Moj komputer rozsyła spam, zamieszczam log

Dla specjalistów Bezpieczeństwo
#1

Mam problem, moj komputer rozsyła spam, proszę o pomoc.

#2

usuń wpis HJT

Daj log z ComboFix

#3

wyrzuciłam tamten wpis, a tu log z combofix:

ComboFix 07-11-19.4C - user 2007-11-29 12:07:22.2 - FAT32 x86

Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.78 [GMT 1:00]

Running from: E:\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

D:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_ICF

((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-29 )))))))))))))))))))))))))))))))

.

2007-11-28 22:17

2007-11-28 22:05

2007-11-28 22:04

2007-11-28 22:04

2007-11-28 22:04 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll

2007-11-28 22:04 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys

2007-11-28 22:04 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys

2007-11-28 22:04 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys

2007-11-28 22:04 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys

2007-11-27 10:31 24,064 --a------ C:\WINDOWS\system32\icf.exe

2007-11-25 19:17

2007-11-15 17:34

2007-11-05 22:08

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-28 19:02 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Panasonic

2007-10-28 18:00 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Apple Computer

2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll

2007-10-20 21:27 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Super-Cow

2007-10-17 17:42 --------- d-----w C:\Program Files\Virtual Earth 3D

2007-10-04 19:41 --------- d-----w C:\Program Files\Microsoft Works

2007-10-04 19:40 --------- d-----w C:\Program Files\Microsoft.NET

2007-10-04 19:37 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help

2007-09-06 11:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-09-06 11:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-07-03 14:31 774,144 ----a-w C:\Program Files\RngInterstitial.dll

2007-04-07 16:36 61,194 ----a-w C:\Program Files\setuplog.txt

.

((((((((((((((((((((((((((((( snapshot@2007-11-29_11.59.24.93 )))))))))))))))))))))))))))))))))))))))))

.

  • 2007-11-29 11:04:18 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_60c.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00]

“OM_Monitor”=“C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe” [2006-05-16 17:51]

“updateMgr”=“c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” [2006-03-30 16:45]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“HControl”=“C:\WINDOWS\ATK0100\HControl.exe” [2005-07-28 09:29]

“RemoteControl”=“C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe” [2004-11-02 20:24]

“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50]

“SoundMAXPnP”=“C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe” [2004-10-14 10:11]

“SoundMAX”=“C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” [2004-09-23 13:41]

“ASUS Live Update”=“C:\Program Files\ASUS\ASUS Live Update\ALU.exe” [2003-09-19 12:54]

“NB Probe”=“C:\Program Files\ASUS\NB Probe\NBProbe.exe” [2005-07-27 17:07]

“Power_Gear”=“C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe” [2005-06-16 15:48]

“SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2005-05-11 09:03]

“ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-05-31 21:05]

“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 12:06]

“OM_Monitor”=“C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe” [2006-05-16 17:50]

“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11]

“QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-04-06 21:18]

“Lexmark 5200 series”=“C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe” [2004-02-24 19:15]

“LXBTCATS”=“C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll” [2004-02-23 15:47]

“TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-07-03 09:26]

“WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00]

C:\Documents and Settings\user\Menu Start\Programy\Autostart\

Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

ASUS ChkMail.lnk - C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe [2006-03-27 16:28:12]

Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-05-28 15:25:20]

AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 16:18:22]

Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-12 15:06:52]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

R2 ghaio;ghaio;??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys

R3 ASNDIS5;ASNDIS5 Protocol Driver;??\C:\WINDOWS\system32\ASNDIS5.SYS

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys

R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D.sys

S3 Asushwio;Asushwio;??\C:\WINDOWS\system32\drivers\Asushwio.sys

S3 ipswuio;ipswuio;C:\WINDOWS\system32\DRIVERS\ipswuio.sys

S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys

S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

S3 ZDCndis5;ZDCndis5 Protocol Driver;??\C:\WINDOWS\system32\ZDCndis5.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{2302f176-20b6-11db-a40f-0017311fa8f6}]

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe

\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{2980c5c2-878b-11dc-a608-0017311fa8f6}]

\Shell\AutoRun\command - EXPLORER.EXE

\Shell\explore\Command - EXPLORER.EXE

\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{a7dbfd6c-09f3-11dc-a529-0017311fa8f6}]

\Shell\AutoRun\command - EXPLORER.EXE

\Shell\explore\Command - EXPLORER.EXE

\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{d0de0aea-1d83-11dc-a55d-0017311fa8f6}]

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe

\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{d0de0aec-1d83-11dc-a55d-0017311fa8f6}]

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe

\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{e94742a0-fc7b-11db-a51a-0017311fa8f6}]

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe

\Shell\Open(&0)\command - Recycled\ctfmon.exe

.

**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-29 12:10:49

Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-11-29 12:11:25

.

— E O F —

#4

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

#5

Teraz wszystko jest ok. Bardzo dziekuję za pomoc!