prosze o sprawdzenie

**Posty:** 78 · przez **snajper1988** 31 Gru 2007, 00:48

Witam

od pewnego czasu komp chodzi strasznie wolno a gdy gram przez siec to czasami ma kilkusekundowe zawiasy :roll:

internet tez chodzi wolniej niz dotychczas... wydaje mi sie ze to moze byc jakaś infekcja

Prosze o sprawdzenie Loga
oto log
z góry dzięki za pomoc

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:41:55, on 2007-12-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\PSIService.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE E:\Instalki\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\PPMate\ppmate.exe -autoplay O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1045 O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{8953EFBB-6B0C-4A49-84FE-865C8AD00330}: NameServer = 194.204.159.1,194.204.159.34 O17 - HKLM\System\CCS\Services\Tcpip\..\{EC1ABF24-1C98-461F-B73D-DD1A846701C5}: NameServer = 194.204.159.1,194.204.159.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

**Posty:** 18165 · przez **wojtas** 31 Gru 2007, 12:27

Wykonaj to co jest podane w tym temacie

skasuj:

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa

**Posty:** 78 · przez **snajper1988** 31 Gru 2007, 15:38

Log SDFix

Kod: Zaznacz wszystko: SDFix: Version 1.120 Run by Sn@jpeR on 2007-12-31 at 13:52 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\Documents and Settings\Sn@jpeR\Ustawienia lokalne\Temp\Jav26.tmp.exe - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-31 14:06:55 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:23,b8,ab,33,f6,b8,db,dc,c0,58,eb,78,9a,26,68,6f,a3,d1,c6,7c,80,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5b,a5,4d,4d,10,0d,02,1b,57,e3,60,5c,3d,51,54,e1,4d,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,ea,92,9f,bd,e8,10,0c,3a,27,00,1f,88,99,c1,0e,04,23,70,a0,12,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:23,b8,ab,33,f6,b8,db,dc,c0,58,eb,78,9a,26,68,6f,a3,d1,c6,7c,80,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5b,a5,4d,4d,10,0d,02,1b,57,e3,60,5c,3d,51,54,e1,4d,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,ea,92,9f,bd,e8,10,0c,3a,27,00,1f,88,99,c1,0e,04,23,70,a0,12,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:23,b8,ab,33,f6,b8,db,dc,c0,58,eb,78,9a,26,68,6f,a3,d1,c6,7c,80,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5b,a5,4d,4d,10,0d,02,1b,57,e3,60,5c,3d,51,54,e1,4d,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,ea,92,9f,bd,e8,10,0c,3a,27,00,1f,88,99,c1,0e,04,23,70,a0,12,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:23,b8,ab,33,f6,b8,db,dc,c0,58,eb,78,9a,26,68,6f,a3,d1,c6,7c,80,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5b,a5,4d,4d,10,0d,02,1b,57,e3,60,5c,3d,51,54,e1,4d,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,ea,92,9f,bd,e8,10,0c,3a,27,00,1f,88,99,c1,0e,04,23,70,a0,12,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:85,90,ed,00,fa,89,ab,8d,ec,bf,21,74,da,40,81,2a,69,57,91,59,d2,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7a,81,11,5d,63,ae,21,92,0e,a8,fb,76,ca,b2,83,83,bc,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d0,4a,b8,c2,64,9c,ac,7c,ee,86,f1,fc,e1,9a,c6,87,11,cf,52,e1,f8,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2ac7d0f7 "s2"=dword:1e01d803 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:85,90,ed,00,fa,89,ab,8d,ec,bf,21,74,da,40,81,2a,69,57,91,59,d2,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,d2,7b,9a,2f,eb,26,17,be,66,4e,71,22,12,b3,8e,4d,64,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ac,a1,8d,05,26,08,6e,ec,8a,06,ad,56,8a,00,ac,67,11,6f,84,42,1a,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:d0,4a,b8,c2,64,9c,ac,7c,ee,86,f1,fc,e1,9a,c6,87,11,cf,52,e1,f8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:85,90,ed,00,fa,89,ab,8d,ec,bf,21,74,da,40,81,2a,69,57,91,59,d2,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,d2,7b,9a,2f,eb,26,17,be,66,4e,71,22,12,b3,8e,4d,64,.. "khjeh"=hex:66,e1,8e,3f,3b,f0,ec,95,b4,71,a5,e2,d9,0e,bd,2b,1f,d3,1a,55,06,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ac,a1,8d,05,26,08,6e,ec,8a,06,ad,56,8a,00,ac,67,11,6f,84,42,1a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:d0,4a,b8,c2,64,9c,ac,7c,ee,86,f1,fc,e1,9a,c6,87,11,cf,52,e1,f8,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,9a,02,00,00,01,00,00,00,06,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\TVAnts\\Tvants.exe"="C:\\Program Files\\TVAnts\\Tvants.exe:*:Enabled:TVAnts" "C:\\Program Files\\PPMate\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\PPMate\\ppmate.exe:*:Enabled:PPMate" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus" "C:\\Program Files\\Aspyr\\MTX\\Game\\MTX.exe"="C:\\Program Files\\Aspyr\\MTX\\Game\\MTX.exe:*:Enabled:MTX" "C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" "C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "C:\\Documents and Settings\\Sn@jpeR\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\Sn@jpeR\\Dane aplikacji\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe:*:Enabled:Age of Empires II" "C:\\Program Files\\F1 Challenge 2007\\F1Challenge2007.exe"="C:\\Program Files\\F1 Challenge 2007\\F1Challenge2007.exe:*:Enabled:F1 Challenge 99-02" "C:\\Program Files\\LANChat Pro\\LANChat.exe"="C:\\Program Files\\LANChat Pro\\LANChat.exe:*:Enabled:LANChat Pro v2.20a executable file" "D:\\Gry\\Need For Speed Most Wanted\\speed.exe"="D:\\Gry\\Need For Speed Most Wanted\\speed.exe:*:Enabled:speed" "D:\\Gry\\Hooligans\\Hooligans.exe"="D:\\Gry\\Hooligans\\Hooligans.exe:*:Enabled:Hooligans" "D:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"="D:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe:*:Enabled:Age of Empires 3" "D:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"="D:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Fri 17 Aug 2001 24,448 A.SHR --- "C:\NTBOOTDD.SYS" Wed 8 Aug 2007 88 ..SHR --- "C:\WINDOWS\system32\9001DC20CB.sys" Fri 14 Sep 2007 88 ..SHR --- "C:\WINDOWS\system32\B207935DEA.sys" Fri 14 Sep 2007 6,372 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Fri 19 Jan 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Finished!

Log Combofix

Kod: Zaznacz wszystko: ComboFix 07-12-31.4 - Sn@jpeR 2007-12-31 14:26:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.249 [GMT 1:00] Running from: E:\Instalki\Instalki2\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-31 ))))))))))))))))))))))))))))))) . 2007-12-31 14:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-31 13:51 . 2007-12-31 13:52 <DIR> d-------- C:\WINDOWS\ERUNT 2007-12-25 13:48 . 2007-12-25 13:48 0 --a------ C:\WINDOWS\mngui.INI 2007-12-14 18:09 . 2007-12-14 18:09 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp 2007-12-14 18:09 . 2007-12-14 18:09 52,499 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-12-14 18:07 . 2007-12-14 18:09 4,837 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-12-14 18:06 . 2007-12-14 18:06 <DIR> d-------- C:\WINDOWS\BricoPacks 2007-12-10 15:57 . 2007-12-10 15:57 <DIR> d-------- C:\Program Files\VID_0E8F&PID_0012 2007-12-05 09:25 . 2007-12-05 15:55 <DIR> d-------- C:\Program Files\Game Graphic Studio 2007-12-02 19:59 . 2007-12-02 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Age of Empires 3 2007-11-13 15:38 . 2007-11-14 08:01 <DIR> d-------- C:\Documents and Settings\Sn@jpeR\Dane aplikacji\Teleca 2007-11-12 14:05 . 2007-11-12 14:05 <DIR> d-------- C:\Documents and Settings\Sn@jpeR\Dane aplikacji\Sony Ericsson 2007-11-12 14:02 . 2007-11-12 14:04 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-11-12 14:01 . 2007-11-12 14:02 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-11-12 14:01 . 2007-11-12 14:02 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared 2007-11-12 14:01 . 2007-11-12 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2007-11-12 14:00 . 2007-11-12 14:00 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-11-12 13:55 . 2007-11-12 13:55 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-12 13:55 . 2007-11-12 13:55 1,409 --a------ C:\WINDOWS\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-31 13:20 --------- d-----w C:\Program Files\lg_fwupdate 2007-12-30 22:16 --------- d-----w C:\Documents and Settings\Sn@jpeR\Dane aplikacji\Skype 2007-12-18 06:06 --------- d-----w C:\Documents and Settings\Sn@jpeR\Dane aplikacji\Azureus 2007-12-14 17:09 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-12-10 14:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-12-02 23:23 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-02 19:36 --------- d-----w C:\Documents and Settings\Sn@jpeR\Dane aplikacji\Hamachi 2007-11-13 14:52 --------- d-----w C:\Program Files\Sony Ericsson 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-12 13:02 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-20 05:01 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-09-28 11:25 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-14 18:59 6,372 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-01-24 14:36 45,305 ----a-w C:\Program Files\dxdllreg_x86.cab 2007-01-24 14:36 198,275 ----a-w C:\Program Files\FEB2007_XACT_x64.cab 2007-01-24 14:36 151,583 ----a-w C:\Program Files\FEB2007_XACT_x86.cab 2007-01-24 14:21 976,020 ------w C:\Program Files\BDAXP.cab 2007-01-24 14:21 917,318 ------w C:\Program Files\Apr2006_MDX1_x86.cab 2007-01-24 14:21 91,265 ------w C:\Program Files\OCT2006_xinput_x64.cab 2007-01-24 14:21 88,102 ------w C:\Program Files\AUG2006_xinput_x64.cab 2007-01-24 14:21 87,989 ------w C:\Program Files\Apr2006_xinput_x64.cab 2007-01-24 14:21 86,925 ------w C:\Program Files\Oct2005_xinput_x64.cab 2007-01-24 14:21 85,235 ----a-w C:\Program Files\dxupdate.cab 2007-01-24 14:21 77,160 ----a-w C:\Program Files\DSETUP.dll 2007-01-24 14:21 503,144 ----a-w C:\Program Files\DXSETUP.exe 2007-01-24 14:21 49,149 ------w C:\Program Files\OCT2006_xinput_x86.cab 2007-01-24 14:21 47,018 ------w C:\Program Files\AUG2006_xinput_x86.cab 2007-01-24 14:21 46,898 ------w C:\Program Files\Apr2006_xinput_x86.cab 2007-01-24 14:21 46,247 ------w C:\Program Files\Oct2005_xinput_x86.cab 2007-01-24 14:21 4,163,518 ------w C:\Program Files\Apr2006_MDX1_x86_Archive.cab 2007-01-24 14:21 213,767 ------w C:\Program Files\DEC2006_d3dx10_00_x64.cab 2007-01-24 14:21 193,435 ------w C:\Program Files\DEC2006_XACT_x64.cab 2007-01-24 14:21 192,680 ------w C:\Program Files\DEC2006_d3dx10_00_x86.cab 2007-01-24 14:21 183,863 ------w C:\Program Files\AUG2006_XACT_x64.cab 2007-01-24 14:21 183,321 ------w C:\Program Files\OCT2006_XACT_x64.cab 2007-01-24 14:21 181,745 ------w C:\Program Files\JUN2006_XACT_x64.cab 2007-01-24 14:21 180,021 ------w C:\Program Files\Apr2006_XACT_x64.cab 2007-01-24 14:21 179,247 ------w C:\Program Files\Feb2006_XACT_x64.cab 2007-01-24 14:21 146,559 ------w C:\Program Files\DEC2006_XACT_x86.cab 2007-01-24 14:21 138,977 ------w C:\Program Files\OCT2006_XACT_x86.cab 2007-01-24 14:21 138,195 ------w C:\Program Files\AUG2006_XACT_x86.cab 2007-01-24 14:21 134,631 ------w C:\Program Files\JUN2006_XACT_x86.cab 2007-01-24 14:21 133,991 ------w C:\Program Files\Apr2006_XACT_x86.cab 2007-01-24 14:21 133,297 ------w C:\Program Files\Feb2006_XACT_x86.cab 2007-01-24 14:21 13,265,040 ------w C:\Program Files\dxnt.cab 2007-01-24 14:21 1,673,576 ----a-w C:\Program Files\dsetup32.dll 2007-01-24 14:21 1,575,336 ------w C:\Program Files\DEC2006_d3dx9_32_x86.cab 2007-01-24 14:21 1,572,114 ------w C:\Program Files\DEC2006_d3dx9_32_x64.cab 2007-01-24 14:21 1,413,862 ------w C:\Program Files\OCT2006_d3dx9_31_x64.cab 2007-01-24 14:21 1,398,718 ------w C:\Program Files\Apr2006_d3dx9_30_x64.cab 2007-01-24 14:21 1,363,684 ------w C:\Program Files\Feb2006_d3dx9_29_x64.cab 2007-01-24 14:21 1,358,864 ------w C:\Program Files\Dec2005_d3dx9_28_x64.cab 2007-01-24 14:21 1,351,430 ------w C:\Program Files\Aug2005_d3dx9_27_x64.cab 2007-01-24 14:21 1,348,242 ------w C:\Program Files\Apr2005_d3dx9_25_x64.cab 2007-01-24 14:21 1,336,890 ------w C:\Program Files\Jun2005_d3dx9_26_x64.cab 2007-01-24 14:21 1,248,387 ------w C:\Program Files\Feb2005_d3dx9_24_x64.cab 2007-01-24 14:21 1,156,363 ------w C:\Program Files\BDANT.cab 2007-01-24 14:21 1,128,177 ------w C:\Program Files\OCT2006_d3dx9_31_x86.cab 2007-01-24 14:21 1,116,109 ------w C:\Program Files\Apr2006_d3dx9_30_x86.cab 2007-01-24 14:21 1,085,608 ------w C:\Program Files\Feb2006_d3dx9_29_x86.cab 2007-01-24 14:21 1,080,344 ------w C:\Program Files\Dec2005_d3dx9_28_x86.cab 2007-01-24 14:21 1,079,850 ------w C:\Program Files\Apr2005_d3dx9_25_x86.cab 2007-01-24 14:21 1,078,532 ------w C:\Program Files\Aug2005_d3dx9_27_x86.cab 2007-01-24 14:21 1,065,813 ------w C:\Program Files\Jun2005_d3dx9_26_x86.cab 2007-01-24 14:21 1,014,113 ------w C:\Program Files\Feb2005_d3dx9_24_x86.cab 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2007-08-08 21:28 88 --sh--r C:\WINDOWS\system32\9001DC20CB.sys 2007-09-14 18:59 88 --sh--r C:\WINDOWS\system32\B207935DEA.sys 2007-09-14 18:59 6,372 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400] "PowerBar"="C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" [2004-04-21 10:26 86016] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-08-08 00:15 2111176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 21:10 339968] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 16:10 57344] "P17Helper"="P17.dll" [2005-05-03 12:38 64512 C:\WINDOWS\system32\P17.dll] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 22:05 32881] "ppmate"="C:\Program Files\PPMate\PPMate\ppmate.exe" [2006-10-27 10:43 1495111] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2007-04-07 01:16 249856] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 13:43 45056] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-09 13:26 185632] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 01:06 487424] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\aoesetup.exe /autorun \Shell\directx\command - F:\DirectX\dxsetup.exe \Shell\dplay\command - F:\DirectX\dplay61a.exe \Shell\dxdiag\command - F:\goodies\ar40eng.exe \Shell\dxinfo\command - F:\goodies\DirectX\dxinfo.exe \Shell\dxtest\command - F:\DirectX\dxdiag.exe \Shell\dxtool\command - F:\goodies\DirectX\dxtool.exe \Shell\log\command - F:\goodies\machine\machine.exe -l \Shell\machine\command - F:\goodies\machine\machine.exe \Shell\setup\command - F:\aoesetup.exe /autorun \Shell\zone\command - F:\goodies\mszone\zoneA600.exe *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-31 14:30:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-31 14:31:25 . 2007-12-15 08:07:42 --- E O F ---

**Posty:** 18165 · przez **wojtas** 31 Gru 2007, 16:34

czysto

**Posty:** 78 · przez **snajper1988** 31 Gru 2007, 16:38

Dzieki Ci wielkie

wnosze o pochwałe dla tego pana

szczęśliwego nowego roku :idea:

prosze o sprawdzenie

Prosze o sprawdzenie

Kto jest na forum