Wolno chodzacy internet

Bartolo · 15 Lipiec 2008 12:00

Od jakiegos czasu niepokoi mnie wolno dzialajacy internet ,wolne otwieranie stron itp mysle ze moze to byc wirus dlatego chcialbym prosic o sprawdzenie loga z hjack

Logfile of HijackThis v1.99.1 Scan saved at 13:58:41, on 2008-07-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Bartek\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [NvCplDaemon] “RUNDLL32.EXE” C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] “nwiz.exe” /install O4 - HKLM…\Run: [NvMediaCenter] “RUNDLL32.EXE” C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKLM…\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [CnxDslTaskBar] “C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852” O4 - HKLM…\Run: [WinampAgent] “C:\Program Files\Winamp\winampa.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [AutoConnect] “C:\Program Files\AutoConnect\AutoConnect.exe” O4 - HKCU…\Run: [AdVantage] “C:\Program Files\AdVantage\AdVantage.exe” O4 - HKCU…\Run: [steam] “c:\program files\steam\steam.exe” -silent O4 - HKCU…\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra ‘Tools’ menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{2610A133-E55E-49C0-8FDC-B3FF7B3EFB02}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

djarta · 15 Lipiec 2008 12:45

Te w/w wpisy sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked.

Daj log z -----> ComboFix

Bartolo · 15 Lipiec 2008 16:58

ComboFix 08-07-14.2 - Bartek 2008-07-15 18:51:26.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.87 [GMT 2:00] Running from: C:\Documents and Settings\Bartek\Pulpit\Combo-Fix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 ))))))))))))))))))))))))))))))) . 2008-07-15 16:20 . 2008-07-15 16:20 2008-06-21 20:19 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-21 20:19 . 2008-06-14 20:01 273,024 -----c— C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-18 23:14 . 2008-06-18 23:14 2008-06-18 22:59 . 2008-06-18 23:03 2008-06-18 22:59 . 2008-06-18 22:59 2008-06-18 22:58 . 2008-06-18 22:58 2008-06-18 22:49 . 2008-06-18 22:49 2008-06-18 22:49 . 2008-06-18 22:49 2008-06-18 22:49 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-06-18 22:49 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-15 14:18 --------- d-----w C:\Program Files\Steam 2008-07-15 14:18 --------- d-----w C:\Program Files\AutoConnect 2008-07-06 10:51 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\mIRC 2008-07-06 10:48 --------- d-----w C:\Program Files\mIRC 2008-07-04 16:15 --------- d-----w C:\Program Files\Quake III Arena 2008-06-14 13:10 4,000 ----a-w C:\ao.dat 2008-05-25 14:20 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\teamspeak2 2008-05-15 18:47 --------- d-----w C:\Program Files\ICQToolbar 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:03 662,016 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE~\Browser Helper Objects{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-01-10 17:33 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360] “AutoConnect”=“C:\Program Files\AutoConnect\AutoConnect.exe” [2004-08-28 20:27 295424] “Steam”=“c:\program files\steam\steam.exe” [2008-03-28 09:59 1271032] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search Destroy\TeaTimer.exe” [2007-08-31 17:46 1460560] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-05-16 01:19 79224] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-10-22 13:22 7700480] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-10-22 13:22 86016] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 02:11 132496] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25 6731312] “CnxDslTaskBar”=“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” [2005-07-21 22:52 278528] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-10-10 07:28 36352] “nwiz”=“nwiz.exe” [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 00:44 15360] [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “C:\Program Files\Gadu-Gadu\gg.exe”= “C:\Program Files\Steam\steamapps\nightmare379\counter-strike\hl.exe”= “C:\Program Files\mIRC\mirc.exe”= “C:\Program Files\BitComet\BitComet.exe”= “C:\Program Files\SopCast\adv\SopAdver.exe”= “C:\Program Files\SopCast\SopCast.exe”= “C:\Program Files\totalcmd\TOTALCMD.EXE”= “C:\Program Files\ICQ6\ICQ.exe”= “C:\Documents and Settings\Bartek\Pulpit\Netsoccer(2)\Netsoccer\server.exe”= [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] “24105:TCP”= 24105:TCP:BitComet 24105 TCP “24105:UDP”= 24105:UDP:BitComet 24105 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2005-05-20 20:27] R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2005-05-20 20:27] R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys [2005-05-20 20:28] . - - - - ORPHANS REMOVED - - - - HKLM-Run-SpeedTouch USB Diagnostics - C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe HKLM-Run-Cmaudio - cmicnfg.cpl ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-15 18:52:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-15 18:56:37 ComboFix-quarantined-files.txt 2008-07-15 16:56:12 ComboFix2.txt 2007-12-16 16:47:52 Pre-Run: 42,159,411,200 bajtów wolnych Post-Run: 42,151,952,384 bajtów wolnych 94 — E O F — 2008-06-25 21:01:58

djarta · 15 Lipiec 2008 17:31

Wklej do Notatnika:

File::

C:\ao.dat


Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]

>>Plik>>Zapisz jako… >>> CFScript

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe

–>

Ma się rozpocząć usuwanie. (i powstanie log). Daj ten log, który powstanie w trakcie usuwania.

Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

Bartolo · 16 Lipiec 2008 09:08

ComboFix 08-07-14.2 - Bartek 2008-07-16 11:01:24.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.95 [GMT 2:00] Running from: C:\Documents and Settings\Bartek\Pulpit\Combo-Fix.exe Command switches used :: C:\Documents and Settings\Bartek\Pulpit\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED FILE :: C:\ao.dat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\ao.dat . ((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 ))))))))))))))))))))))))))))))) . 2008-06-21 20:19 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-21 20:19 . 2008-06-14 20:01 273,024 -----c— C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-18 23:14 . 2008-06-18 23:14 2008-06-18 22:59 . 2008-06-18 23:03 2008-06-18 22:59 . 2008-06-18 22:59 2008-06-18 22:58 . 2008-06-18 22:58 2008-06-18 22:49 . 2008-06-18 22:49 2008-06-18 22:49 . 2008-06-18 22:49 2008-06-18 22:49 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-06-18 22:49 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-16 08:18 --------- d-----w C:\Program Files\Steam 2008-07-16 08:18 --------- d-----w C:\Program Files\AutoConnect 2008-07-06 10:51 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\mIRC 2008-07-06 10:48 --------- d-----w C:\Program Files\mIRC 2008-07-04 16:15 --------- d-----w C:\Program Files\Quake III Arena 2008-05-25 14:20 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\teamspeak2 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:03 662,016 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((( snapshot@2008-07-15_18.55.57.42 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-15 19:12:39 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_530.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360] “AutoConnect”=“C:\Program Files\AutoConnect\AutoConnect.exe” [2004-08-28 20:27 295424] “Steam”=“c:\program files\steam\steam.exe” [2008-03-28 09:59 1271032] “SpybotSD TeaTimer”=“C:\Program Files\Spybot - Search Destroy\TeaTimer.exe” [2007-08-31 17:46 1460560] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-05-16 01:19 79224] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-10-22 13:22 7700480] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-10-22 13:22 86016] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 02:11 132496] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25 6731312] “CnxDslTaskBar”=“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” [2005-07-21 22:52 278528] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-10-10 07:28 36352] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [bU] “nwiz”=“nwiz.exe” [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 00:44 15360] [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “C:\Program Files\Gadu-Gadu\gg.exe”= “C:\Program Files\Steam\steamapps\nightmare379\counter-strike\hl.exe”= “C:\Program Files\mIRC\mirc.exe”= “C:\Program Files\BitComet\BitComet.exe”= “C:\Program Files\SopCast\adv\SopAdver.exe”= “C:\Program Files\SopCast\SopCast.exe”= “C:\Program Files\totalcmd\TOTALCMD.EXE”= “C:\Program Files\ICQ6\ICQ.exe”= “C:\Documents and Settings\Bartek\Pulpit\Netsoccer(2)\Netsoccer\server.exe”= [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] “24105:TCP”= 24105:TCP:BitComet 24105 TCP “24105:UDP”= 24105:UDP:BitComet 24105 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2005-05-20 20:27] R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2005-05-20 20:27] R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys [2005-05-20 20:28] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-16 11:03:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-16 11:07:03 ComboFix-quarantined-files.txt 2008-07-16 09:06:56 ComboFix2.txt 2008-07-15 16:56:38 ComboFix3.txt 2007-12-16 16:47:52 Pre-Run: 42,116,624,384 bajtów wolnych Post-Run: 42,118,025,216 bajtów wolnych 103 — E O F — 2008-06-25 21:01:58

huber2t · 16 Lipiec 2008 09:21

Log wyglada na czysty

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!

Bartolo · 16 Lipiec 2008 11:48

16 lipiec 2008 13:45:16 System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.0 Ostatnia aktualizacja Kaspersky Anti-Virus16/07/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus959271 Ustawienia skanowania Skanowanie przy użyciu następujących baz danych rozszerzone Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer A:\ C:\ D:\ E:\ Statystyki skanowania Liczba skanowanych obiektów 39412 Liczba wykrytych wirusów 1 Liczba zainfekowanych obiektów 1 Liczba podejrzanych obiektów 0 Czas trwania skanowania 01:16:52 Nazwa zainfekowanego obiektu Nazwa wirusa Ostatnie działanie C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat Object is locked pominięty C:\Documents and Settings\Bartek\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\cert8.db Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\flashgot.log Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\formhistory.dat Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\history.dat Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\key3.db Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\parent.lock Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\search.sqlite Object is locked pominięty C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\urlclassifier2.sqlite Object is locked pominięty C:\Documents and Settings\Bartek\ntuser.dat Object is locked pominięty C:\Documents and Settings\Bartek\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\Cache_CACHE_001_ Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\Cache_CACHE_002_ Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\Cache_CACHE_003_ Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\jhbo6ekd.default\Cache_CACHE_MAP_ Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Historia\History.IE5\MSHist012008071620080717\index.dat Object is locked pominięty C:\Documents and Settings\Bartek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log Object is locked pominięty C:\Program Files\Alwil Software\Avast4\DATA\report\Osłona rezydentna.txt Object is locked pominięty C:\Program Files\mIRC\mirc.exe Zainfekowanych: not-a-virus:Client-IRC.Win32.mIRC.631 pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\System Volume Information_restore{2312D6F9-CAF3-4488-A99F-28D39A905997}\RP130\change.log Object is locked pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\SchedLgU.Txt Object is locked pominięty C:\WINDOWS\SoftwareDistribution\EventCache{3C3A2528-482B-4224-A1DF-566616245B4D}.bin Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\Sti_Trace.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\edb.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked pominięty C:\WINDOWS\system32\config\Antivirus.Evt Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\default Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\software Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\system Object is locked pominięty C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\drivers\sptd.sys Object is locked pominięty C:\WINDOWS\system32\h323log.txt Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty C:\WINDOWS\Temp\Perflib_Perfdata_534.dat Object is locked pominięty C:\WINDOWS\Temp_avast4_\Webshlock.txt Object is locked pominięty C:\WINDOWS\wiadebug.log Object is locked pominięty C:\WINDOWS\wiaservc.log Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty Proces skanowania został zakończony.

huber2t · 16 Lipiec 2008 11:52

Usuń to:

Poza tym ok

Bartolo · 16 Lipiec 2008 11:54

Dzieki

Gutek · 16 Lipiec 2008 16:27

Na przyszłość i do innych przy okazji - Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=253052