Powolny komputer

[beinone (Bienone1)]

Witam.Od dwoch dni strasznie wolno chodzi mi komputer oraz internet.Robie skany avastem oraz Spyware Doctor i wirusy niby sie usuwaja lecz komp nadal sie scina i jest powolny.Nie znam sie na tego typu zeczach i prosze o pomoc.

[Gutek]

Daj log z HJT + Silent - http://forum.dobreprogramy.pl/viewtopic.php?t=36654

[beinone (Bienone1)]

Log z HJT…

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:40, on 2007-12-10 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\dllcache\windmns.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [HOT FIX] E0chis.exe O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [Windows Secure Update] load.exe O4 - HKLM…\Run: [intranet] vetor.exe O4 - HKLM…\Run: [PCTAVApp] “C:\Program Files\PC Tools AntiVirus\PCTAV.exe” /MONITORSCAN O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKLM…\Run: [combofix] “C:\WINDOWS\system32\cmd.exe” /c “cd /d C:\ComboFix\ & Combobatch.bat” O4 - HKLM…\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM…\Run: [Anti-Trojan-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM…\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM…\RunServices: [HOT FIX] E0chis.exe O4 - HKLM…\RunServices: [Windows Secure Update] load.exe O4 - HKLM…\RunServices: [intranet] vetor.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [HOT FIX] E0chis.exe O4 - HKCU…\Run: [Windows Secure Update] load.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS\S-1-5-18…\RunOnce: [HOT FIX] E0chis.exe (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O4 - HKUS.DEFAULT…\RunOnce: [HOT FIX] E0chis.exe (User ‘Default user’) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Microsoft Windows DNS Manager - Unknown owner - C:\WINDOWS\System32\dllcache\windmns.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe – End of file - 4726 bytes Złączono Posta: 10.12.2007 (Pon) 17:50 Log z Silent… “Silent Runners.vbs”, revision 53, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\System32\ctfmon.exe” [MS] “HOT FIX” = “E0chis.exe” [file not found] “Windows Secure Update” = “load.exe” [file not found] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “HOT FIX” = “E0chis.exe” [file not found] “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “Windows Secure Update” = “load.exe” [file not found] “Intranet” = “vetor.exe” [file not found] “PCTAVApp” = ““C:\Program Files\PC Tools AntiVirus\PCTAV.exe” /MONITORSCAN” [“PC Tools Research Pty Ltd”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “combofix” = ““C:\WINDOWS\system32\cmd.exe” /c “cd /d C:\ComboFix\ & Combobatch.bat”” [MS] “AT-Watch” = “C:\Program Files\Anti-Trojan-55\ATWatch.exe” [“Anti-Trojan Network”] “Anti-Trojan-Watch” = “C:\Program Files\Anti-Trojan-55\ATWatch.exe” [“Anti-Trojan Network”] “TrojanScanner” = “C:\Program Files\Trojan Remover\Trjscan.exe” [“Simply Super Software”] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{52B87208-9CCF-42C9-B88E-069281105805}” = “Trojan Remover Shell Extension” -> {HKLM…CLSID} = “Trojan Remover Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\TROJAN~1\Trshlex.dll” [“Simply Super Software”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] PCTAVShellExtension(Default) = “{AEEAEC2D-7EE9-4C66-937C-80BF8B03FD54}” -> {HKLM…CLSID} = “PCTAVShlExt Class” \InProcServer32(Default) = “C:\Program Files\PC Tools AntiVirus\PCTAVShellExtension.dll” [“PC Tools Research Pty Ltd”] Trojan Remover(Default) = “{52B87208-9CCF-42C9-B88E-069281105805}” -> {HKLM…CLSID} = “Trojan Remover Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\TROJAN~1\Trshlex.dll” [“Simply Super Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ PCTAVShellExtension(Default) = “{AEEAEC2D-7EE9-4C66-937C-80BF8B03FD54}” -> {HKLM…CLSID} = “PCTAVShlExt Class” \InProcServer32(Default) = “C:\Program Files\PC Tools AntiVirus\PCTAVShellExtension.dll” [“PC Tools Research Pty Ltd”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] Trojan Remover(Default) = “{52B87208-9CCF-42C9-B88E-069281105805}” -> {HKLM…CLSID} = “Trojan Remover Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\TROJAN~1\Trshlex.dll” [“Simply Super Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp” Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [** WMI GetObject error **] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [** WMI GetObject error **] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [** WMI GetObject error **] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [** WMI GetObject error **], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [** WMI GetObject error **], 04 - 05

[Gutek]

Pobierz program SDFix

[beinone (Bienone1)]

SDFix…

SDFix: Version 1.117

Run by Krychu on 2007-12-10 at 18:44

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:

Checking Services:

C:\WINDOWS\system32\Microsoft\backup.ftp Found

C:\WINDOWS\system32\Microsoft\backup.tftp Found

Checking files:

Genuine:

C:\WINDOWS\system32\Microsoft\backup.ftp

C:\WINDOWS\system32\Microsoft\backup.tftp

Dummy:

C:\WINDOWS\system32\ftp.exe

C:\WINDOWS\system32\tftp.exe

C:\WINDOWS\system32\dllcache\ftp.exe

C:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:

C:\WINDOWS\system32\Microsoft\backup.ftp

C:\WINDOWS\system32\Microsoft\backup.tftp

C:\WINDOWS\system32\ftp.exe

C:\WINDOWS\system32\tftp.exe

C:\WINDOWS\system32\dllcache\ftp.exe

C:\WINDOWS\system32\dllcache\tftp.exe

Dummy:

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Rebooting…

Normal Mode:

Checking Files:

Trojan Files Found:

C:\Program Files\Common Files\Carlson\carlton - Deleted

C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted

C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted

C:\WINDOWS\system32\o - Deleted

C:\WINDOWS\system32\WinSecUp.exe - Deleted

Folder C:\Program Files\Common Files\Carlson - Removed

Removing Temp Files…

ADS Check:

C:\WINDOWS

No streams found.

C:\WINDOWS\system32

No streams found.

C:\WINDOWS\system32\svchost.exe

No streams found.

C:\WINDOWS\system32\ntoskrnl.exe

No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-10 18:48:42

Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]

“Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,…

scanning hidden files …

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services:

---

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

“C:\WINDOWS\System32\msmsngers.exe”=“C:\WINDOWS\System32\msmsngers.exe:*:Enabled:Internet”

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:

---

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sat 8 Dec 2007 10,884 A…H. — “C:\WINDOWS\system32\hgwdsa.exe”

Mon 23 Sep 2002 436,224 …SHR — “C:\WINDOWS\system32\msmsngers.exe”

Sat 8 Dec 2007 64,902 A…H. — “C:\WINDOWS\system32\wbnvdjj.exe”

Sun 9 Dec 2007 53,072 A…H. — “C:\WINDOWS\system32\wonscgdf.exe”

Sat 8 Dec 2007 3,508 A…H. — “C:\WINDOWS\system32\yenyexe.exe”

Sat 8 Dec 2007 64,902 A…H. — “C:\WINDOWS\system32\znpwq.exe”

Sat 8 Dec 2007 495,616 …SHR — “C:\WINDOWS\system32\dllcache\windmns.exe”

Finished!

Złączono Posta : 10.12.2007 (Pon) 19:14

jak zrobic Log z ComboFix???

[orzechjuve (Orzechjuve0)]

1) Trzeba zamknąć wszystkie otwarte okna i programy. 2) ComboFix uruchamia się przez dwuklik na ikonkę ComboFix.exe 3) pojawi się napis please wait - więc czekać 4) pojawi się napis the process cannot access the file because it is being users by another process - dalej czekać 5) pojawi się napis na dole okienka type 1 to continue, or 2 to abort. _ - trzeba wpisać 1 i nacisnąć ENTER 6) pojawi się napis: Scanning for infectes files… Shouldn,t take more than 10minutes - czekać 7) W czasie skanowania nie wolno nic robić, nawet poruszać myszką. Cool Po skończeniu skanowania pojawi się log. Jeśli się nie pojawi na ekranie, to można go znaleźć na C:\ComboFix.txt 9) Log może być długi, więc zapisz go sobie gdzieś, a potem wklej na http://wklej.org/, a w poście daj tylko link.

Masz przyklejone w temacie przecież…

[beinone (Bienone1)]

Log z ComboFix…

ComboFix 07-12-09.1 - Krychu 2007-12-10 20:31:30.7 - NTFSx86 Running from: C:\Documents and Settings\Krychu\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32.exe . ((((((((((((((((((((((((( Files Created from 2007-11-10 to 2007-12-10 ))))))))))))))))))))))))))))))) . 2007-12-10 20:30 . 2007-12-10 20:30 61,440 --a------ C:\WINDOWS\system32\YMTUSO.EXE 2007-12-10 20:30 . 2007-12-10 20:30 61,440 --a------ C:\WINDOWS\system32\LRAWNPYR.EXE 2007-12-10 20:30 . 2007-12-10 20:30 32,456 --a------ C:\WINDOWS\system32\dlea.exe 2007-12-10 20:30 . 2007-12-10 20:30 1,635 --a------ C:\WINDOWS\system32\bqmcjvy.exe 2007-12-10 20:25 . 2007-12-10 20:25 458,752 —hs---- C:\WINDOWS\system32\Wseclayer.exe 2007-12-10 20:25 . 2007-12-10 20:25 0 --a------ C:\adware.exe 2007-12-10 20:24 . 2007-12-10 20:24 20,480 --a------ C:\WINDOWS\system32\fwy.exe 2007-12-10 20:07 . 2007-12-10 20:07 4,096 --a------ C:\WINDOWS\system32\wxk.exe 2007-12-10 20:06 . 2007-12-10 20:06 32,456 --a------ C:\WINDOWS\system32\kvjy.exe 2007-12-10 20:06 . 2007-12-10 20:06 1,635 --a------ C:\WINDOWS\system32\raqgp.exe 2007-12-10 20:04 . 2007-12-10 20:04 4,096 --a------ C:\WINDOWS\system32\vqu.exe 2007-12-10 20:02 . 2007-12-10 20:02 32,456 --a------ C:\WINDOWS\system32\mqewb.exe 2007-12-10 20:02 . 2007-12-10 20:02 1,635 --a------ C:\WINDOWS\system32\kltdsnfj.exe 2007-12-10 19:57 . 2007-12-10 19:59 27,136 --ah----- C:\WINDOWS\system32\nnkatauf.exe 2007-12-10 19:54 . 2007-12-10 19:59 16,384 --a------ C:\WINDOWS\system32\cfk.exe 2007-12-10 19:34 . 2007-12-10 19:34 61,440 --------- C:\WINDOWS\system32\ynmtp.exe 2007-12-10 19:34 . 2007-12-10 19:34 32,456 --a------ C:\WINDOWS\system32\loxm.exe 2007-12-10 19:34 . 2007-12-10 19:34 67 --a------ C:\WINDOWS\system32\o 2007-12-10 19:31 . 2007-12-10 19:31 569,856 -r-hs---- C:\WINDOWS\Mrshield.exe 2007-12-10 19:27 . 2007-12-10 19:27 32,456 --a------ C:\WINDOWS\system32\hdcv.exe 2007-12-10 19:18 . 2007-12-10 19:18 37,376 --------- C:\WINDOWS\system32\mljjghh.dll 2007-12-10 19:17 . 2007-12-10 19:18 32,456 --a------ C:\WINDOWS\system32\vxpa.exe 2007-12-10 19:08 . 2007-12-10 19:08 12,288 --a------ C:\WINDOWS\system32\ydu.exe 2007-12-10 19:05 . 2007-12-10 19:05 36,864 --a------ C:\WINDOWS\system32\tfh.exe 2007-12-10 18:44 . 2007-12-10 18:44 2007-12-09 23:33 . 2006-05-25 14:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll 2007-12-09 23:33 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2007-12-09 23:33 . 2005-08-26 00:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll 2007-12-09 23:33 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll 2007-12-09 23:33 . 2006-06-19 12:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll 2007-12-09 20:02 . 2007-12-09 20:05 53,072 --ah----- C:\WINDOWS\system32\wonscgdf.exe 2007-12-09 19:33 . 2007-12-09 19:33 2007-12-09 19:12 . 2007-12-10 18:59 2007-12-09 13:12 . 2007-12-09 13:12 32,456 --a------ C:\WINDOWS\system32\tgyu.exe 2007-12-09 12:47 . 2007-12-09 12:48 2007-12-09 12:33 . 2007-12-09 12:33 32,456 --a------ C:\WINDOWS\system32\adhjjs.exe 2007-12-09 12:25 . 2007-12-09 12:25 32,456 --a------ C:\WINDOWS\system32\xjttk.exe 2007-12-09 12:20 . 2007-12-09 12:20 32,456 --a------ C:\WINDOWS\system32\nzhsvvym.exe 2007-12-09 12:13 . 2007-12-09 12:13 2007-12-09 12:11 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-09 12:09 . 2007-12-09 12:11 2007-12-09 12:08 . 2007-12-09 12:08 2007-12-09 11:25 . 2007-12-09 11:25 32,456 --a------ C:\WINDOWS\system32\muuside.exe 2007-12-09 11:24 . 2007-12-09 11:24 2007-12-09 10:30 . 2007-12-09 13:12 594 —hs---- C:\WINDOWS\system32\irskekbw.ini 2007-12-09 10:24 . 2007-12-09 10:24 32,456 --a------ C:\WINDOWS\system32\ckmo.exe 2007-12-09 02:47 . 2003-11-21 16:07 82,984 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-12-09 02:47 . 2003-11-21 16:07 82,136 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-12-09 02:39 . 2007-12-09 02:39 2007-12-09 02:38 . 2007-12-09 02:47 2007-12-09 02:19 . 2007-12-09 02:19 32,456 --a------ C:\WINDOWS\system32\uamvhf.exe 2007-12-09 02:01 . 2007-12-09 02:01 32,456 --a------ C:\WINDOWS\system32\wbfoh.exe 2007-12-09 01:56 . 2007-12-09 01:56 32,456 --a------ C:\WINDOWS\system32\iaklrvsv.exe 2007-12-09 01:51 . 2007-12-10 19:59 2007-12-09 01:50 . 2007-12-10 18:36 2007-12-09 01:50 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-09 01:50 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-09 01:50 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-09 01:50 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-09 01:49 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-09 01:31 . 2007-12-09 01:34 2007-12-09 01:30 . 2007-12-10 18:05 2007-12-09 01:05 . 2007-12-09 01:05 32,456 --a------ C:\WINDOWS\system32\ozloc.exe 2007-12-09 00:44 . 2007-12-09 00:44 32,456 --a------ C:\WINDOWS\system32\rbziok.exe 2007-12-09 00:06 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-09 00:06 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-09 00:06 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-09 00:06 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-09 00:06 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-09 00:06 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-09 00:05 . 2007-12-09 00:05 2007-12-09 00:05 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-12-09 00:05 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-09 00:05 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-08 23:51 . 2007-12-08 23:51 32,456 --a------ C:\WINDOWS\system32\utdrlt.exe 2007-12-08 23:45 . 2007-12-09 01:50 2007-12-08 23:43 . 2007-12-10 20:23 2007-12-08 23:43 . 2007-12-08 23:43 2007-12-08 23:43 . 2006-11-24 11:19 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-12-08 23:43 . 2006-11-24 11:19 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-12-08 23:43 . 2007-09-17 13:38 22,528 --a------ C:\WINDOWS\system32\drivers\AVHook.sys 2007-12-08 23:43 . 2007-09-17 13:38 15,872 --a------ C:\WINDOWS\system32\drivers\AVRec.sys 2007-12-08 23:43 . 2007-09-17 13:38 15,872 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys 2007-12-08 23:38 . 2007-12-08 23:38 2007-12-08 23:38 . 2003-04-08 09:56 820,133 -ra------ C:\WINDOWS\system32\drivers\sis7012.sys 2007-12-08 23:38 . 2002-07-01 18:10 115,864 -ra------ C:\WINDOWS\system32\a3d.dll 2007-12-08 23:37 . 2002-08-29 02:01 134,272 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-12-08 23:37 . 2002-08-29 01:32 57,856 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-12-08 23:32 . 2007-12-08 23:32 32,456 --a------ C:\WINDOWS\system32\oacfwv.exe 2007-12-08 23:04 . 2007-12-08 23:04 32,456 --a------ C:\WINDOWS\system32\ftetzvm.exe 2007-12-08 22:41 . 2007-12-08 22:41 32,456 --a------ C:\WINDOWS\system32\uusnjcj.exe 2007-12-08 22:39 . 2007-12-08 22:39 32,456 --a------ C:\WINDOWS\system32\tipx.exe 2007-12-08 21:19 . 2007-12-08 21:19 32,456 --a------ C:\WINDOWS\system32\hegr.exe 2007-12-08 20:40 . 2007-12-08 20:40 495,616 -r-hsc— C:\WINDOWS\system32\dllcache\windmns.exe 2007-12-08 20:39 . 2007-12-08 20:39 32,456 --a------ C:\WINDOWS\system32\xzvpmcmw.exe 2007-12-08 20:39 . 2007-12-08 20:39 32,456 --a------ C:\WINDOWS\system32\vpbhl.exe 2007-12-08 17:14 . 2007-12-08 17:14 32,456 --a------ C:\WINDOWS\system32\kckmfsj.exe 2007-12-08 17:14 . 2007-12-08 17:14 32,456 --a------ C:\WINDOWS\system32\eyntuivu.exe 2007-12-08 17:14 . 2007-12-08 17:14 22 --a------ C:\WINDOWS\system32\ati64hlp.stb 2007-12-08 17:11 . 2007-12-08 17:11 569,856 --a------ C:\WINDOWS\Mrshield.exe.vir . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-08 23:45 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-08 22:37 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-08 16:11 49,152 ----a-w C:\WINDOWS\system32\maz.exe 2007-12-08 16:11 133,632 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-08 15:47 64,902 —ha-w C:\WINDOWS\system32\wbnvdjj.exe 2007-12-08 15:45 --------- d-----w C:\Documents and Settings\Krychu\Dane aplikacji\Gadu-Gadu 2007-12-08 15:36 10,884 —ha-w C:\WINDOWS\system32\hgwdsa.exe 2007-12-08 15:28 32,456 ----a-w C:\WINDOWS\system32\zadcguq.exe 2007-12-08 15:25 32,456 ----a-w C:\WINDOWS\system32\qupqtc.exe 2007-12-08 15:21 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-12-08 15:21 --------- d-----w C:\Program Files\ATI Technologies 2007-12-08 15:18 32,456 ----a-w C:\WINDOWS\system32\trluiv.exe 2007-12-08 15:08 32,456 ----a-w C:\WINDOWS\system32\awfe.exe 2007-12-08 15:08 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-08 15:07 64,902 —ha-w C:\WINDOWS\system32\znpwq.exe 2007-12-08 15:07 39,936 ----a-w C:\WINDOWS\system32\awtqnkh.dll.vir 2007-12-08 15:07 32,456 ----a-w C:\WINDOWS\system32\lrmn.exe 2007-12-08 14:51 558,142 ----a-w C:\WINDOWS\java\Packages\4M3TB5ZZ.ZIP 2007-12-08 14:51 155,995 ----a-w C:\WINDOWS\java\Packages\OOHZXJ33.ZIP 2007-12-08 14:49 --------- d-----w C:\Program Files\Usługi online 2002-09-23 12:00 436,224 --sh–r C:\WINDOWS\system32\msmsngers.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE~\Browser Helper Objects{9B4868E3-767E-4A1C-A792-3CC451BA8CAC}] 2007-12-10 19:18 37376 --------- C:\WINDOWS\system32\mljjghh.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-23 13:00] “Windows Secure Update”=“load.exe” [] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 11:54] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2004-08-25 12:52] “Intranet”=“vetor.exe” [] “PCTAVApp”=“C:\Program Files\PC Tools AntiVirus\PCTAV.exe” [2007-10-04 15:44] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 14:00] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] “AT-Watch”="" [] “Anti-Trojan-Watch”=“C:\Program Files\Anti-Trojan-55\ATWatch.exe” [] “Client Server Runtime Process”=“C:\WINDOWS\System32\csrs.exe” [] “Advanced DHTML Enable”=“C:\WINDOWS\System32\dlea.exe” [2007-12-10 20:30] “WinDLL (Wseclayer.exe)”=“C:\WINDOWS\System32\Wseclayer.exe” [2007-12-10 20:25] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] “Intranet”=“vetor.exe” [] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2002-09-23 13:00] “HOT FIX”=“E0chis.exe” [] “Windows Secure Update”=“load.exe” [] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] “HOT FIX”=“E0chis.exe” [] “Windows Secure Update”=“load.exe” [] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{9B4868E3-767E-4A1C-A792-3CC451BA8CAC}”= C:\WINDOWS\system32\mljjghh.dll [2007-12-10 19:18 37376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljjghh] mljjghh.dll 2007-12-10 19:18 37376 C:\WINDOWS\system32\mljjghh.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\mljjghh.dll . ************************************************************************** catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-10 20:33:58 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-10 20:34:36 . — E O F —

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

[Gutek]

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Po tym nowy log z Combo