Problem z :worm win32 netsky

Oprogramowanie komputerowe Problemy z oprogramowaniem
#1

mam problem pewnego dnia pojawiły się u mnie na kompie dziwne programy Error Cleaner, Privacy Protector, Spyware&Malware Protection, SysCleaner.

Wyskakuje mi taka chmurka “worm win32 netsky detected…” z traya, z jakiejś ikonki (krzyżyk w czerwonym kółku).

Pisze mi żebym zabezpieczył komputer.

Oto log z hijackthis’a:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:44:11, on 2008-03-15

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

F:\WINDOWS\System32\smss.exe

F:\WINDOWS\SYSTEM32\winlogon.exe

F:\WINDOWS\system32\services.exe

F:\WINDOWS\system32\lsass.exe

F:\WINDOWS\system32\Ati2evxx.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\SYSTEM32\Ati2evxx.exe

F:\WINDOWS\system32\spoolsv.exe

F:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe

F:\WINDOWS\ATKKBService.exe

F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

F:\Program Files\Common Files\LightScribe\LSSrvc.exe

F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

F:\WINDOWS\system32\PnkBstrA.exe

F:\WINDOWS\System32\snmp.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\Explorer.EXE

F:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe

F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

F:\WINDOWS\RTHDCPL.EXE

F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

F:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe

F:\PROGRA~1\MYSECR~1\MSFMON.exe

F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

F:\Program Files\ATI Technologies\ATI.ACE\cli.exe

F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\Program Files\Winampek\winampa.exe

F:\Program Files\Netropa\Onscreen Display\OSD.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

F:\Program Files\CursorXP\CursorXP.exe

C:\Program Files\Gadu-Gadu\gg.exe

F:\Program Files\Messenger\msmsgs.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

F:\WINDOWS\system32\ctfmon.exe

F:\Program Files\SysCleaner\SysCleaner.exe

C:\iPlus Manager\iPlusFlashSkin.exe

F:\Program Files\ATI Technologies\ATI.ACE\cli.exe

F:\Program Files\ATI Technologies\ATI.ACE\cli.exe

F:\Program Files\Common Files\Teleca Shared\Generic.exe

F:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

F:\Program Files\Mozilla Firefox\firefox.exe

F:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Winampek\winamp.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm … Ojg5&lid=2

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.serial99.com/?a

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Serial99.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll

O3 - Toolbar: etlrlws - {C85D75B0-9513-4672-8376-E4265ACD3AD1} - F:\WINDOWS\etlrlws.dll (file missing)

O4 - HKLM…\Run: [iKeyWorks] F:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe

O4 - HKLM…\Run: [WheelMouse] F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM…\Run: [WINCINEMAMGR] “F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe”

O4 - HKLM…\Run: [MULTIMEDIA KEYBOARD] F:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe

O4 - HKLM…\Run: [MSF_Monitor] F:\PROGRA~1\MYSECR~1\MSFMON.exe /Start

O4 - HKLM…\Run: [sunJavaUpdateSched] “F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”

O4 - HKLM…\Run: [ATICCC] “F:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay

O4 - HKLM…\Run: [iPlusManager] c:\iPlus Manager\iPlusChecker.exe

O4 - HKLM…\Run: [sony Ericsson PC Suite] “F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

O4 - HKLM…\Run: [AVP] “F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe”

O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winampek\winampa.exe

O4 - HKLM…\Run: [PWRISOVM.EXE] c:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM…\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM…\Run: [sBI] F:\Documents and Settings\Bimbollo\Pulpit\install_sbd_en.exe

O4 - HKCU…\Run: [CursorXP] F:\Program Files\CursorXP\CursorXP.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [MSMSGS] “F:\Program Files\Messenger\msmsgs.exe” /background

O4 - HKCU…\Run: [DAEMON Tools Pro Agent] “C:\Program Files\DAEMON Tools Pro\DTProAgent.exe”

O4 - HKCU…\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector

O4 - HKCU…\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [sysCleaner] “F:\Program Files\SysCleaner\SysCleaner.exe” hide

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] F:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: COMPANY_NAME WinCinema Manager.lnk = F:\Program Files\COMPANY_NAME\Common\Bin\WinCinemaMgr.exe

O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\Program Files\COMPANY_NAME\Common\Bin\WinCinemaMgr.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Dodaj do blokowanych banerów - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe

O13 - WWW Prefix: http://www.serial99.com/?

O17 - HKLM\System\CCS\Services\Tcpip…{03AA5522-2F0C-47AF-8FDA-B0910276286F}: NameServer = 212.2.96.51 212.2.96.52

O17 - HKLM\System\CS3\Services\Tcpip…{03AA5522-2F0C-47AF-8FDA-B0910276286F}: NameServer = 212.2.96.51 212.2.96.52

O20 - AppInit_DLLs: F:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe

O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - F:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - F:\Program Files\WinPcap\rpcapd.exe

–

End of file - 9145 bytes

Proszę o pomoc w rozwiązaniu problemu z góry dienx :smiley:

#2

Przeleć spywarem doctorem, z tego co wiem to on umiał sobie z tym poradzić.

#3

sfixuj:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm … Ojg5&lid=2

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.serial99.com/?a

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

O3 - Toolbar: etlrlws - {C85D75B0-9513-4672-8376-E4265ACD3AD1} - F:\WINDOWS\etlrlws.dll (file missing)

O13 - WWW Prefix: http://www.serial99.com/?

P.S instalowałeś program Sysclean???,bo tutaj widać taki wpis:

O4 - HKCU…\Run: [sysCleaner] “F:\Program Files\SysCleaner\SysCleaner.exe” hide

#4

zrób scana tym:

http://dobreprogramy.pl/index.php?dz=2& … Build+2521

#5

bearshare do kosza.

#6

Bimbollo

Pokaż log z ComboFix (na dole)

#7

Zainstalowałem Syscleaner USUNĄĆ??

#8

Nie moge ściągnąć ComboFix bo pokazuje że nie odnaleziono serwera :frowning:

#9

oto log z ComboFix:

ComboFix 08-03-14.4 - Bimbollo 2008-03-16 0:21:56.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.790 [GMT 1:00]

Running from: F:\Documents and Settings\Bimbollo\Pulpit\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

F:\Documents and Settings\Bimbollo\Ulubione\Error Cleaner.url

F:\Documents and Settings\Bimbollo\Ulubione\Privacy Protector.url

F:\Documents and Settings\Bimbollo\Ulubione\SpywareMalware Protection.url

F:\Program Files\myglobalsearch

F:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL

F:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL

F:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL

F:\WINDOWS\privacy_danger

F:\WINDOWS\privacy_danger\images\capt.gif

F:\WINDOWS\privacy_danger\images\danger.jpg

F:\WINDOWS\privacy_danger\images\down.gif

F:\WINDOWS\privacy_danger\images\spacer.gif

F:\WINDOWS\privacy_danger\index.htm

F:\WINDOWS\rs.txt

F:\WINDOWS\system32\D.tmp

.

((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))

.

2008-03-15 23:50 . 2008-03-15 23:50

2008-03-15 23:50 . 2008-03-15 23:50

2008-03-15 23:50 . 2006-05-25 14:52 162,304 --a------ F:\WINDOWS\system32\ztvunrar36.dll

2008-03-15 23:50 . 2003-02-02 19:06 153,088 --a------ F:\WINDOWS\system32\UNRAR3.dll

2008-03-15 23:50 . 2005-08-26 00:50 77,312 --a------ F:\WINDOWS\system32\ztvunace26.dll

2008-03-15 23:50 . 2002-03-06 00:00 75,264 --a------ F:\WINDOWS\system32\unacev2.dll

2008-03-15 23:50 . 2006-06-19 12:01 69,632 --a------ F:\WINDOWS\system32\ztvcabinet.dll

2008-03-15 08:43 . 2008-03-15 08:43

2008-03-15 08:40 . 2008-03-15 08:43

2008-03-09 18:30 . 2008-03-12 18:26 54,156 --ah----- F:\WINDOWS\QTFont.qfn

2008-03-09 18:30 . 2008-03-09 18:30 1,409 --a------ F:\WINDOWS\QTFont.for

2008-03-07 18:24 . 2008-03-07 18:24

2008-02-25 14:32 . 2008-02-25 14:32 38 --a------ F:\WINDOWS\avisplitter.INI

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-15 23:25 33,610,784 --sha-w F:\WINDOWS\system32\drivers\fidbox.dat

2008-03-15 23:25 1,395,744 --sha-w F:\WINDOWS\system32\drivers\fidbox2.dat

2008-03-15 22:56 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab

2008-03-15 22:54 473,708 --sha-w F:\WINDOWS\system32\drivers\fidbox.idx

2008-03-15 22:54 143,120 --sha-w F:\WINDOWS\system32\drivers\fidbox2.idx

2008-03-15 11:21 --------- d-----w F:\Documents and Settings\Bimbollo\Dane aplikacji\wsInspector

2008-03-03 18:24 --------- d-----w F:\Documents and Settings\Bimbollo\Dane aplikacji\BearShare

2008-02-28 15:59 --------- d–h--w F:\Program Files\InstallShield Installation Information

2008-02-09 20:05 2,321,408 ----a-w F:\WINDOWS\system32\TUKernel.exe

2008-01-31 21:09 --------- d-----w F:\Documents and Settings\Bimbollo\Dane aplikacji\InstallShield

2008-01-31 17:27 91,700 ----a-w F:\WINDOWS\system32\drivers\klin.dat

2008-01-30 13:18 22,328 ----a-w F:\WINDOWS\system32\drivers\PnkBstrK.sys

2008-01-30 13:17 103,736 ----a-w F:\WINDOWS\system32\PnkBstrB.exe

2008-01-29 10:24 98,304 ----a-w F:\WINDOWS\system32\CmdLineExt.dll

2008-01-24 15:14 --------- d-----w F:\Program Files\K-Lite Codec Pack

2008-01-22 12:43 606,848 ----a-w F:\WINDOWS\flashax.exe

2008-01-22 12:43 194,560 ----a-w F:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E).scr

2008-01-22 12:43 12,288 ----a-w F:\WINDOWS\impborl.dll

2008-01-22 12:40 --------- d-----w F:\Program Files\ASUS

2008-01-19 10:57 --------- d-----w F:\Program Files\Common Files\Ahead

2008-01-19 10:49 --------- d-----w F:\Documents and Settings\Bimbollo\Dane aplikacji\Ahead

2008-01-18 13:48 --------- d-----w F:\Program Files\CyberLink

2007-12-24 12:49 7,680 ----a-w F:\WINDOWS\system32\ff_vfw.dll

2007-07-05 13:42 1 -c–a-w F:\Documents and Settings\Bimbollo\SI.bin

2007-01-19 18:52 65 -c–a-w F:\Program Files\Common Files\appop.log

2004-10-01 13:00 40,960 ----a-w F:\Program Files\Uninstall_CDS.exe

2006-05-06 16:42 7,260,160 -c–a-w F:\Program Files\mozilla firefox\plugins\libvlc.dll

2007-11-27 19:04 848 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CursorXP”=“F:\Program Files\CursorXP\CursorXP.exe” [2005-01-19 16:34 128000]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 08:39 2119104]

“MSMSGS”=“F:\Program Files\Messenger\msmsgs.exe” [2004-08-04 00:44 1667584]

“DAEMON Tools Pro Agent”=“C:\Program Files\DAEMON Tools Pro\DTProAgent.exe” [2007-09-06 14:08 136136]

“Picasa Media Detector”=“C:\Program Files\Picasa2\PicasaMediaDetector” []

“ctfmon.exe”=“F:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360]

“SysCleaner”=“F:\Program Files\SysCleaner\SysCleaner.exe” [2008-03-15 08:42 1282048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“iKeyWorks”=“F:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe” [2004-08-31 06:33 61440]

“WheelMouse”=“F:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [2004-08-31 19:28 192512]

“RTHDCPL”=“RTHDCPL.EXE” [2005-12-19 07:52 15797248 F:\WINDOWS\RTHDCPL.EXE]

“Alcmtr”=“ALCMTR.EXE” [2005-05-03 11:43 69632 F:\WINDOWS\ALCMTR.EXE]

“WINCINEMAMGR”=“F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe” [2005-01-21 02:47 270336]

“MULTIMEDIA KEYBOARD”=“F:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe” [2000-11-16 23:26 135168]

“MSF_Monitor”=“F:\PROGRA~1\MYSECR~1\MSFMON.exe” [2006-04-22 00:00 94208]

“SunJavaUpdateSched”=“F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11 132496]

“ATICCC”=“F:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2006-01-02 16:41 45056]

“iPlusManager”=“c:\iPlus Manager\iPlusChecker.exe” [2008-01-03 10:59 389120]

“@”="" []

“Sony Ericsson PC Suite”=“F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” [2005-10-26 15:17 159744]

“AVP”=“F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe” [2007-06-28 11:51 218376]

“WinampAgent”=“C:\Program Files\Winampek\winampa.exe” [2007-05-14 23:22 35328]

“PWRISOVM.EXE”=“c:\Program Files\PowerISO\PWRISOVM.EXE” [2007-08-07 01:05 200704]

“NeroFilterCheck”=“F:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50 155648]

“SBI”=“F:\Documents and Settings\Bimbollo\Pulpit\install_sbd_en.exe” []

“TrojanScanner”=“c:\Program Files\Trojan Remover\Trjscan.exe” [2008-03-14 16:24 873040]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“F:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 00:44 15360]

“Picasa Media Detector”=“C:\Program Files\Picasa2\PicasaMediaDetector.exe” [2007-09-28 02:17 443968]

F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 14:44:06 29696]

COMPANY_NAME WinCinema Manager.lnk - F:\Program Files\COMPANY_NAME\Common\Bin\WinCinemaMgr.exe [2007-01-19 19:49:51 229376]

InterVideo WinCinema Manager.lnk - F:\Program Files\COMPANY_NAME\Common\Bin\WinCinemaMgr.exe [2007-01-19 19:49:51 229376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

“DisableTaskMgr”= 1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

“NoLogOff”= 1

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

“AppInit_DLLs”=F:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusOverride”=dword:00000001

“FirewallOverride”=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

“DisableMonitoring”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“c:\Program Files\BitTorrent\bittorrent.exe”=

“C:\Giery\S.T.A.L.K.E.R\bin\XR_3DA.exe”=

“C:\Giery\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe”=

“F:\Program Files\Reality Pump\Earth 2160\Earth2160_NO_SSE.exe”=

“F:\Program Files\Reality Pump\Earth 2160\Earth2160_SSE.exe”=

“F:\Program Files\Messenger\msmsgs.exe”=

“C:\Program Files\Gadu-Gadu\gg.exe”=

“F:\Documents and Settings\Bimbollo\Ustawienia lokalne\Temp\ElectronicArts_Patcher_000.exe”=

“C:\Program Files\BearShare Applications\BearShare\BearShare.exe”=

“C:\Giery\Ghost Recon Advanced Warfighter\GRAW.exe”=

“E:\Giery\Knights’n’Merchants TPR\KM_TPR.exe”=

“C:\Giery\NN2BE\nwn2main.exe”=

“C:\Giery\NN2BE\nwn2main_amdxp.exe”=

“C:\Giery\NN2BE\nwupdate.exe”=

“C:\Giery\NN2BE\nwn2server.exe”=

“F:\Program Files\uTorrent\uTorrent.exe”=

“E:\Giery\Cod4\iw3mp.exe”=

“E:\Giery\nascar\NASCAR_Thunder_2004.exe”=

“E:\Giery\Settlers VI\base\bin\Settlers6.exe”=

“C:\Program Files\Sony Ericsson\Update Service\Update Service.exe”=

“E:\Giery\DoW\W40kWA.exe”=

“E:\Giery\DoW\W40k.exe”=

“E:\Giery\DK\Dawn of War - Dark Crusade\DarkCrusade.exe”=

“F:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe”=

“E:\Giery\cs\hl.exe”=

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

“13012:TCP”= 13012:TCP:BitComet 13012 TCP

“13012:UDP”= 13012:UDP:BitComet 13012 UDP

R0 ivicd;Ivi CDVD Filter Driver;F:\WINDOWS\system32\drivers\ivicd.sys [2005-01-12 06:29]

R1 msikbd2k;Multimedia Keyboard Filter Driver;F:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 15:18]

R2 MSF32;MSF32;F:\Program Files\MySecretFolder XP\MSF32.SYS [2006-04-22 00:00]

R2 nhksrv;Netropa NHK Server;F:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe [2000-09-13 16:18]

R2 UxTuneUp;TuneUp Design Expansion;F:\WINDOWS\System32\svchost.exe [2004-08-04 00:44]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;F:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 13:58]

R3 Video3D;ASUS Video3D Service;F:\WINDOWS\system32\Drivers\Video3D32.sys [2005-09-27 10:02]

S3 Amusbdev;A4Tech Wireless Desktop USB RF-Mouse filter driver;F:\WINDOWS\system32\DRIVERS\Amusbdev.sys [2004-08-25 10:09]

S3 ggflt;SEMC USB Flash Driver Filter;F:\WINDOWS\system32\DRIVERS\ggflt.sys [2007-11-13 20:49]

S3 iviudf;iviudf;F:\WINDOWS\system32\drivers\IviUdf.sys [2005-06-23 02:09]

S3 SEMWWNIC;Sony Ericsson SEMWWNIC;F:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-10-19 15:11]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{0d8df2e0-a55e-11dc-a234-94ff33404e23}]

\Shell\AutoRun\command - I:\CDCheck.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{17c1e7a4-abbe-11db-a775-abc1de3da736}]

\Shell\AutoRun\command - I:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{a5a35704-b9ba-11db-a7af-992ad7c6b02b}]

\Shell\AutoRun\command - EXPLORER.EXE

\Shell\explore\Command - EXPLORER.EXE

\Shell\open\Command - EXPLORER.EXE

.

Contents of the ‘Scheduled Tasks’ folder

“2008-02-15 17:22:23 F:\WINDOWS\Tasks\1-Click Maintenance.job”

  • C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-16 00:26:16

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SBI = F:\Documents and Settings\Bimbollo\Pulpit\install_sbd_en.exe???

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-03-16 0:27:14

ComboFix-quarantined-files.txt 2008-03-15 23:26:52

.

2008-02-14 17:24:45 — E O F —

#10

nie kasuj syscleanera,sfixowałeś te wpisy co podałem???

#11

no sfixowałem i co dalej??

#12

no i coś się poprawiło???występują nadal :

mam problem pewnego dnia pojawiły się u mnie na kompie dziwne programy Error Cleaner, Privacy Protector, Spyware&Malware Protection, SysCleaner

usuń syscleanera.

wrzuć loga z hijackthisa.

#13

Bimbollo ,

Odinstaluj SysCleaner. Combo usunął kilka szkodliwych plików :smiley:

Wklej do notatnika:

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableTaskMgr"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysCleaner"=-

Plik -> zapisz jako -> CFScript.txt

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

88953CFScript-createdbyMiekiemoes.gif

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum + nowy log z HijackThis. Logi daj na http://www.wklej.org :slight_smile:

Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie plik C: ** Qoobox**

#14

Logi z ComboFIX

http://www.wklej.org/id/a5187ca586

Logi Z HJ:

http://www.wklej.org/id/5f4b5e1ecc

#15

sfixuj:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Serial99.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\Program Files\WinSweep\ws.js

#16

Zrobiłeś?

#17

Już sfixowałem coś jeszcze???

#18

jest poprawa czy nie czy będziemy tak analizować co za śmieci masz na kompie…

#19

Już zrobiłem tamto i wyżuciłem to na C:\Qoobox czy jakoś tak

ale teraz nie działa mi GG!!

#20

a tak ogólnie to duża poprawa

:slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: