ciągle powracające trojany

[piterq1991 0]

Witam!

 

Proszę o pomoc z ciągle powracającymi trojanami. Nie podłączam, żadnych kart pamięci do laptopa a mimo wszystko cały czas powracają te same śmieci.

Log z combofix:

 

[codeComboFix 10-07-30.01 - Izabela 2010-07-30 20:48:17.9.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1407.1007 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Izabela\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Izabela\USTAWI~1\Temp\E_N4
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\cnvpe.fne
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\dp1.fne
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\eAPI.fne
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\HtmlView.fne
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\internet.fne
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\krnln.fnr
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\shell.fne
c:\docume~1\Izabela\USTAWI~1\Temp\E_N4\spec.fne
c:\windows\system32\625048
c:\windows\system32\625048\0e7e81.txt
c:\windows\system32\625048\45a000.txt
c:\windows\system32\681144
c:\windows\system32\681144\a8.ini
c:\windows\system32\681144\cnvpe.fne
c:\windows\system32\681144\dp1.fne
c:\windows\system32\681144\eAPI.fne
c:\windows\system32\681144\GC-B89.EXE
c:\windows\system32\681144\HtmlView.fne
c:\windows\system32\681144\internet.fne
c:\windows\system32\681144\krnln.fnr
c:\windows\system32\681144\RegEx.fnr
c:\windows\system32\681144\shell.fne
c:\windows\system32\681144\spec.fne
c:\windows\system32\681144\VC-VL8.EXE
c:\windows\system32\681144\VV71873A.EXE
c:\windows\system32\681144\Z7D1C76B.EXE

.
((((((((((((((((((((((((( Pliki utworzone od 2010-06-28 do 2010-07-30 )))))))))))))))))))))))))))))))
.

2010-07-30 18:37 . 2009-07-06 08:48 11448 ----a-w- c:\windows\system32\drivers\AsUpIO.sys
2010-07-30 18:37 . 2009-09-30 09:33 24576 ----a-w- c:\windows\system32\AsIO.dll
2010-07-30 18:37 . 2009-08-04 08:28 11296 ----a-w- c:\windows\system32\drivers\AsIO.sys
2010-07-29 23:13 . 2008-09-10 19:56 144960 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\nppl3260.dll
2010-07-29 23:13 . 2008-09-10 19:37 94208 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\nprpjplug.dll
2010-07-29 23:13 . 2010-07-29 23:13 -------- d-----w- c:\program files\Real Alternative
2010-07-29 23:13 . 2010-07-29 23:13 -------- d-----w- c:\documents and settings\Izabela\Ustawienia lokalne\Dane aplikacji\Real
2010-07-21 23:23 . 2010-07-21 23:23 364544 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.3.dll
2010-07-21 23:23 . 2010-07-21 23:23 397312 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.3.dll
2010-07-08 22:05 . 2010-07-08 22:05 -------- d-----w- c:\program files\Common Files\PCSuite
2010-07-08 22:04 . 2010-07-08 22:04 -------- d-----w- c:\program files\PC Connectivity Solution
2010-07-08 22:03 . 2010-07-08 22:02 36747456 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_pol.exe
2010-07-08 22:03 . 2010-07-08 22:03 95232 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\pcswpcsi.exe
2010-07-08 22:03 . 2010-07-08 22:03 8192 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstCCD.exe
2010-07-08 22:03 . 2010-07-08 22:03 61440 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-07-08 22:03 . 2010-07-08 22:03 10240 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCS.exe

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-30 18:39 . 2009-12-15 20:10 -------- d-----w- c:\program files\ASUS
2010-07-30 18:39 . 2009-12-15 20:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-30 10:04 . 2009-09-10 13:45 51166 ----a-w- c:\windows\system32\perfc015.dat
2010-07-30 10:04 . 2009-09-10 13:45 359416 ----a-w- c:\windows\system32\perfh015.dat
2010-07-30 09:53 . 2009-12-15 21:17 188152 ----a-w- c:\documents and settings\Izabela\Dane aplikacji\Mozilla\Firefox\Profiles\nhiaiql5.default\FlashGot.exe
2010-07-29 19:31 . 2009-12-15 20:39 -------- d-----w- c:\documents and settings\Izabela\Dane aplikacji\Gadu-Gadu 10
2010-07-28 07:15 . 2009-12-15 20:39 -------- d-----w- c:\program files\Gadu-Gadu 10
2010-07-08 22:05 . 2009-12-17 19:49 -------- d-----w- c:\program files\Nokia
2010-07-08 22:05 . 2009-12-17 19:49 -------- d-----w- c:\program files\Common Files\Nokia
2010-07-08 22:02 . 2009-12-17 19:48 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Installations
2010-07-08 10:27 . 2010-04-15 14:26 -------- d-----w- c:\documents and settings\Izabela\Dane aplikacji\PC Suite
2010-07-08 10:27 . 2010-07-08 10:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-06-14 14:31 . 2009-12-15 19:23 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-06 10:28 . 2009-09-10 13:45 919040 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:04 . 2009-09-10 13:45 1860608 ----a-w- c:\windows\system32\win32k.sys
2010-04-12 20:11 . 2010-04-12 20:11 1406935 --sh--r- c:\windows\system32\EDE282\2B091E.EXE
.

------- Sigcheck -------

[-] 2009-09-10 . C8BDAD4065118558B3DC360FC96D81DB . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2B091E"="c:\windows\system32\EDE282\2B091E.EXE" [2010-04-12 1406935]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\Izabela\Menu Start\Programy\Autostart\
Skr˘t do bannerkiller2-[www.legalne.lnk - c:\program files\Gadu-Gadu 10\bannerkiller2-[www.legalne.info].exe [2010-4-6 6144]
SynTPEnh.lnk - c:\program files\Synaptics\SynTP\SynTPEnh.exe [2009-12-15 761945]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 17:43 69632 ----a-w- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2006-03-08 21:43 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2006-03-08 20:05 344064 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControl]
2006-02-23 11:40 106496 ----a-w- c:\windows\ATK0100\HControl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 15:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-14 16:21 16270848 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 17:04 2879488 ----a-w- c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-01-20 11:34 544768 ----a-w- c:\windows\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2005-10-21 13:26 761945 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Gadu-Gadu 10\\gg.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Izabela\\Pulpit\\JDownloader_portable\\CommonFiles\\Java\\bin\\javaw.exe"=

R0 Si3124;Si3124;c:\windows\system32\drivers\si3124.sys [2009-09-10 69248]
R0 Si3531;Si3531;c:\windows\system32\drivers\Si3531.sys [2009-09-10 212520]
R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2010-07-30 11448]
R1 dk2drv;DK2 WindowsNT Driver;c:\windows\system32\drivers\dk2drv.sys [2010-02-03 49720]
R3 SynMini;USB2.0 1.3M WebCam;c:\windows\system32\drivers\SynMini.sys [2009-12-15 1056512]
R3 SynScan;USB2.0 1.3M WebCam Still Image;c:\windows\system32\drivers\SynScan.sys [2009-12-15 8064]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - ASIO
*NewlyCreated* - ASUPIO
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://google.pl/
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Izabela\Dane aplikacji\Mozilla\Firefox\Profiles\nhiaiql5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.3.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\nppl3260.dll
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-30 20:51
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2010-07-30 20:52:39
ComboFix-quarantined-files.txt 2010-07-30 18:52

Przed: 11 664 244 736 bajtów wolnych
Po: 11 680 305 152 bajtów wolnych

- - End Of File - - AB0188B4EFB67153504FB05AD74DEAB9
[/code]

[tehawanka 0]

Przeskanuj plik tutaj: c:\windows\system32\sfcfiles.dll

1. Pobierz i uruchom OTL

Do okna Własne opcje skanowania / skrypt wklej:

:Files

c:\windows\system32\EDE282

 

:Reg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"2B091E"=-

 

:Commands

[emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

 

2. Uruchom OTL

Do okna Własne opcje skanowania / skrypt wklej:

netsvcs
%systemdrive%\*.*

Zaznacz opcje Wszyscy użytkownicy, Infekcja LOP, Infekcja Purity i kliknij Skanuj

Log umieść tutaj i podaj link.