Prosze o sptrawdzenie logow

[yello]

Od kilku dni pojawia mi sie komunikat generowany przez ESET NOD32:

2009-12-28 23:18:33 HTTP filter file [dkcs.void.ru/viaide.exe] a variant of Win32/Injector.AMO trojan connection terminated - quarantined ZARZĄDZANIE NT\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\svchost.exe.

Logi z ComboFixa

http://www.wklej.org/id/249454/

Logi z Hijacka

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 23:12:31, on 2009-12-28

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\MagicTune Premium\MagicTuneEngine.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\DAP\DAP.EXE

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\MagicTune Premium\MagicTune.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [go.microsoft.com/fwlink/?LinkId=69157]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [go.microsoft.com/fwlink/?LinkId=54896]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [go.microsoft.com/fwlink/?LinkId=54896]

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = [toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q]=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=%s]

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM…\Run: [Zone Labs Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”

O4 - HKLM…\Run: [egui] “C:\Program Files\ESET\ESET Smart Security\egui.exe” /hide /waitservice

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [DownloadAccelerator] “C:\Program Files\DAP\DAP.EXE” /STARTUP

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - [http]

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - [http]

O17 - HKLM\System\CCS\Services\Tcpip…{B90EC6DB-7A47-4953-8981-2837A7FEBE63}: NameServer = 208.67.222.222,208.67.220.220

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–

End of file - 5916 bytes

[Gutek]

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny. Zmiana zasad wklejania logów.

Pozdrawiam Gutek

Wklej do Notatnika:

File:: c:\windows\Internet Logs\xDB53.tmp c:\windows\Internet Logs\xDB50.tmp c:\windows\Internet Logs\xDB51.tmp c:\windows\Internet Logs\xDB4F.tmp c:\windows\Internet Logs\xDB4E.tmp c:\windows\Internet Logs\xDB52.tmp c:\windows\Internet Logs\xDB4C.tmp c:\windows\Internet Logs\xDB4B.tmp c:\windows\Internet Logs\xDB54.tmp c:\windows\Internet Logs\xDB4D.tmp C:\documents and settings\yello\Dane aplikacji\iplac:\windows\Internet Logs\xDB49.tmp c:\windows\Internet Logs\xDB4A.tmp c:\windows\Internet Logs\xDB48.tmp c:\windows\Internet Logs\xDB47.tmp c:\windows\Internet Logs\xDB46.tmp c:\windows\Internet Logs\xDB45.tmp c:\windows\Internet Logs\xDB43.tmp c:\windows\Internet Logs\xDB42.tmp c:\windows\Internet Logs\xDB44.tmp c:\windows\Internet Logs\xDB41.tmp c:\windows\Internet Logs\xDB3F.tmp c:\windows\Internet Logs\xDB3E.tmp c:\windows\Internet Logs\xDB40.tmp c:\windows\Internet Logs\xDB3D.tmp c:\windows\Internet Logs\xDB3C.tmp c:\windows\Internet Logs\xDB3B.tmp c:\windows\system32\CmdLineExt.dll c:\windows\Internet Logs\xDB3A.tmp c:\windows\Internet Logs\xDB39.tmp c:\windows\Internet Logs\xDB38.tmp c:\windows\Internet Logs\xDB36.tmp c:\windows\Internet Logs\xDB37.tmp c:\windows\Internet Logs\xDB34.tmp c:\windows\Internet Logs\xDB35.tmp c:\windows\Internet Logs\xDB33.tmp c:\windows\Internet Logs\xDB32.tmp c:\program files\a648be4f.tmp Folder:: c:\program files\AskSearch

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.