Nastepnie ladowal mi sie nachalnie sie jakis dziwny program Oczyszczaczkomputerza. I na dodatek zaczelo sie cos dziac z przegladarkami EXplore i Firefox : Bardzo czesto wyskakiwaly okienka ostrzegajace odpowiednio: firefox.exe has generated errors an will be closed by Windows. You will need to restart the program, albo IExplore.exe has generated errors ... idalej jak wyzej.Skorzystalam z porady na jakims forum, sciagnelam program SmithFraudFix i zastosowalam. Ten oczyszczcz komputerza zniknal i juz wiec sie na razie nie pokazal, ale inne opisane wyzej problemy zostaly. I nadodatek po zalogowaniu dolaczyl drugi komunikat RUNDLL Error loading C:\DOCUME~1\LIPKA\LOCALS~1\Temp\jkhfe.dll. The specified module could not by found, czyli byly juz dwa komunikaty i dalej co jakis czas klopoty z przegladarkami internetowymi. Znow skorzystalam z porady w internecie i sciagnelam program ComboFix i zastosowalam. Po zakonczeniu pracy programu, zrestartowalam komputer i wyskoczyly mi na dodatek nastepne dwa komunikaty RUNDLL, a mianowicie 1. Error loading C:\WINNT\system32\wjvwnmeg.dll, 2. Error loading C:\WINNT\system32\pwdiexmg.dll Prosze o pomoc!
Zalaczam logi:
SDFix: Version 1.163
Run by BabciaEla on Sat 03/29/2008 at 7:17a
Microsoft Windows 2000 [Version 5.00.2195]
Running From: C:\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
C:\WINNT\Downloaded Program Files\UGDCPL_0001_N122M2012NetInstaller.exe - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 07:30:12
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_0471&Pid_1144&Mi_00\6&10b65970&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_0471&Pid_1144&Mi_00\7&23287b7f&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_0471&Pid_1144&Mi_00\6&10b65970&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_0471&Pid_1144&Mi_00\7&23287b7f&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Wed 27 Feb 2008 0 A..H. --- "C:\WINNT\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT3.tmp"
Finished!
SDFix: Version 1.163
Run by BabciaEla on Sun 03/30/2008 at 9:06a
Microsoft Windows 2000 [Version 5.00.2195]
Running From: C:\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-30 09:12:55
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_0471&Pid_1144&Mi_00\6&10b65970&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_0471&Pid_1144&Mi_00\7&23287b7f&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_0471&Pid_1144&Mi_00\6&10b65970&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_0471&Pid_1144&Mi_00\7&23287b7f&0&0\Device Parameters]
"HWRevision?U\x2039\x11b\x81\x11b\x11a?"="100"
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Wed 27 Feb 2008 0 A..H. --- "C:\WINNT\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT3.tmp"
Finished!
ComboFix 08-03-30.2 - BabciaEla 03/31/2008 7:20:52.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1250.48.1033.18.18 [GMT 2:00]
Running from: D:\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINNT\BM7b54edff.xml
C:\WINNT\cookies.ini
C:\WINNT\pskt.ini
C:\WINNT\system32\bjmtolwv.ini
C:\WINNT\system32\bwsvcjwt.dll
C:\WINNT\system32\Cfx32.lic
C:\WINNT\system32\cfx32.ocx
C:\WINNT\system32\cgjgaepe.ini
C:\WINNT\system32\desufdvw.dll
C:\WINNT\system32\dmjngdtu.dll
C:\WINNT\system32\epeagjgc.dll
C:\WINNT\system32\epmbhexs.dll
C:\WINNT\system32\jemdfjws.ini
C:\WINNT\system32\kbpmdyxh.dll
C:\WINNT\system32\mcrh.tmp
C:\WINNT\system32\mnstvdxk.dll
C:\WINNT\system32\pwdiexmg.dll
C:\WINNT\system32\qgokedds.dll
C:\WINNT\system32\swjfdmej.dll
C:\WINNT\system32\sxehbmpe.ini
C:\WINNT\system32\vwlotmjb.dll
C:\WINNT\system32\wjvwnmeg.dll
C:\WINNT\system32\wvdfused.ini
C:\WINNT\system32\xmofymwp.dll
C:\WINNT\system32\yvpaejyt.dll
C:\WINNT\system32\ywximxlu.dll
C:\WINNT\Web\default.htt
.
((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 )))))))))))))))))))))))))))))))
.
2008-03-31 06:44 . 03/31/08 06:44a 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2f0.dat
2008-03-30 22:29 . 03/30/08 10:29p 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-03-30 22:29 . 03/30/08 10:29p 1,409 --a------ C:\WINNT\QTFont.for
2008-03-29 08:36 . 03/31/08 07:14a 1,283,944 ---h----- C:\WINNT\ShellIconCache
2008-03-28 16:25 . 03/28/08 04:26p <DIR> d-------- C:\WINNT\ERUNT
2008-03-28 15:57 . 03/30/08 09:15a <DIR> d-------- C:\SDFix
2008-03-28 13:48 . 03/28/08 01:48p 54,336 --a------ C:\WINNT\system32\yvvqlvvy.dll
2008-03-28 13:48 . 03/28/08 01:48p 54,336 --a------ C:\WINNT\system32\iqracbcv.dll
2008-03-28 13:48 . 03/28/08 01:48p 54,336 --a------ C:\WINNT\system32\axnxpvii.dll
2008-03-28 13:47 . 03/28/08 01:47p 54,336 --a------ C:\WINNT\system32\uarpqbsc.dll
2008-03-28 13:47 . 03/28/08 01:47p 54,336 --a------ C:\WINNT\system32\bprynajc.dll
2008-03-28 13:46 . 03/28/08 01:46p 54,336 --a------ C:\WINNT\system32\pciunswd.dll
2008-03-28 13:46 . 03/28/08 01:46p 54,336 --a------ C:\WINNT\system32\iidaamdp.dll
2008-03-28 13:46 . 03/28/08 01:46p 54,336 --a------ C:\WINNT\system32\dkhkcrnc.dll
2008-03-28 13:45 . 03/28/08 01:45p 54,336 --a------ C:\WINNT\system32\qttueefv.dll
2008-03-28 13:45 . 03/28/08 01:45p 54,336 --a------ C:\WINNT\system32\jahbqrei.dll
2008-03-28 13:44 . 03/28/08 01:44p 54,336 --a------ C:\WINNT\system32\qjxgujpx.dll
2008-03-28 13:44 . 03/28/08 01:44p 54,336 --a------ C:\WINNT\system32\madqkvrp.dll
2008-03-28 13:44 . 03/28/08 01:44p 54,336 --a------ C:\WINNT\system32\fgxwxqyc.dll
2008-03-28 13:43 . 03/28/08 01:43p 54,336 --a------ C:\WINNT\system32\aygdxjfp.dll
2008-03-23 13:03 . 03/23/08 01:03p <DIR> dr------- C:\New Briefcase
2008-03-22 20:19 . 03/22/08 08:19p 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_358.dat
2008-03-12 10:15 . 03/12/08 10:15a 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2f8.dat
2008-03-03 20:24 . 03/03/08 08:24p 129 --a------ C:\WINNT\system32\test.aok
2008-02-27 23:03 . 02/27/08 11:03p <DIR> d-------- C:\Documents and Settings\Lipka\Application Data\CANON INC
2008-02-27 23:03 . 03/27/08 12:25p <DIR> d-------- C:\Documents and Settings\Lipka\Application Data\CameraWindowDC
2008-02-27 22:57 . 03/28/08 12:33a <DIR> d-------- C:\Documents and Settings\Lipka\Application Data\ZoomBrowser EX
2008-02-27 22:35 . 02/27/08 10:35p <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ZoomBrowser EX
2008-02-27 22:30 . 02/27/08 10:30p <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CANON INC
2008-02-27 22:30 . 02/27/08 10:35p <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CameraWindowDC
2008-02-27 22:28 . 06/19/03 01:05p 12,592 --a------ C:\WINNT\system32\drivers\usbscan.sys
2008-02-27 22:28 . 06/19/03 01:05p 12,592 --a--c--- C:\WINNT\system32\dllcache\usbscan.sys
2008-02-26 18:27 . 09/02/05 06:08p 117,760 --a------ C:\WINNT\system32\CNDPTPU.dll
2008-02-26 18:27 . 09/02/05 06:08p 63,488 --a------ C:\WINNT\system32\CNDPTPC.dll
2008-02-26 18:17 . 02/26/08 06:18p <DIR> d-------- C:\WINNT\winsxs
2008-02-26 18:17 . 02/26/08 06:17p <DIR> d-------- C:\WINNT\PCHEALTH
2008-02-26 18:14 . 02/26/08 06:14p <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-02-26 17:54 . 02/26/08 05:54p <DIR> d-------- C:\Program Files\Common Files\Canon
2008-02-02 12:05 . 02/02/08 12:05p <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Leadertech
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-31 05:14 --------- d---a-w C:\Program Files\Neostrada TP
2008-03-31 05:02 --------- d-----w C:\Documents and Settings\Lipka\Application Data\Skype
2008-03-29 06:33 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Skype
2008-03-28 12:22 2,916,352 ----a-w C:\WINNT\Internet Logs\xDB7.tmp
2008-03-28 06:37 13,236,137 ----a-w C:\WINNT\Internet Logs\tvDebug.zip
2008-03-27 23:12 --------- d---a-w C:\Program Files\Spyware Terminator
2008-03-27 23:12 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-03-27 22:35 --------- d---a-w C:\Documents and Settings\Lipka\Application Data\Spyware Terminator
2008-03-26 09:02 --------- d-----w C:\Program Files\SkanerOnline
2008-03-12 14:37 2,868,736 ----a-w C:\WINNT\Internet Logs\xDB6.tmp
2008-03-12 14:37 2,648,064 ----a-w C:\WINNT\Internet Logs\xDB5.tmp
2008-03-09 08:11 2,956,800 ----a-w C:\WINNT\Internet Logs\xDB4.tmp
2008-02-26 16:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-26 16:27 --------- d-----w C:\Program Files\Canon
2008-01-26 20:53 2,821,120 ----a-w C:\WINNT\Internet Logs\xDB3.tmp
2008-01-10 08:33 9,024,799 ----a-w C:\WINNT\Internet Logs\vsmon_on_demand_2008_01_10_00_36_09_full.dmp.zip
2008-01-09 23:36 4,086,272 ----a-w C:\WINNT\Internet Logs\xDB1.tmp
2008-01-01 11:41 6,681,600 ----a-w C:\WINNT\Internet Logs\xDB2.tmp
2007-12-10 11:39 575,488 ----a-w C:\WINNT\system32\WININET.DLL
2007-12-05 10:40 631,056 ----a-w C:\WINNT\system32\OLEAUT32.DLL
2006-07-05 12:03 271 ---h--w C:\Program Files\desktop.ini
2006-07-05 12:03 21,952 ---h--w C:\Program Files\folder.htt
1999-12-07 12:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6E475257-25BD-4A42-B3BF-867D4E8AAF3D}]
C:\DOCUME~1\Lipka\LOCALS~1\Temp\jkhfe.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
01/09/08 10:23a 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [01/09/08 10:23a 262144]
[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [01/09/08 10:23a 262144]
[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [12/07/99 02:00p 20752 C:\WINNT\system32\internat.exe]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [09/13/07 02:31p 22880040]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/27/07 09:34a 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [06/19/03 12:05p 111376 C:\WINNT\system32\mobsync.exe]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [10/16/03 07:07p 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [10/16/03 07:07p 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [10/16/03 07:07p 53248]
"DemonStarter"="C:\Program Files\PWN\Definicje\Bin\Starter.exe" [12/01/99 02:47p 36864]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [06/25/03 03:30p 335872]
"ASUS Probe"="D:\Tools\ASUS Probe\AsusProb.exe" [12/06/02 04:07p 617984]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [12/22/03 08:38a 241664]
"HPDJ Taskbar Utility"="C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb10.exe" [05/12/04 10:30p 172032]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [05/12/04 10:29p 49152]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [11/14/07 05:05p 919016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [12/07/99 02:00p 20752 C:\WINNT\system32\internat.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [06/19/03 12:05p 186640]
C:\Documents and Settings\Imiela\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-30 23:30:44 114688]
R2 CINEMSUP;Software Cinemaster NT4.0 Driver;C:\WINNT\system32\DRIVERS\CINEMSUP.SYS [01/08/02 10:16a]
R3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINNT\system32\drivers\ctlsb16.sys [10/23/99 03:10p]
R3 TTDec;ATI WDM Teletext Decoder;C:\WINNT\system32\DRIVERS\ATINTTXX.sys [08/04/04 03:07a]
S3 lsermous;Logitech Serial Mouse Driver;C:\WINNT\system32\DRIVERS\lsermous.sys [09/27/99 08:26p]
S3 mga64;mga64;C:\WINNT\system32\DRIVERS\mga64m.sys [11/29/99 07:47p]
S3 MSSEARCH;Microsoft Search;"C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe" [10/12/04 11:10p]
S3 oad;Visibroker Activation Daemon;D:\Borland\vbroker\bin\oad.exe [03/12/98 05:57p]
S3 osagent;VisiBroker Smart Agent;D:\Borland\vbroker\bin\osagent.exe [03/12/98 05:58p]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINNT\system32\DRIVERS\w200bus.sys [11/07/06 09:42a]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINNT\system32\DRIVERS\w200mdfl.sys [11/07/06 09:42a]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINNT\system32\DRIVERS\w200mdm.sys [11/07/06 09:42a]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINNT\system32\DRIVERS\w200mgmt.sys [11/07/06 09:42a]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINNT\system32\DRIVERS\w200obex.sys [11/07/06 09:42a]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 07:25:13
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\tsd32.dll
.
Completion time: 03/31/2008 7:27:23
ComboFix-quarantined-files.txt 2008-03-31 05:27:10
Pre-Run: 3,315,568,640 bytes free
Post-Run: 3,295,281,152 bytes free
.
2008-03-23 12:23:17 --- E O F ---
ufff..