Trojan... log z HJT i ComboFixa

madzieela · 10 Sierpień 2007 21:04

wczoraj nod32 wykrył mi trojany(które się mnozą) i parę infekcji…

proszę o pomoc…

log z HJT

Logfile of HijackThis v1.99.1 Scan saved at 22:42, on 2007-08-09 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\WinFast\WFDTV\DTVSchdl.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe C:\WINDOWS\System32\wuauclt.exe C:\DOCUME~1\z\USTAWI~1\Temp\winlogon.exe C:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Editor plugin - {16B7CC90-058C-4e94-A697-609BE6EEEC9A} - madjaro.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [CorelDRAW ESSENTIALS14] C:\Program Files\Corel\CorelDRAW ESSENTIALS 2\Register\Registration.exe /title=“CorelDRAW ESSENTIALS” /date=081107 serial=ES02WBD-0090061-FBU O4 - HKLM…\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe O4 - HKLM…\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Program files\gg\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Firewall auto setup] C:\DOCUME~1\z\USTAWI~1\Temp\winlogon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Action Manager 32.lnk = C:\Program Files\ScannerU\AM32.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Program files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Program files\FlashGet\jc_all.htm O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe O14 - IERESET.INF: START_PAGE_URL=http://www.encyklopedia.pl/ O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - E:\Program files\ares\chatServer.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

log z combofixa:

“z” - 2007-08-09 22:42:31 Dodatek Service Pack. 1 ComboFix 07-06-3B - Running from: “C:\Documents and Settings\z\Pulpit\Nieuľywane skr˘ty pulpitu” ((((((((((((((((((((((((( Files Created from 2007-07-09 to 2007-08-09 ))))))))))))))))))))))))))))))) 2007-08-09 22:37 58,989 --a------ C:\WINDOWS\system32\0x000.exe 2007-08-09 22:37 46,931 --a------ C:\WINDOWS\system32\0x008.exe 2007-07-29 12:13 2007-07-21 09:39 2007-07-21 09:39 2007-07-21 09:39 2007-07-21 09:39 2007-07-21 09:03 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-07-21 09:03 270,336 --a------ C:\WINDOWS\system32\imon.dll 2007-07-14 21:27 2007-07-14 21:27 2007-07-14 21:27 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2060-08-18 17:02:22 1,496,064 ------w C:\WINDOWS\system32\CC3250MT.DLL 2060-08-18 16:40:44 909,824 ------w C:\WINDOWS\system32\cp3245mt.dll 2060-08-18 16:40:44 24,064 ------w C:\WINDOWS\system32\borlndmm.dll 2007-07-08 14:56:08 201,912 ----a-w C:\DOCUME~1\z\DANEAP~1\GDIPFONTCACHEV1.DAT 2007-07-06 09:39:10 2,508 ----a-w C:\WINDOWS\system32\tmp.reg 2007-06-14 17:45:32 -------- d-----w C:\Program Files\MyGlobalSearch 2007-06-13 16:24:04 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2007-06-13 16:21:24 90,240 ----a-w C:\WINDOWS\system32\drivers\sptd4045.sys 2007-06-13 16:21:24 642,560 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-05-30 19:23:56 1,156 ----a-w C:\WINDOWS\mozver.dat 2007-05-30 19:18:58 0 ----a-w C:\WINDOWS\nsreg.dat 2007-05-22 16:23:06 79,408 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-22 16:23:06 458,022 ----a-w C:\WINDOWS\system32\perfh015.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 18:39] {16B7CC90-058C-4e94-A697-609BE6EEEC9A}=madjaro.dll [] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}=C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-06-08 15:22] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=E:\PROGRA~1\FlashGet\jccatch.dll [2006-05-16 15:19] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar1.dll [2007-06-01 21:38] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2007-07-15 21:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “nwiz”=“nwiz.exe” [2004-02-04 13:37 C:\WINDOWS\system32\nwiz.exe] “RemoteControl”=“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2003-12-08 17:35] “CorelDRAW ESSENTIALS14”=“C:\Program Files\Corel\CorelDRAW ESSENTIALS 2\Register\Registration.exe” [2003-07-21 15:17] “WinFastDTV”=“C:\Program Files\WinFast\WFDTV\DTVSchdl.exe” [2005-07-15 16:59] “WinFast Schedule”=“C:\Program Files\WinFast\WFTVFM\WFWIZ.exe” [2005-09-30 09:18] “SoundMan”=“SOUNDMAN.EXE” [2006-08-03 05:12 C:\WINDOWS\soundman.exe] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-07-21 09:02] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-20 18:05] “PowerBar”="" [] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-15 21:44] “Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” [] “Gadu-Gadu”=“E:\Program files\gg\Gadu-Gadu\gg.exe” [2007-05-10 16:36] “Firewall auto setup”=“C:\DOCUME~1\z\USTAWI~1\Temp\winlogon.exe” [2007-08-09 22:37] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* Contents of the ‘Scheduled Tasks’ folder 2007-07-14 19:27:36 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

qrczak13 · 10 Sierpień 2007 23:05

Ściągnij The Avenger,

wypakuj > uruchom > Input script manually > klikasz w lupkę > w nowo otwartym oknie wklejasz:

Po wklejeniu > Done > klik na zielone światło > ok i będzie restart. Po restarcie wchodzisz gdzie masz The Avenger wklejasz raport avenger.txt

Nowy log z combo daj zrobieniu w/w.

madzieela · 11 Sierpień 2007 14:00

niestety po naciśnięciu zielonego światełka wystąpił błąd…

Kuba11 · 11 Sierpień 2007 14:16

Pokaż nowe logi.

madzieela · 11 Sierpień 2007 14:37

mogą dać nowe logi ale po co jak AKCJA się nie udała…???

Kuba11 · 11 Sierpień 2007 14:40

Jak taki mądry jesteś to po co przychodzisz po pomoc?

Nie raz była już taka sytuacja(nawet chyba dzisiaj), że występowały błędy a pliki i tak były usuwane.

madzieela · 11 Sierpień 2007 14:42

ok przepraszam…

“mądra” jestem dziewczyną… ale szczegół

HJT:

Logfile of HijackThis v1.99.1 Scan saved at 16:34, on 2007-08-11 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\WinFast\WFDTV\DTVSchdl.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Documents and Settings\z\Ustawienia lokalne\Temp\winlogon.exe C:\WINDOWS\System32\wuauclt.exe C:\ComboFix\28256.cfexe C:\WINDOWS\explorer.exe C:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Editor plugin - {16B7CC90-058C-4e94-A697-609BE6EEEC9A} - madjaro.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [CorelDRAW ESSENTIALS14] C:\Program Files\Corel\CorelDRAW ESSENTIALS 2\Register\Registration.exe /title=“CorelDRAW ESSENTIALS” /date=082607 serial=ES02WBD-0090061-FBU O4 - HKLM…\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe O4 - HKLM…\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [00PCTFW] “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU…\Run: [Gadu-Gadu] “E:\Program files\gg\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Firewall auto setup] C:\Documents and Settings\z\Ustawienia lokalne\Temp\winlogon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Action Manager 32.lnk = C:\Program Files\ScannerU\AM32.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet’a - E:\Program files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet’a - E:\Program files\FlashGet\jc_all.htm O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\flashget.exe O14 - IERESET.INF: START_PAGE_URL=http://www.encyklopedia.pl/ O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - E:\Program files\ares\chatServer.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

CF:

“z” - 2007-08-11 16:32:15 Dodatek Service Pack. 1 ComboFix 07-06-3B - Running from: “C:\Documents and Settings\z\Pulpit\Nieuľywane skr˘ty pulpitu” ((((((((((((((((((((((((( Files Created from 2007-07-11 to 2007-08-11 ))))))))))))))))))))))))))))))) 2007-08-11 15:57 2007-08-10 23:24 2007-08-10 23:21 55,904 --a------ C:\WINDOWS\system32\drivers\pctfw.sys 2007-08-10 23:21 100,448 --a------ C:\WINDOWS\system32\drivers\pctfw1.sys 2007-08-10 23:21 2007-08-10 14:12 2007-08-09 22:37 58,989 --a------ C:\WINDOWS\system32\0x000.exe 2007-08-09 22:37 46,931 --a------ C:\WINDOWS\system32\0x008.exe 2007-07-29 12:13 2007-07-21 09:39 2007-07-21 09:39 2007-07-21 09:39 2007-07-21 09:39 2007-07-21 09:03 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-07-21 09:03 270,336 --a------ C:\WINDOWS\system32\imon.dll 2007-07-14 21:27 2007-07-14 21:27 2007-07-14 21:27 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2060-08-18 17:02:22 1,496,064 ------w C:\WINDOWS\system32\CC3250MT.DLL 2060-08-18 16:40:44 909,824 ------w C:\WINDOWS\system32\cp3245mt.dll 2060-08-18 16:40:44 24,064 ------w C:\WINDOWS\system32\borlndmm.dll 2007-07-08 14:56:08 201,912 ----a-w C:\DOCUME~1\z\DANEAP~1\GDIPFONTCACHEV1.DAT 2007-07-06 09:39:10 2,508 ----a-w C:\WINDOWS\system32\tmp.reg 2007-06-14 17:45:32 -------- d-----w C:\Program Files\MyGlobalSearch 2007-06-13 16:24:04 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2007-06-13 16:21:24 90,240 ----a-w C:\WINDOWS\system32\drivers\sptd4045.sys 2007-06-13 16:21:24 642,560 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-05-30 19:23:56 1,156 ----a-w C:\WINDOWS\mozver.dat 2007-05-30 19:18:58 0 ----a-w C:\WINDOWS\nsreg.dat 2007-05-22 16:23:06 79,408 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-22 16:23:06 458,022 ----a-w C:\WINDOWS\system32\perfh015.dat ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 18:39] {16B7CC90-058C-4e94-A697-609BE6EEEC9A}=madjaro.dll [] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}=C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-06-08 15:22] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=E:\PROGRA~1\FlashGet\jccatch.dll [2006-05-16 15:19] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar1.dll [2007-06-01 21:38] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2007-07-15 21:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “nwiz”=“nwiz.exe” [2004-02-04 13:37 C:\WINDOWS\system32\nwiz.exe] “RemoteControl”=“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2003-12-08 17:35] “CorelDRAW ESSENTIALS14”=“C:\Program Files\Corel\CorelDRAW ESSENTIALS 2\Register\Registration.exe” [2003-07-21 15:17] “WinFastDTV”=“C:\Program Files\WinFast\WFDTV\DTVSchdl.exe” [2005-07-15 16:59] “WinFast Schedule”=“C:\Program Files\WinFast\WFTVFM\WFWIZ.exe” [2005-09-30 09:18] “SoundMan”=“SOUNDMAN.EXE” [2006-08-03 05:12 C:\WINDOWS\soundman.exe] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22] “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2007-06-29 06:24] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-07-21 09:02] “00PCTFW”=“C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” [2007-04-28 08:13] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-20 18:05] “PowerBar”="" [] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-15 21:44] “Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” [] “Gadu-Gadu”=“E:\Program files\gg\Gadu-Gadu\gg.exe” [2007-05-10 16:36] “Firewall auto setup”=“C:\Documents and Settings\z\Ustawienia lokalne\Temp\winlogon.exe” [2007-08-09 22:37] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* Contents of the ‘Scheduled Tasks’ folder 2007-07-14 19:27:36 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Kuba11 · 11 Sierpień 2007 14:44

ComboFix jest urwany wklej cały na http://www.wklej.org a tutaj daj tylko link.

madzieela · 11 Sierpień 2007 14:48

http://www.wklej.org/id/acfcb67149

chyba tak…

qrczak13 · 12 Sierpień 2007 17:59

Pobierz Windows Worms Doors Cleaner, ustaw znaczki na zielono, Netbios może być na żółto.

Po użyciu narzędzia wymagany jest restart.

Ściągasz Pocket Killbox,

zaznaczasz Delete on reboot , w polu Full Path of File to Delete wklej po kolei ścieżki:

C:\WINDOWS\system32\0x000.exe

C:\WINDOWS\system32\0x008.exe

C:\Documents and Settings\z\Ustawienia lokalne\Temp\winlogon.exe

i naciskasz X czerwony po każdej. Program poprosi o restart kompa, co robisz, ale po wklejeniu ostatniej ścieżki.

Do notatnika wklej:

Plik > zapisz jako > zmień rozszerzenie z .txt na wszystkie pliki > zapisz pod nazwą Fix.reg np na

pulpicie > dwuklik na Fix.reg > potwierdzasz > restart.

Użyj ATF Cleaner w trybie awaryjnym > jak wejść

madzieela · 13 Sierpień 2007 13:51

dzięki mój problem jest już rozwiązany