Windows warning message! pomocy

Dla specjalistów Bezpieczeństwo
#1

Wczoraj włączam komputer i na moim ekranie pojawia się taki tekst , oto print screen

http://img98.imageshack.us/my.php?image=virusfv4.jpg

I co w takiej sytuacji?? Czym co i jak mam zrobić po kolei….

Wielkie dzięki z góry

Pozdrawiam

#2

Pobierz Combofix http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=36654 przeskanuj system daj log

potem przeskanuj HijackThis 2.02 daj log

kolejność skanowania jak podałem

:slight_smile:

#3

ComboFix 08-10-16.08 - Ola 2008-10-17 19:23:48.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.255 [GMT 2:00]

Uruchomiony z: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe

* Utworzono nowy punkt przywracania

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA!!

.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\system32\blphcju1j0e32c.scr

c:\windows\system32\Drivers\Winbg05.sys

C:\WINDOWS\system32\lphcju1j0e32c.exe

C:\WINDOWS\system32\phcju1j0e32c.bmp

C:\WINDOWS\system32\WinCtrl32.dl_

C:\WINDOWS\system32\WinCtrl32.dll

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_WINBG05

-------\Service_Winbg05

((((((((((((((((((((((((( Pliki utworzone od 2008-09-17 do 2008-10-17 )))))))))))))))))))))))))))))))

.

2008-10-10 21:45 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll

2008-10-10 21:45 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2008-10-10 21:45 . 2004-08-03 22:58 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys

2008-10-10 21:45 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

2008-10-10 10:07 . 2008-10-10 11:11

2008-10-10 09:57 . 2008-10-10 09:57

2008-10-10 09:57 . 2008-10-10 09:57 98,304 --a------ C:\WINDOWS\system32CmdLineExt.dll

2008-10-10 09:53 . 2008-10-10 09:53

2008-10-10 09:52 . 2008-10-10 09:52

2008-10-10 09:50 . 2008-10-10 09:57 1,081 --a------ C:\WINDOWS\disney.ini

2008-10-10 09:50 . 2008-10-10 09:52 182 --a------ C:\WINDOWS\disneysy.ini

2008-09-22 11:21 . 2008-09-22 11:21

2008-09-22 11:20 . 2008-09-22 11:20

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-17 17:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help

2008-10-10 07:53 --------- d–h--w C:\Program Files\InstallShield Installation Information

2008-10-09 16:50 --------- d-----w C:\Program Files\Avant Browser

2008-10-09 15:20 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\uTorrent

2008-10-03 21:20 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Ahead

2008-10-03 11:12 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BearShare

2008-08-24 19:48 --------- d-----w C:\Program Files\Sun

2008-08-24 19:48 --------- d-----w C:\Program Files\Java

2008-08-24 19:46 --------- d-----w C:\Program Files\Common Files\Java

2008-08-24 17:19 --------- d-----w C:\Program Files\BearShare Applications

2008-08-24 17:14 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Media Player Classic

2008-08-24 17:13 --------- d-----w C:\Program Files\Real Alternative

2008-08-24 17:13 --------- d-----w C:\Program Files\Media Player Classic

2008-08-24 17:12 --------- d-----w C:\Program Files\Microsoft.NET

2008-08-24 17:08 --------- d-----w C:\Program Files\Alcohol Soft

2008-08-24 17:04 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu

2008-08-24 17:02 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BESTplayer

2008-08-24 16:59 --------- d-----w C:\Program Files\Winamp

2008-08-24 16:59 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Winamp

2008-08-24 16:58 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-08-24 16:57 --------- d-----w C:\Program Files\uTorrent

2008-08-24 16:53 --------- d-----w C:\Program Files\QuickTime

2008-08-24 16:52 --------- d-----w C:\Program Files\Apple Software Update

2008-08-24 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer

2008-08-24 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple

2008-08-24 16:50 --------- d-----w C:\Program Files\Gadu-Gadu

2008-08-24 16:49 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Avant Profiles

2008-08-24 16:46 --------- d-----w C:\Program Files\Common Files\Ahead

2008-08-24 16:45 --------- d-----w C:\Program Files\Nero

2008-08-24 16:43 --------- d-----w C:\Program Files\ffdshow

2008-08-24 16:43 --------- d-----w C:\Program Files\AC3filters

2008-08-24 16:42 --------- d-----w C:\Program Files\Common Files\Adobe

2008-08-24 16:37 --------- d-----w C:\Program Files\VIA

2008-08-24 16:35 --------- d-----w C:\Program Files\Realtek Sound Manager

2008-08-24 16:35 --------- d-----w C:\Program Files\Realtek AC97

2008-08-24 16:35 --------- d-----w C:\Program Files\AvRack

2008-08-24 16:34 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-08-24 16:31 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\ATI

2008-08-24 16:29 --------- d-----w C:\Program Files\ATI Technologies

2008-08-24 16:17 --------- d-----w C:\Program Files\microsoft frontpage

2008-08-24 16:15 --------- d-----w C:\Program Files\Usługi online

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 15360]

“BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-08-22 94208]

“AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [2008-03-20 217544]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-08-24 108544]

ATI CATALYST - pasek zadaä.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-05-04 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]

–a------ 2005-05-04 00:33 32768 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]

–a------ 2005-05-03 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

–a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

–a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

–a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

-ra------ 2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusDisableNotify”=dword:00000001

“UpdatesDisableNotify”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

“C:\Program Files\uTorrent\uTorrent.exe”=

“C:\Program Files\BearShare Applications\BearShare\BearShare.exe”=

“C:\Program Files\Nowe Gadu-Gadu\gg.exe”=

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

“8461:TCP”= 8461:TCP:GoD High Port

“8462:TCP”= 8462:TCP:GoD Low Port

S3 FXDRV;FXDRV;F:\Fxdrv.sys []

S3 s3chipid;s3chipid;C:\DOCUME~1\Ola\USTAWI~1\Temp\s3chipid.sys []

.

        • USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-lphcju1j0e32c - C:\WINDOWS\system32\lphcju1j0e32c.exe

MSConfigStartUp-lphcju1j0e32c - C:\WINDOWS\system32\lphcju1j0e32c.exe

.

------- Skan uzupełniający -------

.

O8 -: Eksportuj do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-17 19:29:51

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów …

skanowanie ukrytych wpisów autostartu …

skanowanie ukrytych plików …

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

C:\WINDOWS\system32\ati2evxx.exe

C:\WINDOWS\system32\ati2evxx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\wdfmgr.exe

.

**************************************************************************

.

Czas ukończenia: 2008-10-17 19:30:55 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2008-10-17 17:30:52

Przed: 18 949 378 048 bajtów wolnych

Po: 22,825,705,472 bajtów wolnych

152

#4

Logfile of HijackThis v1.99.1

Scan saved at 19:33:38, on 2008-10-17

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Avant Browser\avant.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Ola\Pulpit\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

O4 - HKCU…\Run: [AlcoholAutomount] “C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” /automount

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/ … leId=19588

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

#5

Po przeskanowaniu ComboFix - problem zniknoł

#6

Pobierz —> The Avenger

Wklej do niego ten tekst:

Files to delete:

C:\WINDOWS\system32\WinCtrl32.dl_

C:\WINDOWS\system32\WinCtrl32.dll

F:\Fxdrv.sys 

C:\DOCUME~1\Ola\USTAWI~1\Temp\s3chipid.sys


Drivers to delete:

s3chipid

FXDRV

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.

Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

Daj nowego loga z ComboFixa po tej operacji. :wink:

====================

K.

#7

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: file “C:\WINDOWS\system32\WinCtrl32.dl_” not found!

Deletion of file “C:\WINDOWS\system32\WinCtrl32.dl_” failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

–> the object does not exist

Error: file “C:\WINDOWS\system32\WinCtrl32.dll” not found!

Deletion of file “C:\WINDOWS\system32\WinCtrl32.dll” failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

–> the object does not exist

Error: could not open file “F:\Fxdrv.sys”

Deletion of file “F:\Fxdrv.sys” failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

–> bad path / the parent directory does not exist

Error: file “C:\DOCUME~1\Ola\USTAWI~1\Temp\s3chipid.sys” not found!

Deletion of file “C:\DOCUME~1\Ola\USTAWI~1\Temp\s3chipid.sys” failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

–> the object does not exist

Driver “s3chipid” deleted successfully.

Driver “FXDRV” deleted successfully.

Completed script processing.

*******************

#8

Nowy log z ComboFixa!

Bardzo mnie to cieszy. :slight_smile:

====================

K.

#9

ComboFix 08-10-16.08 - Ola 2008-10-17 19:43:45.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.301 [GMT 2:00]

Uruchomiony z: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA!!

.

((((((((((((((((((((((((( Pliki utworzone od 2008-09-17 do 2008-10-17 )))))))))))))))))))))))))))))))

.

2008-10-10 21:45 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll

2008-10-10 21:45 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2008-10-10 21:45 . 2004-08-03 22:58 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys

2008-10-10 21:45 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

2008-10-10 10:07 . 2008-10-10 11:11

2008-10-10 09:57 . 2008-10-10 09:57

2008-10-10 09:57 . 2008-10-10 09:57 98,304 --a------ C:\WINDOWS\system32CmdLineExt.dll

2008-10-10 09:53 . 2008-10-10 09:53

2008-10-10 09:52 . 2008-10-10 09:52

2008-10-10 09:50 . 2008-10-10 09:57 1,081 --a------ C:\WINDOWS\disney.ini

2008-10-10 09:50 . 2008-10-10 09:52 182 --a------ C:\WINDOWS\disneysy.ini

2008-09-22 11:21 . 2008-09-22 11:21

2008-09-22 11:20 . 2008-09-22 11:20

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-17 17:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help

2008-10-10 07:53 --------- d–h--w C:\Program Files\InstallShield Installation Information

2008-10-09 16:50 --------- d-----w C:\Program Files\Avant Browser

2008-10-09 15:20 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\uTorrent

2008-10-03 21:20 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Ahead

2008-10-03 11:12 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BearShare

2008-08-24 19:48 --------- d-----w C:\Program Files\Sun

2008-08-24 19:48 --------- d-----w C:\Program Files\Java

2008-08-24 19:46 --------- d-----w C:\Program Files\Common Files\Java

2008-08-24 17:19 --------- d-----w C:\Program Files\BearShare Applications

2008-08-24 17:14 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Media Player Classic

2008-08-24 17:13 --------- d-----w C:\Program Files\Real Alternative

2008-08-24 17:13 --------- d-----w C:\Program Files\Media Player Classic

2008-08-24 17:12 --------- d-----w C:\Program Files\Microsoft.NET

2008-08-24 17:08 --------- d-----w C:\Program Files\Alcohol Soft

2008-08-24 17:04 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu

2008-08-24 17:02 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BESTplayer

2008-08-24 16:59 --------- d-----w C:\Program Files\Winamp

2008-08-24 16:59 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Winamp

2008-08-24 16:58 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-08-24 16:57 --------- d-----w C:\Program Files\uTorrent

2008-08-24 16:53 --------- d-----w C:\Program Files\QuickTime

2008-08-24 16:52 --------- d-----w C:\Program Files\Apple Software Update

2008-08-24 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer

2008-08-24 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple

2008-08-24 16:50 --------- d-----w C:\Program Files\Gadu-Gadu

2008-08-24 16:49 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Avant Profiles

2008-08-24 16:46 --------- d-----w C:\Program Files\Common Files\Ahead

2008-08-24 16:45 --------- d-----w C:\Program Files\Nero

2008-08-24 16:43 --------- d-----w C:\Program Files\ffdshow

2008-08-24 16:43 --------- d-----w C:\Program Files\AC3filters

2008-08-24 16:42 --------- d-----w C:\Program Files\Common Files\Adobe

2008-08-24 16:37 --------- d-----w C:\Program Files\VIA

2008-08-24 16:35 --------- d-----w C:\Program Files\Realtek Sound Manager

2008-08-24 16:35 --------- d-----w C:\Program Files\Realtek AC97

2008-08-24 16:35 --------- d-----w C:\Program Files\AvRack

2008-08-24 16:34 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-08-24 16:31 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\ATI

2008-08-24 16:29 --------- d-----w C:\Program Files\ATI Technologies

2008-08-24 16:17 --------- d-----w C:\Program Files\microsoft frontpage

2008-08-24 16:15 --------- d-----w C:\Program Files\Usługi online

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 15360]

“BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-08-22 94208]

“AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [2008-03-20 217544]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-08-24 108544]

ATI CATALYST - pasek zadaä.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-05-04 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]

–a------ 2005-05-04 00:33 32768 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]

–a------ 2005-05-03 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

–a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

–a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

–a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

-ra------ 2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusDisableNotify”=dword:00000001

“UpdatesDisableNotify”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

“C:\Program Files\uTorrent\uTorrent.exe”=

“C:\Program Files\BearShare Applications\BearShare\BearShare.exe”=

“C:\Program Files\Nowe Gadu-Gadu\gg.exe”=

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

“8461:TCP”= 8461:TCP:GoD High Port

“8462:TCP”= 8462:TCP:GoD Low Port

.

.

------- Skan uzupełniający -------

.

O8 -: Eksportuj do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-17 19:44:43

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów …

skanowanie ukrytych wpisów autostartu …

skanowanie ukrytych plików …

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

.

Czas ukończenia: 2008-10-17 19:45:20

ComboFix-quarantined-files.txt 2008-10-17 17:45:18

ComboFix2.txt 2008-10-17 17:30:56

Przed: 22 827 974 656 bajtów wolnych

Po: 22,821,593,088 bajtów wolnych

124

#10

Ja nie widzę tu nic niepokojącego.

Usuń ręcznie folder C:** Qoobox**,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer Ccleanerem

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj tym: Dr.WEB CureIt! .

=============================

K.

#11

ComboFix 08-10-16.08 - Ola 2008-10-17 19:43:45.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.301 [GMT 2:00]

Uruchomiony z: C:\Documents and Settings\Ola\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA!!

.

((((((((((((((((((((((((( Pliki utworzone od 2008-09-17 do 2008-10-17 )))))))))))))))))))))))))))))))

.

2008-10-10 21:45 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll

2008-10-10 21:45 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2008-10-10 21:45 . 2004-08-03 22:58 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys

2008-10-10 21:45 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

2008-10-10 10:07 . 2008-10-10 11:11

2008-10-10 09:57 . 2008-10-10 09:57

2008-10-10 09:57 . 2008-10-10 09:57 98,304 --a------ C:\WINDOWS\system32CmdLineExt.dll

2008-10-10 09:53 . 2008-10-10 09:53

2008-10-10 09:52 . 2008-10-10 09:52

2008-10-10 09:50 . 2008-10-10 09:57 1,081 --a------ C:\WINDOWS\disney.ini

2008-10-10 09:50 . 2008-10-10 09:52 182 --a------ C:\WINDOWS\disneysy.ini

2008-09-22 11:21 . 2008-09-22 11:21

2008-09-22 11:20 . 2008-09-22 11:20

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-17 17:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help

2008-10-10 07:53 --------- d–h--w C:\Program Files\InstallShield Installation Information

2008-10-09 16:50 --------- d-----w C:\Program Files\Avant Browser

2008-10-09 15:20 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\uTorrent

2008-10-03 21:20 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Ahead

2008-10-03 11:12 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BearShare

2008-08-24 19:48 --------- d-----w C:\Program Files\Sun

2008-08-24 19:48 --------- d-----w C:\Program Files\Java

2008-08-24 19:46 --------- d-----w C:\Program Files\Common Files\Java

2008-08-24 17:19 --------- d-----w C:\Program Files\BearShare Applications

2008-08-24 17:14 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Media Player Classic

2008-08-24 17:13 --------- d-----w C:\Program Files\Real Alternative

2008-08-24 17:13 --------- d-----w C:\Program Files\Media Player Classic

2008-08-24 17:12 --------- d-----w C:\Program Files\Microsoft.NET

2008-08-24 17:08 --------- d-----w C:\Program Files\Alcohol Soft

2008-08-24 17:04 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Gadu-Gadu

2008-08-24 17:02 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\BESTplayer

2008-08-24 16:59 --------- d-----w C:\Program Files\Winamp

2008-08-24 16:59 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Winamp

2008-08-24 16:58 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-08-24 16:57 --------- d-----w C:\Program Files\uTorrent

2008-08-24 16:53 --------- d-----w C:\Program Files\QuickTime

2008-08-24 16:52 --------- d-----w C:\Program Files\Apple Software Update

2008-08-24 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer

2008-08-24 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple

2008-08-24 16:50 --------- d-----w C:\Program Files\Gadu-Gadu

2008-08-24 16:49 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\Avant Profiles

2008-08-24 16:46 --------- d-----w C:\Program Files\Common Files\Ahead

2008-08-24 16:45 --------- d-----w C:\Program Files\Nero

2008-08-24 16:43 --------- d-----w C:\Program Files\ffdshow

2008-08-24 16:43 --------- d-----w C:\Program Files\AC3filters

2008-08-24 16:42 --------- d-----w C:\Program Files\Common Files\Adobe

2008-08-24 16:37 --------- d-----w C:\Program Files\VIA

2008-08-24 16:35 --------- d-----w C:\Program Files\Realtek Sound Manager

2008-08-24 16:35 --------- d-----w C:\Program Files\Realtek AC97

2008-08-24 16:35 --------- d-----w C:\Program Files\AvRack

2008-08-24 16:34 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-08-24 16:31 --------- d-----w C:\Documents and Settings\Ola\Dane aplikacji\ATI

2008-08-24 16:29 --------- d-----w C:\Program Files\ATI Technologies

2008-08-24 16:17 --------- d-----w C:\Program Files\microsoft frontpage

2008-08-24 16:15 --------- d-----w C:\Program Files\Usługi online

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 15360]

“BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-08-22 94208]

“AlcoholAutomount”=“C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” [2008-03-20 217544]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-08-24 108544]

ATI CATALYST - pasek zadaä.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2005-05-04 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]

–a------ 2005-05-04 00:33 32768 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]

–a------ 2005-05-03 21:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

–a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

–a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

–a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

-ra------ 2005-08-17 12:39 90112 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusDisableNotify”=dword:00000001

“UpdatesDisableNotify”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

“C:\Program Files\uTorrent\uTorrent.exe”=

“C:\Program Files\BearShare Applications\BearShare\BearShare.exe”=

“C:\Program Files\Nowe Gadu-Gadu\gg.exe”=

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

“8461:TCP”= 8461:TCP:GoD High Port

“8462:TCP”= 8462:TCP:GoD Low Port

.

.

------- Skan uzupełniający -------

.

O8 -: Eksportuj do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-17 19:44:43

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów …

skanowanie ukrytych wpisów autostartu …

skanowanie ukrytych plików …

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

.

Czas ukończenia: 2008-10-17 19:45:20

ComboFix-quarantined-files.txt 2008-10-17 17:45:18

ComboFix2.txt 2008-10-17 17:30:56

Przed: 22 827 974 656 bajtów wolnych

Po: 22,821,593,088 bajtów wolnych

124

#12

ale jeśli problem zniknoł z windows warning message to coś dalej muszę robić?

#13

a ten folder moge usunąć już? C:\Qoobox

#14

:?: :?: :?: :?:

#15

Masz wszystko opisane, czytaj!

================

K.

#16

dzięki wielkie za pomoc, wszystko juz śmiga =D>