Niepewnosc w dzialaniu neta, mozliwy wirus?

Dexter28 · 1 Lipiec 2008 15:09

Witam, ostatnimi czasy komputer zwolnił i internet zaczął wariowac, wklejam logi z hijaka i combofixa

Log z Hijackthis

C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\Mixer.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\ping.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKLM…\Run: [CloneCDTray] “C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe” /s O4 - HKLM…\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft OfficeXP\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe – End of file - 4639 bytes

Log z ComboFix

ComboFix 08-06-20.4 - albo Adam albo Artur 2008-07-01 16:09:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.160 [GMT 2:00] Running from: C:\Documents and Settings\albo Adam albo Artur\Pulpit\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\000346AA C:\Program Files\myglobalsearch\bar\Cache\00071A3D C:\Program Files\myglobalsearch\bar\Cache\00458531.bin C:\Program Files\myglobalsearch\bar\Cache\00458924.bin C:\Program Files\myglobalsearch\bar\Cache\00458BAF.bin C:\Program Files\myglobalsearch\bar\Cache\004C5E9C C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm . ((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 ))))))))))))))))))))))))))))))) . 2008-07-01 16:04 . 2008-07-01 16:04 2008-06-28 11:34 . 2002-09-20 18:03 20,480 --a------ C:\WINDOWS\system32\hidserv.dll 2008-06-28 11:34 . 2002-09-20 18:03 20,480 --a–c— C:\WINDOWS\system32\dllcache\hidserv.dll 2008-06-28 11:34 . 2001-10-26 16:48 14,080 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-06-28 11:34 . 2001-10-26 16:48 14,080 --a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-06-28 11:33 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-06-28 11:33 . 2001-10-26 16:57 12,160 --a–c— C:\WINDOWS\system32\dllcache\mouhid.sys 2008-06-28 11:26 . 2002-08-29 01:32 28,160 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-06-28 11:26 . 2002-08-29 01:32 28,160 --a–c— C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-06-28 11:26 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-06-28 11:26 . 2001-08-17 22:02 9,600 --a–c— C:\WINDOWS\system32\dllcache\hidusb.sys 2008-06-28 11:19 . 2001-08-17 20:13 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys 2008-06-28 11:19 . 2001-08-17 20:13 27,165 --a–c— C:\WINDOWS\system32\dllcache\fetnd5.sys 2008-06-28 11:19 . 2002-08-29 01:32 19,328 --a------ C:\WINDOWS\system32\drivers\usbehci.sys 2008-06-28 11:19 . 2002-09-20 18:03 5,120 --a------ C:\WINDOWS\system32\hccoin.dll 2008-06-20 14:06 . 2008-06-20 14:06 665,600 --a------ C:\WINDOWS\system32\drivers\hardlock.sys 2008-06-20 14:06 . 2008-06-20 14:06 47,616 --a------ C:\WINDOWS\system32\drivers\Haspnt.sys 2008-06-20 14:06 . 2008-06-20 14:06 6,656 --a------ C:\WINDOWS\system32\haspvdd.dll 2008-06-20 14:06 . 2008-05-21 08:03 2,645 --a------ C:\WINDOWS\system32\config.hsp 2008-06-20 14:06 . 2008-06-20 14:06 383 --a------ C:\WINDOWS\system32\haspdos.sys 2008-06-20 13:57 . 2008-06-20 14:06 868 --a------ C:\WINDOWS\rm-win.ini 2008-06-07 12:46 . 2001-07-21 23:23 1,875,968 --a–c— C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-06-07 12:45 . 2001-10-26 18:28 13,463,552 --a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-06-07 12:44 . 2001-10-26 17:29 2,134,528 --a–c— C:\WINDOWS\system32\dllcache\EXCH_smtpsnap.dll 2008-06-07 12:42 . 2001-10-26 18:29 159,744 --a–c— C:\WINDOWS\system32\dllcache\icwhelp.dll 2008-06-07 12:34 . 2001-08-17 20:12 23,070 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys 2008-06-07 12:31 . 2002-09-21 00:25 1,086,182 -ra------ C:\WINDOWS\SET25.tmp 2008-06-07 12:31 . 2001-10-27 12:34 13,923 -ra------ C:\WINDOWS\SET3B.tmp 2008-06-05 21:22 . 2008-06-05 21:22 2008-06-05 21:20 . 2008-06-05 21:20 2008-06-04 21:08 . 2002-09-21 00:25 1,086,182 -ra------ C:\WINDOWS\SET28.tmp 2008-06-04 21:08 . 2001-10-27 12:34 13,923 -ra------ C:\WINDOWS\SET3D.tmp 2008-06-02 17:08 . 2008-06-02 17:15 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-30 20:51 --------- d-----w C:\Program Files\Steam 2008-06-30 20:32 --------- d-----w C:\Documents and Settings\albo Adam albo Artur\Dane aplikacji\teamspeak2 2008-06-24 16:06 --------- d-----w C:\Program Files\TrackMania Nations ESWC 2008-06-06 16:49 --------- d-----w C:\Documents and Settings\albo Adam albo Artur\Dane aplikacji\Skype 2008-06-06 16:29 --------- d-----w C:\Documents and Settings\albo Adam albo Artur\Dane aplikacji\skypePM 2008-05-26 01:58 --------- d-----w C:\Program Files\Gadu-Gadu 2008-05-16 12:22 --------- d-----w C:\Program Files\Auslogics 2008-05-12 21:03 --------- d-----w C:\Program Files\Real 2008-05-12 21:03 --------- d-----w C:\Program Files\Common Files\xing shared 2008-05-12 21:03 --------- d-----w C:\Program Files\Common Files\Real 2008-05-10 18:40 --------- d-----w C:\Program Files\JPEGCompress 2008-05-08 07:43 --------- d-----w C:\Program Files\Google 2008-01-19 11:49 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 12:54 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2003-05-14 13:07 4616192] “nwiz”=“nwiz.exe” [2003-05-14 13:07 323584 C:\WINDOWS\system32\nwiz.exe] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 02:11 132496] “CloneCDTray”=“C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe” [2006-09-28 21:21 57344] “C-Media Mixer”=“Mixer.exe” [2003-04-06 11:39 1818624 C:\WINDOWS\mixer.exe] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2008-05-12 23:03 185896] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2002-09-20 19:05 13312] “NvMediaCenter”=“C:\WINDOWS\System32\NVMCTRAY.DLL” [2003-05-14 13:07 49152] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft OfficeXP\Office10\OSA.EXE [2001-02-13 01:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “vidc.3iv2”= 3ivxVfWCodec.dll “VIDC.HFYU”= huffyuv.dll “VIDC.VP31”= vp31vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 18:04 3313664 C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-12-12 16:23 21686568 C:\Program Files\Skype\Phone\Skype.exe R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-16 01:20] . Contents of the ‘Scheduled Tasks’ folder “2008-02-11 11:56:02 C:\WINDOWS\Tasks\Mozilla Firefox.job” - C:\PROGRA~1\MOZILL~1\firefox.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-01 16:13:29 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe . ************************************************************************** . Completion time: 2008-07-01 16:17:05 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-01 14:17:00 Pre-Run: 6,021,775,360 bajtów wolnych Post-Run: 6,161,842,176 bajt˘w wolnych 139

Gutek · 1 Lipiec 2008 15:12

Optymalizacja XP: viewtopic.php?t=76580

Optymalizacja autostartu: http://www.bezpieczenstwosystemow.pl/in … opic=116.0

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

Opis RegCleaner - http://www.agavk.p9.pl/strony/progra_regcleaner.php

Zobacz - Obsługa jv16 PowerTools

Skan + raport z http://www.kaspersky.pl/virusscanner.html