Rookit - wyskakujący alarm na avaście - log

**Posty:** 18 · przez **MikeMitnick** 29 Cze 2009, 09:53

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:52:14, on 2009-06-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\AhnRpta.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\sm56hlpr.exe C:\Program Files\Power Manager\PM.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Documents and Settings\Użytkownik\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [bgsmsnd.exe] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [HEXelon MAX] "C:\Documents and Settings\Użytkownik\Pulpit\HEXelonMAX6\hexelon.exe" /auto O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9D5290FF-78A9-40DF-9FF6-02AAAB7810CB}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O24 - Desktop Component 0: (no name) - http://pro.hit.gemius.pl/hitredir/id=pzM7yzN88OffufVeZTSMcWXF.MhNuMwd1CcM4zFRhiP.p7/url=www.legalnywindows.pl/t/33.jpg -- End of file - 6677 bytes

co chwila w pracy wyskakują mi alarmy na avaście, nie pomagają skany i wyrzucania plików.

przykładowe ścieżki do zainfekowanych plików (tak mówi avast):

C:\s.exe
C:\DOCUME~1\UYTKOW~1\USTAWI~1\Temp\439.exe

**Posty:** 8001 · przez **Okocza** 29 Cze 2009, 10:11

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

**Posty:** 18 · przez **MikeMitnick** 29 Cze 2009, 13:03

LOG z sdfixa:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Uľytkownik on 2009-06-29 at 12:02 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\autorun.inf - Deleted C:\WINDOWS\system32\info.txt - Deleted Removing Temp Files [b]ADS Check [/b]:

LOG z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-06-28.02 - Użytkownik 2009-06-29 12:45.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1045.18.894.556 [GMT 2:00] Uruchomiony z: c:\documents and settings\Użytkownik\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1201 [VPS 081008-1] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\1f.bat C:\autorun.inf C:\d9c.bat C:\m.com C:\o.exe c:\recycler\S-1-5-21-8133061763-7937973993-402868423-8209\winmap32.exe C:\s.exe c:\windows\AhnRpta.exe c:\windows\system32\e8main0.dll c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\olhrwef.exe C:\y6yol.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AVPSYS -------\Service_AVPsys ((((((((((((((((((((((((( Pliki utworzone od 2009-05-28 do 2009-06-29 ))))))))))))))))))))))))))))))) . 2009-06-29 09:49 . 2009-06-29 10:14 -------- d-----w- C:\SDFix 2009-06-29 08:40 . 2009-06-29 08:40 -------- d-----w- c:\windows\ERUNT 2009-06-29 07:51 . 2009-06-29 07:51 106931 --sh--r- C:\n0euybx.exe 2009-06-24 09:02 . 2009-06-24 09:01 106448 --sh--r- C:\8paf1d.com 2009-06-17 08:12 . 2009-06-17 08:57 -------- d-----w- C:\MikroMap 2009-06-12 12:31 . 2009-06-12 12:35 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-06-12 12:30 . 2009-06-12 12:30 -------- d-----w- c:\program files\New Star Soccer 4 2009-06-01 07:19 . 2009-06-01 08:40 -------- d-----w- C:\RM-Win2 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-19 13:04 . 2008-07-17 09:18 -------- d-----w- c:\program files\Panda Security 2009-05-19 13:02 . 2005-12-29 22:41 -------- d-----w- c:\program files\IrfanView 2008-02-14 10:42 . 2008-02-14 10:39 24 --sh--w- c:\windows\S5271BA6A.tmp 2008-02-08 08:44 . 2008-02-08 08:44 952 --sha-w- c:\windows\system32\KGyGaAvL.sys . ------- Sigcheck ------- [7] 2004-08-04 12:00 14336 BA98327E90022DBD6EE76490E0622E2E c:\windows\system32\svchost.exe [7] 2004-08-04 12:00 14336 BA98327E90022DBD6EE76490E0622E2E c:\windows\system32\dllcache\svchost.exe [7] 2005-03-02 18:21 578560 6A93565BE9B8422EB7538C66AC732D76 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll [7] 2007-03-08 15:51 579584 11ABDECC02EFC1D2B6A6A0FA46C26594 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll [7] 2004-08-04 12:00 578560 0C81764F50F32D376E6E4B9E9F4B01A0 c:\windows\$NtUninstallKB890859$\user32.dll [7] 2005-03-02 18:18 578560 B7EEB1A1AF740306049241DDF61F21FF c:\windows\$NtUninstallKB925902$\user32.dll [7] 2007-03-08 15:38 579072 A37A4637F84F8DD771274EAF8D17FA65 c:\windows\system32\user32.dll [7] 2007-03-08 15:38 579072 A37A4637F84F8DD771274EAF8D17FA65 c:\windows\system32\dllcache\user32.dll [7] 2004-08-04 12:00 82944 AB82237486B727DD7DAB36A76F38A3A2 c:\windows\system32\ws2_32.dll [7] 2004-08-04 12:00 82944 AB82237486B727DD7DAB36A76F38A3A2 c:\windows\system32\dllcache\ws2_32.dll [7] 2005-05-02 20:59 661504 0B92C1CD30226986880B017BF0D13CC9 c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll [7] 2005-10-21 03:39 664064 720005547AE4E3002CA171B50141F0ED c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll [7] 2007-03-07 17:40 823296 E3911D7D15C573A703EEB8A70FAD7211 c:\windows\$hf_mig$\KB931768-IE7\SP2QFE\wininet.dll [7] 2007-04-25 08:35 823808 A190E374FBD24CA43C62B341C39FB355 c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll [7] 2007-06-27 14:14 824320 1A995365F0D222E436207F2FF0B844BA c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll [7] 2004-08-04 12:00 658944 D37DAFB534AC8343D59A1B501ABE852C c:\windows\$NtUninstallKB883939$\wininet.dll [7] 2005-05-02 20:57 660480 41268F49C839FC5042A9BC06F6CBF8A7 c:\windows\$NtUninstallKB905915$\wininet.dll [7] 2005-10-21 03:42 660992 406F49324AF7B16C9F896E36851BE621 c:\windows\$NtUninstallKB912812$\wininet.dll [7] 2006-03-04 04:01 666112 29F9CFD7C62B188E9E580455A5388880 c:\windows\$NtUninstallKB916281$\wininet.dll [7] 2006-05-10 05:27 666112 D11493E5AC4AB399BCD28130E158A56B c:\windows\$NtUninstallKB918899$\wininet.dll [7] 2006-06-23 11:27 667136 9DF7509E4CA980A1C68CF737FEBB6017 c:\windows\$NtUninstallKB922760$\wininet.dll [7] 2006-09-14 08:37 667136 0228190B1B080B777D60CA62910DCC2C c:\windows\$NtUninstallKB925454$\wininet.dll [7] 2006-10-23 15:35 667136 94C7BC5C38CCBFE9F23EDFBD680AC3D5 c:\windows\ie7\wininet.dll [7] 2006-11-07 20:03 818688 92995334F993E6E49C25C6D02EC04401 c:\windows\ie7updates\KB928090-IE7\wininet.dll [7] 2007-01-12 08:27 822784 BE43D00D802C92F01C8CC952C6F483F8 c:\windows\ie7updates\KB931768-IE7\wininet.dll [7] 2007-03-07 17:42 822784 20AE658FB42B4862EA3DB2ADDFA58492 c:\windows\ie7updates\KB933566-IE7\wininet.dll [7] 2007-04-25 07:44 822784 307450BB7171F98F729608C8651C03AB c:\windows\ie7updates\KB937143-IE7\wininet.dll [-] 2007-08-20 10:01 824832 EE0D310C577662B6219C0643B17C4150 c:\windows\SoftwareDistribution\Download\8db9b23c0840fb4d2e10e678fa519386\sp2gdr\wininet.dll [-] 2007-08-20 09:51 825344 9D6DA6A9C682C5156B1E6BBAAD6592F9 c:\windows\SoftwareDistribution\Download\8db9b23c0840fb4d2e10e678fa519386\sp2qfe\wininet.dll [7] 2007-06-27 14:09 823808 6D866EDD24FF7D48E6F1D72F9E5FEA52 c:\windows\system32\wininet.dll [7] 2007-06-27 14:09 823808 6D866EDD24FF7D48E6F1D72F9E5FEA52 c:\windows\system32\dllcache\wininet.dll [7] 2004-08-04 12:00 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB884020$\tcpip.sys [7] 2004-08-13 22:50 359040 4092C56967175F009DC8458DC434358E c:\windows\$NtUninstallKB893066$\tcpip.sys [7] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$NtUninstallKB913446$\tcpip.sys [7] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$NtUninstallKB917953$\tcpip.sys [7] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\system32\dllcache\tcpip.sys [7] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\system32\drivers\tcpip.sys [7] 2004-08-04 12:00 504832 0344407089B08548D4FEBA62BB0F32D0 c:\windows\system32\winlogon.exe [7] 2004-08-04 12:00 504832 0344407089B08548D4FEBA62BB0F32D0 c:\windows\system32\dllcache\winlogon.exe [7] 2004-08-04 12:00 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\dllcache\ndis.sys [7] 2004-08-04 12:00 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\drivers\ndis.sys [7] 2004-08-04 12:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\dllcache\ip6fw.sys [7] 2004-08-04 12:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys [7] 2005-03-02 09:14 2058240 35D11FDC381536AB95E3005489131F44 c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe [7] 2006-12-19 18:47 2060672 4A447A38F3D164BB634D20D0A2C6833B c:\windows\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe [7] 2007-02-28 16:09 2060672 2F4A36B1B03D64FB176CB0F3EB597118 c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe [7] 2004-08-04 12:00 2058112 44D1BC1B05E0C7C82E81687B79C653C7 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe [7] 2005-03-02 18:08 2058112 0F6990820C6CE0A7A911FAE5937EF1F6 c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe [7] 2006-12-19 18:24 2058880 3D50D5DB6343C789A75523714C8AB8C2 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe [7] 2007-02-28 16:04 2058880 2BDC1A6CEFE320E9C39FABF1961EBB9D c:\windows\Driver Cache\i386\ntkrnlpa.exe [7] 2007-02-28 16:04 2058880 2BDC1A6CEFE320E9C39FABF1961EBB9D c:\windows\system32\ntkrnlpa.exe [7] 2007-02-28 16:04 2058880 2BDC1A6CEFE320E9C39FABF1961EBB9D c:\windows\system32\dllcache\ntkrnlpa.exe [7] 2005-03-02 18:14 2180864 DBA3E4215279C8012B37D2135B531258 c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe [7] 2006-12-19 18:47 2183296 745C1A081AA663EA324E87432C244F70 c:\windows\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe [7] 2007-02-28 16:09 2183424 C450518EF9ACC02A2D799698021E31A8 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe [7] 2004-08-04 12:00 2182272 DCF53422B7EDDED3B7431FBAE4A7EE3F c:\windows\$NtUninstallKB890859$\ntoskrnl.exe [7] 2005-03-02 18:09 2180608 3F3612846D67352468D2286FC23FB0C2 c:\windows\$NtUninstallKB929338$\ntoskrnl.exe [7] 2006-12-19 18:24 2181632 0DE4E7F68803B29526ED89F6C0DD013C c:\windows\$NtUninstallKB931784$\ntoskrnl.exe [7] 2007-02-28 16:04 2181632 C378BE3A1EDC5E4421D428655AC4A48C c:\windows\Driver Cache\i386\ntoskrnl.exe [7] 2007-02-28 16:04 2181632 C378BE3A1EDC5E4421D428655AC4A48C c:\windows\system32\ntoskrnl.exe [7] 2007-02-28 16:04 2181632 C378BE3A1EDC5E4421D428655AC4A48C c:\windows\system32\dllcache\ntoskrnl.exe [7] 2007-06-13 13:12 1034752 8DB0650B211425B9CDB7D1C4A8F6B482 c:\windows\explorer.exe [7] 2004-08-04 12:00 1033728 379098A96E6C165B659DE7E4328010EA c:\windows\$NtUninstallKB884883$\explorer.exe [7] 2005-04-07 18:48 1033728 05412646FA6EA684AF560D9984AE4E88 c:\windows\$NtUninstallKB938828$\explorer.exe [7] 2007-06-13 13:12 1034752 8DB0650B211425B9CDB7D1C4A8F6B482 c:\windows\system32\dllcache\explorer.exe [7] 2004-08-04 12:00 108544 3DA8D964D2CC12EF8E8C342471A37917 c:\windows\system32\services.exe [7] 2004-08-04 12:00 108544 3DA8D964D2CC12EF8E8C342471A37917 c:\windows\system32\dllcache\services.exe [7] 2004-08-04 12:00 13312 F485FEFC8CC4FD29243D800BE5D275D1 c:\windows\system32\lsass.exe [7] 2004-08-04 12:00 13312 F485FEFC8CC4FD29243D800BE5D275D1 c:\windows\system32\dllcache\lsass.exe [7] 2004-08-04 12:00 15360 CBFA30492D70CE3938D8A7783D0C0436 c:\windows\system32\ctfmon.exe [7] 2004-08-04 12:00 15360 CBFA30492D70CE3938D8A7783D0C0436 c:\windows\system32\dllcache\ctfmon.exe [7] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe [7] 2004-08-04 12:00 57856 BEBE8A85954FF460374FD5A0CD21E19B c:\windows\$NtUninstallKB896423$\spoolsv.exe [7] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe [7] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\dllcache\spoolsv.exe [7] 2007-07-30 17:19 53080 F3E9065EB617A7E3A832A7976BFA021B c:\windows\system32\wuauclt.exe [7] 2007-07-30 17:19 53080 F3E9065EB617A7E3A832A7976BFA021B c:\windows\system32\dllcache\wuauclt.exe [7] 2004-08-04 12:00 25088 BD768099B4C44AA631728CB74EB54396 c:\windows\system32\userinit.exe [7] 2004-08-04 12:00 25088 BD768099B4C44AA631728CB74EB54396 c:\windows\system32\dllcache\userinit.exe [7] 2004-08-04 12:00 296448 2C28157229925280916B3041CCC5FE4B c:\windows\system32\termsrv.dll [7] 2004-08-04 12:00 296448 2C28157229925280916B3041CCC5FE4B c:\windows\system32\dllcache\termsrv.dll [7] 2006-07-05 10:58 1013760 0139C7F85C0B3BBA2ABA93404A523276 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll [7] 2007-04-16 16:11 1014784 D8ACC0B8C46FC756E3F64C14EAF9CE8F c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll [7] 2004-08-04 12:00 1012224 578BB2F44597CB53451DED99013573F3 c:\windows\$NtUninstallKB917422$\kernel32.dll [7] 2006-07-05 10:56 1012736 F46E92BB377A01C8911B60A83FE947BF c:\windows\$NtUninstallKB935839$\kernel32.dll [7] 2007-04-16 15:54 1013248 C0AAFEE37EE787D9609D9FE00FA427F8 c:\windows\system32\kernel32.dll [7] 2007-04-16 15:54 1013248 C0AAFEE37EE787D9609D9FE00FA427F8 c:\windows\system32\dllcache\kernel32.dll [7] 2004-08-04 12:00 17408 B20BB2A65349EF132FA7F2EB51A29E5C c:\windows\system32\powrprof.dll [7] 2004-08-04 12:00 17408 B20BB2A65349EF132FA7F2EB51A29E5C c:\windows\system32\dllcache\powrprof.dll [7] 2004-08-04 12:00 110080 BDB679C04273B19BF46BD0D591FDEEC3 c:\windows\system32\imm32.dll [7] 2004-08-04 12:00 110080 BDB679C04273B19BF46BD0D591FDEEC3 c:\windows\system32\dllcache\imm32.dll [7] 2004-08-04 12:00 1548288 F044A12CFFB8E58BC044A2605283A636 c:\windows\system32\sfcfiles.dll [7] 2004-08-04 12:00 1548288 F044A12CFFB8E58BC044A2605283A636 c:\windows\system32\dllcache\sfcfiles.dll [7] 2004-08-03 23:38 24960 CC13DB862F929AE33F64C3BEDC01CD31 c:\windows\system32\dllcache\kbdclass.sys [7] 2004-08-03 23:38 24960 CC13DB862F929AE33F64C3BEDC01CD31 c:\windows\system32\drivers\kbdclass.sys [7] 2004-08-04 12:00 24960 CC13DB862F929AE33F64C3BEDC01CD31 c:\windows\system32\ReinstallBackups\0000\DriverFiles\i386\kbdclass.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 79224] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 155648] "PowerManager"="c:\program files\Power Manager\PM.exe" [2005-08-19 163840] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "bgsmsnd.exe"="c:\windows\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe" [2007-07-09 109624] "SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-08-01 544768] "SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-05-17 77824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] backup=c:\windows\pss\DSLMON.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DVD@ccess.lnk] backup=c:\windows\pss\DVD@ccess.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] backup=c:\windows\pss\Kalendarz XP.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD LT.lnk] backup=c:\windows\pss\Przyspieszenie uruchomienia programu AutoCAD LT.lnkCommon Startup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-09 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-09 20560] R2 athsgt;athsgt;c:\windows\system32\drivers\athsgt.sys [2007-05-24 164992] R2 DVDAccss;DVDAccss;c:\windows\system32\drivers\DVDAccss.sys [2006-06-12 29156] R2 limsgt;limsgt;c:\windows\system32\drivers\limsgt.sys [2007-05-24 12544] R3 EKBfltr;ENE Keyboard Controller;c:\windows\system32\drivers\EKBfltr.sys [2005-10-20 5504] S1 ntiomin;ntiomin; [x] S3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\DRIVERS\adiusbae.sys --> c:\windows\system32\DRIVERS\adiusbae.sys [?] S3 cglptnt;cglptnt;c:\totalcmd\CGLPTNT.SYS [2008-07-02 7888] S3 HPZs2k12;Storage Class Driver for IEEE-1284.4 (HPZ12);c:\windows\system32\Drivers\hpzs2k12.sys --> c:\windows\system32\Drivers\hpzs2k12.sys [?] S3 MMIOPORT;MMIOPORT;c:\windows\system32\drivers\MMIOPORT.SYS [2008-07-03 7424] S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [2009-02-12 18432] S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - WINIO [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-HEXelon MAX - c:\documents and settings\Użytkownik\Pulpit\HEXelonMAX6\hexelon.exe . ------- Skan uzupełniający ------- . uStart Page = about:blank uInternet Connection Wizard,ShellNext = iexplore IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 TCP: {9D5290FF-78A9-40DF-9FF6-02AAAB7810CB} = 194.204.159.1,194.204.152.34 DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game10.zylom.com/activex/zylomgamesplayer.cab DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} - hxxp://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-29 12:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,22,0f,6c,5f,a5, fa,f0,9c,e2,63,26,f1,3f,c8,ff,68,ef,77,a2,40,e1,eb,c1,a7,e2,63,26,f1,3f,c8,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,12,e8,fd,20,91, 73,9d,42,6a,9c,d6,61,af,45,84,18,66,97,01,61,88,62,d1,75,6a,9c,d6,61,af,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,b7,ab,a8,86,3c, 34,96,ab,ff,7c,85,e0,43,d4,0e,fe,27,fe,b3,92,a6,4f,55,1c,ff,7c,85,e0,43,d4,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,bc,7a,87,d9,f4, b5,fe,a0,86,8c,21,01,be,91,eb,e7,8d,97,57,6a,94,33,1f,d7,86,8c,21,01,be,91,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,31,f4,69,51,14, 2e,32,d7,f5,1d,4d,73,a8,13,5c,05,85,c6,74,34,3f,5f,38,9e,f5,1d,4d,73,a8,13,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,fc,de,56,da,a2, 45,18,83,df,20,58,62,78,6b,cf,c8,01,00,e9,b9,7f,2f,33,d7,df,20,58,62,78,6b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,1c,a2,38,91,97, 20,ce,1f,fb,a7,78,e6,12,2f,9a,ea,5a,fc,11,60,ef,80,ad,ec,fb,a7,78,e6,12,2f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,5c,8d,8d,99,1d, ed,b7,cb,01,3a,48,fc,e8,04,4a,f1,76,00,c2,ec,9b,dc,7e,97,01,3a,48,fc,e8,04,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,cd,d8,74,a8,78, 2d,69,ff,f6,0f,4e,58,98,5b,89,c9,32,17,b6,ff,5b,29,94,6c,f6,0f,4e,58,98,5b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,a4,20,70,e0,d3, 05,c2,d2,3d,ce,ea,26,2d,45,aa,78,4f,33,a8,18,75,64,da,3d,3d,ce,ea,26,2d,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,e6,97,a1,2d,ce, f9,c1,08,2a,b7,cc,b5,b9,7f,41,e7,09,5e,25,f6,06,7c,ea,56,2a,b7,cc,b5,b9,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,3b,97,cd,db,64, 14,11,9d,6c,43,2d,1e,aa,22,2f,9c,f7,5e,0d,8f,e6,be,37,81,6c,43,2d,1e,aa,22,\ [HKEY_LOCAL_MACHINE\software\Xanthic\{001706C5-92AF-BAD2-5C4C-4F4DC4DEC48D}*_] "fr"="078E66525D5146" "lr"="078E58755A5146" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(772) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(1524) c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\tcpsvcs.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-06-29 13:03 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-06-29 11:01 Przed: 64 244 289 536 bajtów wolnych Po: 64 404 652 032 bajtów wolnych 311 --- E O F --- 2007-09-12 15:04

log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:08:18, on 2009-06-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\sm56hlpr.exe C:\Program Files\Power Manager\PM.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Użytkownik\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [bgsmsnd.exe] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9D5290FF-78A9-40DF-9FF6-02AAAB7810CB}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O24 - Desktop Component 0: (no name) - http://pro.hit.gemius.pl/hitredir/id=pzM7yzN88OffufVeZTSMcWXF.MhNuMwd1CcM4zFRhiP.p7/url=www.legalnywindows.pl/t/33.jpg -- End of file - 6204 bytes

**Posty:** 8001 · przez **Okocza** 29 Cze 2009, 13:13

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Kod: Zaznacz wszystko: Files to delete: C:\n0euybx.exe C:\8paf1d.com

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z RSIT

poza tym log z sdfixa jest urwany

**Posty:** 18 · przez **MikeMitnick** 29 Cze 2009, 13:20

Nie widzę tej lupki z prawej strony ani opcji Input script manually. Mam jedno okno The Avenger, i miejsce gdzie mogę wkleić to o czym piszesz (okienko ma na dole przycisk execute). Ale lupy i tej opcji brak.

**Posty:** 8001 · przez **Okocza** 29 Cze 2009, 13:26

MikeMitnick, w nowej wersji programu wklejasz w to okienko ktore masz po uruchomieniu programu