problem z trojanami, prosze o sprawdzenie loga

[huber2t]

fix w hijackthis

O20 - AppInit_DLLs: ghrst.dll,ethyg.dll,gyjert.dll,tjdegtr.dll,fyhje.dll,hgnmjsdg.dll,uyjtd.dll,ukrt h.dll,hjmh.dll,dhugtj.dll,ytjkyer.dll,dgrgfs.dll,gfcfg.dll,frntrn.dll,qrhhb.dll, drghszd.dll,fngn.dll,gnfctt.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxg nfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.d ll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmna it.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,gtujerg.dll,jyjlt.dll,ijatnaw.dl l,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,yuker.dll,setrhes. dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll, fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,yjrfe.dll,dscef.dll,crugd.dll ,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dl l,sthth.dll,wfhyt.dll,rgghjj.dll,ghjkdr.dll,hfther.dll,

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\system32\hgfhk.cfg
C:\WINDOWS\system32\ciwdaapi.sys
C:\WINDOWS\system32\ydgn.cfg
C:\WINDOWS\system32\winsYs.reg
C:\WINDOWS\system32\aoqnabib.sys
C:\WINDOWS\system32\bcsxachu.sys
C:\WINDOWS\system32\ethyg.dll
C:\WINDOWS\system32\fassaplo.sys
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\fzptbjpg.sys
C:\WINDOWS\system32\ghjkdr.dll
C:\WINDOWS\system32\ghrst.dll
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\newxbttb.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\spwdbapi.sys
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\xzfhbjpg.sys


Plik zapisz jako CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

[semenfour]

Oto Log:

Kod: Zaznacz wszystko

ComboFix 08-06-05.3 - ati 2008-06-06 16:06:04.5 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.335 [GMT 2:00]
Running from: C:\Documents and Settings\ati\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\ati\Pulpit\CFScript.txt
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\WINDOWS\system32\aoqnabib.sys
C:\WINDOWS\system32\bcsxachu.sys
C:\WINDOWS\system32\ciwdaapi.sys
C:\WINDOWS\system32\ethyg.dll
C:\WINDOWS\system32\fassaplo.sys
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\fzptbjpg.sys
C:\WINDOWS\system32\ghjkdr.dll
C:\WINDOWS\system32\ghrst.dll
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\hgfhk.cfg
C:\WINDOWS\system32\newxbttb.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\spwdbapi.sys
C:\WINDOWS\system32\winsYs.reg
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\xzfhbjpg.sys
C:\WINDOWS\system32\ydgn.cfg
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\aoqnabib.sys
C:\WINDOWS\system32\bcsxachu.sys
C:\WINDOWS\system32\ciwdaapi.sys
C:\WINDOWS\system32\ethyg.dll
C:\WINDOWS\system32\fassaplo.sys
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\fzptbjpg.sys
C:\WINDOWS\system32\ghjkdr.dll
C:\WINDOWS\system32\ghrst.dll
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\hgfhk.cfg
C:\WINDOWS\system32\newxbttb.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\spwdbapi.sys
C:\WINDOWS\system32\winsYs.reg
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\xzfhbjpg.sys
C:\WINDOWS\system32\ydgn.cfg

.
(((((((((((((((((((((((((   Files Created from 2008-05-06 to 2008-06-06  )))))))))))))))))))))))))))))))
.

2008-06-05 23:21 . 2008-06-05 23:21   <DIR>   d--------   C:\FileZillaPortable
2008-06-02 16:08 . 2004-06-24 11:00   6,656   --a------   C:\WINDOWS\system32\drivers\AsProbe.sys
2008-06-02 16:07 . 1997-04-22 10:16   6,272   --a------   C:\WINDOWS\system32\drivers\ASLM75.SYS
2008-06-02 16:06 . 1996-11-05 16:13   299,008   --a------   C:\WINDOWS\uninst.exe
2008-06-02 15:59 . 2005-05-02 21:15   36,484   --a------   C:\WINDOWS\system32\drivers\SMBios.sys
2008-06-01 15:10 . 2008-06-01 19:21   <DIR>   d--------   C:\Alcohol 52
2008-06-01 14:13 . 2008-06-01 14:13   <DIR>   d--------   C:\Documents and Settings\ati\Dane aplikacji\teamspeak2
2008-06-01 14:07 . 2003-08-19 19:36   65,536   --a--c---   C:\WINDOWS\system32\dllcache\a3d.dll
2008-06-01 14:07 . 2003-08-19 19:36   65,536   ---------   C:\WINDOWS\system32\a3d.dll
2008-06-01 14:07 . 2005-06-22 10:11   23,552   --a------   C:\WINDOWS\system32\PostProc.dll
2008-06-01 13:20 . 2008-06-01 13:40   139,264   --a------   C:\WINDOWS\War3Unin.exe
2008-06-01 13:20 . 2008-06-01 13:48   51,960   --a------   C:\WINDOWS\War3Unin.dat
2008-06-01 13:20 . 2008-06-01 13:40   2,829   --a------   C:\WINDOWS\War3Unin.pif
2008-06-01 12:59 . 2008-06-01 14:13   <DIR>   d--------   C:\Teamspeak2_RC2
2008-06-01 12:59 . 2008-06-01 12:59   34,064   --a------   C:\WINDOWS\system32\lhacm.acm
2008-06-01 12:58 . 2008-06-01 12:58   <DIR>   d--------   C:\DAEMON Tools Lite
2008-06-01 12:52 . 2008-06-01 12:52   <DIR>   d--------   C:\Documents and Settings\ati\Dane aplikacji\DAEMON Tools
2008-06-01 12:52 . 2008-06-01 12:52   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2008-06-01 11:04 . 2008-06-06 09:59   <DIR>   d--------   C:\SpeedFan
2008-06-01 11:04 . 2008-06-01 11:04   45   --a------   C:\WINDOWS\system32\initdebug.nfo
2008-05-31 14:47 . 2008-05-31 14:47   <DIR>   d--------   C:\DivX
2008-05-31 11:27 . 2008-05-31 11:27   <DIR>   d--------   C:\Documents and Settings\ati\WINDOWS
2008-05-30 14:53 . 2008-05-30 14:53   <DIR>   d--------   C:\CCleaner
2008-05-29 22:16 . 2006-12-10 23:32   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2008-05-29 22:10 . 2008-05-29 22:10   <DIR>   d--------   C:\ALLPlayer
2008-05-29 21:10 . 2004-08-03 23:08   26,496   --a--c---   C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-28 22:33 . 2008-05-28 22:33   <DIR>   d--------   C:\Program Files\3DO
2008-05-28 22:30 . 1998-10-07 12:54   327,168   --a------   C:\WINDOWS\IsUn0415.exe
2008-05-28 16:56 . 2008-05-28 16:56   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2008-05-27 20:22 . 2008-06-06 15:21   <DIR>   d--------   C:\HijackThis
2008-05-26 22:44 . 2008-05-26 22:44   <DIR>   d--------   C:\Reader 8.0
2008-05-26 22:44 . 2008-05-26 22:44   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2008-05-26 21:40 . 2008-05-26 21:40   <DIR>   d--------   C:\Documents and Settings\ati\Dane aplikacji\Gadu-Gadu
2008-05-26 21:20 . 2008-05-26 21:20   <DIR>   d--------   C:\Documents and Settings\NetworkService\Dane aplikacji\Xfire
2008-05-26 21:19 . 2008-06-06 15:55   <DIR>   d--------   C:\Documents and Settings\ati\Dane aplikacji\Xfire
2008-05-26 21:18 . 2008-06-06 12:08   <DIR>   d--------   C:\Xfire
2008-05-26 20:57 . 2008-06-03 21:28   <DIR>   d--------   C:\Gadu-Gadu
2008-05-26 20:57 . 2008-05-26 21:40   <DIR>   d--------   C:\Documents and Settings\ati\Gadu-Gadu
2008-05-26 20:37 . 2008-05-26 20:37   0   --a------   C:\WINDOWS\ativpsrm.bin
2008-05-26 20:35 . 2004-08-04 00:44   130,048   --a------   C:\WINDOWS\system32\ksproxy.ax
2008-05-26 20:35 . 2004-08-04 00:44   130,048   --a--c---   C:\WINDOWS\system32\dllcache\ksproxy.ax
2008-05-26 20:35 . 2004-08-03 23:08   60,288   --a------   C:\WINDOWS\system32\drivers\drmk.sys
2008-05-26 20:35 . 2004-08-03 23:08   60,288   --a--c---   C:\WINDOWS\system32\dllcache\drmk.sys
2008-05-26 20:35 . 2004-11-18 10:42   22,752   --a------   C:\WINDOWS\system32\spupdsvc.exe
2008-05-26 20:35 . 2004-08-04 00:44   4,096   --a------   C:\WINDOWS\system32\ksuser.dll
2008-05-26 20:35 . 2004-08-04 00:44   4,096   --a--c---   C:\WINDOWS\system32\dllcache\ksuser.dll
2008-05-26 20:34 . 2008-05-26 20:34   <DIR>   d--------   C:\WinRAR
2008-05-26 20:26 . 2008-05-12 10:49   593,920   ---------   C:\WINDOWS\system32\ati2sgag.exe
2008-05-26 20:25 . 2008-06-01 14:08   <DIR>   d--h-----   C:\Program Files\InstallShield Installation Information
2008-05-26 20:24 . 2008-06-02 22:44   <DIR>   d--------   C:\Program Files\Common Files\InstallShield
2008-05-26 20:24 . 2008-05-26 20:24   <DIR>   d--------   C:\ATI
2008-05-26 20:18 . 2008-05-31 14:47   1,346   --a------   C:\WINDOWS\mozver.dat
2008-05-14 03:28 . 2008-05-14 03:28   41,296   --a------   C:\WINDOWS\system32\xfcodec.dll
2008-05-13 03:51 . 2008-05-13 03:51   1,044,480   --a------   C:\WINDOWS\system32\libdivx.dll
2008-05-13 03:51 . 2008-05-13 03:51   200,704   --a------   C:\WINDOWS\system32\ssldivx.dll
2008-05-12 18:30 . 2008-05-12 18:30   3,007,488   --a------   C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-12 18:30 . 2008-05-12 18:30   3,007,488   --a--c---   C:\WINDOWS\system32\dllcache\ati2mtag.sys
2008-05-12 17:56 . 2008-05-12 17:56   397,312   --a------   C:\WINDOWS\system32\ATIDEMGX.dll
2008-05-12 17:54 . 2008-05-12 17:54   305,152   --a--c---   C:\WINDOWS\system32\dllcache\ati2dvag.dll
2008-05-12 17:54 . 2008-05-12 17:54   305,152   --a------   C:\WINDOWS\system32\ati2dvag.dll
2008-05-12 17:53 . 2008-05-12 17:53   307,200   --a------   C:\WINDOWS\system32\atiiiexx.dll
2008-05-12 17:45 . 2008-05-12 17:45   180,224   --a------   C:\WINDOWS\system32\atipdlxx.dll
2008-05-12 17:45 . 2008-05-12 17:45   139,264   --a------   C:\WINDOWS\system32\Oemdspif.dll
2008-05-12 17:45 . 2008-05-12 17:45   43,520   --a------   C:\WINDOWS\system32\ati2edxx.dll
2008-05-12 17:45 . 2008-05-12 17:45   26,112   --a------   C:\WINDOWS\system32\Ati2mdxx.exe
2008-05-12 17:44 . 2008-05-12 17:44   139,264   --a------   C:\WINDOWS\system32\ati2evxx.dll
2008-05-12 17:43 . 2008-05-12 17:43   10,153,984   --a------   C:\WINDOWS\system32\atioglx2.dll
2008-05-12 17:43 . 2008-05-12 17:43   540,672   --a------   C:\WINDOWS\system32\ati2evxx.exe
2008-05-12 17:41 . 2008-05-12 17:41   53,248   --a------   C:\WINDOWS\system32\ATIDDC.DLL
2008-05-12 17:32 . 2008-05-12 17:32   3,203,168   --a--c---   C:\WINDOWS\system32\dllcache\ati3duag.dll
2008-05-12 17:32 . 2008-05-12 17:32   3,203,168   --a------   C:\WINDOWS\system32\ati3duag.dll
2008-05-12 17:22 . 2008-05-12 17:22   3,107,788   --a------   C:\WINDOWS\system32\ativvaxx.dat
2008-05-12 17:22 . 2008-05-12 17:22   3,107,788   --a------   C:\WINDOWS\system32\ativva5x.dat
2008-05-12 17:22 . 2008-05-12 17:22   1,999,616   --a--c---   C:\WINDOWS\system32\dllcache\ativvaxx.dll
2008-05-12 17:22 . 2008-05-12 17:22   1,999,616   --a------   C:\WINDOWS\system32\ativvaxx.dll
2008-05-12 17:22 . 2008-05-12 17:22   887,724   --a------   C:\WINDOWS\system32\ativva6x.dat
2008-05-12 17:09 . 2008-05-12 17:09   47,104   --a------   C:\WINDOWS\system32\amdpcom32.dll
2008-05-12 17:05 . 2008-05-12 17:05   5,439,488   --a------   C:\WINDOWS\system32\atioglxx.dll
2008-05-12 17:05 . 2008-05-12 17:05   327,680   --a------   C:\WINDOWS\system32\atikvmag.dll
2008-05-12 17:03 . 2008-05-12 17:03   19,968   --a------   C:\WINDOWS\system32\atiadlxx.dll
2008-05-12 17:03 . 2008-05-12 17:03   17,408   --a------   C:\WINDOWS\system32\atitvo32.dll
2008-05-12 17:02 . 2008-05-12 17:02   241,664   --a------   C:\WINDOWS\system32\atiok3x2.dll
2008-05-12 17:02 . 2008-05-12 17:02   49,152   --a------   C:\WINDOWS\system32\drivers\ati2erec.dll
2008-05-12 16:57 . 2008-05-12 16:57   548,864   --a--c---   C:\WINDOWS\system32\dllcache\ati2cqag.dll
2008-05-12 16:57 . 2008-05-12 16:57   548,864   --a------   C:\WINDOWS\system32\ati2cqag.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 14:08   2,404,896   --sha-w   C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-06 14:08   134,688   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-06 13:57   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-06 11:43   36,188   --sha-w   C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-06 11:43   14,360   --sha-w   C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-29 18:33   88,774   ----a-w   C:\WINDOWS\system32\drivers\klick.dat
2008-05-28 15:06   96,966   ----a-w   C:\WINDOWS\system32\drivers\klin.dat
2008-05-28 15:06   112,144   ----a-w   C:\WINDOWS\system32\drivers\kl1.sys
2008-05-26 17:36   ---------   d-----w   C:\Documents and Settings\ati\Dane aplikacji\Talkback
2008-05-26 16:36   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-05-26 16:13   ---------   d-----w   C:\Program Files\microsoft frontpage
2008-05-26 16:08   ---------   d-----w   C:\Program Files\Usługi online
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S2 cdralw;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\system32\DRIVERS\nvmini.sys []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 16:08:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-06 16:11:01
ComboFix-quarantined-files.txt  2008-06-06 14:10:58
ComboFix2.txt  2008-06-06 11:52:15

Pre-Run: 6,747,893,760 bajtów wolnych
Post-Run: 6,752,649,216 bajtów wolnych

190


[huber2t]

log ok

Wyłącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

Włącz przywracanie systemu.