Problem z reklamiarzem - pls o sprawdzenie loga HijackThis

xxxam · 20 Listopad 2007 15:04

Witam wszystkich i proszę o pomoc. Jak tylko podłączę komputer do internetu Avast zaczyna wypluwać ekraniki o wysyłaniu wielu maili o tym samym temacie. Przypuszczam, że to jakieś mailware. Avast nie podaje żadnych szczegółów, chociaż przy skanowaniu znalazł coś i usunął.

Trojan Remover pokazuje coś takiego :

This file is called by Service Registry key:

C:\WINDOWS\System32\DefLib.sys

An executable file with this name *has not* been found (it may not exist)

i że wywołuje go następujący klucz w rejestrze :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysLibrary"ImagePath"

Poniżej log z Hijack’a :

Logfile of HijackThis v1.99.1 Scan saved at 15:28:57, on 2007-11-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe d:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe d:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\WINDOWS\RTHDCPL.EXE D:\Program Files\HP\HP Software Update\HPWuSchd2.exe D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Messenger\msmsgs.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\DOCUME~1\User\USTAWI~1\Temp\winlogon.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\OpenOffice.ux.pl 2.2.1\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.2.1\program\soffice.BIN C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe D:\Narzędzia!totalcmd\TOTALCMD.EXE D:\Narzędzia\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O4 - HKLM…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [LGODDFU] “C:\Program Files\lg_fwupdate\fwupdate.exe” blrun O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM…\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU…\Run: [Firewall auto setup] C:\DOCUME~1\User\USTAWI~1\Temp\winlogon.exe O4 - Startup: OpenOffice.ux.pl 2.2.1.lnk = C:\Program Files\OpenOffice.ux.pl 2.2.1\program\quickstart.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SQL Server (INSERTGT) (MSSQL$INSERTGT) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sINSERTGT (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

Z góry dziękuję za pomoc

Pozdrawiam

Jarek

arekmalek · 20 Listopad 2007 17:42

Użyj w trybie awaryjnym SDFix daj raport. Wyczyść tempy za pomocą ATF Cleaner

Złączono Posta : 20.11.2007 (Wto) 18:44

Potem fix wpisu.

raquo

Gutek · 20 Listopad 2007 18:53

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

xxxam · 21 Listopad 2007 08:14

Sorki , poprawiłem temat

Mam nadzieję że teraz lepiej - przepraszam za to ale sam nie wiem jak streścić krótko problem.

Złączono Posta : 21.11.2007 (Sro) 10:01

arekmalek Zrobiłem wszystko jak napisałeś. Poniżej log z SDFix’a i ponownie Hijackthis

Mam nadzieję, że juz wszystko będzie git.

SDFix: Version 1.115 Run by Administrator on 2007-11-21 at 09:33 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Name: FCI SysLibrary Path: C:\WINDOWS\system32\svchost.exe:ext.exe ??\C:\WINDOWS\system32\DefLib.sys FCI - Deleted SysLibrary - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\10C.TMP - Deleted C:\WINDOWS\system32\8_exception.nls - Deleted C:\WINDOWS\system32\w32drv1.exe - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe : ADS Found! svchost.exe: deleted 24064 bytes in 1 streams. Checking for remaining Streams C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-21 09:36:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:133bcb05 “s2”=dword:4fc305b6 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “h0”=dword:00000000 “ujdew”=hex:3d,bc,04,74,a4,89,ea,ac,40,e7,a4,03,be,72,9d,c2,77,e0,53,54,ae,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “h0”=dword:00000000 “ujdew”=hex:3d,bc,04,74,a4,89,ea,ac,40,e7,a4,03,be,72,9d,c2,77,e0,53,54,ae,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “h0”=dword:00000000 “ujdew”=hex:3d,bc,04,74,a4,89,ea,ac,40,e7,a4,03,be,72,9d,c2,77,e0,53,54,ae,… scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts] “\x106 Systematic TT BRK (TrueType)”=“aesymatt.ttf” “\x106nigma Scrawl 4 BRK (TrueType)”=“aescrawl.ttf” “R\x13attpick (TrueType)”=“Rattpick.ttf” [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,34,03,00,00,01,00,00,00,09,00,00,00,58,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “%windir%\system32\sessmgr.exe”="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" “D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe” “D:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe” “D:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe” “D:\Program Files\HP\Digital Imaging\bin\hposfx08.exe”=“D:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe” “D:\Program Files\HP\Digital Imaging\bin\hposid01.exe”=“D:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe” “D:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe” “D:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe” “D:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe” “D:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe” “D:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe” “D:\Program Files\HP\Digital Imaging\bin\hpoews01.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe” “D:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe”=“D:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe” “D:\Program Files\Gadu-Gadu\gg.exe”=“D:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny” “%windir%\Network Diagnostic\xpnetdiag.exe”="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" “C:\WINDOWS\system32\dpvsetup.exe”=“C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test” “C:\WINDOWS\system32\rundll32.exe”=“C:\WINDOWS\system32\rundll32.exe:*:Enabled:Uruchamia plik DLL jako aplikację” “C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe”=“C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe:*:Enabled:sqlservr” “C:\WINDOWS\system32\svchost.exe”=“C:\WINDOWS\system32\svchost.exe:*:Enabled:svchost” “C:\Program Files\Skype\Phone\Skype.exe”=“C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] “%windir%\system32\sessmgr.exe”="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" “%windir%\Network Diagnostic\xpnetdiag.exe”="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Sat 1 Sep 2007 4,348 …SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Finished!

i Hijackthis

Logfile of HijackThis v1.99.1 Scan saved at 09:51:23, on 2007-11-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe d:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe d:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\WINDOWS\RTHDCPL.EXE D:\Program Files\HP\HP Software Update\HPWuSchd2.exe D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Messenger\msmsgs.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\OpenOffice.ux.pl 2.2.1\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.2.1\program\soffice.BIN C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe D:\Narzędzia!totalcmd\TOTALCMD.EXE D:\Narzędzia\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O4 - HKLM…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [LGODDFU] “C:\Program Files\lg_fwupdate\fwupdate.exe” blrun O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM…\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Startup: OpenOffice.ux.pl 2.2.1.lnk = C:\Program Files\OpenOffice.ux.pl 2.2.1\program\quickstart.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SQL Server (INSERTGT) (MSSQL$INSERTGT) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sINSERTGT (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

Natomiast …

Tego wpisu nie znalazłem do poprawienia. Może dlatego, że po napisaniu wczoraj posta odpalałem Registry MEchanic’a ???

Pozdro

Jarek

Gutek · 21 Listopad 2007 22:13

Daj log z ComboFix

xxxam · 22 Listopad 2007 07:58

Od wczoraj niby jest spokój. Przy zamykaniu systemu wyświetla na chwilkę błąd z jakimś DLL-em w treści ale trwa to tak krótko, że nie daję rady przeczytać .

Poniżej log z ComboFix’a

ComboFix 07-11-19.3 - User 2007-11-22 8:49:40.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.394 [GMT 1:00] Running from: D:\Narzędzia\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-10-22 to 2007-11-22 ))))))))))))))))))))))))))))))) . 2007-11-21 09:33 2007-11-21 09:32 2007-11-21 09:32 2007-11-21 09:32 2007-11-21 09:32 2007-11-21 09:32 2007-11-21 09:32 2007-11-21 09:32 2007-11-20 13:17 2007-11-20 13:16 2007-11-20 13:16 2007-11-20 13:16 2007-11-13 10:53 2007-11-09 09:12 32 --a------ C:\WINDOWS\system87sG.dat 2007-11-09 09:11 2007-10-23 10:55 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-23 10:55 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-23 10:55 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-23 10:55 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-23 10:55 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-22 07:53 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\OpenOffice.ux.pl2 2007-11-22 07:52 --------- d-----w C:\Program Files\lg_fwupdate 2007-11-22 07:52 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Skype 2007-11-19 15:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InsERT 2007-11-13 08:39 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\gtk-2.0 2007-11-05 15:48 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\InsERT GT 2007-10-24 08:15 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Nokia 2007-10-01 08:40 --------- d-----w C:\Program Files\xcsoftinslog 2007-10-01 08:40 --------- d-----w C:\Program Files\CAIRO-soft 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 13:00] “PowerBar”="" [] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-07-02 16:10] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2005-09-15 14:43] “PcSync”=“D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [2006-04-11 16:52] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” [2005-11-28 06:55] “igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” [2005-11-28 06:52] “igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” [2005-11-28 06:55] “SkyTel”=“SkyTel.EXE” [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe] “RemoteControl”=“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2004-11-02 20:24] “InCD”=“C:\Program Files\Ahead\InCD\InCD.exe” [2006-03-16 09:00] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “LGODDFU”=“C:\Program Files\lg_fwupdate\fwupdate.exe” [2007-07-31 10:16] “RTHDCPL”=“RTHDCPL.EXE” [2006-05-18 07:27 C:\WINDOWS\RTHDCPL.exe] “RegistryMechanic”="" [] “HP Software Update”=“D:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [2006-02-19 01:41] “PCSuiteTrayApplication”=“D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe” [2006-04-26 07:29] “avast!”=“d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “TrojanScanner”=“C:\Program Files\Trojan Remover\Trjscan.exe” [2007-11-11 13:42] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 13:00] C:\Documents and Settings\User\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.2.1.lnk - C:\Program Files\OpenOffice.ux.pl 2.2.1\program\quickstart.exe [2007-07-09 23:18:48] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22] R2 MSSQL$INSERTGT;SQL Server (INSERTGT);“C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe” -sINSERTGT S3 SQLWriter;SQL Server VSS Writer;“C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{1dee8add-e4c7-11d9-b70b-806d6172696f}] \Shell\AutoRun\command - D:\setup.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-22 08:52:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-22 8:53:31 - machine was rebooted . — E O F —

Wielkie dzięki za pomoc ewrybady

Gutek · 22 Listopad 2007 17:21

Powinno być Ok