prosze o spawdzenie loga

[Creative_pp]

Ostatnio ma dosc wysokie pingi, i co dziwnego komputer sam zresetowal mi dnsy w polaczeniu internetowym;|

Logfile of HijackThis v1.99.1
Scan saved at 18:30:02, on 2008-01-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\Program Files\Common Files\NMSAccessU.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Quintessential Media Player\QMPlayer.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
c:\program files\antivir personaledition classic\avscan.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.mks.com.pl
O15 - Trusted Zone: http://*.mks.com.pl
O15 - Trusted Zone: http://*.nasza-klasa.pl
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,4956/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFE1A0A6-1D10-49BF-95DE-040BBE6C64C3}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lmab_device - Unknown owner - C:\WINDOWS\system32\LMabcoms.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Common Files\NMSAccessU.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

[wojtas]

skasuj te wpisy:

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

pogrubiony folder wywal do kosza chyba ze znasz ten folder to zostaw

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Creative_pp]

LOg z SDFix'a

SDFix: Version 1.131

Run by Administrator on 2008-01-24 at 23:56

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\DOCUME~1\ADMINI~1\Pulpit\HIJACK~1\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\NSPRS.DLL - Deleted
C:\WINDOWS\SYSTEM32\SERAUTH1.DLL - Deleted
C:\WINDOWS\SYSTEM32\SERAUTH2.DLL - Deleted
C:\WINDOWS\SYSTEM32\SSPRS.DLL - Deleted





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\explorer.exe
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 00:02:15
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]
"ujdew"=hex:20,02,00,00,26,1a,1b,84,cf,ae,93,12,e2,3f,48,59,20,9e,ea,0d,e0,..
"ljej40"=hex:00,83,9b,3b,5d,63,5e,2d,0d,c9,fd,79,72,a3,ef,cf,72,90,e9,29,31,..
"ljej41"=hex:96,82,52,37,35,62,88,21,0c,c9,1e,75,73,a3,10,c3,72,90,e5,24,e1,..
"ljej42"=hex:96,82,01,20,35,62,fd,36,0c,c9,40,62,73,a3,23,d4,72,90,3c,32,e1,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]


"DisplayName"="Alcohol 120% (Trial Version)"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 40


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g�˘wny"
"C:\\WINDOWS\\system32\\LMabcoms.exe"="C:\\WINDOWS\\system32\\LMabcoms.exe:*:Enabled:Lexmark Enhanced TCP/IP"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\ADMINI~1\Pulpit\HIJACK~1\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 7 Aug 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 9 Aug 2006 400 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Wed 9 Aug 2006 48 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"

Finished!

Log z Combo Fix'a

"Administrator" - 2008-01-25 0:07:32 Dodatek Service Pack 2
ComboFix 07-05.27.V - Running from: "C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\"


((((((((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 ))))))))))))))))))))))))))))))))))


2008-01-24 23:54 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-23 15:32 <DIR> d-------- C:\Documents and Settings\ADMINI~1\.gimp-2.4
2008-01-23 15:32 <DIR> d-------- C:\DOCUME~1\ADMINI~1\.gimp-2.4
2008-01-22 19:48 151,552 --a------ C:\WINDOWS\system32\MSOSS.DLL
2008-01-08 00:41 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Zoner
2008-01-08 00:40 <DIR> d-------- C:\Program Files\Zoner
2008-01-08 00:38 <DIR> d-------- C:\Program Files\WebHat Software
2008-01-03 21:04 <DIR> d-------- C:\WINDOWS\Prefetch
2008-01-03 21:00 9,728 --------- C:\WINDOWS\system32\rwnh.dll
2008-01-03 21:00 10,752 --------- C:\WINDOWS\system32\smtpapi.dll
2008-01-03 00:55 <DIR> d-------- C:\Program Files\Shozam
2008-01-03 00:52 <DIR> d-------- C:\Program Files\MyGlobalSearch
2008-01-03 00:52 <DIR> d-------- C:\Program Files\BearShare
2008-01-03 00:52 <DIR> d-------- C:\My Downloads


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-01-24 14:56:55 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-24 14:56:42 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-24 05:49:01 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\foobar2000
2008-01-23 19:08:40 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\teamspeak2
2008-01-23 14:34:11 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\gtk-2.0
2008-01-22 19:09:40 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2008-01-22 19:09:40 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2008-01-22 19:09:40 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2008-01-22 18:48:09 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-07 19:53:20 22,328 ----a-w C:\DOCUME~1\ADMINI~1\DANEAP~1\PnkBstrK.sys
2008-01-07 19:52:33 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-07 19:52:31 674,600 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-01-03 20:00:09 -------- d-----w C:\Program Files\Movie Maker
2008-01-03 19:42:16 -------- d-----w C:\Program Files\NAPI-PROJEKT
2008-01-02 23:55:42 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\GetRightToGo
2007-12-29 19:58:34 -------- d-----w C:\Program Files\PartyGaming
2007-12-20 22:55:14 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Xfire
2007-12-19 20:24:10 -------- d-----w C:\Program Files\Common Files\snp325
2007-12-19 20:23:47 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\InstallShield
2007-12-19 00:12:45 -------- d-----w C:\Program Files\MSN Messenger
2007-12-18 23:04:24 -------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-18 22:46:48 -------- d-----w C:\Program Files\Windows Live
2007-12-18 22:45:48 -------- d--h--w C:\Program Files\WindowsUpdate
2007-12-17 23:14:46 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\MSN6
2007-12-13 22:39:16 -------- d-----w C:\Program Files\SHOUTcast
2007-12-13 22:37:11 -------- d-----w C:\Program Files\Maxthon2
2007-12-13 22:36:11 -------- d-----w C:\Program Files\Maxthon
2007-12-08 18:07:22 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\SecondLife
2007-12-05 21:30:28 -------- d-----w C:\Program Files\Gadu-Gadu
2007-12-04 20:12:04 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Hamachi
2007-12-04 19:33:27 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-11-30 19:12:18 -------- d-----w C:\Program Files\AAOURL
2007-11-30 00:20:41 -------- d-----w C:\Program Files\AA
2007-11-27 22:04:51 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Skype
2007-11-19 14:14:35 80,444 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-11-19 14:14:35 461,026 ----a-w C:\WINDOWS\system32\perfh015.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2006-08-06 20:35]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 18:40]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-10 22:41]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programy^Autostart^Rejestrowanie produktów Corela.lnk]
path=C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\Rejestrowanie produktów Corela.lnk
backup=C:\WINDOWS\pss\Rejestrowanie produktów Corela.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Twoje TVN24]



Contents of the 'Scheduled Tasks' folder
2008-01-11 17:40:03 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 00:08:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2008-01-25 0:09:39
C:\ComboFix-quarantined-files.txt ... 2008-01-25 00:09
C:\ComboFix2.txt ... 2007-10-11 17:39
C:\ComboFix3.txt ... 2007-10-02 19:57

--- E O F ---

[wojtas]

skasuj ten folder:

C:\Program Files\MyGlobalSearch

[Creative_pp]

okej zrobione cos jeszcze jets nie tak?

[Dzi@dek]

All Ok

[Creative_pp]

dziękuję