Nie mogę skanować komputera antywirusem

system · 7 Grudzień 2007 11:14

witam-jak w temacie,podczas skanowania komputera następuje restart wklejam loga Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:57:32, on 2007-12-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file) O4 - HKLM…\Run: [kis] “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda … 4361368836 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} - O17 - HKLM\System\CCS\Services\Tcpip…{6507CB3E-3617-4D8D-891D-5A5C79F78CDA}: NameServer = 217.30.129.149,217.30.137.200 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe O23 - Service: bgg - Unknown owner - C:\WINDOWS\enbgg.exe (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe – End of file - 3521 bytes

Gutek · 7 Grudzień 2007 16:50

usuń wpisy HJT

Daj log z ComboFix

system · 7 Grudzień 2007 19:21

ComboFix 07-12-07.5 - Administrator 2007-12-07 20:02:25.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.240 [GMT 1:00] Running from: C:\Documents and Settings\Administrator\Moje dokumenty\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Dane aplikacji\inst.exe . ((((((((((((((((((((((((( Files Created from 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))) . 2007-12-07 11:56 . 2007-12-07 11:56 2007-12-02 13:40 . 2007-12-02 13:40 83 --a------ C:\WINDOWS\WWP.INI 2007-12-01 20:51 . 2007-12-01 20:51 1,409 --a------ C:\WINDOWS\system32\tmpF59F9.FOT 2007-12-01 20:50 . 2007-12-01 20:50 2007-12-01 15:32 . 2007-12-01 15:32 2007-12-01 15:32 . 2007-12-01 15:32 2007-11-22 19:26 . 2007-12-01 20:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-22 19:26 . 2007-11-22 19:26 1,409 --a------ C:\WINDOWS\QTFont.for 2007-11-13 17:30 . 2007-12-07 19:59 2007-11-10 16:02 . 2007-11-10 16:02 0 --a------ C:\WINDOWS\VCDWizardDLL.INI 2007-11-10 14:44 . 2007-11-10 16:18 2007-11-10 14:44 . 2007-11-10 14:44 2007-11-10 14:44 . 2007-11-10 14:44 10,368 --a------ C:\WINDOWS\system32\drivers\pfc.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-07 19:03 --------- d-----w C:\Program Files\Kaspersky Lab 2007-12-07 18:40 2,826,528 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-12-07 18:34 53,889,056 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-12-07 18:27 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-12-07 13:52 724,856 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-12-07 13:52 268,784 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-12-07 12:48 --------- d-----w C:\Program Files\PeerGuardian2 2007-12-02 13:28 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-24 14:40 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\OpenOffice.org2 2007-11-21 16:40 --------- d-----w C:\Program Files\Real Alternative 2007-10-14 09:20 --------- d-----w C:\Program Files\Smarty Uninstaller Pro 2007-10-13 17:46 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Business Logic 2007-10-12 15:55 8,864 ----a-w C:\WINDOWS\system32\drivers\CDAC15BA.SYS 2007-10-12 15:55 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\ArcSoft 2007-10-10 15:49 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo Photo Commander 5 2007-10-09 17:07 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Spider Player 2007-10-09 16:07 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Picajet.com 2007-10-08 16:16 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Vso 2007-10-08 16:06 --------- d-----w C:\Program Files\vso 2007-10-07 16:30 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Lavasoft 2007-10-07 16:28 --------- d-----w C:\Program Files\Lavasoft 2007-10-07 11:46 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2007-10-07 11:46 47,360 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\pcouffin.sys 2007-04-11 18:08 94,080 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\ezplay.sys 2007-04-11 18:08 87,608 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\ezpinst.exe 2007-06-12 21:14 23 --sha-w C:\WINDOWS\system32\abddbebac_r.dll 2006-10-22 07:50 5 --sha-w C:\WINDOWS\system32\efedaffec_s.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “kis”=“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” [2006-03-24 19:09] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoResolveSearch”= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll S2 bgg;bgg;C:\WINDOWS\enbgg.exe S3 ADM8511;Konwerter z USB na Fast Ethernet ADMtek ADM8511/AN986;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys S3 MEMSWEEP2;MEMSWEEP2;??\C:\WINDOWS\system32\SophosMEMSWEEP.SYS *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . Contents of the ‘Scheduled Tasks’ folder “2007-12-07 16:15:01 C:\WINDOWS\Tasks\1-Click Maintenance.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe “2007-12-07 16:15:01 C:\WINDOWS\Tasks\1-Klik Konserwacja.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 20:05:07 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-07 20:06:05 . — E O F —

Gutek · 8 Grudzień 2007 16:05

przeskanuj pliki na http://virusscan.jotti.org/

system · 9 Grudzień 2007 09:52

przeskanowałem,użyłem też spyware doctor–znalazło kilka trojanów i usunęło,daję nowego loga

Złączono Posta : 09.12.2007 (Nie) 10:54

ComboFix 07-12-07.5 - Administrator 2007-12-09 10:29:34.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.158 [GMT 1:00] Running from: C:\Documents and Settings\Administrator\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-09 to 2007-12-09 ))))))))))))))))))))))))))))))) . 2007-12-08 10:46 . 2007-12-08 20:38 2007-12-08 10:46 . 2007-12-09 10:00 2007-12-08 10:46 . 2007-12-08 10:46 2007-12-08 10:46 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-08 10:46 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-08 10:46 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-08 10:46 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-08 10:45 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-08 10:45 . 2005-07-06 18:13 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-12-08 10:45 . 2005-07-06 18:13 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-12-02 13:40 . 2007-12-02 13:40 83 --a------ C:\WINDOWS\WWP.INI 2007-12-01 20:51 . 2007-12-01 20:51 1,409 --a------ C:\WINDOWS\system32\tmpF59F9.FOT 2007-12-01 20:50 . 2007-12-01 20:50 2007-12-01 15:32 . 2007-12-01 15:32 2007-12-01 15:32 . 2007-12-01 15:32 2007-11-22 19:26 . 2007-12-01 20:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-22 19:26 . 2007-11-22 19:26 1,409 --a------ C:\WINDOWS\QTFont.for 2007-11-13 17:30 . 2007-12-07 19:59 2007-11-10 16:02 . 2007-11-10 16:02 0 --a------ C:\WINDOWS\VCDWizardDLL.INI 2007-11-10 14:44 . 2007-11-10 16:18 2007-11-10 14:44 . 2007-11-10 14:44 2007-11-10 14:44 . 2007-11-10 14:44 10,368 --a------ C:\WINDOWS\system32\drivers\pfc.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-09 09:34 60,148,512 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-12-09 09:33 2,881,568 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-12-08 19:54 809,216 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-12-08 19:54 274,208 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-12-08 19:16 --------- d-----w C:\Program Files\PeerGuardian2 2007-12-08 19:13 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-12-08 12:22 --------- d-----w C:\Program Files\Kaspersky Lab 2007-12-02 13:28 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-24 14:40 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\OpenOffice.org2 2007-11-21 16:40 --------- d-----w C:\Program Files\Real Alternative 2007-10-14 09:20 --------- d-----w C:\Program Files\Smarty Uninstaller Pro 2007-10-13 17:46 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Business Logic 2007-10-12 15:55 8,864 ----a-w C:\WINDOWS\system32\drivers\CDAC15BA.SYS 2007-10-12 15:55 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\ArcSoft 2007-10-10 15:49 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo Photo Commander 5 2007-10-09 17:07 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Spider Player 2007-10-09 16:07 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Picajet.com 2007-10-07 11:46 47,360 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\pcouffin.sys 2007-04-11 18:08 94,080 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\ezplay.sys 2007-04-11 18:08 87,608 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\ezpinst.exe 2007-06-12 21:14 23 --sha-w C:\WINDOWS\system32\abddbebac_r.dll 2006-10-22 07:50 5 --sha-w C:\WINDOWS\system32\efedaffec_s.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “kis”=“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” [2006-03-24 19:09] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-11-02 17:24] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoResolveSearch”= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" S2 bgg;bgg;C:\WINDOWS\enbgg.exe S3 ADM8511;Konwerter z USB na Fast Ethernet ADMtek ADM8511/AN986;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys S3 MEMSWEEP2;MEMSWEEP2;??\C:\WINDOWS\system32\SophosMEMSWEEP.SYS . Contents of the ‘Scheduled Tasks’ folder “2007-12-07 16:15:01 C:\WINDOWS\Tasks\1-Click Maintenance.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe “2007-12-07 16:15:01 C:\WINDOWS\Tasks\1-Klik Konserwacja.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-09 10:33:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-09 10:35:37 . — E O F —

Złączono Posta : 09.12.2007 (Nie) 11:45

zapomniałem dodać że nie ma teraz restartów komputera podczas skanowania.skanowałem on lain --nod,arca vir -nic nie znalazło.kasperski na komputerze wykrywa trojana win32.inject.mf ale nie może go zlokalizować ? co to jest ?

Złączono Posta : 09.12.2007 (Nie) 12:12

przeskanowałem C:\WINDOWS\system32\tmpF59F9.FOT

C:\WINDOWS\system32\abddbebac_r.dll

C:\WINDOWS\system32\efedaffec_s.dll na podanej stronie i nic nie wykryło,ale skanowałem też na stronie http://www.virustotal.com/pl/ i tutaj jeden antywirus PREVXL wykrył Polynomial.Code.Exploit .jak to usunąć.

Złączono Posta : 09.12.2007 (Nie) 12:14

w tym pliku to wykryło C:\WINDOWS\system32\efedaffec_s.dll

Gutek · 9 Grudzień 2007 15:10

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Pobierz program SDFix

system · 9 Grudzień 2007 18:26

SDFix: Version 1.117 Run by Administrator on 2007-12-09 at 18:44 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-09 18:54:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:c884d99e “s2”=dword:fb0b5ba9 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “p0”=“C:\Program Files\Alcohol Soft\Alcohol 120” “h0”=dword:00000000 “ujdew”=hex:fa,b7,70,69,81,74,bc,28,1d,38,11,15,c1,9c,cc,be,f0,73,30,60,23,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “p0”=“C:\Program Files\Alcohol Soft\Alcohol 120” “h0”=dword:00000000 “ujdew”=hex:fa,b7,70,69,81,74,bc,28,1d,38,11,15,c1,9c,cc,be,f0,73,30,60,23,… scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] “OODEFRAG04.00.00.01SERVER”=“5BEC6EC65870315CC9441497DDD619D90CAAB9E99F46F1720850303592EA115F1F1” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] “DisplayName”=“Alcohol 120%” [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved{9A2CB389-0FA3-867F-FCB5-438F35B3C01E}] “iacljbflfeaioldjnf”=hex:6b,61,67,65,6b,67,6d,63,67,66,65,6c,6f,6b,62,64,6a,6b,6b,6b,6d,… “hamkiikkefgkdafp”=hex:6b,61,67,65,6b,67,6d,63,67,66,65,6c,6f,6b,62,64,6a,6b,6b,6b,6d,… “hagkjnnbebmhdkii”=hex:69,61,6a,6b,66,68,6a,69,6f,6c,69,64,69,6e,62,6c,64,67,00,ff “jajkempffombmagcncod”=hex:64,62,66,6c,63,65,61,6a,65,6a,63,6c,66,6c,6f,6e,6b,6c,69,63,6f,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Tue 12 Jun 2007 23 A.SH. — “C:\WINDOWS\system32\abddbebac_r.dll” Sun 22 Oct 2006 5 A.SH. — “C:\WINDOWS\system32\efedaffec_s.dll” Sun 9 Dec 2007 0 A…H. — “C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5514e65b633fea538ae256458d4950b8\BITDA.tmp” Sun 9 Dec 2007 0 A…H. — “C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\beb1d6c7e93e2bbb12f3eebdad5a0202\BITD9.tmp” Sun 9 Dec 2007 0 A…H. — “C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\dd817b11526c6d6099a6124ffe89a545\BITB9.tmp” Sun 9 Dec 2007 0 A…H. — “C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\f0f20e7f1f0058a4a42bac06e78efbed\BITB8.tmp” Finished!

Gutek · 9 Grudzień 2007 23:22

C:\WINDOWS\system32\ efedaffec_s.dll usuń plik skoro skner powiedział, że jest zły w trybie awaryjnym recznie

system · 10 Grudzień 2007 16:03

1-jak ten plik znaleźć ?

2-po użyciu SDFix nie mogę wyłączyć systemowej zapory i systemowej ochrony przed wirusami.mam zainstalowany KIS i też

jest włączony,czy tak ma być ?

Gutek · 10 Grudzień 2007 16:57

Tak ma nie być, doinstalowałeś rzeczy, więc na wszelki wypadek -

Daj log z ComboFix

system · 10 Grudzień 2007 17:40

ComboFix 07-12-07.5 - Administrator 2007-12-10 18:26:20.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.177 [GMT 1:00] Running from: C:\Documents and Settings\Administrator\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-10 to 2007-12-10 ))))))))))))))))))))))))))))))) . 2007-12-09 18:42 . 2007-12-09 18:43 2007-12-08 10:46 . 2007-12-10 16:58 2007-12-08 10:46 . 2007-12-10 16:28 2007-12-08 10:46 . 2007-12-08 10:46 2007-12-08 10:46 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-08 10:46 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-08 10:46 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-08 10:46 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-08 10:45 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-08 10:45 . 2005-07-06 18:13 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-12-08 10:45 . 2005-07-06 18:13 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-12-02 13:40 . 2007-12-02 13:40 83 --a------ C:\WINDOWS\WWP.INI 2007-12-01 20:51 . 2007-12-01 20:51 1,409 --a------ C:\WINDOWS\system32\tmpF59F9.FOT 2007-12-01 20:50 . 2007-12-01 20:50 2007-12-01 15:32 . 2007-12-01 15:32 2007-12-01 15:32 . 2007-12-01 15:32 2007-11-22 19:26 . 2007-12-01 20:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-22 19:26 . 2007-11-22 19:26 1,409 --a------ C:\WINDOWS\QTFont.for 2007-11-13 17:30 . 2007-12-07 19:59 2007-11-10 16:02 . 2007-11-10 16:02 0 --a------ C:\WINDOWS\VCDWizardDLL.INI 2007-11-10 14:44 . 2007-11-10 16:18 2007-11-10 14:44 . 2007-11-10 14:44 2007-11-10 14:44 . 2007-11-10 14:44 10,368 --a------ C:\WINDOWS\system32\drivers\pfc.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-10 17:30 60,478,240 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-12-10 17:30 2,903,328 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-12-10 17:28 --------- d-----w C:\Program Files\Kaspersky Lab 2007-12-10 17:11 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\OpenOffice.org2 2007-12-10 17:01 --------- d-----w C:\Program Files\PeerGuardian2 2007-12-10 15:13 813,512 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-12-10 15:13 276,152 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-12-09 15:12 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-12-02 13:28 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-21 16:40 --------- d-----w C:\Program Files\Real Alternative 2007-10-14 09:20 --------- d-----w C:\Program Files\Smarty Uninstaller Pro 2007-10-13 17:46 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Business Logic 2007-10-12 15:55 8,864 ----a-w C:\WINDOWS\system32\drivers\CDAC15BA.SYS 2007-10-12 15:55 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\ArcSoft 2007-10-10 15:49 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo Photo Commander 5 2007-10-07 11:46 47,360 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\pcouffin.sys 2007-04-11 18:08 94,080 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\ezplay.sys 2007-04-11 18:08 87,608 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\ezpinst.exe 2007-06-12 21:14 23 --sha-w C:\WINDOWS\system32\abddbebac_r.dll 2006-10-22 07:50 5 --sha-w C:\WINDOWS\system32\efedaffec_s.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “kis”=“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” [2006-03-24 19:09] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-11-02 17:24] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoResolveSearch”= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" S2 bgg;bgg;C:\WINDOWS\enbgg.exe S3 ADM8511;Konwerter z USB na Fast Ethernet ADMtek ADM8511/AN986;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys S3 MEMSWEEP2;MEMSWEEP2;??\C:\WINDOWS\system32\SophosMEMSWEEP.SYS . Contents of the ‘Scheduled Tasks’ folder “2007-12-07 16:15:01 C:\WINDOWS\Tasks\1-Click Maintenance.job” “2007-12-07 16:15:01 C:\WINDOWS\Tasks\1-Klik Konserwacja.job” - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-10 18:30:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-10 18:32:05 . — E O F —

Gutek · 11 Grudzień 2007 19:08

W logu nic nie widać

system · 12 Grudzień 2007 15:29

dziękuję-chyba wszystko jest w porządku,antywirusy niczego nie wykrywają ale mam problem który mnie przerasta.jak wyłączyć systemową zaporę i systemową ochronę przed wirusami ?-pozdrawiam.

system · 13 Grudzień 2007 15:04

w końcu sobie poradziłem,dziękuję i pozdrawiam. Temat można usunąć.posting.php?mode=reply&f=16&t=207277#

posting.php?mode=reply&f=16&t=207277#