Attention, "nazwa komputera"! some dangerous viruses in your

**Posty:** 24 · przez **moniarm** 21 Sie 2008, 19:29

Przy wejściu na jakikolwiek dysk wyskakuje mi "Attention, "nazwa komputera"! Some dangerous viruses in your system. Microsoft Windows XP files corrupted. This may lead to the destruction of important files in C:\WINDOWS. Download protection software now!"

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:28:43, on 2008-08-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\VDOTool\TBPanel.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Norton Ghost\Agent\VProSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: IE Shop - {F73DBD9E-5F1B-4BCA-8604-A911DCE08B37} - C:\WINDOWS\system32\hdbo.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\Skype4COM.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- End of file - 7603 bytes

**Posty:** 8001 · przez **Okocza** 21 Sie 2008, 19:29

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

i daj logi nowe z combofixa i hijack this (w tej kolejnosci)

**Posty:** 24 · przez **moniarm** 21 Sie 2008, 19:38

ComboFix

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:28:43, on 2008-08-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\VDOTool\TBPanel.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Norton Ghost\Agent\VProSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: IE Shop - {F73DBD9E-5F1B-4BCA-8604-A911DCE08B37} - C:\WINDOWS\system32\hdbo.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\Skype4COM.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- End of file - 7603 bytes

Hijack this

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:38:20, on 2008-08-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\VDOTool\TBPanel.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Norton Ghost\Agent\VProSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\Skype4COM.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- End of file - 7629 bytes

**Posty:** 35 · przez **huber2t** 21 Sie 2008, 19:40

Podaj log z Combofix

**Posty:** 24 · przez **moniarm** 21 Sie 2008, 19:43

Źle wklejiłam :-)

Kod: Zaznacz wszystko: ComboFix 08-08-19.06 - slawek 2008-08-21 19:41:27.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1447 [GMT 2:00] Running from: C:\Documents and Settings\slawek\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))) . 2008-08-21 19:31 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-08-21 19:31 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-08-21 19:31 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-08-21 19:31 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-08-21 19:31 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-08-21 19:31 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-08-21 19:31 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-08-21 19:31 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-08-21 19:31 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-08-21 19:31 . 2008-08-21 19:33 1,826 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-21 18:57 . 2008-08-21 18:57 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-21 18:38 . 2008-08-21 18:46 <DIR> d-------- C:\Program Files\SkanerOnline 2008-08-20 22:54 . 2008-08-20 22:54 61,440 --a------ C:\WINDOWS\system32\hayo.dll 2008-08-20 21:40 . 2008-08-20 21:40 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Pogo Games 2008-08-20 21:38 . 2008-08-20 21:38 <DIR> d-------- C:\Program Files\Oberon Media 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\iTunes 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\iPod 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\Bonjour 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Apple Computer 2008-08-20 21:29 . 2008-08-20 21:30 <DIR> d-------- C:\Program Files\QuickTime 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Program Files\Apple Software Update 2008-08-20 21:29 . 2008-08-20 21:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-08-20 20:17 . 2008-08-20 20:17 <DIR> d-------- C:\Program Files\Shockwave.com 2008-08-19 23:01 . 2008-08-19 23:01 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-17 14:26 . 2008-08-17 14:26 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\PlayFirst 2008-08-17 14:26 . 2008-08-17 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2008-08-17 11:32 . 2008-08-17 11:32 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-08-17 11:31 . 2008-08-17 14:25 <DIR> d-------- C:\Program Files\Yahoo! Games 2008-08-17 11:15 . 2008-08-20 18:57 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-08-17 09:43 . 2008-08-17 09:45 <DIR> d-------- C:\Program Files\Wonderland Adventures 2008-08-17 09:43 . 2008-08-17 09:43 <DIR> d-------- C:\Program Files\ReflexiveArcade 2008-08-16 21:03 . 2008-08-16 21:37 <DIR> d-------- C:\Program Files\GameHouse 2008-08-16 17:05 . 2008-08-16 17:05 <DIR> d-------- C:\WINDOWS\Go-Go Gourmet 2 - Chef of the Year 2008-08-16 17:05 . 2008-08-16 17:05 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Go-Go Gourmet Chef of the Year 2008-08-16 13:35 . 2008-08-16 14:11 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\The Hobbit 2008-08-15 21:15 . 2008-08-15 21:15 <DIR> d-------- C:\WINDOWS\Sun 2008-08-15 21:15 . 2008-08-15 21:15 <DIR> d-------- C:\Program Files\Java 2008-08-15 21:15 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-15 21:14 . 2008-08-15 21:14 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-15 07:33 . 2008-08-15 07:33 <DIR> d-------- C:\Program Files\GXTranscoder v2 2008-08-15 07:33 . 2008-08-15 07:33 115,545 --a------ C:\WINDOWS\GXTranscoder v2 Uninstaller.exe 2008-08-13 22:16 . 2008-08-13 22:16 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-08-13 22:16 . 2008-08-13 22:16 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\Program Files\AGEIA Technologies 2008-08-13 22:11 . 2008-08-13 22:11 <DIR> d-------- C:\Program Files\OpenAL 2008-08-13 22:11 . 2008-01-29 12:53 782,336 -ra------ C:\WINDOWS\system32\tmp4C.tmp 2008-08-13 22:11 . 2008-01-29 12:53 782,336 -ra------ C:\WINDOWS\system32\tmp4B.tmp 2008-08-13 22:11 . 2008-08-13 22:15 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-13 22:11 . 2008-08-13 22:15 110,592 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-11 19:14 . 2008-08-12 21:07 <DIR> d-------- C:\Program Files\DC++ 2008-08-08 17:39 . 2008-08-08 17:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-08-08 17:38 . 2008-08-08 17:38 <DIR> d-------- C:\Program Files\BFG 2008-08-07 17:32 . 2008-08-07 17:32 36 --a------ C:\WINDOWS\Tiny_Run.ini 2008-08-04 22:22 . 2008-08-04 22:22 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Media Player Classic 2008-08-04 22:21 . 2008-08-04 22:21 <DIR> d-------- C:\Program Files\Real Alternative 2008-08-04 22:12 . 2008-08-04 22:12 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-30 19:25 . 2008-07-30 19:26 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Moje pliki Bitwy o Śródziemie™ II 2008-07-29 22:27 . 2008-07-29 22:27 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Microsoft Games 2008-07-27 20:13 . 2008-07-27 20:13 4 --a------ C:\WINDOWS\system32\proc-503976190.bin 2008-07-27 18:56 . 2008-07-27 18:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-07-27 17:42 . 2008-07-27 17:42 <DIR> d-------- C:\Program Files\IVT Corporation . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-20 21:39 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-18 07:06 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Tlen.pl 2008-08-16 11:34 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-08 10:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-07-27 18:13 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\GanymedeNet 2008-07-13 17:59 --------- d-----w C:\Program Files\Illustrate 2008-07-13 17:59 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\AccurateRip 2008-07-13 17:58 5,052,280 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2008-07-06 17:22 --------- d-----w C:\Program Files\Ganymede 2008-07-06 16:57 --------- d-----w C:\Program Files\Microsoft.NET 2008-07-04 16:38 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-07-02 07:07 --------- d-----w C:\Program Files\Common Files\NSV 2008-07-02 07:05 --------- d-----w C:\Program Files\Winamp 2008-07-02 07:05 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Winamp 2008-07-01 21:27 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-07-01 21:15 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Nero 2008-07-01 21:13 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-07-01 21:11 --------- d-----w C:\Program Files\Nero 2008-07-01 21:11 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-01 21:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-07-01 21:08 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-07-01 21:07 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\DAEMON Tools 2008-07-01 20:45 --------- d-----w C:\Program Files\BitComet 2008-07-01 20:45 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Symantec . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-01-08 12:25 2124088] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 01:09 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 15:36 2169368] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-11-28 10:45 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-11-28 10:45 81920] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008] "nwiz"="nwiz.exe" [2007-11-28 10:45 1626112 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-22 20:42 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 15:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-09-20 09:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0] --a------ 2007-03-28 21:41 2037352 C:\Program Files\Norton Ghost\Agent\VProTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0x00000000" "UpdatesDisableNotify"="0x00000000" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "F:\\Gry\\PES2008\\PES2008.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2main.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2main_amdxp.exe"= "F:\\Gry\\Neverwinter Nights\\nwupdate.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2server.exe"= "F:\\Gry\\Stronghold 2\\Stronghold2.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "F:\\Gry\\Rise\\thrones.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8283:TCP"= 8283:TCP:BitComet 8283 TCP "8283:UDP"= 8283:UDP:BitComet 8283 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 17:23] R2 Start BT in service;Start BT in service;C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [2007-12-27 15:39] *Newly Created Service* - CATCHME *Newly Created Service* - OSE *Newly Created Service* - PROCEXP90 . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\slawek\Dane aplikacji\Mozilla\Firefox\Profiles\wcbu9l1t.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - google.pl . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-21 19:42:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-21 19:42:21 ComboFix-quarantined-files.txt 2008-08-21 17:42:15 ComboFix2.txt 2008-08-21 17:37:41 ComboFix3.txt 2008-08-21 17:33:35 Pre-Run: 13,720,141,824 bajtów wolnych Post-Run: 13,711,106,048 bajtów wolnych 192

**Posty:** 35 · przez **huber2t** 21 Sie 2008, 19:47

Pobierz ComboFix, ale nie uruchamiaj
Otwórz notatnik i wklej do niego:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\WS2Fix.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\tmp4C.tmp C:\WINDOWS\system32\tmp4B.tmp

Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

fix w hijackthis

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)

**Posty:** 24 · przez **moniarm** 21 Sie 2008, 19:50

Kod: Zaznacz wszystko: ComboFix 08-08-19.06 - slawek 2008-08-21 19:49:07.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1367 [GMT 2:00] Running from: C:\Documents and Settings\slawek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\slawek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\tmp4B.tmp C:\WINDOWS\system32\tmp4C.tmp C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\dumphive.exe C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\tmp4B.tmp C:\WINDOWS\system32\tmp4C.tmp C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe . ((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))) . 2008-08-21 18:57 . 2008-08-21 18:57 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-21 18:38 . 2008-08-21 18:46 <DIR> d-------- C:\Program Files\SkanerOnline 2008-08-20 22:54 . 2008-08-20 22:54 61,440 --a------ C:\WINDOWS\system32\hayo.dll 2008-08-20 21:40 . 2008-08-20 21:40 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Pogo Games 2008-08-20 21:38 . 2008-08-20 21:38 <DIR> d-------- C:\Program Files\Oberon Media 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\iTunes 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\iPod 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\Bonjour 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Apple Computer 2008-08-20 21:29 . 2008-08-20 21:30 <DIR> d-------- C:\Program Files\QuickTime 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Program Files\Apple Software Update 2008-08-20 21:29 . 2008-08-20 21:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-08-20 20:17 . 2008-08-20 20:17 <DIR> d-------- C:\Program Files\Shockwave.com 2008-08-19 23:01 . 2008-08-19 23:01 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-17 14:26 . 2008-08-17 14:26 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\PlayFirst 2008-08-17 14:26 . 2008-08-17 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2008-08-17 11:32 . 2008-08-17 11:32 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-08-17 11:31 . 2008-08-17 14:25 <DIR> d-------- C:\Program Files\Yahoo! Games 2008-08-17 11:15 . 2008-08-20 18:57 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-08-17 09:43 . 2008-08-17 09:45 <DIR> d-------- C:\Program Files\Wonderland Adventures 2008-08-17 09:43 . 2008-08-17 09:43 <DIR> d-------- C:\Program Files\ReflexiveArcade 2008-08-16 21:03 . 2008-08-16 21:37 <DIR> d-------- C:\Program Files\GameHouse 2008-08-16 17:05 . 2008-08-16 17:05 <DIR> d-------- C:\WINDOWS\Go-Go Gourmet 2 - Chef of the Year 2008-08-16 17:05 . 2008-08-16 17:05 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Go-Go Gourmet Chef of the Year 2008-08-16 13:35 . 2008-08-16 14:11 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\The Hobbit 2008-08-15 21:15 . 2008-08-15 21:15 <DIR> d-------- C:\WINDOWS\Sun 2008-08-15 21:15 . 2008-08-15 21:15 <DIR> d-------- C:\Program Files\Java 2008-08-15 21:15 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-15 21:14 . 2008-08-15 21:14 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-15 07:33 . 2008-08-15 07:33 <DIR> d-------- C:\Program Files\GXTranscoder v2 2008-08-15 07:33 . 2008-08-15 07:33 115,545 --a------ C:\WINDOWS\GXTranscoder v2 Uninstaller.exe 2008-08-13 22:16 . 2008-08-13 22:16 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-08-13 22:16 . 2008-08-13 22:16 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\Program Files\AGEIA Technologies 2008-08-13 22:11 . 2008-08-13 22:11 <DIR> d-------- C:\Program Files\OpenAL 2008-08-13 22:11 . 2008-08-13 22:15 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-13 22:11 . 2008-08-13 22:15 110,592 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-11 19:14 . 2008-08-12 21:07 <DIR> d-------- C:\Program Files\DC++ 2008-08-08 17:39 . 2008-08-08 17:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-08-08 17:38 . 2008-08-08 17:38 <DIR> d-------- C:\Program Files\BFG 2008-08-07 17:32 . 2008-08-07 17:32 36 --a------ C:\WINDOWS\Tiny_Run.ini 2008-08-04 22:22 . 2008-08-04 22:22 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Media Player Classic 2008-08-04 22:21 . 2008-08-04 22:21 <DIR> d-------- C:\Program Files\Real Alternative 2008-08-04 22:12 . 2008-08-04 22:12 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-30 19:25 . 2008-07-30 19:26 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Moje pliki Bitwy o Śródziemie™ II 2008-07-29 22:27 . 2008-07-29 22:27 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Microsoft Games 2008-07-27 20:13 . 2008-07-27 20:13 4 --a------ C:\WINDOWS\system32\proc-503976190.bin 2008-07-27 18:56 . 2008-07-27 18:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-07-27 17:42 . 2008-07-27 17:42 <DIR> d-------- C:\Program Files\IVT Corporation . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-20 21:39 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-18 07:06 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Tlen.pl 2008-08-16 11:34 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-08 10:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-07-27 18:13 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\GanymedeNet 2008-07-13 17:59 --------- d-----w C:\Program Files\Illustrate 2008-07-13 17:59 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\AccurateRip 2008-07-13 17:58 5,052,280 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2008-07-06 17:22 --------- d-----w C:\Program Files\Ganymede 2008-07-06 16:57 --------- d-----w C:\Program Files\Microsoft.NET 2008-07-04 16:38 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-07-02 07:07 --------- d-----w C:\Program Files\Common Files\NSV 2008-07-02 07:05 --------- d-----w C:\Program Files\Winamp 2008-07-02 07:05 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Winamp 2008-07-01 21:27 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-07-01 21:15 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Nero 2008-07-01 21:13 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-07-01 21:11 --------- d-----w C:\Program Files\Nero 2008-07-01 21:11 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-01 21:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-07-01 21:08 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-07-01 21:07 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\DAEMON Tools 2008-07-01 20:45 --------- d-----w C:\Program Files\BitComet 2008-07-01 20:45 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Symantec . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-01-08 12:25 2124088] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 01:09 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 15:36 2169368] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-11-28 10:45 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-11-28 10:45 81920] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008] "nwiz"="nwiz.exe" [2007-11-28 10:45 1626112 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-22 20:42 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 15:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-09-20 09:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0] --a------ 2007-03-28 21:41 2037352 C:\Program Files\Norton Ghost\Agent\VProTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0x00000000" "UpdatesDisableNotify"="0x00000000" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "F:\\Gry\\PES2008\\PES2008.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2main.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2main_amdxp.exe"= "F:\\Gry\\Neverwinter Nights\\nwupdate.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2server.exe"= "F:\\Gry\\Stronghold 2\\Stronghold2.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "F:\\Gry\\Rise\\thrones.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8283:TCP"= 8283:TCP:BitComet 8283 TCP "8283:UDP"= 8283:UDP:BitComet 8283 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 17:23] R2 Start BT in service;Start BT in service;C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [2007-12-27 15:39] *Newly Created Service* - CATCHME *Newly Created Service* - OSE *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-21 19:49:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-21 19:50:02 ComboFix-quarantined-files.txt 2008-08-21 17:49:56 ComboFix2.txt 2008-08-21 17:42:21 ComboFix3.txt 2008-08-21 17:37:41 ComboFix4.txt 2008-08-21 17:33:35 Pre-Run: 13,696,950,272 bajtów wolnych Post-Run: 13,686,390,784 bajtów wolnych 205

**Posty:** 684 · przez **djarta** 21 Sie 2008, 19:55

C:\WINDOWS\system32\hayo.dll

Nie podoba mi się ten plik.

Sprawdź go na --> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

=====================
K.

**Posty:** 24 · przez **moniarm** 21 Sie 2008, 19:59

Skanowałam tym pierwszym.

Kod: Zaznacz wszystko: Scanner results Scan taken on 21 Aug 2008 17:57:12 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found Trojan.Bho.Gcr Avast Found nothing AVG Antivirus Found nothing BitDefender Found Trojan.BHO.OBV ClamAV Found Trojan.BHO-3678 CPsecure Found Troj.Clicker.W32.BHO.H Dr.Web Found Trojan.Fakealert.1231 F-Prot Antivirus Found nothing F-Secure Anti-Virus Found Trojan.Win32.BHO.gcr Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found Trojan.Win32.BHO.gcr NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found Mal/FakeVir-E VirusBuster Found nothing VBA32 Found nothing

**Posty:** 684 · przez **djarta** 21 Sie 2008, 20:03

Usuń ten plik ręcznie lub:

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\hayo.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

======================
K.

**Posty:** 24 · przez **moniarm** 21 Sie 2008, 20:10

C:\Qoobox. - usunęłam

Kod: Zaznacz wszystko: ComboFix 08-08-19.06 - slawek 2008-08-21 20:05:43.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1354 [GMT 2:00] Running from: C:\Documents and Settings\slawek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\slawek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\hayo.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\hayo.dll C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_NPF -------\Service_Binary file SvcDump matches ((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))) . 2008-08-21 20:04 . 2008-08-21 20:04 <DIR> d-------- C:\Program Files\Operation Mania 2008-08-21 18:57 . 2008-08-21 18:57 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-21 18:38 . 2008-08-21 18:46 <DIR> d-------- C:\Program Files\SkanerOnline 2008-08-20 21:40 . 2008-08-20 21:40 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Pogo Games 2008-08-20 21:38 . 2008-08-20 21:38 <DIR> d-------- C:\Program Files\Oberon Media 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\iTunes 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\iPod 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Program Files\Bonjour 2008-08-20 21:31 . 2008-08-20 21:31 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Apple Computer 2008-08-20 21:29 . 2008-08-20 21:30 <DIR> d-------- C:\Program Files\QuickTime 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Program Files\Apple Software Update 2008-08-20 21:29 . 2008-08-20 21:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-08-20 21:29 . 2008-08-20 21:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-08-20 20:17 . 2008-08-20 20:17 <DIR> d-------- C:\Program Files\Shockwave.com 2008-08-19 23:01 . 2008-08-19 23:01 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-17 14:26 . 2008-08-17 14:26 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\PlayFirst 2008-08-17 14:26 . 2008-08-17 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2008-08-17 11:32 . 2008-08-17 11:32 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-08-17 11:31 . 2008-08-17 14:25 <DIR> d-------- C:\Program Files\Yahoo! Games 2008-08-17 11:15 . 2008-08-20 18:57 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-08-17 09:43 . 2008-08-17 09:45 <DIR> d-------- C:\Program Files\Wonderland Adventures 2008-08-17 09:43 . 2008-08-17 09:43 <DIR> d-------- C:\Program Files\ReflexiveArcade 2008-08-16 21:03 . 2008-08-16 21:37 <DIR> d-------- C:\Program Files\GameHouse 2008-08-16 17:05 . 2008-08-16 17:05 <DIR> d-------- C:\WINDOWS\Go-Go Gourmet 2 - Chef of the Year 2008-08-16 17:05 . 2008-08-16 17:05 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Go-Go Gourmet Chef of the Year 2008-08-16 13:35 . 2008-08-16 14:11 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\The Hobbit 2008-08-15 21:15 . 2008-08-15 21:15 <DIR> d-------- C:\WINDOWS\Sun 2008-08-15 21:15 . 2008-08-15 21:15 <DIR> d-------- C:\Program Files\Java 2008-08-15 21:15 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-15 21:14 . 2008-08-15 21:14 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-15 07:33 . 2008-08-15 07:33 <DIR> d-------- C:\Program Files\GXTranscoder v2 2008-08-15 07:33 . 2008-08-15 07:33 115,545 --a------ C:\WINDOWS\GXTranscoder v2 Uninstaller.exe 2008-08-13 22:16 . 2008-08-13 22:16 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-08-13 22:16 . 2008-08-13 22:16 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-13 22:15 . 2008-08-13 22:15 <DIR> d-------- C:\Program Files\AGEIA Technologies 2008-08-13 22:11 . 2008-08-13 22:11 <DIR> d-------- C:\Program Files\OpenAL 2008-08-13 22:11 . 2008-08-13 22:15 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-13 22:11 . 2008-08-13 22:15 110,592 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-11 19:14 . 2008-08-12 21:07 <DIR> d-------- C:\Program Files\DC++ 2008-08-08 17:39 . 2008-08-08 17:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-08-08 17:38 . 2008-08-08 17:38 <DIR> d-------- C:\Program Files\BFG 2008-08-07 17:32 . 2008-08-07 17:32 36 --a------ C:\WINDOWS\Tiny_Run.ini 2008-08-04 22:22 . 2008-08-04 22:22 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Media Player Classic 2008-08-04 22:21 . 2008-08-04 22:21 <DIR> d-------- C:\Program Files\Real Alternative 2008-08-04 22:12 . 2008-08-04 22:12 <DIR> d-------- C:\Program Files\Alwil Software 2008-07-30 19:25 . <DIR> C:\Documents and Settings\slawek\Dane aplikacji\Moje pliki Bitwy o —r˘dziemiet II 2008-07-29 22:27 . 2008-07-29 22:27 <DIR> d-------- C:\Documents and Settings\slawek\Dane aplikacji\Microsoft Games 2008-07-27 20:13 . 2008-07-27 20:13 4 --a------ C:\WINDOWS\system32\proc-503976190.bin 2008-07-27 18:56 . 2008-07-27 18:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-07-27 17:42 . 2008-07-27 17:42 <DIR> d-------- C:\Program Files\IVT Corporation . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 18:07 42,512 ----a-w C:\WINDOWS\system32\drivers\npf.sys 2008-08-21 18:07 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-18 07:06 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Tlen.pl 2008-08-16 11:34 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-08 10:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-07-30 17:26 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Moje pliki Bitwy o Śródziemie™ II 2008-07-27 18:13 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\GanymedeNet 2008-07-13 17:59 --------- d-----w C:\Program Files\Illustrate 2008-07-13 17:59 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\AccurateRip 2008-07-13 17:58 5,052,280 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2008-07-06 17:22 --------- d-----w C:\Program Files\Ganymede 2008-07-06 16:57 --------- d-----w C:\Program Files\Microsoft.NET 2008-07-04 16:38 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-07-02 07:07 --------- d-----w C:\Program Files\Common Files\NSV 2008-07-02 07:05 --------- d-----w C:\Program Files\Winamp 2008-07-02 07:05 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Winamp 2008-07-01 21:27 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-07-01 21:15 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Nero 2008-07-01 21:13 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-07-01 21:11 --------- d-----w C:\Program Files\Nero 2008-07-01 21:11 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-01 21:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-07-01 21:08 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-07-01 21:07 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\DAEMON Tools 2008-07-01 20:45 --------- d-----w C:\Program Files\BitComet 2008-07-01 20:45 --------- d-----w C:\Documents and Settings\slawek\Dane aplikacji\Symantec 2004-08-04 00:44 933,888 --sh--r C:\WINDOWS\system32\stdhost.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-21_19.33.23.89 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE + 2008-08-21 18:07:13 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5ec.dat + 2008-08-21 18:07:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ac.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-01-08 12:25 2124088] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 01:09 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-27 15:36 2169368] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-11-28 10:45 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-11-28 10:45 81920] "nwiz"="nwiz.exe" [2007-11-28 10:45 1626112 C:\WINDOWS\system32\nwiz.exe] "DirectX Driver"="stdhost.exe" [2004-08-04 02:44 933888 C:\WINDOWS\system32\stdhost.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "DirectX Driver"="stdhost.exe" [2004-08-04 02:44 933888 C:\WINDOWS\system32\stdhost.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-22 20:42 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 15:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-09-20 09:51 1836328 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0] --a------ 2007-03-28 21:41 2037352 C:\Program Files\Norton Ghost\Agent\VProTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "F:\\Gry\\PES2008\\PES2008.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2main.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2main_amdxp.exe"= "F:\\Gry\\Neverwinter Nights\\nwupdate.exe"= "F:\\Gry\\Neverwinter Nights\\nwn2server.exe"= "F:\\Gry\\Stronghold 2\\Stronghold2.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "F:\\Gry\\Rise\\thrones.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8283:TCP"= 8283:TCP:BitComet 8283 TCP "8283:UDP"= 8283:UDP:BitComet 8283 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 17:23] R2 Start BT in service;Start BT in service;C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [2007-12-27 15:39] S3 NPF;Netgroup Packet Filter;C:\WINDOWS\system32\drivers\npf.sys [2008-08-21 20:07] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-21 20:07:24 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\wpcap.dll 240240 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe C:\Program Files\Norton Ghost\Agent\VProSvc.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-08-21 20:08:56 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-21 18:08:54 ComboFix2.txt 2008-08-21 17:50:03 ComboFix3.txt 2008-08-21 17:42:21 ComboFix4.txt 2008-08-21 17:37:41 ComboFix5.txt 2008-08-21 18:05:34 Pre-Run: 13,556,068,352 bajtów wolnych Post-Run: 13,538,033,664 bajt˘w wolnych 220

**Posty:** 684 · przez **djarta** 21 Sie 2008, 20:16

Ja nie widzę teraz nic podejrzanego.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=========================
K.