Trojan Adclicker - jak się pozbyć

raak07 · 20 Grudzień 2007 00:04

przesyłam loga

ComboFix 07-12-19.2 - Kazik 2007-12-20 0:51:56.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.209 [GMT 1:00] Running from: D:\plyty_CDRW\cdrw_1\logi\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 ))))))))))))))))))))))))))))))) . 2007-12-13 08:33 . 2007-12-13 08:33 32,768 --a------ C:\WINDOWS\system32\routing.exe 2007-12-09 12:29 . 2007-12-09 12:29 2007-12-08 22:28 . 2007-12-08 22:28 2007-12-07 17:41 . 2007-12-07 17:41 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-06 16:05 . 2007-12-06 16:05 2007-12-02 19:54 . 2007-12-02 19:54 2007-12-02 19:54 . 2007-12-02 21:16 48 --a------ C:\WINDOWS\wpd99.drv 2007-12-02 19:54 . 2007-12-02 19:54 28 --a------ C:\WINDOWS\pdf995.ini 2007-12-02 19:52 . 2007-12-02 19:57 2007-12-02 19:52 . 2007-12-02 21:16 2007-12-02 19:52 . 2007-12-02 19:52 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-12-02 19:52 . 2007-12-02 19:52 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-11-29 12:34 . 2007-11-29 12:34 2007-11-29 10:28 . 2007-12-13 08:33 249,856 --a------ C:\WINDOWS\system32\ndt2.sys 2007-11-28 23:45 . 2007-11-19 14:02 983,040 --a------ C:\WINDOWS\PowerISO.exe 2007-11-28 17:51 . 2007-11-29 08:54 431 --a------ C:\WINDOWS\ao97pr.ini 2007-11-28 17:49 . 2007-11-29 12:37 956 --a------ C:\WINDOWS\ao2000pr.ini 2007-11-28 17:44 . 2007-11-28 17:49 2007-11-26 23:09 . 2007-11-26 23:09 2007-11-26 22:21 . 1998-11-13 13:10 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:10 . 2007-11-26 22:10 2007-11-25 14:32 . 2007-11-25 14:33 2007-11-25 14:32 . 2007-11-25 14:32 2007-11-25 14:32 . 2007-11-25 14:32 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-19 23:47 --------- d-----w C:\Program Files\Symantec AntiVirus 2007-12-19 22:45 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Skype 2007-12-19 17:24 --------- d-----w C:\Program Files\X Plugin Manager 2007-12-02 21:36 --------- d-----w C:\Program Files\Creative 2007-12-02 21:26 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-30 18:19 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Tlen.pl 2007-11-26 22:11 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Winamp 2007-11-26 21:23 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-26 21:10 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-11-04 15:55 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Moje pliki zapisu Bitwy o Śródziemie 2007-11-04 08:53 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\AdobeUM 2007-11-02 10:24 --------- d-----w C:\Program Files\Bit Lord 1.1 2007-10-30 19:17 --------- d-----w C:\Program Files\DivXCodec 2007-10-29 17:56 --------- d-----w C:\Program Files\XviD 2007-10-29 17:56 --------- d-----w C:\Program Files\DivX 2007-10-29 16:16 --------- d-----w C:\Program Files\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2007-10-29 16:04 --------- d-----w C:\Program Files\MPlayer 2007-10-29 13:23 --------- d-----w C:\Program Files\Winamp 2007-10-27 19:53 --------- d-----w C:\Program Files\EA GAMES 2007-10-25 17:59 --------- d-----w C:\Program Files\X3 map by Scorp 2007-10-25 16:43 --------- d-----w C:\Program Files\DeepSilver 2007-10-25 16:37 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Gadu-Gadu 2007-10-25 16:36 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-25 16:21 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2007-10-25 16:21 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-25 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd3117.sys 2007-10-25 16:19 643,072 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-25 08:40 --------- d-----w C:\Program Files\Skype 2007-10-25 08:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-10-25 08:39 --------- d-----w C:\Program Files\Common Files\Skype 2007-10-25 08:35 --------- d-----w C:\Program Files\Tlen.pl 2007-10-25 08:23 --------- d-----w C:\Program Files\Common Files\Macromedia 2007-10-25 08:21 --------- d-----w C:\Program Files\Macromedia 2007-10-25 07:58 --------- d-----w C:\Program Files\Common Files\Nero 2007-10-25 07:56 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-25 07:56 --------- d-----w C:\Program Files\Ahead 2007-10-25 07:51 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-25 07:50 --------- d-----w C:\Program Files\Symantec 2007-10-25 07:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-10-25 07:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-10-25 07:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-25 07:21 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2005-12-10 02:06 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2004-02-29 15:44] “vptray”=“C:\PROGRA~1\SYMANT~1\VPTray.exe” [2004-03-12 14:18] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-12-10 15:57] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “CorelDRAW Graphics Suite 11b”=“C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe” [2004-06-23 00:20] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] C:\Documents and Settings\Kazik\Menu Start\Programy\Autostart\ WinMySQLadmin.lnk - E:\usr\mysql\bin\winmysqladmin.exe [2007-07-30 11:07:21] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Monitor Apache Servers.lnk - E:\usr\Apache2\bin\ApacheMonitor.exe [2004-03-18 10:15:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2003-10-31 19:42 32768 --a------ C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] CTHELPER.EXE R2 perfmons;perfmons Service;C:\WINDOWS\system32\perfs.exe [2001-10-26 20:27] R2 Routing;Routing Service;C:\WINDOWS\system32\routing.exe [2007-12-13 08:33] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-20 00:53:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] “ImagePath”=“E:/usr/mysql/bin/mysqld-nt.exe” . Completion time: 2007-12-20 0:53:58 =================================================================== Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:08:32, on 2007-12-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe E:\usr\Apache2\bin\Apache.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe E:\usr\mysql\bin\mysqld-nt.exe E:\usr\Apache2\bin\Apache.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\perfs.exe C:\WINDOWS\system32\routing.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe E:\usr\Apache2\bin\ApacheMonitor.exe C:\WINDOWS\system32\devldr32.exe E:\usr\mysql\bin\winmysqladmin.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 82.98.86.177 wizvsaustin.com O1 - Hosts: 82.98.86.163 tabang.net O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM…\Run: [iSUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start O4 - HKLM…\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe /title=“CorelDRAW Graphics Suite 12” /date=122607 serial=dR12WRS-8796594-FHE lang=PL O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Startup: WinMySQLadmin.lnk = E:\usr\mysql\bin\winmysqladmin.exe O4 - Global Startup: Monitor Apache Servers.lnk = E:\usr\Apache2\bin\ApacheMonitor.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows … 4268544328 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/ … 586-jc.cab O17 - HKLM\System\CCS\Services\Tcpip…{247362BF-DA36-4E82-9D05-E166C27032EB}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip…{247362BF-DA36-4E82-9D05-E166C27032EB}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip…{247362BF-DA36-4E82-9D05-E166C27032EB}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apache2 - Apache Software Foundation - E:\usr\Apache2\bin\Apache.exe O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: MySql - Unknown owner - E:/usr/mysql/bin/mysqld-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe – End of file - 7690 bytes

już raz miałem ten problem - zrobiłem w/g instrukcji, ale bez rezultatu

proszę o pomoc

pozdrawiam

bez_pseudonimu · 20 Grudzień 2007 17:18

O1 - Hosts: 82.98.86.177 wizvsaustin.com

Gutek · 20 Grudzień 2007 21:01

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

raak07 · 20 Grudzień 2007 22:28

dziękuję

oto log

ComboFix 07-12-19.2 - Kazik 2007-12-20 23:17:31.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.279 [GMT 1:00] Running from: D:\plyty_CDRW\cdrw_1\logi\ComboFix.exe Command switches used :: D:\plyty_CDRW\cdrw_1\logi\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\perfs.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\perfs.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_PERFMONS -------\perfmons ((((((((((((((((((((((((( Files Created from 2007-11-20 to 2007-12-20 ))))))))))))))))))))))))))))))) . 2007-12-20 12:01 . 2007-12-20 12:01 45,056 --a------ C:\WINDOWS\system32\Indt2.sys 2007-12-13 08:33 . 2007-12-13 08:33 32,768 --a------ C:\WINDOWS\system32\routing.exe 2007-12-09 12:29 . 2007-12-09 12:29 2007-12-08 22:28 . 2007-12-08 22:28 2007-12-07 17:41 . 2007-12-07 17:41 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-06 16:05 . 2007-12-06 16:05 2007-12-02 19:54 . 2007-12-02 19:54 2007-12-02 19:54 . 2007-12-02 21:16 48 --a------ C:\WINDOWS\wpd99.drv 2007-12-02 19:54 . 2007-12-02 19:54 28 --a------ C:\WINDOWS\pdf995.ini 2007-12-02 19:52 . 2007-12-02 19:57 2007-12-02 19:52 . 2007-12-02 21:16 2007-12-02 19:52 . 2007-12-02 19:52 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-12-02 19:52 . 2007-12-02 19:52 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-11-29 12:34 . 2007-11-29 12:34 2007-11-29 10:28 . 2007-12-13 08:33 249,856 --a------ C:\WINDOWS\system32\ndt2.sys 2007-11-28 23:45 . 2007-11-19 14:02 983,040 --a------ C:\WINDOWS\PowerISO.exe 2007-11-28 17:51 . 2007-11-29 08:54 431 --a------ C:\WINDOWS\ao97pr.ini 2007-11-28 17:49 . 2007-11-29 12:37 956 --a------ C:\WINDOWS\ao2000pr.ini 2007-11-28 17:44 . 2007-11-28 17:49 2007-11-26 23:09 . 2007-11-26 23:09 2007-11-26 22:21 . 1998-11-13 13:10 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:10 . 2007-11-26 22:10 2007-11-25 14:32 . 2007-11-25 14:33 2007-11-25 14:32 . 2007-11-25 14:32 2007-11-25 14:32 . 2007-11-25 14:32 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-20 22:19 --------- d-----w C:\Program Files\Symantec AntiVirus 2007-12-20 17:36 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Skype 2007-12-19 17:24 --------- d-----w C:\Program Files\X Plugin Manager 2007-12-02 21:36 --------- d-----w C:\Program Files\Creative 2007-12-02 21:26 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-30 18:19 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Tlen.pl 2007-11-26 22:11 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Winamp 2007-11-26 21:23 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-26 21:10 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-11-04 15:55 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Moje pliki zapisu Bitwy o Śródziemie 2007-11-04 08:53 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\AdobeUM 2007-11-02 10:24 --------- d-----w C:\Program Files\Bit Lord 1.1 2007-10-30 19:17 --------- d-----w C:\Program Files\DivXCodec 2007-10-29 17:56 --------- d-----w C:\Program Files\XviD 2007-10-29 17:56 --------- d-----w C:\Program Files\DivX 2007-10-29 16:16 --------- d-----w C:\Program Files\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2007-10-29 16:04 --------- d-----w C:\Program Files\MPlayer 2007-10-29 13:23 --------- d-----w C:\Program Files\Winamp 2007-10-27 19:53 --------- d-----w C:\Program Files\EA GAMES 2007-10-25 17:59 --------- d-----w C:\Program Files\X3 map by Scorp 2007-10-25 16:43 --------- d-----w C:\Program Files\DeepSilver 2007-10-25 16:37 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Gadu-Gadu 2007-10-25 16:36 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-25 16:21 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2007-10-25 16:21 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-25 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd3117.sys 2007-10-25 16:19 643,072 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-25 08:40 --------- d-----w C:\Program Files\Skype 2007-10-25 08:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-10-25 08:39 --------- d-----w C:\Program Files\Common Files\Skype 2007-10-25 08:35 --------- d-----w C:\Program Files\Tlen.pl 2007-10-25 08:23 --------- d-----w C:\Program Files\Common Files\Macromedia 2007-10-25 08:21 --------- d-----w C:\Program Files\Macromedia 2007-10-25 07:58 --------- d-----w C:\Program Files\Common Files\Nero 2007-10-25 07:56 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-25 07:56 --------- d-----w C:\Program Files\Ahead 2007-10-25 07:51 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-25 07:50 --------- d-----w C:\Program Files\Symantec 2007-10-25 07:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-10-25 07:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-10-25 07:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-25 07:21 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2005-12-10 02:06 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2004-02-29 15:44] “vptray”=“C:\PROGRA~1\SYMANT~1\VPTray.exe” [2004-03-12 14:18] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-12-10 15:57] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “CorelDRAW Graphics Suite 11b”=“C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe” [2004-06-23 00:20] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] C:\Documents and Settings\Kazik\Menu Start\Programy\Autostart\ WinMySQLadmin.lnk - E:\usr\mysql\bin\winmysqladmin.exe [2007-07-30 11:07:21] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Monitor Apache Servers.lnk - E:\usr\Apache2\bin\ApacheMonitor.exe [2004-03-18 10:15:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2003-10-31 19:42 32768 --a------ C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] CTHELPER.EXE . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-20 23:21:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] “ImagePath”=“E:/usr/mysql/bin/mysqld-nt.exe” . Completion time: 2007-12-20 23:22:39 - machine was rebooted

Gutek · 21 Grudzień 2007 23:16

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Pobierz program SDFix

raak07 · 22 Grudzień 2007 10:54

dziękuję

SDFix: Version 1.119 Run by Kazik on 2007-12-22 at 11:31 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-22 11:36:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s0”=dword:f0154d82 “s1”=dword:90d4df60 “s2”=dword:c57de973 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“C:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:67,95,12,16,22,a7,ad,46,80,f3,90,71,b4,76,bc,89,45,58,7c,c1,88,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,70,15,55,4f,f1,61,0b,e9,38,2c,e3,28,e4,17,85,3f,e6,… “khjeh”=hex:84,ec,85,c6,23,4d,f9,89,be,92,75,3f,6c,41,95,98,85,83,c6,47,13,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:94,5d,c7,1f,85,c8,ac,6d,cb,b5,2f,dc,55,3d,3b,93,27,37,1a,9d,4b,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] “khjeh”=hex:ba,a6,02,f0,4c,8e,25,72,b7,e5,fa,12,11,b0,74,0b,72,41,1f,9c,0f,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “p0”=“C:\Program Files\DAEMON Tools” “h0”=dword:00000000 “khjeh”=hex:67,95,12,16,22,a7,ad,46,80,f3,90,71,b4,76,bc,89,45,58,7c,c1,88,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,70,15,55,4f,f1,61,0b,e9,38,2c,e3,28,e4,17,85,3f,e6,… “khjeh”=hex:84,ec,85,c6,23,4d,f9,89,be,92,75,3f,6c,41,95,98,85,83,c6,47,13,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:94,5d,c7,1f,85,c8,ac,6d,cb,b5,2f,dc,55,3d,3b,93,27,37,1a,9d,4b,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] “khjeh”=hex:ba,a6,02,f0,4c,8e,25,72,b7,e5,fa,12,11,b0,74,0b,72,41,1f,9c,0f,… scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Sat 10 Nov 2007 4,348 …SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Sat 10 Nov 2007 4,348 …H. — “C:\Documents and Settings\Kazik\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak” Fri 7 Dec 2007 20 A…H. — “C:\Documents and Settings\Kazik\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak” Sat 10 Nov 2007 9,655 A.SH. — “C:\Documents and Settings\Kazik\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak” Finished!

Gutek · 22 Grudzień 2007 21:31

Daj jeszcze raz log z Combo

raak07 · 22 Grudzień 2007 23:42

dziękuję za zainteresowanie

muszę tu wspomnieć iż czasami zostaje zerwane płączenie z Internetem - brak komunikatu

to log z Combo

ComboFix 07-12-19.2 - Kazik 2007-12-23 0:24:08.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.179 [GMT 1:00] Running from: D:\plyty_CDRW\cdrw_1\logi\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 ))))))))))))))))))))))))))))))) . 2007-12-22 22:48 . 2007-12-22 22:48 45,056 --a------ C:\WINDOWS\system32\Indt2.sys 2007-12-22 22:48 . 2007-12-22 22:48 32,768 --a------ C:\WINDOWS\system32\tmpxp_12789130527.bk 2007-12-22 11:31 . 2007-12-22 11:31 2007-12-22 11:18 . 2007-12-22 11:18 32,768 --a------ C:\WINDOWS\system32\tmpxp_246257342572.bk 2007-12-21 23:07 . 2007-12-21 23:07 32,768 --a------ C:\WINDOWS\system32\tmpxp_202958700063.bk 2007-12-21 11:37 . 2007-12-21 11:37 32,768 --a------ C:\WINDOWS\system32\tmpxp_63650485876.bk 2007-12-13 08:33 . 2007-12-13 08:33 32,768 --a------ C:\WINDOWS\system32\routing.exe 2007-12-09 12:29 . 2007-12-09 12:29 2007-12-08 22:28 . 2007-12-22 20:52 2007-12-07 17:41 . 2007-12-07 17:41 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-06 16:05 . 2007-12-06 16:05 2007-12-02 19:54 . 2007-12-02 19:54 2007-12-02 19:54 . 2007-12-02 21:16 48 --a------ C:\WINDOWS\wpd99.drv 2007-12-02 19:54 . 2007-12-02 19:54 28 --a------ C:\WINDOWS\pdf995.ini 2007-12-02 19:52 . 2007-12-02 19:57 2007-12-02 19:52 . 2007-12-02 21:16 2007-12-02 19:52 . 2007-12-02 19:52 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-12-02 19:52 . 2007-12-02 19:52 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-11-29 12:34 . 2007-11-29 12:34 2007-11-29 10:28 . 2007-12-13 08:33 249,856 --a------ C:\WINDOWS\system32\ndt2.sys 2007-11-28 23:45 . 2007-11-19 14:02 983,040 --a------ C:\WINDOWS\PowerISO.exe 2007-11-28 17:51 . 2007-11-29 08:54 431 --a------ C:\WINDOWS\ao97pr.ini 2007-11-28 17:49 . 2007-11-29 12:37 956 --a------ C:\WINDOWS\ao2000pr.ini 2007-11-28 17:44 . 2007-11-28 17:49 2007-11-26 23:09 . 2007-11-26 23:09 2007-11-26 22:21 . 1998-11-13 13:10 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:10 . 2007-11-26 22:10 2007-11-25 14:32 . 2007-11-25 14:33 2007-11-25 14:32 . 2007-11-25 14:32 2007-11-25 14:32 . 2007-11-25 14:32 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-22 20:12 --------- d-----w C:\Program Files\Symantec AntiVirus 2007-12-22 18:30 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Skype 2007-12-19 17:24 --------- d-----w C:\Program Files\X Plugin Manager 2007-12-02 21:36 --------- d-----w C:\Program Files\Creative 2007-12-02 21:26 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-30 18:19 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Tlen.pl 2007-11-26 22:11 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Winamp 2007-11-26 21:23 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-26 21:10 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-11-04 15:55 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Moje pliki zapisu Bitwy o Śródziemie 2007-11-04 08:53 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\AdobeUM 2007-11-02 10:24 --------- d-----w C:\Program Files\Bit Lord 1.1 2007-10-30 19:17 --------- d-----w C:\Program Files\DivXCodec 2007-10-29 17:56 --------- d-----w C:\Program Files\XviD 2007-10-29 17:56 --------- d-----w C:\Program Files\DivX 2007-10-29 16:16 --------- d-----w C:\Program Files\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2007-10-29 16:04 --------- d-----w C:\Program Files\MPlayer 2007-10-29 13:23 --------- d-----w C:\Program Files\Winamp 2007-10-27 19:53 --------- d-----w C:\Program Files\EA GAMES 2007-10-25 17:59 --------- d-----w C:\Program Files\X3 map by Scorp 2007-10-25 16:43 --------- d-----w C:\Program Files\DeepSilver 2007-10-25 16:37 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Gadu-Gadu 2007-10-25 16:36 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-25 16:21 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2007-10-25 16:21 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-25 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd3117.sys 2007-10-25 16:19 643,072 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-25 08:40 --------- d-----w C:\Program Files\Skype 2007-10-25 08:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-10-25 08:39 --------- d-----w C:\Program Files\Common Files\Skype 2007-10-25 08:35 --------- d-----w C:\Program Files\Tlen.pl 2007-10-25 08:23 --------- d-----w C:\Program Files\Common Files\Macromedia 2007-10-25 08:21 --------- d-----w C:\Program Files\Macromedia 2007-10-25 07:58 --------- d-----w C:\Program Files\Common Files\Nero 2007-10-25 07:56 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-25 07:56 --------- d-----w C:\Program Files\Ahead 2007-10-25 07:51 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-25 07:50 --------- d-----w C:\Program Files\Symantec 2007-10-25 07:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-10-25 07:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-10-25 07:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-25 07:21 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2005-12-10 02:06 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2004-02-29 15:44] “vptray”=“C:\PROGRA~1\SYMANT~1\VPTray.exe” [2004-03-12 14:18] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-12-10 15:57] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “CorelDRAW Graphics Suite 11b”=“C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe” [2004-06-23 00:20] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] C:\Documents and Settings\Kazik\Menu Start\Programy\Autostart\ WinMySQLadmin.lnk - E:\usr\mysql\bin\winmysqladmin.exe [2007-07-30 11:07:21] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Monitor Apache Servers.lnk - E:\usr\Apache2\bin\ApacheMonitor.exe [2004-03-18 10:15:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2003-10-31 19:42 32768 --a------ C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] CTHELPER.EXE R2 Routing;Routing Service;C:\WINDOWS\system32\routing.exe [2007-12-13 08:33] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-23 00:25:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] “ImagePath”=“E:/usr/mysql/bin/mysqld-nt.exe” . Completion time: 2007-12-23 0:26:18 C:\ComboFix2.txt … 2007-12-22 11:24 C:\ComboFix3.txt … 2007-12-20 23:22

Gutek · 23 Grudzień 2007 00:22

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

raak07 · 23 Grudzień 2007 09:52

podziwiam Twoją determinację w walce z tym paskudztwem

nowy log

pozdrawiam

P.S.

Wesołych Świąt

ComboFix 07-12-19.2 - Kazik 2007-12-23 10:33:13.9 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.181 [GMT 1:00] Running from: D:\plyty_CDRW\cdrw_1\logi\ComboFix.exe Command switches used :: D:\plyty_CDRW\cdrw_1\logi\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\Indt2.sys C:\WINDOWS\system32\ndt2.sys . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\Indt2.sys C:\WINDOWS\system32\ndt2.sys . ((((((((((((((((((((((((( Files Created from 2007-11-23 to 2007-12-23 ))))))))))))))))))))))))))))))) . 2007-12-22 22:48 . 2007-12-22 22:48 32,768 --a------ C:\WINDOWS\system32\tmpxp_12789130527.bk 2007-12-22 11:31 . 2007-12-22 11:31 2007-12-22 11:18 . 2007-12-22 11:18 32,768 --a------ C:\WINDOWS\system32\tmpxp_246257342572.bk 2007-12-21 23:07 . 2007-12-21 23:07 32,768 --a------ C:\WINDOWS\system32\tmpxp_202958700063.bk 2007-12-21 11:37 . 2007-12-21 11:37 32,768 --a------ C:\WINDOWS\system32\tmpxp_63650485876.bk 2007-12-13 08:33 . 2007-12-13 08:33 32,768 --a------ C:\WINDOWS\system32\routing.exe 2007-12-09 12:29 . 2007-12-09 12:29 2007-12-08 22:28 . 2007-12-22 20:52 2007-12-07 17:41 . 2007-12-07 17:41 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-12-06 16:07 2007-12-06 16:07 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-12-06 16:05 . 2007-12-06 16:05 2007-12-02 19:54 . 2007-12-02 19:54 2007-12-02 19:54 . 2007-12-02 21:16 48 --a------ C:\WINDOWS\wpd99.drv 2007-12-02 19:54 . 2007-12-02 19:54 28 --a------ C:\WINDOWS\pdf995.ini 2007-12-02 19:52 . 2007-12-02 19:57 2007-12-02 19:52 . 2007-12-02 21:16 2007-12-02 19:52 . 2007-12-02 19:52 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-12-02 19:52 . 2007-12-02 19:52 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-11-29 12:34 . 2007-11-29 12:34 2007-11-28 23:45 . 2007-11-19 14:02 983,040 --a------ C:\WINDOWS\PowerISO.exe 2007-11-28 17:51 . 2007-11-29 08:54 431 --a------ C:\WINDOWS\ao97pr.ini 2007-11-28 17:49 . 2007-11-29 12:37 956 --a------ C:\WINDOWS\ao2000pr.ini 2007-11-28 17:44 . 2007-11-28 17:49 2007-11-26 23:09 . 2007-11-26 23:09 2007-11-26 22:21 . 1998-11-13 13:10 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:11 . 2007-11-26 22:11 2007-11-26 22:10 . 2007-11-26 22:10 2007-11-25 14:32 . 2007-11-25 14:33 2007-11-25 14:32 . 2007-11-25 14:32 2007-11-25 14:32 . 2007-11-25 14:32 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-23 09:18 --------- d-----w C:\Program Files\Symantec AntiVirus 2007-12-22 18:30 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Skype 2007-12-19 17:24 --------- d-----w C:\Program Files\X Plugin Manager 2007-12-02 21:36 --------- d-----w C:\Program Files\Creative 2007-12-02 21:26 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-30 18:19 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Tlen.pl 2007-11-26 22:11 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Winamp 2007-11-26 21:23 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-26 21:10 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-11-04 15:55 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Moje pliki zapisu Bitwy o Śródziemie 2007-11-04 08:53 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\AdobeUM 2007-11-02 10:24 --------- d-----w C:\Program Files\Bit Lord 1.1 2007-10-30 19:17 --------- d-----w C:\Program Files\DivXCodec 2007-10-29 17:56 --------- d-----w C:\Program Files\XviD 2007-10-29 17:56 --------- d-----w C:\Program Files\DivX 2007-10-29 16:16 --------- d-----w C:\Program Files\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\CyberLink 2007-10-29 16:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2007-10-29 16:04 --------- d-----w C:\Program Files\MPlayer 2007-10-29 13:23 --------- d-----w C:\Program Files\Winamp 2007-10-27 19:53 --------- d-----w C:\Program Files\EA GAMES 2007-10-25 17:59 --------- d-----w C:\Program Files\X3 map by Scorp 2007-10-25 16:43 --------- d-----w C:\Program Files\DeepSilver 2007-10-25 16:37 --------- d-----w C:\Documents and Settings\Kazik\Dane aplikacji\Gadu-Gadu 2007-10-25 16:36 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-25 16:21 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2007-10-25 16:21 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-25 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd3117.sys 2007-10-25 16:19 643,072 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-25 08:40 --------- d-----w C:\Program Files\Skype 2007-10-25 08:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-10-25 08:39 --------- d-----w C:\Program Files\Common Files\Skype 2007-10-25 08:35 --------- d-----w C:\Program Files\Tlen.pl 2007-10-25 08:23 --------- d-----w C:\Program Files\Common Files\Macromedia 2007-10-25 08:21 --------- d-----w C:\Program Files\Macromedia 2007-10-25 07:58 --------- d-----w C:\Program Files\Common Files\Nero 2007-10-25 07:56 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-25 07:56 --------- d-----w C:\Program Files\Ahead 2007-10-25 07:51 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-25 07:50 --------- d-----w C:\Program Files\Symantec 2007-10-25 07:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-10-25 07:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-10-25 07:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-25 07:21 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2005-12-10 02:06 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2004-02-29 15:44] “vptray”=“C:\PROGRA~1\SYMANT~1\VPTray.exe” [2004-03-12 14:18] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-12-10 15:57] “ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe” [2004-06-16 06:03] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2004-06-16 06:03] “CorelDRAW Graphics Suite 11b”=“C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe” [2004-06-23 00:20] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] C:\Documents and Settings\Kazik\Menu Start\Programy\Autostart\ WinMySQLadmin.lnk - E:\usr\mysql\bin\winmysqladmin.exe [2007-07-30 11:07:21] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Monitor Apache Servers.lnk - E:\usr\Apache2\bin\ApacheMonitor.exe [2004-03-18 10:15:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2003-10-31 19:42 32768 --a------ C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch] CTHELPER.EXE R2 Routing;Routing Service;C:\WINDOWS\system32\routing.exe [2007-12-13 08:33] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-23 10:34:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] “ImagePath”=“E:/usr/mysql/bin/mysqld-nt.exe” . Completion time: 2007-12-23 10:35:34 C:\ComboFix2.txt … 2007-12-23 00:26 C:\ComboFix3.txt … 2007-12-22 11:24

Gutek · 23 Grudzień 2007 11:33

C:\WINDOWS\system32\routing.exe - przeskanuj plik na http://virusscan.jotti.org/

raak07 · 23 Grudzień 2007 13:04

cześć

przeskanowałem

pozdrawiam

Gutek · 23 Grudzień 2007 14:51

No to Ok

raak07 · 23 Grudzień 2007 21:04

Dziękuje