NOD32 wykrywa mi wirus Rbottrojan

julita_231 · 3 Wrzesień 2007 21:02

Logfile of HijackThis v1.99.1 Scan saved at 22:59:41, on 2007-09-03 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\OneStepSearch\onestep.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe D:\PROGRAMY ZAINSTALOWANE\WINIAMP\Winamp\winampa.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\OneStepSearch\onestep.exe D:\PROGRAMY ZAINSTALOWANE\ASHAMPO\Ashampoo Magic Defrag\bin\aDefragService.exe D:\PROGRAMY ZAINSTALOWANE\SKYPE\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Shareaza\Shareaza.exe D:\PROGRAMY ZAINSTALOWANE\SKYPE\Plugin Manager\skypePM.exe D:\emule\emule.exe D:\PROGRAMY ZAINSTALOWANE\ASHAMPO\Ashampoo Magic Defrag\bin\aDefragCtrl.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\explorer.exe C:\Documents and Settings\JULITA\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAMY ZAINSTALOWANE\ACROBAT\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\PROGRAMY ZAINSTALOWANE\SKYPE\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr O4 - HKLM…\Run: [WinampAgent] D:\PROGRAMY ZAINSTALOWANE\WINIAMP\Winamp\winampa.exe O4 - HKLM…\Run: [ZoneAlarm Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\PROGRAMY ZAINSTALOWANE\GG\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “D:\PROGRAMY ZAINSTALOWANE\SKYPE\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [shareaza] “C:\Program Files\Shareaza\Shareaza.exe” -tray O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [eMuleAutoStart] D:\emule\emule.exe -AutoStart O4 - Global Startup: Ashampoo Magic Defrag.lnk = D:\PROGRAMY ZAINSTALOWANE\ASHAMPO\Ashampoo Magic Defrag\bin\aDefragCtrl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~2\OFFICE\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\PROGRAMY ZAINSTALOWANE\SKYPE\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~2\OFFICE\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_34.cab O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_48.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/sho … wflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ashampoo Defrag Service (AshampooDefragService) - - D:\PROGRAMY ZAINSTALOWANE\ASHAMPO\Ashampoo Magic Defrag\bin\aDefragService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: OneStep Search Service - Unknown owner - C:\Program Files\OneStepSearch\onestep.exe" “C:\Program Files\OneStepSearch\onestep.dll” Service (file missing) O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\PROGRAMY ZAINSTALOWANE\TUNE UP\WinStylerThemeSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

Gutek · 3 Wrzesień 2007 23:28

jaka lokalizacja?

Start >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz OneStep Search Service , a folder w trybie awaryjnym usuń

Daj log z ComboFix

julita_231 · 4 Wrzesień 2007 13:29

ComboFix 07-08-30.3 - “JULITA” 2007-09-04 15:15:07.1 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.151 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-08-04 to 2007-09-04 ))))))))))))))))))))))))))))))) 2007-09-04 14:58 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-09-04 00:03 2007-09-03 23:38 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll 2007-09-03 23:38 75,264 --a------ C:\WINDOWS\system32\unacev2.dll 2007-09-03 23:38 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll 2007-09-03 23:38 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll 2007-09-03 23:38 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2007-09-03 23:37 2007-09-03 23:37 2007-09-03 23:37 2007-09-03 21:52 4,212 —h----- C:\WINDOWS\system32\zllictbl.dat 2007-09-03 21:50 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll 2007-09-03 21:50 2007-09-03 21:48 2007-09-03 16:14 2007-08-30 15:56 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-08-30 15:56 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-08-30 15:56 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-08-30 15:54 2007-08-30 13:00 2007-08-26 21:17 2007-08-26 20:37 2007-08-25 19:04 2007-08-20 22:08 2007-08-18 16:10 20,096 --a------ C:\WINDOWS\system32\drivers\MSIRCOMM.sys 2007-08-18 16:10 20,096 --a------ C:\WINDOWS\system32\dllcache\msircomm.sys 2007-08-15 16:49 2007-08-14 23:17 2007-08-14 00:23 2007-08-04 11:01 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-26 20:27 118784 --a------ C:\WINDOWS\web\Wallpaper\Adorable Pets Free #6.exe 2007-08-01 12:29 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Winferno 2007-07-31 16:55 118784 --a------ C:\WINDOWS\web\Wallpaper\Adorable Pets Free #6 dir\uninstall.exe 2007-07-29 16:37 --------- d-------- C:\Program Files\VOX BOX 2.02 2007-07-28 14:14 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Legacy Interactive 2007-07-21 19:30 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Oberon Games 2007-07-16 19:07 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\iWin 2007-07-14 21:28 --------- d-------- C:\Program Files\Common Files\NSV 2007-07-12 20:33 --------- d-------- C:\Program Files\Onet 2007-07-12 20:33 --------- d-------- C:\Program Files\Common Files\Onet.pl 2007-07-12 20:33 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\Kamerzysta 2007-07-12 20:33 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\Czat 2007-07-12 20:33 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\AutoUpdate 2007-07-11 20:35 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Aveyond I 2007-07-08 10:44 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\Big Fish Games 2007-07-07 15:22 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2007-07-07 15:22 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\GanymedeNet 2007-07-07 14:25 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\Help 2007-07-06 19:00 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\PlayFirst 2007-07-06 19:00 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PlayFirst 2007-07-05 16:31 --------- d-------- C:\DOCUME~1\JULITA\DANEAP~1\Gamelab ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2002-10-15 03:04] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “Onet.pl AutoUpdate”=“C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe” [2005-07-27 11:59] “WinampAgent”=“D:\PROGRAMY ZAINSTALOWANE\WINIAMP\Winamp\winampa.exe” [2007-05-15 00:22] “ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-06-21 21:54] “TrojanScanner”=“C:\Program Files\Trojan Remover\Trjscan.exe” [2007-08-29 20:30] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-28 22:00] “Gadu-Gadu”=“D:\PROGRAMY ZAINSTALOWANE\GG\Gadu-Gadu\gg.exe” [2005-11-16 12:57] “Skype”=“D:\PROGRAMY ZAINSTALOWANE\SKYPE\Phone\Skype.exe” [2007-06-08 15:18] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-09 19:19] “Shareaza”=“C:\Program Files\Shareaza\Shareaza.exe” [2005-10-27 18:44] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2002-08-20 15:08] “eMuleAutoStart”=“D:\emule\emule.exe” [2006-09-14 15:15] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] “WinampAgent”=D:\PROGRAMY ZAINSTALOWANE\WINIAMP\Winamp\winampa.exe “Cmaudio”=RunDll32 cmicnfg.cpl,CMICtrlWnd “ATIPTA”=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe “NeroFilterCheck”=C:\WINDOWS\System32\NeroCheck.exe R3 axvbusx;axvbusx;C:\WINDOWS\System32\DRIVERS\axvbusx.sys R3 axvscsi;axvscsi;C:\WINDOWS\System32\DRIVERS\axvscsi.sys S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\System32\DRIVERS\MSIRCOMM.sys S4 OneStep Search Service;OneStep Search Service;“C:\Program Files\OneStepSearch\onestep.exe” “C:\Program Files\OneStepSearch\onestep.dll” Service *Newly Created Service* - ALG *Newly Created Service* - CATCHME *Newly Created Service* - IPNAT *Newly Created Service* - SHAREDACCESS Contents of the ‘Scheduled Tasks’ folder 2007-09-04 13:07:18 C:\WINDOWS\Tasks\1-Click Maintenance.job - D:\PROGRAMY ZAINSTALOWANE\TUNE UP\SystemOptimizer.exe 2007-07-31 14:59:38 C:\WINDOWS\Tasks\rpc.job - C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-04 15:18:17 Windows 5.1.2600 Dodatek Service Pack. 1 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-04 15:20:00 C:\ComboFix-quarantined-files.txt … 2007-09-04 15:20 — E O F —

Gutek · 4 Wrzesień 2007 19:33

Na koniec

Pobierz program SDFix