Proszę o sprawdzenie loga - reklamy, dziwne procesy

arekmalek · 28 Maj 2007 16:36

Logfile of HijackThis v1.99.1 Scan saved at 18:31:19, on 2007-05-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AusLogics Visual Styler\themehelpersvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\CursorXP\CursorXP.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\UberIcon\UberIcon Manager.exe C:\TapetA\Tapeta.exe C:\Program Files\Tlen.pl\tlen.exe C:\DOCUME~1\1\USTAWI~1\Temp\Katalog tymczasowy 3 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ig R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:4001 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {359DE360-39C7-4E1C-947B-DDD36032CB21} - C:\WINDOWS\system32\dhnjrlnl.dll (file missing) O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\whtgvlyw.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {8F2FFE41-94F3-4C76-BB20-68C8429B969D} - C:\WINDOWS\system32\ssqrr.dll O2 - BHO: (no name) - {905C6866-82AB-AB78-DB7F-88ADAECD77C1} - C:\WINDOWS\system32\kdj.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {AE735435-5F6C-4C18-9462-73F5C93BB4Bb} - C:\WINDOWS\system32\dhnjrlnl.dll (file missing) O2 - BHO: (no name) - {EC25E570-EE3D-4887-B7A9-D7729CB88D98} - C:\WINDOWS\system32\ssqrr.dll O2 - BHO: (no name) - {F2DFF0DC-2389-437B-AC81-88C0F9505918} - C:\WINDOWS\system32\dhnjrlnl.dll (file missing) O2 - BHO: (no name) - {F36CCFBD-8FAA-4872-8576-15C88BC7B319} - C:\WINDOWS\system32\ssqnkkl.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM…\Run: [skrót do strony właściwości High Definition Audio] HDAudPropShortcut.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [setup] rundll32.exe “C:\WINDOWS\system32\xllsmcxq.dll”,realset O4 - HKCU…\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU…\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” O4 - HKCU…\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [uberIcon] “C:\Program Files\UberIcon\UberIcon Manager.exe” O4 - HKCU…\Run: [TapetA] C:\TapetA\Tapeta.exe O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [iNTERNATIONAL] International* O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: ssqnkkl - C:\WINDOWS\SYSTEM32\ssqnkkl.dll O20 - Winlogon Notify: ssqrr - C:\WINDOWS\system32\ssqrr.dll O20 - Winlogon Notify: wineij32 - C:\WINDOWS\SYSTEM32\wineij32.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AusLogics Windows Themes Helper (ALThemeHelper) - Unknown owner - C:\Program Files\AusLogics Visual Styler\themehelpersvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Gutek · 28 Maj 2007 16:43

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Daj log z Combofix

arekmalek · 28 Maj 2007 17:10

“1” - 2007-05-28 19:03:10 Dodatek Service Pack 2 ComboFix 07-05.27.V - Running from: “C:\Documents and Settings\1\Pulpit” (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\cfrspyen.dll C:\WINDOWS\system32\fayedvql.dll C:\WINDOWS\system32\iryyruuc.dll C:\WINDOWS\system32\whtgvlyw.dll C:\WINDOWS\system32\wtmigihk.dll C:\WINDOWS\system32\xllsmcxq.dll C:\WINDOWS\system32\wineij32.dll C:\WINDOWS\system32\qxcmsllx.ini C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\rrqss.ini C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\rrqss.tmp C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\rrqss.ini C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\rrqss.tmp * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) “C:\WINDOWS\system32\wnsapicc32.exe” “C:\Program Files\outerinfo\Terms.rtf” “C:\WINDOWS\system32\vbzip11.dll” “C:\Program Files\outerinfo” Purity Folders: C:\WINDOWS\system32\SMBOLS~1 ((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-28 )))))))))))))))))))))))))))))))))) 2007-05-27 18:34 206 --a------ C:\WINDOWS\g23243578.exe 2007-05-27 18:14 206 --a------ C:\WINDOWS\g22047671.exe 2007-05-27 17:54 206 --a------ C:\WINDOWS\g20833500.exe 2007-05-27 17:32 206 --a------ C:\WINDOWS\g19513296.exe 2007-05-27 17:09 206 --a------ C:\WINDOWS\g18189093.exe 2007-05-27 16:49 206 --a------ C:\WINDOWS\g16987546.exe 2007-05-27 16:28 206 --a------ C:\WINDOWS\g15720546.exe 2007-05-27 13:23 2007-05-27 12:35 206 --a------ C:\WINDOWS\g1712218.exe 2007-05-27 12:17 2007-05-27 12:17 2007-05-27 12:16 1,048,576 --ah----- C:\DOCUME~1\GRY\NTUSER.DAT 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:10 2007-05-26 21:12 2007-05-26 21:11 206 --a------ C:\WINDOWS\g5454656.exe 2007-05-26 20:39 206 --a------ C:\WINDOWS\g3489500.exe 2007-05-26 19:12 53,760 --------- C:\WINDOWS\system32\wintems.exe 2007-05-26 19:12 2007-05-26 11:06 2007-05-24 18:19 2007-05-24 18:18 93,956 --a------ C:\WINDOWS\system32\flec003.exe 2007-05-24 18:18 93,956 --------- C:\WINDOWS\system32\hldrrr.exe 2007-05-23 06:57 2007-05-20 14:27 2007-05-19 08:12 262,708 --ahs---- C:\WINDOWS\system32\ssqrr.dll.vir 2007-05-19 08:05 29,206 --a------ C:\WINDOWS\system32\ssqnkkl.dll.vir 2007-05-18 20:59 2007-05-18 18:30 2007-05-17 16:08 245,760 --------- C:\WINDOWS\system32\DECO_32.DLL 2007-05-17 16:08 2007-05-16 19:30 92,208 --------- C:\WINDOWS\system32\WING.DLL 2007-05-16 19:30 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-05-16 19:30 188,960 --------- C:\WINDOWS\system32\WINGDE.DLL 2007-05-16 19:30 12,800 --------- C:\WINDOWS\system32\WING32.DLL 2007-05-16 19:30 2007-05-14 20:03 2007-05-14 13:41 32,910 -ra------ C:\WINDOWS\system32\drivers\ser120.sys 2007-05-11 19:48 2007-05-09 12:06 2007-05-09 10:06 2007-05-06 09:19 2007-05-06 09:15 2007-05-06 09:10 2007-05-06 09:05 2007-05-06 08:53 2007-05-05 10:02 2007-05-04 13:00 2,252,672 --a------ C:\WINDOWS\system32\ntoskvs1.exe 2007-05-04 12:55 2007-05-04 12:55 2007-05-04 12:49 2007-05-03 17:25 2007-05-02 14:19 2007-05-01 15:22 2007-05-01 15:14 2007-05-01 14:49 2007-04-29 16:40 2007-04-29 16:23 2007-04-28 10:19 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-28 09:04:39 -------- d-----w C:\Program Files\IrfanView 2007-05-28 09:03:48 -------- d-----w C:\Program Files\Google 2007-05-28 08:34:28 -------- d-----w C:\Program Files\Sunbelt Software 2007-05-27 10:10:39 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-24 11:40:26 -------- d-----w C:\Program Files\ProxyWay 2007-05-21 07:04:28 2,596 ----a-w C:\WINDOWS\unins000.dat 2007-05-19 06:20:02 -------- d-----w C:\Program Files\Movie Maker 2007-05-15 12:15:16 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-06 07:03:01 2,552 ----a-w C:\WINDOWS\unins001.dat 2007-05-01 07:56:00 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Tlen.pl 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-28 15:13:39 -------- d-----w C:\Program Files\San Andreas Mod Installer 2007-04-27 13:31:50 75,008 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-27 13:31:50 499,128 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-26 17:06:35 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Ahead 2007-04-25 16:20:18 -------- d-----w C:\Program Files\3D Formula 1 Screensaver 2007-04-20 10:14:04 -------- d-----w C:\DOCUME~1\1\DANEAP~1\IrfanView 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 15:25:11 -------- d-----w C:\Program Files\Microsoft Works 2007-04-17 15:24:31 -------- d-----w C:\Program Files\MSBuild 2007-04-17 10:59:16 -------- d-----w C:\Program Files\Paragon Software 2007-04-17 10:50:17 -------- d-----w C:\Program Files\kswiat 2007-04-16 09:54:51 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-04-15 15:11:58 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-15 13:22:17 -------- d-----w C:\Program Files\PITy 2007-04-15 10:52:36 -------- d-----w C:\Program Files\CursorXP 2007-04-15 08:11:24 7,370,752 ----a-w C:\WINDOWS\system32\logonuiX.exe 2007-04-14 16:09:44 573 ----a-w C:\WINDOWS\eReg.dat 2007-04-14 14:36:50 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-04-14 14:34:38 -------- d-----w C:\Program Files\WinCustomize 2007-04-14 14:34:04 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Help 2007-04-14 14:30:14 -------- d-----w C:\Program Files\Yahoo! 2007-04-14 08:18:43 -------- d-----w C:\Program Files\VS Online 2007-04-13 17:44:05 235,008 ----a-w C:\WINDOWS\BS-ZOLL.SCR 2007-04-13 17:43:47 235,008 ----a-w C:\WINDOWS\BS-PASS.SCR 2007-04-13 13:20:10 -------- d-----w C:\Program Files\Tlen.pl 2007-04-12 13:58:31 -------- d-----w C:\Program Files\Messenger 2007-04-12 13:57:47 -------- d-----w C:\Program Files\xp-AntiSpy 2007-04-12 07:26:15 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Google 2007-04-10 17:29:52 1,212 ----a-w C:\WINDOWS\mozver.dat 2007-04-10 16:01:19 -------- d-----w C:\Program Files\VID_0C12&PID_0005 2007-04-10 14:45:26 -------- d-----w C:\Program Files\EA SPORTS 2007-04-10 14:32:27 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-10 13:15:26 -------- d-----w C:\Program Files\Ahead 2007-04-10 13:14:40 -------- d-----w C:\Program Files\Common Files\Ahead 2007-04-10 12:52:32 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Lavasoft 2007-04-10 12:51:06 -------- d-----w C:\Program Files\Lavasoft 2007-04-10 12:34:15 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-10 12:34:12 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-10 12:01:53 -------- d-----w C:\Program Files\Alwil Software 2007-04-10 12:01:01 -------- d-----w C:\Program Files\7-Zip 2007-04-10 11:48:59 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-10 11:30:02 -------- d-----w C:\Program Files\jv16 PowerTools 2005 2007-04-10 11:04:31 -------- d-----w C:\Program Files\ASUS 2007-04-10 10:57:00 -------- d-----w C:\Program Files\Realtek 2007-04-10 10:54:37 -------- d-----w C:\Program Files\Intel 2007-04-10 10:46:13 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-10 10:45:47 0 --sha-r C:\MSDOS.SYS 2007-04-10 10:45:47 0 --sha-r C:\IO.SYS 2007-04-10 10:45:47 0 ----a-w C:\CONFIG.SYS 2007-04-10 10:45:47 0 ----a-w C:\AUTOEXEC.BAT 2007-04-10 10:44:17 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-10 10:44:13 -------- d-----w C:\Program Files\Usługi online 2007-04-10 10:43:13 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-10 10:42:03 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-10 10:41:29 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-10 10:41:17 -------- d-----w C:\Program Files\Windows NT 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 00:17] {359DE360-39C7-4E1C-947B-DDD36032CB21}=C:\WINDOWS\system32\dhnjrlnl.dll [] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 00:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {905C6866-82AB-AB78-DB7F-88ADAECD77C1}=C:\WINDOWS\system32\kdj.dll [] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-01-19 23:55] {AE735435-5F6C-4C18-9462-73F5C93BB4Bb}=C:\WINDOWS\system32\dhnjrlnl.dll [] {F2DFF0DC-2389-437B-AC81-88C0F9505918}=C:\WINDOWS\system32\dhnjrlnl.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skrót do strony właściwości High Definition Audio”=“HDAudPropShortcut.exe” [2004-08-12 17:45 C:\WINDOWS\system32\Hdaudpropshortcut.exe] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “SoundMan”=“SOUNDMAN.EXE” [] “AlcWzrd”=“ALCWZRD.EXE” [] “Alcmtr”=“ALCMTR.EXE” [] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [] “NBJ”=“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” [2004-09-22 15:10] “CursorXP”=“C:\Program Files\CursorXP\CursorXP.exe” [2005-01-19 17:34] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe” [2007-04-10 16:17] “UberIcon”=“C:\Program Files\UberIcon\UberIcon Manager.exe” [2006-07-17 23:16] “TapetA”=“C:\TapetA\Tapeta.exe” [2005-09-08 12:03] “hldrrr”=“C:\WINDOWS\system32\hldrrr.exe” [2007-10-27 05:10] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [2006-10-27 00:48] SafeBoot registry key needs to be repaired. This machine cannot enter Safe Mode. [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{5b614695-ed06-11db-9463-0011d8a3dd63}] Auto\command- RavMonE.exe e AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{f9fd2b22-e787-11db-9444-0011d8a3dd63}] AutoRun\command- G:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe *Newly Created Service* -PROCEXP90 Contents of the ‘Scheduled Tasks’ folder 2007-04-10 13:09:35 C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-28 19:06:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-28 19:07:37 C:\ComboFix-quarantined-files.txt … 2007-05-28 19:07 — E O F —

Złączono Posta : 28.05.2007 (Pon) 18:11

“1” - 2007-05-28 19:03:10 Dodatek Service Pack 2 ComboFix 07-05.27.V - Running from: “C:\Documents and Settings\1\Pulpit” (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\cfrspyen.dll C:\WINDOWS\system32\fayedvql.dll C:\WINDOWS\system32\iryyruuc.dll C:\WINDOWS\system32\whtgvlyw.dll C:\WINDOWS\system32\wtmigihk.dll C:\WINDOWS\system32\xllsmcxq.dll C:\WINDOWS\system32\wineij32.dll C:\WINDOWS\system32\qxcmsllx.ini C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\rrqss.ini C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\rrqss.tmp C:\WINDOWS\system32\rrqss.bak1 C:\WINDOWS\system32\rrqss.bak2 C:\WINDOWS\system32\rrqss.ini C:\WINDOWS\system32\rrqss.ini2 C:\WINDOWS\system32\rrqss.tmp * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) “C:\WINDOWS\system32\wnsapicc32.exe” “C:\Program Files\outerinfo\Terms.rtf” “C:\WINDOWS\system32\vbzip11.dll” “C:\Program Files\outerinfo” Purity Folders: C:\WINDOWS\system32\SMBOLS~1 ((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-28 )))))))))))))))))))))))))))))))))) 2007-05-27 18:34 206 --a------ C:\WINDOWS\g23243578.exe 2007-05-27 18:14 206 --a------ C:\WINDOWS\g22047671.exe 2007-05-27 17:54 206 --a------ C:\WINDOWS\g20833500.exe 2007-05-27 17:32 206 --a------ C:\WINDOWS\g19513296.exe 2007-05-27 17:09 206 --a------ C:\WINDOWS\g18189093.exe 2007-05-27 16:49 206 --a------ C:\WINDOWS\g16987546.exe 2007-05-27 16:28 206 --a------ C:\WINDOWS\g15720546.exe 2007-05-27 13:23 2007-05-27 12:35 206 --a------ C:\WINDOWS\g1712218.exe 2007-05-27 12:17 2007-05-27 12:17 2007-05-27 12:16 1,048,576 --ah----- C:\DOCUME~1\GRY\NTUSER.DAT 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:16 2007-05-27 12:10 2007-05-26 21:12 2007-05-26 21:11 206 --a------ C:\WINDOWS\g5454656.exe 2007-05-26 20:39 206 --a------ C:\WINDOWS\g3489500.exe 2007-05-26 19:12 53,760 --------- C:\WINDOWS\system32\wintems.exe 2007-05-26 19:12 2007-05-26 11:06 2007-05-24 18:19 2007-05-24 18:18 93,956 --a------ C:\WINDOWS\system32\flec003.exe 2007-05-24 18:18 93,956 --------- C:\WINDOWS\system32\hldrrr.exe 2007-05-23 06:57 2007-05-20 14:27 2007-05-19 08:12 262,708 --ahs---- C:\WINDOWS\system32\ssqrr.dll.vir 2007-05-19 08:05 29,206 --a------ C:\WINDOWS\system32\ssqnkkl.dll.vir 2007-05-18 20:59 2007-05-18 18:30 2007-05-17 16:08 245,760 --------- C:\WINDOWS\system32\DECO_32.DLL 2007-05-17 16:08 2007-05-16 19:30 92,208 --------- C:\WINDOWS\system32\WING.DLL 2007-05-16 19:30 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-05-16 19:30 188,960 --------- C:\WINDOWS\system32\WINGDE.DLL 2007-05-16 19:30 12,800 --------- C:\WINDOWS\system32\WING32.DLL 2007-05-16 19:30 2007-05-14 20:03 2007-05-14 13:41 32,910 -ra------ C:\WINDOWS\system32\drivers\ser120.sys 2007-05-11 19:48 2007-05-09 12:06 2007-05-09 10:06 2007-05-06 09:19 2007-05-06 09:15 2007-05-06 09:10 2007-05-06 09:05 2007-05-06 08:53 2007-05-05 10:02 2007-05-04 13:00 2,252,672 --a------ C:\WINDOWS\system32\ntoskvs1.exe 2007-05-04 12:55 2007-05-04 12:55 2007-05-04 12:49 2007-05-03 17:25 2007-05-02 14:19 2007-05-01 15:22 2007-05-01 15:14 2007-05-01 14:49 2007-04-29 16:40 2007-04-29 16:23 2007-04-28 10:19 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-28 09:04:39 -------- d-----w C:\Program Files\IrfanView 2007-05-28 09:03:48 -------- d-----w C:\Program Files\Google 2007-05-28 08:34:28 -------- d-----w C:\Program Files\Sunbelt Software 2007-05-27 10:10:39 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-24 11:40:26 -------- d-----w C:\Program Files\ProxyWay 2007-05-21 07:04:28 2,596 ----a-w C:\WINDOWS\unins000.dat 2007-05-19 06:20:02 -------- d-----w C:\Program Files\Movie Maker 2007-05-15 12:15:16 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-06 07:03:01 2,552 ----a-w C:\WINDOWS\unins001.dat 2007-05-01 07:56:00 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Tlen.pl 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-28 15:13:39 -------- d-----w C:\Program Files\San Andreas Mod Installer 2007-04-27 13:31:50 75,008 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-27 13:31:50 499,128 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-26 17:06:35 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Ahead 2007-04-25 16:20:18 -------- d-----w C:\Program Files\3D Formula 1 Screensaver 2007-04-20 10:14:04 -------- d-----w C:\DOCUME~1\1\DANEAP~1\IrfanView 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 15:25:11 -------- d-----w C:\Program Files\Microsoft Works 2007-04-17 15:24:31 -------- d-----w C:\Program Files\MSBuild 2007-04-17 10:59:16 -------- d-----w C:\Program Files\Paragon Software 2007-04-17 10:50:17 -------- d-----w C:\Program Files\kswiat 2007-04-16 09:54:51 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-04-15 15:11:58 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-15 13:22:17 -------- d-----w C:\Program Files\PITy 2007-04-15 10:52:36 -------- d-----w C:\Program Files\CursorXP 2007-04-15 08:11:24 7,370,752 ----a-w C:\WINDOWS\system32\logonuiX.exe 2007-04-14 16:09:44 573 ----a-w C:\WINDOWS\eReg.dat 2007-04-14 14:36:50 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-04-14 14:34:38 -------- d-----w C:\Program Files\WinCustomize 2007-04-14 14:34:04 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Help 2007-04-14 14:30:14 -------- d-----w C:\Program Files\Yahoo! 2007-04-14 08:18:43 -------- d-----w C:\Program Files\VS Online 2007-04-13 17:44:05 235,008 ----a-w C:\WINDOWS\BS-ZOLL.SCR 2007-04-13 17:43:47 235,008 ----a-w C:\WINDOWS\BS-PASS.SCR 2007-04-13 13:20:10 -------- d-----w C:\Program Files\Tlen.pl 2007-04-12 13:58:31 -------- d-----w C:\Program Files\Messenger 2007-04-12 13:57:47 -------- d-----w C:\Program Files\xp-AntiSpy 2007-04-12 07:26:15 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Google 2007-04-10 17:29:52 1,212 ----a-w C:\WINDOWS\mozver.dat 2007-04-10 16:01:19 -------- d-----w C:\Program Files\VID_0C12&PID_0005 2007-04-10 14:45:26 -------- d-----w C:\Program Files\EA SPORTS 2007-04-10 14:32:27 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-10 13:15:26 -------- d-----w C:\Program Files\Ahead 2007-04-10 13:14:40 -------- d-----w C:\Program Files\Common Files\Ahead 2007-04-10 12:52:32 -------- d-----w C:\DOCUME~1\1\DANEAP~1\Lavasoft 2007-04-10 12:51:06 -------- d-----w C:\Program Files\Lavasoft 2007-04-10 12:34:15 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-10 12:34:12 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-10 12:01:53 -------- d-----w C:\Program Files\Alwil Software 2007-04-10 12:01:01 -------- d-----w C:\Program Files\7-Zip 2007-04-10 11:48:59 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-10 11:30:02 -------- d-----w C:\Program Files\jv16 PowerTools 2005 2007-04-10 11:04:31 -------- d-----w C:\Program Files\ASUS 2007-04-10 10:57:00 -------- d-----w C:\Program Files\Realtek 2007-04-10 10:54:37 -------- d-----w C:\Program Files\Intel 2007-04-10 10:46:13 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-10 10:45:47 0 --sha-r C:\MSDOS.SYS 2007-04-10 10:45:47 0 --sha-r C:\IO.SYS 2007-04-10 10:45:47 0 ----a-w C:\CONFIG.SYS 2007-04-10 10:45:47 0 ----a-w C:\AUTOEXEC.BAT 2007-04-10 10:44:17 -------- d–h--w C:\Program Files\WindowsUpdate 2007-04-10 10:44:13 -------- d-----w C:\Program Files\Usługi online 2007-04-10 10:43:13 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-10 10:42:03 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-10 10:41:29 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-04-10 10:41:17 -------- d-----w C:\Program Files\Windows NT 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 00:17] {359DE360-39C7-4E1C-947B-DDD36032CB21}=C:\WINDOWS\system32\dhnjrlnl.dll [] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 00:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {905C6866-82AB-AB78-DB7F-88ADAECD77C1}=C:\WINDOWS\system32\kdj.dll [] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-01-19 23:55] {AE735435-5F6C-4C18-9462-73F5C93BB4Bb}=C:\WINDOWS\system32\dhnjrlnl.dll [] {F2DFF0DC-2389-437B-AC81-88C0F9505918}=C:\WINDOWS\system32\dhnjrlnl.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skrót do strony właściwości High Definition Audio”=“HDAudPropShortcut.exe” [2004-08-12 17:45 C:\WINDOWS\system32\Hdaudpropshortcut.exe] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “SoundMan”=“SOUNDMAN.EXE” [] “AlcWzrd”=“ALCWZRD.EXE” [] “Alcmtr”=“ALCMTR.EXE” [] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe” [] “NBJ”=“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” [2004-09-22 15:10] “CursorXP”=“C:\Program Files\CursorXP\CursorXP.exe” [2005-01-19 17:34] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe” [2007-04-10 16:17] “UberIcon”=“C:\Program Files\UberIcon\UberIcon Manager.exe” [2006-07-17 23:16] “TapetA”=“C:\TapetA\Tapeta.exe” [2005-09-08 12:03] “hldrrr”=“C:\WINDOWS\system32\hldrrr.exe” [2007-10-27 05:10] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [2006-10-27 00:48] SafeBoot registry key needs to be repaired. This machine cannot enter Safe Mode. [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{5b614695-ed06-11db-9463-0011d8a3dd63}] Auto\command- RavMonE.exe e AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{f9fd2b22-e787-11db-9444-0011d8a3dd63}] AutoRun\command- G:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe *Newly Created Service* -PROCEXP90 Contents of the ‘Scheduled Tasks’ folder 2007-04-10 13:09:35 C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-28 19:06:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-28 19:07:37 C:\ComboFix-quarantined-files.txt … 2007-05-28 19:07 — E O F —

Gutek · 28 Maj 2007 18:21

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po tym nowy log z Combo