Czerwona Tapeta Z Napisem: "your Privacy Is In Danger!"

[Holden]

Jak w temacie, mam czerwoną tapetę z napisem "YOUR PRIVACY IS IN DANGER!".... i ogólnie cały komp się zaczął mulić, poza tym na pulpicie pojawiły się chyba 3 skróty niby programów anty spyware, ale są to skróty do jakiś linków które po usunięciu pojawiają się znowu jak ponownie uruchomie komputer. Jedynie pozbyłem się takiego czerwonego krzyżyka w pasku z wyskakującymi dymkami i takich wyskakujących okien z jakimiś pytaniami.... no i może troche mniej już muli, ale tapeta i te skróty ciągle są :/:/ Z góry bardzo dziękuje za pomoc 8O

 

Pozdrawiam

 

Log z HijackThis:

 

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 23:51, on 2008-04-23Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exeC:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\SoundMAX\Smax4.exeC:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exeC:\Program Files\Opera\Opera.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2"]http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2[/url]R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ŁączaO2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLLO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /trayO4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"O4 - HKCU\..\Run: [P2kAutostart] D:\Moje Dokumenty\Motorola E1000\p2kCommander V3\P2kAutostart.exeO4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - [url="http://www.creative.com/su2/CTL_V02002/ocx/15033/CTPID.cab"]http://www.creative.com/su2/CTL_V02002/ocx/15033/CTPID.cab[/url]O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO21 - SSODL: vadokmxt - {E111AAE5-1466-4621-A591-F1A6E4C74F6B} - C:\WINDOWS\vadokmxt.dllO23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exeO23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exeO23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exeO24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm--End of file - 4969 bytes

 

Log z SmitfraudFix (2 opcja):

 

SmitFraudFix v2.317Scan done at 19:25:33,31, 2008-04-23Run from C:\USUWANIE SYFU!\SmitfraudFixOS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NTThe filesystem type is FAT32Fix run in safe mode»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix!!!Attention, following keys are not inevitably infected!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Killing process»»»»»»»»»»»»»»»»»»»»»»»» hosts127.0.0.1  localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFixVACFixCredits: Malware Analysis & DiagnosticCode: S!RiC:\WINDOWS\qnmargolewk.dll deleted.C:\WINDOWS\dpevflbg.dll deleted.C:\WINDOWS\wdpoefan.dll deleted.»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 FixS!Ri's WS2Fix: LSP not Found.»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!Ri»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected filesC:\WINDOWS\privacy_danger\ Deleted»»»»»»»»»»»»»»»»»»»»»»»» IEDFixIEDFixCredits: Malware Analysis & DiagnosticCode: S!Ri»»»»»»»»»»»»»»»»»»»»»»»» 404Fix404FixCredits: Malware Analysis & DiagnosticCode: S!Ri»»»»»»»»»»»»»»»»»»»»»»»» DNS»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System!!!Attention, following keys are not inevitably infected!!![HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]"System"=""»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done.  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix!!!Attention, following keys are not inevitably infected!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» End

[ULLISSES]

! O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

! O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)

! O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)

 

? O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe

? O21 - SSODL: vadokmxt - {E111AAE5-1466-4621-A591-F1A6E4C74F6B} - C:\WINDOWS\vadokmxt.dll

Legenda:

! - zbędne

? - nie wiem co to ;]

 

Log z SF wygląda na czysty - tzn że SF posprzątał.

 

Proponuję ściągnąc XPAntispy i powyłączać zbędne rzeczy, a głównie ActiveDestkop.

[Kolobos]

Powinienes napisac tutaj: http://forum.purepc.pl/forum/Centrum-Bezpieczenstwa/104/ !

Daj log z combofix.

[Holden]

No żeczywiście troche pomyliłem działy. W XP-AntiSpy nie było opcji żeby wyłączyć ActiveDesktop ale już sobie poradziłem jakoś z tą tapetą, z tymi okienkami i z tymi skrótami na pulpicie. Ten plik C:\WINDOWS\vadokmxt.dll miał trojana i kaspersky go usunął. Teraz wydaje się ze jest wszystko OK, ale jeszcze dla pewności daje LOG z Combofix:

 

ComboFix 08-04-22.5 - Holden 2008-04-24 13:34:36.3 - <strong class='bbc'>FAT32</strong>x86Running from: C:\USUWANIE SYFU!\ComboFix.exe<strong class='bbc'>WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!</strong>.(((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))).C:\Documents and Settings\Holden\Ulubione\Error Cleaner.urlC:\Documents and Settings\Holden\Ulubione\Privacy Protector.urlC:\Documents and Settings\Holden\Ulubione\Spyware&Malware Protection.urlC:\WINDOWS\privacy_dangerC:\WINDOWS\privacy_danger\images\capt.gifC:\WINDOWS\privacy_danger\images\danger.jpgC:\WINDOWS\privacy_danger\images\down.gifC:\WINDOWS\privacy_danger\images\spacer.gifC:\WINDOWS\privacy_danger\index.htm.(((((((((((((((((((((((((   Files Created from 2008-03-24 to 2008-04-24  ))))))))))))))))))))))))))))))).2008-04-23 19:25 . 2007-09-06 00:22	289,144	--a------	C:\WINDOWS\system32\VCCLSID.exe2008-04-23 19:25 . 2006-04-27 17:49	288,417	--a------	C:\WINDOWS\system32\SrchSTS.exe2008-04-23 19:25 . 2008-04-14 19:28	86,528	--a------	C:\WINDOWS\system32\VACFix.exe2008-04-23 19:25 . 2008-04-23 08:12	82,944	--a------	C:\WINDOWS\system32\IEDFix.exe2008-04-23 19:25 . 2008-04-23 08:12	82,944	--a------	C:\WINDOWS\system32\404Fix.exe2008-04-23 19:25 . 2003-06-05 21:13	53,248	--a------	C:\WINDOWS\system32\Process.exe2008-04-23 19:25 . 2004-07-31 18:50	51,200	--a------	C:\WINDOWS\system32\dumphive.exe2008-04-23 19:25 . 2007-10-04 00:36	25,600	--a------	C:\WINDOWS\system32\WS2Fix.exe2008-04-23 19:25 . 2008-04-23 19:25	2,004	--a------	C:\WINDOWS\system32\tmp.reg2008-04-23 19:24 . 2008-04-23 19:24	<DIR>	d--hs----	C:\FOUND.0112008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--h-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Ustawienia lokalne2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Ulubione2008-04-23 19:08 . 2006-08-07 10:56	<DIR>	d--h-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Szablony2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Pulpit2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Moje dokumenty2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	dr-------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Menu Start2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	dr-h-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Dane aplikacji2008-04-23 19:08 . 2008-04-23 19:08	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB0262008-04-23 19:08 . 2008-04-23 23:32	1,024	--ah-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\NTUSER.DAT.LOG2008-04-23 19:00 . 2008-04-23 19:00	<DIR>	d--------	C:\_OTMoveIt2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Ustawienia lokalne2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator\Ulubione2008-04-23 18:58 . 2006-08-07 10:56	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Szablony2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator\Pulpit2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator\Moje dokumenty2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	dr-------	C:\Documents and Settings\Administrator\Menu Start2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	dr-h-----	C:\Documents and Settings\Administrator\Dane aplikacji2008-04-23 18:58 . 2008-04-23 18:58	<DIR>	d--------	C:\Documents and Settings\Administrator2008-04-23 18:58 . 2008-04-23 23:32	1,024	--ah-----	C:\Documents and Settings\Administrator\NTUSER.DAT.LOG2008-04-23 18:43 . 2008-04-23 18:43	<DIR>	d--------	C:\USUWANIE SYFU!2008-04-23 18:27 . 2008-04-23 18:27	<DIR>	d--------	C:\fixwareout2008-04-23 18:20 . 2008-04-23 18:20	<DIR>	d--------	C:\Program Files\Trend Micro2008-04-23 18:15 . 2008-04-23 18:15	413	--a------	C:\Fix.reg2008-04-23 17:55 . 2008-04-23 17:55	<DIR>	d--------	C:\Documents and Settings\Holden\Dane aplikacji\TmpRecentIcons2008-04-23 15:48 . 2008-04-23 14:19	102,400	--a------	C:\WINDOWS\olgdqarf.exe2008-04-23 15:48 . 2008-04-23 14:19	90,112	--a------	C:\WINDOWS\wxvgsdbq.exe2008-04-08 23:35 . 2008-04-08 23:35	<DIR>	d--------	C:\Program Files\MP3 CD Converter Professional2008-04-08 23:35 . 2008-04-08 23:35	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\TEMP2008-04-08 23:28 . 2008-04-08 23:28	<DIR>	d--------	C:\Program Files\MIKSOFT2008-04-08 22:27 . 2008-04-23 14:28	54,156	--ah-----	C:\WINDOWS\QTFont.qfn2008-04-08 22:27 . 2008-04-08 22:27	1,409	--a------	C:\WINDOWS\QTFont.for.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-04-24 07:46	48,644	--sha-w	C:\WINDOWS\system32\drivers\fidbox.idx2008-04-24 07:46	3,727,360	--sha-w	C:\WINDOWS\system32\drivers\fidbox.dat2008-04-24 07:46	223,520	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.dat2008-04-24 07:46	22,028	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.idx2008-04-17 13:22	96,645	----a-w	C:\WINDOWS\system32\drivers\klin.dat2008-04-17 13:22	87,941	----a-w	C:\WINDOWS\system32\drivers\klick.dat.------- Sigcheck -------2004-08-03 23:14  359040  9f4b36614a0fc234525ba224957de55c	C:\WINDOWS\SoftwareDistribution\Download\586431add2daa2c113d0928dcedff7fc\backup\sp2gdr\tcpip.sys2004-08-03 23:14  359040  9f4b36614a0fc234525ba224957de55c	C:\WINDOWS\SoftwareDistribution\Download\586431add2daa2c113d0928dcedff7fc\backup\sp2qfe\tcpip.sys2008-01-08 20:28  359040  28f288e08a098df3c0eb6aa813bb41fd	C:\WINDOWS\system32\dllcache\tcpip.sys2008-01-08 20:27  359040  28f288e08a098df3c0eb6aa813bb41fd	C:\WINDOWS\system32\drivers\tcpip.sys.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"P2kAutostart"="D:\Moje Dokumenty\Motorola E1000\p2kCommander V3\P2kAutostart.exe" [ ]"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 12:17 340136]"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2003-07-13 02:49 155648]"SoundMax"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19 729088]"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]"UIHost"="a3logon.exe"[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"vidc.I263"= i263_32.drv"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm"VIDC.YV12"= yv12vfw.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnkbackup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Holden^Menu Start^Programy^Autostart^Xfire.lnk]path=C:\Documents and Settings\Holden\Menu Start\Programy\Autostart\Xfire.lnkbackup=C:\WINDOWS\pss\Xfire.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]--a------ 2007-06-28 12:51 218376 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]--------- 2005-10-27 11:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]--a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]--a------ 2006-11-12 12:48 157592 C:\Program Files\DAEMON Tools\daemon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]--a------ 2007-10-18 15:27 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]C:\Program Files\Messenger\msmsgs.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]--a------ 2003-07-13 02:49 155648 C:\WINDOWS\system32\NeroCheck.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]--a------ 2007-09-17 01:07 81920 C:\WINDOWS\system32\NvMcTray.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Auto Shutdown]--a------ 2006-11-24 10:11 359679 C:\Program Files\PC Auto Shutdown\AutoShutdown.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTuner]--a------ 2007-09-27 18:20 2633728 C:\Program Files\RivaTuner v2.05\RivaTuner.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]--a------ 2007-09-27 18:20 2633728 C:\Program Files\RivaTuner v2.05\RivaTuner.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]--a------ 2006-04-10 09:19 729088 C:\Program Files\Analog Devices\SoundMAX\Smax4.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]-ra------ 2006-05-01 04:07 843776 C:\Program Files\Analog Devices\Core\smax4pnp.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]--a------ 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]"PCAutoShutdown_Service"=2 (0x2)"IDriverT"=3 (0x3)[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusDisableNotify"=dword:00000001"UpdatesDisableNotify"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="C:\\Pro Evolution Soccer 2008\\PES2008.exe"="C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"54500:TCP"= 54500:TCP:Azureus port"54500:UDP"= 54500:UDP:Azureus port UDP"48342:TCP"= 48342:TCP:uTorrent[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eaaee97a-2c76-11db-ad34-00e04c1e18b0}]\Shell\AutoRun\command - G:\AutoRun.exe[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe".**************************************************************************catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url]Rootkit scan 2008-04-24 13:37:15Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPIscanning hidden processes ... scanning hidden autostart entries ...HKCU\Software\Microsoft\Windows\CurrentVersion\Run  P2kAutostart = D:\Moje Dokumenty\Motorola E1000\p2kCommander V3\P2kAutostart.exe?0??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.Completion time: 2008-04-24 13:38:02ComboFix-quarantined-files.txt  2008-04-24 11:38:02ComboFix2.txt  2008-04-23 17:06:24Pre-Run: 3,325,796,352 bajtów wolnychPost-Run: 3,313,664,000 bajtów wolnych185	--- E O F ---	2007-08-22 20:07:42

[Kolobos]

Utworz na pulpicie plik CFScript.txt i wklej do niego:

 

File::

C:\WINDOWS\olgdqarf.exe

C:\WINDOWS\wxvgsdbq.exe

 

Folder::

C:\FOUND.011

 

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"P2kAutostart"=-

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NBKeyScan"=-

 

Zapisz i przeciagnij go na ikone combofix.

Pomysl tez o zmianie systemu plikow na NTFS.

 

Wklej tez do notatnika:

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"UIHost"=hex(2):6c,00,6f,00,67,00,6f,00,6e,00,75,00,69,00,2e,00,65,00,78,00,65,\

00,00,00

 

Zapisz jako fix.reg i uruchom.

[Holden]

Zrobiłem wszystko jak mówiłeś, dzięki wielkie. Teraz w combofix mam taki log:

 

ComboFix 08-04-22.5 - Holden 2008-04-24 20:56:21.5 - <strong class='bbc'>FAT32</strong>x86Running from: C:\USUWANIE SYFU!\ComboFix.exeCommand switches used :: C:\USUWANIE SYFU!\CFScript.txt<strong class='bbc'>WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!</strong>FILE ::C:\WINDOWS\olgdqarf.exeC:\WINDOWS\wxvgsdbq.exe.(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))..---- Previous Run -------.C:\FOUND.011C:\FOUND.011\FILE0000.CHK.(((((((((((((((((((((((((   Files Created from 2008-03-24 to 2008-04-24  ))))))))))))))))))))))))))))))).2008-04-23 19:25 . 2007-09-06 00:22	289,144	--a------	C:\WINDOWS\system32\VCCLSID.exe2008-04-23 19:25 . 2006-04-27 17:49	288,417	--a------	C:\WINDOWS\system32\SrchSTS.exe2008-04-23 19:25 . 2008-04-14 19:28	86,528	--a------	C:\WINDOWS\system32\VACFix.exe2008-04-23 19:25 . 2008-04-23 08:12	82,944	--a------	C:\WINDOWS\system32\IEDFix.exe2008-04-23 19:25 . 2008-04-23 08:12	82,944	--a------	C:\WINDOWS\system32\404Fix.exe2008-04-23 19:25 . 2003-06-05 21:13	53,248	--a------	C:\WINDOWS\system32\Process.exe2008-04-23 19:25 . 2004-07-31 18:50	51,200	--a------	C:\WINDOWS\system32\dumphive.exe2008-04-23 19:25 . 2007-10-04 00:36	25,600	--a------	C:\WINDOWS\system32\WS2Fix.exe2008-04-23 19:25 . 2008-04-23 19:25	2,004	--a------	C:\WINDOWS\system32\tmp.reg2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--h-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Ustawienia lokalne2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Ulubione2008-04-23 19:08 . 2006-08-07 10:56	<DIR>	d--h-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Szablony2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Pulpit2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Moje dokumenty2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	dr-------	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Menu Start2008-04-23 19:08 . 2006-08-07 12:48	<DIR>	dr-h-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\Dane aplikacji2008-04-23 19:08 . 2008-04-23 19:08	<DIR>	d--------	C:\Documents and Settings\Administrator.HOLDEN-57DBB0262008-04-23 19:08 . 2008-04-23 23:32	1,024	--ah-----	C:\Documents and Settings\Administrator.HOLDEN-57DBB026\NTUSER.DAT.LOG2008-04-23 19:00 . 2008-04-23 19:00	<DIR>	d--------	C:\_OTMoveIt2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Ustawienia lokalne2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator\Ulubione2008-04-23 18:58 . 2006-08-07 10:56	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Szablony2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator\Pulpit2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	d--------	C:\Documents and Settings\Administrator\Moje dokumenty2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	dr-------	C:\Documents and Settings\Administrator\Menu Start2008-04-23 18:58 . 2006-08-07 12:48	<DIR>	dr-h-----	C:\Documents and Settings\Administrator\Dane aplikacji2008-04-23 18:58 . 2008-04-23 18:58	<DIR>	d--------	C:\Documents and Settings\Administrator2008-04-23 18:58 . 2008-04-23 23:32	1,024	--ah-----	C:\Documents and Settings\Administrator\NTUSER.DAT.LOG2008-04-23 18:43 . 2008-04-23 18:43	<DIR>	d--------	C:\USUWANIE SYFU!2008-04-23 18:27 . 2008-04-23 18:27	<DIR>	d--------	C:\fixwareout2008-04-23 18:20 . 2008-04-23 18:20	<DIR>	d--------	C:\Program Files\Trend Micro2008-04-23 18:15 . 2008-04-23 18:15	413	--a------	C:\Fix.reg2008-04-23 17:55 . 2008-04-23 17:55	<DIR>	d--------	C:\Documents and Settings\Holden\Dane aplikacji\TmpRecentIcons2008-04-08 23:35 . 2008-04-08 23:35	<DIR>	d--------	C:\Program Files\MP3 CD Converter Professional2008-04-08 23:35 . 2008-04-08 23:35	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\TEMP2008-04-08 23:28 . 2008-04-08 23:28	<DIR>	d--------	C:\Program Files\MIKSOFT2008-04-08 22:27 . 2008-04-23 14:28	54,156	--ah-----	C:\WINDOWS\QTFont.qfn2008-04-08 22:27 . 2008-04-08 22:27	1,409	--a------	C:\WINDOWS\QTFont.for.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-04-24 15:39	48,668	--sha-w	C:\WINDOWS\system32\drivers\fidbox.idx2008-04-24 15:39	3,727,360	--sha-w	C:\WINDOWS\system32\drivers\fidbox.dat2008-04-24 15:39	223,776	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.dat2008-04-24 15:39	22,052	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.idx2008-04-17 13:22	96,645	----a-w	C:\WINDOWS\system32\drivers\klin.dat2008-04-17 13:22	87,941	----a-w	C:\WINDOWS\system32\drivers\klick.dat.------- Sigcheck -------2004-08-03 23:14  359040  9f4b36614a0fc234525ba224957de55c	C:\WINDOWS\SoftwareDistribution\Download\586431add2daa2c113d0928dcedff7fc\backup\sp2gdr\tcpip.sys2004-08-03 23:14  359040  9f4b36614a0fc234525ba224957de55c	C:\WINDOWS\SoftwareDistribution\Download\586431add2daa2c113d0928dcedff7fc\backup\sp2qfe\tcpip.sys2008-01-08 20:28  359040  28f288e08a098df3c0eb6aa813bb41fd	C:\WINDOWS\system32\dllcache\tcpip.sys2008-01-08 20:27  359040  28f288e08a098df3c0eb6aa813bb41fd	C:\WINDOWS\system32\drivers\tcpip.sys.(((((((((((((((((((((((((((((   snapshot@2008-04-24_13.37.44.29   ))))))))))))))))))))))))))))))))))))))))).- 2008-04-24 11:25:02	2,048	--s-a-w	C:\WINDOWS\bootstat.dat+ 2008-04-24 18:06:26	2,048	--s-a-w	C:\WINDOWS\bootstat.dat.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]"UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 12:17 340136]"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2003-07-13 02:49 155648]"SoundMax"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19 729088]"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]"UIHost"="a3logon.exe"[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"vidc.I263"= i263_32.drv"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm"VIDC.YV12"= yv12vfw.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnkbackup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Holden^Menu Start^Programy^Autostart^Xfire.lnk]path=C:\Documents and Settings\Holden\Menu Start\Programy\Autostart\Xfire.lnkbackup=C:\WINDOWS\pss\Xfire.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]--a------ 2007-06-28 12:51 218376 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]--------- 2005-10-27 11:00 299008 C:\Program Files\Creative\Shared Files\CamTray.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]--a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]--a------ 2006-11-12 12:48 157592 C:\Program Files\DAEMON Tools\daemon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]--a------ 2007-10-18 15:27 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]C:\Program Files\Messenger\msmsgs.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]--a------ 2003-07-13 02:49 155648 C:\WINDOWS\system32\NeroCheck.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]--a------ 2007-09-17 01:07 8491008 C:\WINDOWS\system32\NvCpl.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]--a------ 2007-09-17 01:07 81920 C:\WINDOWS\system32\NvMcTray.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]--a------ 2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Auto Shutdown]--a------ 2006-11-24 10:11 359679 C:\Program Files\PC Auto Shutdown\AutoShutdown.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTuner]--a------ 2007-09-27 18:20 2633728 C:\Program Files\RivaTuner v2.05\RivaTuner.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]--a------ 2007-09-27 18:20 2633728 C:\Program Files\RivaTuner v2.05\RivaTuner.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]--a------ 2006-04-10 09:19 729088 C:\Program Files\Analog Devices\SoundMAX\Smax4.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]-ra------ 2006-05-01 04:07 843776 C:\Program Files\Analog Devices\Core\smax4pnp.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]--a------ 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]"PCAutoShutdown_Service"=2 (0x2)"IDriverT"=3 (0x3)[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusDisableNotify"=dword:00000001"UpdatesDisableNotify"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="C:\\Pro Evolution Soccer 2008\\PES2008.exe"="C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"54500:TCP"= 54500:TCP:Azureus port"54500:UDP"= 54500:UDP:Azureus port UDP"48342:TCP"= 48342:TCP:uTorrent[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe".**************************************************************************catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url]Rootkit scan 2008-04-24 20:59:15Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPIscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.Completion time: 2008-04-24 20:59:56ComboFix-quarantined-files.txt  2008-04-24 18:59:56ComboFix3.txt  2008-04-23 17:06:24ComboFix2.txt  2008-04-24 11:38:04Pre-Run: 6,484,451,328 bajtów wolnychPost-Run: 6,471,155,712 bajtów wolnych180	--- E O F ---	2007-08-22 20:07:42

Mam nadzieje ze juz wszystko dobrze.

[Kolobos]

Fix.reg tez uruchomiles, ktory podalem bo widze, ze wpis jest taki jak byl.