Po Podłończeniu Jakielkolwiek Pamięci Zewnętrznej Wyskakują Mi Błędy

[hitman1301]

Kiedy podłącze jakąkolwiek pamięć przenośną to wyskakują mi błędy. np.ComComp.exe lub ekplorer.exe

I nawet kiedy jest podłączony wyskakuje mi brak dysku.

Proszę o pomoc.

Edytowane 2 Stycznia 2009 przez hitman1301

[SGJ]

Jak oczyscisz komputer z wirusów mozesz prosic o dalszą pomoc.

[Kolobos]

Nie chcial dac log'a z combofix.

[hitman1301]

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\windows\system32\explorer.exe

 

.

((((((((((((((((((((((((( Pliki utworzone od 2008-12-03 do 2009-01-03 )))))))))))))))))))))))))))))))

.

 

2009-01-02 13:01 . 2009-01-02 13:01 <DIR> d-------- c:\windows\system32\IOSUBSYS

2009-01-02 13:01 . 2009-01-02 13:01 <DIR> d-------- c:\program files\Google

2008-12-30 10:20 . 2004-08-03 22:44 221,184 --a------ c:\windows\system32\wmpns.dll

2008-12-29 18:41 . 2009-01-03 11:58 85,504 -r-hs---- c:\windows\system32\vbsdfe0.dll

2008-12-23 23:02 . 2008-12-23 23:02 200,192 --a------ c:\windows\system32\vamsoft.exe

2008-12-20 09:13 . 2009-01-03 12:04 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne

2008-12-20 09:13 . 2008-11-02 18:27 <DIR> d-------- c:\documents and settings\Administrator\Ulubione

2008-12-20 09:13 . 2008-11-02 17:35 <DIR> d--h----- c:\documents and settings\Administrator\Szablony

2008-12-20 09:13 . 2008-11-02 18:27 <DIR> d-------- c:\documents and settings\Administrator\Pulpit

2008-12-20 09:13 . 2008-11-02 18:27 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty

2008-12-20 09:13 . 2008-11-02 18:27 <DIR> dr------- c:\documents and settings\Administrator\Menu Start

2008-12-20 09:13 . 2008-11-02 18:27 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji

2008-12-20 09:13 . 2008-12-20 09:13 <DIR> d-------- c:\documents and settings\Administrator

2008-12-19 12:31 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll

2008-12-19 12:31 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys

2008-12-19 12:31 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys

2008-12-19 12:31 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll

2008-12-17 20:06 . 2008-12-17 20:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\VOWSoft

2008-12-15 18:09 . 2008-12-17 19:44 <DIR> d-------- c:\documents and settings\nowy\Dane aplikacji\Ahead

2008-12-13 13:07 . 2008-12-13 13:07 <DIR> d-------- c:\documents and settings\nowy\Dane aplikacji\Media Player Classic

2008-12-12 22:47 . 2008-12-12 22:47 3,751,995 --a------ c:\windows\system32\GPhotos.scr

2008-12-11 17:08 . 2008-12-11 17:08 <DIR> d-------- c:\documents and settings\nowy\Dane aplikacji\Gadu-Gadu

2008-12-11 17:07 . 2008-12-12 21:31 <DIR> d-------- c:\documents and settings\nowy\Gadu-Gadu

2008-12-09 22:00 . 2008-12-09 22:00 <DIR> d---s---- c:\documents and settings\nowy\UserData

2008-12-09 17:45 . 2008-12-09 17:45 <DIR> d-------- c:\windows\system32\Adobe

2008-12-09 17:45 . 2008-12-09 17:45 681 --a------ c:\windows\mozver.dat

2008-12-09 15:20 . 2008-12-14 09:38 <DIR> d-------- c:\documents and settings\nowy\.jpi_cache

2008-12-09 15:20 . 2008-12-09 15:20 <DIR> d-------- c:\documents and settings\nowy\.java

2008-12-08 19:43 . 2008-12-08 19:43 <DIR> d-------- c:\program files\SAGEM

2008-12-08 19:42 . 2008-12-08 19:42 <DIR> d--hs---- c:\windows\ftpcache

2008-12-08 19:42 . 2009-01-03 11:59 <DIR> d-------- c:\program files\neostrada tp

2008-12-08 19:42 . 2008-12-08 19:42 <DIR> d-------- c:\program files\Java

2008-12-08 19:42 . 2002-11-01 20:15 45,175 --------- c:\windows\system32\plugincpl140_03.cpl

2008-12-08 19:42 . 2002-11-01 20:15 41,068 --------- c:\windows\system32\ActPanel.dll

2008-12-08 19:40 . 2001-10-26 16:57 12,160 --a------ c:\windows\system32\drivers\mouhid.sys

2008-12-08 19:40 . 2001-10-26 16:57 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys

2008-12-08 19:39 . 2001-08-17 22:02 9,600 --a------ c:\windows\system32\drivers\hidusb.sys

2008-12-08 19:39 . 2001-08-17 22:02 9,600 --a--c--- c:\windows\system32\dllcache\hidusb.sys

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-31 13:17 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-08 18:43 33 ----a-w c:\windows\system32\drivers\adidsl.cfg

2008-11-03 20:05 --------- d-----w c:\program files\EXPERTool

2008-11-03 19:58 15,600 ----a-w c:\windows\gdrv.sys

2008-11-03 19:57 --------- d-----w c:\program files\Realtek

2008-11-03 19:56 315,392 ----a-w c:\windows\HideWin.exe

2008-11-03 19:56 --------- d-----w c:\program files\DIFX

2008-11-03 19:56 --------- d-----w c:\program files\Common Files\InstallShield

2008-11-03 19:54 --------- d-----w c:\documents and settings\nowy\Dane aplikacji\InstallShield

2008-11-03 18:30 --------- d-----w c:\program files\SubEdit-Player

2008-11-03 18:29 --------- d-----w c:\program files\K-Lite Codec Pack

2008-11-03 18:25 --------- d-----w c:\program files\Winamp

2008-11-03 18:25 --------- d-----w c:\documents and settings\nowy\Dane aplikacji\Winamp

2008-11-03 18:19 --------- d-----w c:\program files\Alwil Software

2008-11-03 18:17 --------- d-----w c:\program files\Common Files\Adobe

2008-11-03 18:12 --------- d-----w c:\program files\Common Files\Ahead

2008-11-03 18:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ahead

2008-11-03 18:11 --------- d-----w c:\program files\Nero

2008-11-03 18:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero

.

 

((((((((((((((((((((((((((((( snapshot@2008-12-31_14.55.09,60 )))))))))))))))))))))))))))))))))))))))))

.

- 2007-03-07 23:51:00 43,528 ------w c:\windows\system32\drivers\PxHelp20.sys

+ 2008-07-31 22:17:04 43,872 ----a-w c:\windows\system32\drivers\pxhelp20.sys

- 2007-03-07 23:51:00 547,576 ------w c:\windows\system32\px.dll

+ 2008-07-31 22:17:04 588,272 ------w c:\windows\system32\px.dll

- 2007-03-07 23:51:00 510,712 ------w c:\windows\system32\pxdrv.dll

+ 2008-07-31 22:17:04 543,216 ------w c:\windows\system32\pxdrv.dll

- 2007-03-07 23:51:00 72,440 ------w c:\windows\system32\pxhpinst.exe

+ 2008-07-31 22:17:04 72,176 ------w c:\windows\system32\pxhpinst.exe

- 2007-03-07 23:51:00 187,128 ------w c:\windows\system32\pxmas.dll

+ 2008-07-31 22:17:04 186,864 ------w c:\windows\system32\pxmas.dll

- 2007-03-07 23:51:00 379,640 ------w c:\windows\system32\pxwave.dll

+ 2008-07-31 22:17:04 379,376 ------w c:\windows\system32\pxwave.dll

- 2007-03-07 23:51:00 39,672 ------w c:\windows\system32\vxblock.dll

+ 2008-07-31 22:17:04 88,560 ------w c:\windows\system32\vxblock.dll

+ 2009-01-03 11:04:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_ea4.dat

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-07-10 2177576]

"vamsoft"="c:\windows\system32\vamsoft.exe" [2008-12-23 200192]

"EXPLORER.EXE"="EXPLORER.EXE" [2004-08-03 c:\windows\explorer.exe]

"wsctf.exe"="wsctf.exe" [bU]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 222768]

"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208]

"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328]

"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2004-08-23 20480]

"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\GestMaj.exe" [2004-10-14 102400]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 79224]

"nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [2007-06-15 c:\windows\SkyTel.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

 

c:\documents and settings\All Users\Menu Start\Programy\Autostart\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 111616]

DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-08 839680]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"avast! Web Scanner"=3 (0x3)

"avast! Mail Scanner"=3 (0x3)

"avast! Antivirus"=2 (0x2)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"UacDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\Program Files\\Counter-Strike\\hl.exe"=

"c:\\Program Files\\neostrada tp\\neostradatp.exe"=

"c:\\Program Files\\Nero\\Nero 7\\InCD\\NBHGui.exe"=

"c:\\WINDOWS\\system32\\nwiz.exe"=

"c:\\WINDOWS\\system32\\vamsoft.exe"=

"c:\\PROGRA~1\\NEOSTR~1\\Inactivity.exe"=

"c:\\PROGRA~1\\NEOSTR~1\\GestMaj.exe"=

"c:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"=

"c:\\PROGRA~1\\NEOSTR~1\\TaskBarIcon.exe"=

"c:\\WINDOWS\\system32\\userinit.exe"=

"c:\\Program Files\\EXPERTool\\TBPanel.exe"=

"c:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe"=

"c:\\Program Files\\neostrada tp\\ComComp.exe"=

"c:\\Program Files\\Nero\\Nero 7\\InCD\\InCD.exe"=

"c:\\WINDOWS\\system32\\CF17617.exe"=

 

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2008-11-02 38448]

R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\pjifto.sys []

R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\DRIVERS\e4usbaw.sys [2008-12-08 116992]

S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\Drivers\e4ldr.sys [2008-12-08 64000]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

\Shell\AutoRun\command - C:\2u.com

\Shell\explore\Command - C:\2u.com

\Shell\open\Command - C:\2u.com

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

\Shell\AutoRun\command - D:\2u.com

\Shell\explore\Command - D:\2u.com

\Shell\open\Command - D:\2u.com

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\2u.com

\Shell\explore\Command - E:\2u.com

\Shell\open\Command - E:\2u.com

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13b0c58f-cc68-11dd-b548-4d6564696130}]

\shell\AutoRun\command - K:\EXPLORER.EXE

\shell\explore\Command - K:\EXPLORER.EXE

\shell\open\Command - K:\EXPLORER.EXE

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{865264f0-d1b7-11dd-b57a-4d6564696130}]

\Shell\AutoRun\command - vva0hc0p.cmd

\Shell\explore\Command - vva0hc0p.cmd

\Shell\open\Command - vva0hc0p.cmd

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.neostrada.pl

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: { - c:\program files\Messenger\msmsgs.exe

TCP: {504623D9-97DE-42C4-8F78-E35E19BAE92E} = 194.204.159.1 217.98.63.164

FF - ProfilePath - c:\documents and settings\nowy\Dane aplikacji\Mozilla\Firefox\Profiles\axag4yo4.default\

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll

FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava11.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava12.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava32.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJPI140_03.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPOJI610.dll

FF - plugin: e:\program files\Google\Picasa3\npPicasa3.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-03 12:04:48

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

 

skanowanie ukrytych procesów ...

 

skanowanie ukrytych wpisów autostartu ...

 

skanowanie ukrytych plików ...

 

skanowanie pomyślnie ukończone

ukryte pliki: 0

 

**************************************************************************

.

Czas ukończenia: 2009-01-03 12:05:19

ComboFix-quarantined-files.txt 2009-01-03 11:05:17

ComboFix2.txt 2009-01-01 12:59:05

ComboFix3.txt 2008-12-31 13:56:03

 

Przed: 45,088,714,752 bajtów wolnych

Po: 45,076,463,616 bajtów wolnych

 

223

[Kolobos]

Czy mozesz poprawic bledy ortograficzne w swoich postach? Szczegolnie te z tematu: "Podłończeniu Jakielkolwiek" (uzyj do tego przycisku EDYTUJ).

 

 

Podlacz wszystkie zainfekowane nosniki i uzyj Flash Disinfector.

 

Utworz na pulpicie plik CFScript.txt, wklej do niego:

 

File::

c:\windows\system32\vbsdfe0.dll

c:\windows\system32\vamsoft.exe

 

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vamsoft"=-

"EXPLORER.EXE"=-

"wsctf.exe"=-

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"=-

"DisableRegistryTools"=-

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13b0c58f-cc68-11dd-b548-4d6564696130}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{865264f0-d1b7-11dd-b57a-4d6564696130}]

 

Zapisz go i przeciagnij na ikone combofix.exe

Na koniec zablokuj dostep do klucza mountpoints2, tak jak to masz opisane na dole tej strony:

http://www.searchengines.pl/Infekcje-z-pen...ych-t94761.html