Podaje LOG z combofix'a i bardzo prosze o pomoc

[szamanp]

http://www.wklej.eu/index.php?id=a815088224&view=nl

[djarta]

c:\winnt\system32\user32.dll ... jest zarażony !!

Bardzo źle...
Użyj (w Trybie Awaryjnym)-->SDFix. (niżej na stronie linku).
Pokaż Report.txt znajdujący się w folderze SDFix.


===========
K.

viewtopic.php?f=22&t=13967#p73689

[szamanp]

SDFix: Version 1.240
Run by Go_Like_Hell on 2009-02-06 at 21:18

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services :


Infected user32.dll Found!

user32.dll File Locations:

"C:\WINNT\system32\user32.DLL" 578560 2009-01-13 19:10
"C:\WINNT\system32\dllcache\user32.dll" 578560 2009-01-13 19:10

[C:\WINNT\system32\user32.DLL] 6769CE3DB2AC699CF4D12ABE0A5720A0
[C:\WINNT\system32\dllcache\user32.dll] 6769CE3DB2AC699CF4D12ABE0A5720A0


[C:\WINNT\System32\wrvyag] 6A93565BE9B8422EB7538C66AC732D76


Note: SDFix does not repair this file!



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 21:26:11
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:ebfe1392
"s1"=dword:6489bd18
"s2"=dword:b98be363
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:f4,72,d8,1c,c2,7e,35,2e,bc,99,5d,dd,ad,34,aa,b6,50,23,52,82,f3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8a,4e,71,00,c3,ed,b4,50,8e,ed,78,e7,7a,b7,9f,6e,ac,..
"khjeh"=hex:c4,52,5e,d1,87,66,35,8e,86,0d,db,fa,4b,c0,b8,f6,54,92,2d,ff,09,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:63,3a,46,85,85,49,e1,8f,b3,1d,2f,1c,61,45,e3,11,9e,04,24,f3,49,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:f4,72,d8,1c,c2,7e,35,2e,bc,99,5d,dd,ad,34,aa,b6,50,23,52,82,f3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8a,4e,71,00,c3,ed,b4,50,8e,ed,78,e7,7a,b7,9f,6e,ac,..
"khjeh"=hex:c4,52,5e,d1,87,66,35,8e,86,0d,db,fa,4b,c0,b8,f6,54,92,2d,ff,09,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:63,3a,46,85,85,49,e1,8f,b3,1d,2f,1c,61,45,e3,11,9e,04,24,f3,49,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\\Program Files\\Tlen.pl\\tlen.exe"="C:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Gry\\TrackMania United\\TmUnited.exe"="C:\\Gry\\TrackMania United\\TmUnited.exe:*:Enabled:TmUnited"
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:BitTorrent DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Documents and Settings\\Go_Like_Hell\\Application Data\\PowerChallenge\\PowerFootball\\PowerFootball.exe"="C:\\Documents and Settings\\Go_Like_Hell\\Application Data\\PowerChallenge\\PowerFootball\\PowerFootball.exe:*:Enabled:PowerFootball"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :



Files with Hidden Attributes :

Mon 20 Oct 2003 73,688 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe"
Sat 24 Jan 2004 5,120 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll"

Finished!

[szamanp]

oto log z sdfix

http://www.wklej.eu/index.php?id=0482314e24

[djarta]

No niestety, czeka Cię chyba sformatowanie dysku. SDFix nie mógł usunąć tego pliku i podmienić na nowy, niestety.


===========
K.

[szamanp]

no trudno
W kazdym badz razie dzieki wielkie za pomoc

[Arexe]

Poczytaj to, moze sie uda: http://support.microsoft.com/kb/326687/pl

Kod: Zaznacz wszystko

Metoda 1: Wyodrębnianie nowej kopii pliku User32.dll z dysku CD z systemem Windows XP

Jesli sie nie uda, to dopiero wtedy czeka cie format