created from 2007-10-09 to 2007-11-09 )))))))))))))))))))))))))))))))
.
2007-11-09 01:32 173,540 --a------ C:\WINDOWS\system32\ddaby.dll
2007-11-09 01:13 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-09 00:51
2007-11-09 00:24 86,080 --a------ C:\WINDOWS\system32\ovxsbksa.dll
2007-11-09 00:21 80,448 --a------ C:\WINDOWS\system32\jnpapdrc.dll
2007-11-09 00:19 71,232 --a------ C:\WINDOWS\system32\jnlhnaoy.exe
2007-11-09 00:13 71,232 --a------ C:\WINDOWS\system32\yidvamll.exe
2007-11-09 00:10 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-09 00:10 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-09 00:10 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-09 00:10 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-08 23:52 86,080 --a------ C:\WINDOWS\system32\uwdatfnk.dll
2007-11-08 23:49 80,448 --a------ C:\WINDOWS\system32\aytlgnvs.dll
2007-11-08 23:47 71,232 --a------ C:\WINDOWS\system32\cpjkqbwx.exe
2007-11-08 23:40 80,448 --a------ C:\WINDOWS\system32\ahiwypnn.dll
2007-11-08 23:32 71,232 --a------ C:\WINDOWS\system32\sdxyrheu.exe
2007-11-08 21:19 80,448 --a------ C:\WINDOWS\system32\gdnehyxi.dll
2007-11-08 21:13 86,080 --a------ C:\WINDOWS\system32\atynheae.dll
2007-11-08 21:11 71,232 --a------ C:\WINDOWS\system32\xetiegxi.exe
2007-11-08 20:14 80,448 --a------ C:\WINDOWS\system32\admkeijp.dll
2007-11-08 20:08 71,232 --a------ C:\WINDOWS\system32\grxkudhb.exe
2007-11-08 19:55
2007-11-08 19:20
2007-11-08 19:08 80,448 --a------ C:\WINDOWS\system32\ofdmgabj.dll
2007-11-08 19:05 71,232 --a------ C:\WINDOWS\system32\jmsbmirh.exe
2007-11-08 16:04 80,448 --a------ C:\WINDOWS\system32\okipmocc.dll
2007-11-08 15:55 71,232 --a------ C:\WINDOWS\system32\wksyoxuq.exe
2007-11-08 14:06 80,448 --a------ C:\WINDOWS\system32\hwbtktba.dll
2007-11-08 14:05 71,232 --a------ C:\WINDOWS\system32\fqqpdrjp.exe
2007-11-08 13:38 80,448 --a------ C:\WINDOWS\system32\ntqhtbdf.dll
2007-11-08 13:38 71,232 --a------ C:\WINDOWS\system32\bodntixg.exe
2007-11-08 12:38 80,448 --a------ C:\WINDOWS\system32\tioxmsto.dll
2007-11-08 12:38 71,232 --a------ C:\WINDOWS\system32\olcdoemf.exe
2007-11-08 12:35 80,448 --a------ C:\WINDOWS\system32\uqtydrib.dll
2007-11-08 12:34 86,080 --------- C:\WINDOWS\system32\fejcnxha.dll
2007-11-08 12:32 71,232 --a------ C:\WINDOWS\system32\muqdaoyl.exe
2007-11-08 12:19 80,448 --a------ C:\WINDOWS\system32\kmbscged.dll
2007-11-08 12:17 71,232 --a------ C:\WINDOWS\system32\tytqgauq.exe
2007-11-08 11:50 80,448 --a------ C:\WINDOWS\system32\pyfbcvqk.dll
2007-11-08 11:48 71,232 --a------ C:\WINDOWS\system32\mtvnpfqh.exe
2007-11-08 11:41
2007-11-08 10:07 86,080 --------- C:\WINDOWS\system32\xbgtgqai.dll
2007-11-08 10:01 80,448 --a------ C:\WINDOWS\system32\qwkufhxb.dll
2007-11-08 09:59 71,232 --a------ C:\WINDOWS\system32\foyobqnd.exe
2007-11-08 09:54 86,080 --------- C:\WINDOWS\system32\mojoyyop.dll
2007-11-08 09:51 80,448 --a------ C:\WINDOWS\system32\itexryhm.dll
2007-11-08 09:46 71,232 --a------ C:\WINDOWS\system32\oqvxpexk.exe
2007-11-07 17:19 79,936 --a------ C:\WINDOWS\system32\kbhywjiy.dll
2007-11-07 17:13 86,080 --a------ C:\WINDOWS\system32\bryprrwl.dll
2007-11-07 17:10 71,232 --a------ C:\WINDOWS\system32\sodlqhbs.exe
2007-11-07 11:37 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-11-07 11:37 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-11-07 11:36
2007-11-07 11:36
2007-11-07 11:36 5,702,176 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-07 11:36 40,992 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-07 11:27
2007-11-07 09:30
2007-11-06 20:52 298,104 --a------ C:\WINDOWS\system32\imon.dll
2007-11-06 19:01 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-11-06 17:17 81,472 --a------ C:\WINDOWS\system32\mvtritem.dll
2007-11-06 17:09 145,984 --a------ C:\WINDOWS\system32\cmxjbuny.dll
2007-11-06 17:08 145,984 --a------ C:\WINDOWS\system32\eloaljmj.dll
2007-11-06 16:56
2007-11-06 16:56
2007-11-06 16:56
2007-11-06 16:56 36,352 --a------ C:\WINDOWS\system32\gebxwvw.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 00:36 79,484 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-09 00:36 4,820 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-09 00:36 1,572,864 —ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-09 00:36 1,572,864 —ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-09 00:36 1,572,864 —ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-09 00:36 1,572,864 —ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-09 00:20 --------- d-----w C:\Program Files\TClock
2007-11-08 11:35 --------- d-----w C:\Program Files\Axis Communications
2007-11-08 11:31 --------- d-----w C:\Program Files\BitComet
2007-11-07 17:32 --------- d-----w C:\Program Files\Java
2007-11-07 17:28 --------- d-----w C:\Program Files\Winamp
2007-11-07 17:27 --------- d-----w C:\Program Files\Apple Software Update
2007-11-07 17:27 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer
2007-11-06 20:37 --------- d—a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP
2007-09-10 22:20 --------- d-----w C:\Program Files\Yahoo!
2007-09-10 22:20 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Yahoo!
2007-07-21 13:43 20,392 -c–a-w C:\Documents and Settings\AGATA\Dane aplikacji\GDIPFONTCACHEV1.DAT
2006-11-02 17:39:23 88 -csh–r C:\WINDOWS\system32\9380E06095.sys
2006-11-02 17:39:31 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{031656A7-6BEE-403F-B672-B197A9EE6A39}]
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{03DD2B24-8B6C-4103-8F97-EF55E34AB86A}]
C:\Program Files\NetMeeting\hokelovuC:\WINDOWS\System32\v4\caws83122.exe.dll
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{634BBAB7-3F60-4426-944F-A62B9007F67F}]
2007-11-06 16:56 36352 --a------ C:\WINDOWS\System32\gebxwvw.dll
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{74ef5d06-98fe-40e9-8ee7-dd6b058d0f29}]
2007-11-09 00:21 80448 --a------ C:\WINDOWS\System32\jnpapdrc.dll
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-06 17:09 145984 --a------ C:\WINDOWS\system32\cmxjbuny.dll
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{ba6d83bf-2ac3-4585-9522-f0ae8e28c290}]
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{D3BF1D55-496D-49BF-BB4D-B1708ABDC2FA}]
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{E6E57497-1CB7-4E92-8437-DCE47B7D5754}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
“{11A69AE4-FBED-4832-A2BF-45AF82825583}”= C:\WINDOWS\system32\cmxjbuny.dll [2007-11-06 17:09 145984]
[HKEY_CLASSES_ROOT\CLSID{11A69AE4-FBED-4832-A2BF-45AF82825583}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
“{11A69AE4-FBED-4832-A2BF-45AF82825583}”= C:\WINDOWS\system32\cmxjbuny.dll [2007-11-06 17:09 145984]
[HKEY_CLASSES_ROOT\CLSID{11A69AE4-FBED-4832-A2BF-45AF82825583}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“WMC_AutoUpdate”="" []
“AVP”=“C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe” [2007-06-28 12:51]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
“{634BBAB7-3F60-4426-944F-A62B9007F67F}”= C:\WINDOWS\System32\gebxwvw.dll [2007-11-06 16:56 36352]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmxjbuny]
cmxjbuny.dll 2007-11-06 17:09 145984 C:\WINDOWS\system32\cmxjbuny.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebxwvw]
gebxwvw.dll 2007-11-06 16:56 36352 C:\WINDOWS\system32\gebxwvw.dll
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\System32\DRIVERS\klim5.sys
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 01:38:22
Windows 5.1.2600 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-09 1:41:05 - machine was rebooted
.
— E O F —
Bardzo proszę o pomoc.
