Problemy z internetem

Eyro · 15 Październik 2007 14:53

Krótko mówiąc strasznie wolno mi net chodzi ;/ przeskanowałem system programem Ad-aware wykryło 18 infekcji i usunąłem lecz nadal to samo ;( Jak by ktoś znalazł chwile to tu macie skan z HiJack This

Logfile of HijackThis v1.99.1 Scan saved at 16:40:22, on 2007-10-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\BearShare\BearShare.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe E:\Tibia80\Tibia.exe E:\TibiaBot NG\loader.exe E:\TibiaBot NG\loader.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Valve\sXe Injected\sXe Injected.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\Rar$EX00.860\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 1/1561.321 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay O4 - HKLM…\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [DriverCD] F:\Run.exe O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKCU…\Run: [HEXelon MAX] “C:\DOCUME~1\PAWE~1\USTAWI~1\Temp\Rar$EX00.891\HEXelonMAX6\hexelon.exe” /auto O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip…{06CF8D56-510F-42EA-ACA3-AB7F391F8C4E}: NameServer = 194.204.152.34 O17 - HKLM\System\CCS\Services\Tcpip…{677AC819-2613-4FFF-9D85-B0EA20A37850}: NameServer = 194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{06CF8D56-510F-42EA-ACA3-AB7F391F8C4E}: NameServer = 194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{06CF8D56-510F-42EA-ACA3-AB7F391F8C4E}: NameServer = 194.204.152.34 O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Gutek · 15 Październik 2007 15:08

możesz usunąć wpisy HJT

Daj log z ComboFix

Eyro · 15 Październik 2007 15:21

ComboFix 07-10-12.4 - Pawe 2007-10-15 17:19:24.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.638 [GMT 2:00] Running from: C:\Documents and Settings\Pawe\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-15 to 2007-10-15 ))))))))))))))))))))))))))))))) . 2007-10-15 17:11 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-15 14:19 2007-10-15 14:19 2007-10-15 14:18 2007-10-12 17:20 2007-10-02 15:44 2007-09-19 22:10 2007-09-18 17:47 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2007-09-18 17:46 2,097,152 C:\Documents and Settings\Paweł\NTUSER.DAT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-15 15:09 --------- d—a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-14 10:46 --------- d-----w C:\Program Files\FlashGet 2007-10-13 19:29 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Hamachi 2007-10-13 19:29 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Hamachi 2007-10-11 18:02 --------- d-----w C:\Program Files\Tibia 2007-10-11 06:22 --------- d-----w C:\Program Files\Tibia Auto 2007-10-06 19:45 --------- d-----w C:\Program Files\Valve 2007-09-30 10:01 25,544 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-19 20:49 3,145,728 —ha-w C:\Documents and Settings\Gość\ntuser.dat 2007-09-08 07:15 --------- d-----w C:\Program Files\Gadu-Gadu 2007-08-26 10:38 --------- d-----w C:\Program Files\Electronic Arts 2007-08-26 10:37 --------- d-----w C:\Program Files\Asprate 2007-08-26 09:31 --------- d-----w C:\Program Files\QuickTime 2007-08-26 09:30 --------- d-----w C:\Program Files\Apple Software Update 2007-08-26 09:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-08-26 09:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-08-25 11:12 --------- d-----w C:\Program Files\CCP 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-15 12:29 --------- d-----w C:\Program Files\Java 2007-08-04 12:00 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-08-04 12:00 249,856 ----a-w C:\WINDOWS\Setup1.exe 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-28 06:54 7,998 ----a-w C:\WINDOWS\system32\ealregsnapshot1.reg . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2006-01-02 18:41] “KAVPersonal50”=“C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe” [2004-08-03 12:33] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 21:24] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 12:50] “DriverCD”=“F:\Run.exe” [] “RTHDCPL”=“RTHDCPL.EXE” [2006-05-27 04:47 C:\WINDOWS\RTHDCPL.exe] “SkyTel”=“SkyTel.EXE” [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [2007-07-12 04:00] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] “Flashget”=“C:\Program Files\FlashGet\flashget.exe” [2007-06-29 13:44] “BearShare”=“C:\Program Files\BearShare\BearShare.exe” [2006-02-14 17:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-01-30 16:58] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\ hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-06-12 16:59:25] R1 Klmc;Klmc;C:\WINDOWS\system32\drivers\klmc.sys S3 cdrmkaun;cdrmkaun;??\C:\DOCUME~1\Admin\USTAWI~1\Temp\cdrmkaun.sys S3 ddsxeiservice;ddsxeiservice;??\D:\Valve\sXe Injected\ddsxei.sys S3 gdrv;gdrv;??\C:\WINDOWS\gdrv.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys *Newly Created Service* - CATCHME . Contents of the ‘Scheduled Tasks’ folder “2007-10-13 14:53:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-15 17:20:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 2396 ************************************************************************** . Completion time: 2007-10-15 17:21:05 . — E O F —

Gutek · 15 Październik 2007 15:27

Nic nie widzę

Eyro · 15 Październik 2007 15:31

Narazie net mi śmiga normalnie po tym jak usunąłem to co powiedziałeś