[log]spywer po wejsciu na stronke

**Posty:** 13 · przez **Zollek** 29 Sie 2008, 22:21

Witam
Weszlem na strone i wgral mi sie jakis spywere. Po skanie avastem i uzyciu combofixa wyglada ze pomoglo ale jeszcze prozisl bym o sprawdzenie logow.

combofix:

Kod: Zaznacz wszystko: ComboFix 08-08-29.01 - Ja 2008-08-29 22:06:46.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1526 [GMT 2:00] Running from: C:\Documents and Settings\Ja\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\Ja\USTAWI~1\Temp\tmp2.tmp C:\Documents and Settings\Ja\Dane aplikacji\rhc12uj0e94a C:\Program Files\rhc12uj0e94a C:\WINDOWS\system32\a.exe C:\WINDOWS\system32\lphc52uj0e94a.exe C:\WINDOWS\system32\phc52uj0e94a.bmp C:\WINDOWS\system32\tdssadw.dll C:\WINDOWS\system32\tdssinit.dll C:\WINDOWS\system32\tdssl.dll C:\WINDOWS\system32\tdsslog.dll C:\WINDOWS\system32\tdssmain.dll C:\WINDOWS\system32\tdssservers.dat C:\WINDOWS\system32\tmp52.tmp . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TDSSSERV -------\Service_TDSSserv ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))) . 2008-08-29 21:28 . 2008-08-29 21:28 12,288 --a------ C:\WINDOWS\system32\tdssserf.dll 2008-08-23 21:34 . 2008-08-23 21:34 <DIR> d-------- C:\Documents and Settings\Ja\Dane aplikacji\IrfanView 2008-08-16 19:44 . 2008-08-16 19:44 <DIR> d-------- C:\Program Files\MyPlayCity.com 2008-08-16 18:47 . 2008-08-16 18:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-16 18:47 . 2008-08-16 18:47 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-16 10:54 . 2008-08-16 10:59 <DIR> d-------- C:\Program Files\3D-Fahrschule 2008-08-11 15:14 . 2008-08-11 15:14 <DIR> d-------- C:\Program Files\IrfanView 2008-08-10 23:17 . 2008-08-10 23:17 <DIR> d-------- C:\Documents and Settings\Ja\Dane aplikacji\InstallShield 2008-08-10 22:46 . 2008-08-10 22:46 <DIR> d-------- C:\Documents and Settings\LocalService\Pulpit 2008-08-06 02:26 . 2008-08-06 02:26 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-08-03 21:56 . 2008-08-03 21:58 <DIR> d-------- C:\Sierra 2008-08-03 21:05 . 2008-08-03 21:17 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2008-08-03 21:05 . 2008-08-03 21:17 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2008-08-03 21:05 . 2008-08-03 21:17 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2008-08-03 09:57 . 2008-08-03 21:58 515 --a------ C:\WINDOWS\SIERRA.INI 2008-08-02 20:09 . 2008-08-02 20:09 <DIR> d-------- C:\Documents and Settings\Ja\Dane aplikacji\Sierra 2008-08-02 15:45 . 2008-08-02 15:45 <DIR> d-------- C:\Program Files\Prawo Jazdy 2006 2008-08-02 09:48 . 2008-08-02 16:31 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-07-29 15:42 . 2008-07-29 15:42 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-29 20:11 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-29 13:17 136,888 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-29 13:17 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-08-28 14:26 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Xfire 2008-08-24 08:58 --------- d-----w C:\Program Files\Lx_cats 2008-08-23 17:36 --------- d-s---w C:\Program Files\Xfire 2008-08-16 18:00 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Winamp 2008-08-16 17:18 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\BearShare 2008-08-16 17:12 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-07 13:35 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-08-03 19:11 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Hamachi 2008-08-03 18:07 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\teamspeak2 2008-08-02 06:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-07-29 16:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2008-07-20 08:07 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\GSC 2008-07-20 06:51 --------- d-----w C:\Program Files\mp3DirectCut 2008-07-18 21:02 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Ventrilo 2008-07-16 14:17 --------- d-----w C:\Program Files\r2 Studios 2008-07-16 14:17 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\r2 Studios 2008-07-16 14:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\r2 Studios 2008-07-09 19:28 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Skype 2008-07-09 19:23 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\skypePM 2008-07-09 17:53 --------- d-----w C:\Program Files\Alwil Software 2008-07-09 13:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-07-09 13:52 --------- d-----w C:\Program Files\Gadu-Gadu 2008-07-09 03:38 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-08 18:42 --------- d-----w C:\Program Files\Spyware Doctor 2008-07-08 18:39 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\PC Tools 2008-07-07 13:28 --------- d-----w C:\Program Files\ImageForge3 2008-07-07 13:28 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\CursorArts 2008-07-06 15:03 --------- d-----w C:\Program Files\Supaplex 3000 2008-07-06 09:35 1,962,773 ----a-w C:\WINDOWS\system32\4.scr 2008-07-06 09:34 2,015,863 ----a-w C:\WINDOWS\system32\3.scr 2008-07-06 09:32 1,353,836 ----a-w C:\WINDOWS\system32\2.scr 2008-07-04 20:03 --------- d-----w C:\Program Files\IPLA 2008-07-02 00:59 968,021 ----a-w C:\WINDOWS\system32\1.scr 2008-06-06 10:39 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-06-06 10:39 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-06-05 09:43 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2008-06-05 09:43 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll 2008-04-07 11:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll . [code]<pre> ------w 6,430,577 2008-05-16 16:34:12 C:\Documents and Settings\Ja\Moje dokumenty\test\I386\SVCPACK\GADU-GADU .EXE </pre>[/code] ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 09:56 122880] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-25 15:59 98304] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824] "WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2007-05-22 10:14 405504] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-06-10 21:22 1163656] "lphc52uj0e94a"="C:\WINDOWS\system32\lphc52uj0e94a.exe" [N/A] "LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-04-27 16:21 69632] "P17Helper"="SPIRun.dll" [2006-07-03 06:43 10752 C:\WINDOWS\system32\SPIRun.dll] "nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "VIDC.XFR1"= xfcodec.dll "VIDC.YV12"= yv12vfw.dll "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.mpegacm"= mpegacm.acm "msacm.ulmp3acm"= ulmp3acm.acm "VIDC.MJPG"= Pvmjpg30.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\lxcgcoms.exe"= "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcgPSWX.EXE"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"= "D:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "D:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"= "D:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"= "D:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"= 135:TCP:TCP Port 135 "5000:TCP"= 5000:TCP:TCP Port 5000 "5001:TCP"= 5001:TCP:TCP Port 5001 "5002:TCP"= 5002:TCP:TCP Port 5002 "5003:TCP"= 5003:TCP:TCP Port 5003 "5004:TCP"= 5004:TCP:TCP Port 5004 "5005:TCP"= 5005:TCP:TCP Port 5005 "5006:TCP"= 5006:TCP:TCP Port 5006 "5007:TCP"= 5007:TCP:TCP Port 5007 "5008:TCP"= 5008:TCP:TCP Port 5008 "5009:TCP"= 5009:TCP:TCP Port 5009 "5010:TCP"= 5010:TCP:TCP Port 5010 "5011:TCP"= 5011:TCP:TCP Port 5011 "5012:TCP"= 5012:TCP:TCP Port 5012 "5013:TCP"= 5013:TCP:TCP Port 5013 "5014:TCP"= 5014:TCP:TCP Port 5014 "5015:TCP"= 5015:TCP:TCP Port 5015 "5016:TCP"= 5016:TCP:TCP Port 5016 "5017:TCP"= 5017:TCP:TCP Port 5017 "5018:TCP"= 5018:TCP:TCP Port 5018 "5019:TCP"= 5019:TCP:TCP Port 5019 "5020:TCP"= 5020:TCP:TCP Port 5020 R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2006-09-13 18:19] R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2005-01-06 16:55] S3 CoachUsb;Coach Digital Camera on USB;C:\WINDOWS\system32\DRIVERS\CoachUsb.sys [2004-11-24 14:34] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0c2d635-048d-11dd-ba94-806d6172696f}] \Shell\AutoRun\command - F:\SETUP.EXE /UPDATE . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\i839amou.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ig?hl=pl FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-29 22:10:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCGCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> ?:\WINDOWS\System32\CSCDLL.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Completion time: 2008-08-29 22:14:34 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-29 20:14:21 Pre-Run: 4,820,856,832 bajtów wolnych Post-Run: 5,394,345,984 bajt˘w wolnych 227

hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:17:00, on 2008-08-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [lphc52uj0e94a] C:\WINDOWS\system32\lphc52uj0e94a.exe O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 5252 bytes

**Posty:** 8001 · przez **Okocza** 29 Sie 2008, 22:26

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\tdssserf.dll Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "lphc52uj0e94a"=- [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0c2d635-048d-11dd-ba94-806d6172696f}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

to na fix w hj

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [lphc52uj0e94a] C:\WINDOWS\system32\lphc52uj0e94a.exe

**Posty:** 13 · przez **Zollek** 29 Sie 2008, 22:36

Combofix:

Kod: Zaznacz wszystko: ComboFix 08-08-29.01 - Ja 2008-08-29 22:31:13.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1597 [GMT 2:00] Running from: C:\Documents and Settings\Ja\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Ja\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\tdssserf.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\tdssserf.dll . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-29 ))))))))))))))))))))))))))))))) . 2008-08-29 22:16 . 2008-08-29 22:16 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-23 21:34 . 2008-08-23 21:34 <DIR> d-------- C:\Documents and Settings\Ja\Dane aplikacji\IrfanView 2008-08-16 19:44 . 2008-08-16 19:44 <DIR> d-------- C:\Program Files\MyPlayCity.com 2008-08-16 18:47 . 2008-08-16 18:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-16 18:47 . 2008-08-16 18:47 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-16 10:54 . 2008-08-16 10:59 <DIR> d-------- C:\Program Files\3D-Fahrschule 2008-08-11 15:14 . 2008-08-11 15:14 <DIR> d-------- C:\Program Files\IrfanView 2008-08-10 23:17 . 2008-08-10 23:17 <DIR> d-------- C:\Documents and Settings\Ja\Dane aplikacji\InstallShield 2008-08-10 22:46 . 2008-08-10 22:46 <DIR> d-------- C:\Documents and Settings\LocalService\Pulpit 2008-08-06 02:26 . 2008-08-06 02:26 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll 2008-08-03 21:56 . 2008-08-03 21:58 <DIR> d-------- C:\Sierra 2008-08-03 21:05 . 2008-08-03 21:17 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2008-08-03 21:05 . 2008-08-03 21:17 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2008-08-03 21:05 . 2008-08-03 21:17 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2008-08-03 09:57 . 2008-08-03 21:58 515 --a------ C:\WINDOWS\SIERRA.INI 2008-08-02 20:09 . 2008-08-02 20:09 <DIR> d-------- C:\Documents and Settings\Ja\Dane aplikacji\Sierra 2008-08-02 15:45 . 2008-08-02 15:45 <DIR> d-------- C:\Program Files\Prawo Jazdy 2006 2008-08-02 09:48 . 2008-08-02 16:31 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-07-29 15:42 . 2008-07-29 15:42 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-29 20:32 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-29 13:17 136,888 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-29 13:17 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-08-28 14:26 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Xfire 2008-08-24 08:58 --------- d-----w C:\Program Files\Lx_cats 2008-08-23 17:36 --------- d-s---w C:\Program Files\Xfire 2008-08-16 18:00 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Winamp 2008-08-16 17:18 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\BearShare 2008-08-16 17:12 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-07 13:35 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-08-03 19:11 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Hamachi 2008-08-03 18:07 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\teamspeak2 2008-08-02 06:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-07-29 16:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\QuickTime 2008-07-20 08:07 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\GSC 2008-07-20 06:51 --------- d-----w C:\Program Files\mp3DirectCut 2008-07-18 21:02 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Ventrilo 2008-07-16 14:17 --------- d-----w C:\Program Files\r2 Studios 2008-07-16 14:17 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\r2 Studios 2008-07-16 14:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\r2 Studios 2008-07-09 19:28 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\Skype 2008-07-09 19:23 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\skypePM 2008-07-09 17:53 --------- d-----w C:\Program Files\Alwil Software 2008-07-09 13:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-07-09 13:52 --------- d-----w C:\Program Files\Gadu-Gadu 2008-07-09 03:38 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-08 18:42 --------- d-----w C:\Program Files\Spyware Doctor 2008-07-08 18:39 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\PC Tools 2008-07-07 13:28 --------- d-----w C:\Program Files\ImageForge3 2008-07-07 13:28 --------- d-----w C:\Documents and Settings\Ja\Dane aplikacji\CursorArts 2008-07-06 15:03 --------- d-----w C:\Program Files\Supaplex 3000 2008-07-06 09:35 1,962,773 ----a-w C:\WINDOWS\system32\4.scr 2008-07-06 09:34 2,015,863 ----a-w C:\WINDOWS\system32\3.scr 2008-07-06 09:32 1,353,836 ----a-w C:\WINDOWS\system32\2.scr 2008-07-04 20:03 --------- d-----w C:\Program Files\IPLA 2008-07-02 00:59 968,021 ----a-w C:\WINDOWS\system32\1.scr 2008-06-06 10:39 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-06-06 10:39 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-06-05 09:43 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2008-06-05 09:43 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll 2008-04-07 11:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll . [code]<pre> ------w 6,430,577 2008-05-16 16:34:12 C:\Documents and Settings\Ja\Moje dokumenty\test\I386\SVCPACK\GADU-GADU .EXE </pre>[/code] ((((((((((((((((((((((((((((( snapshot@2008-08-29_22.13.52.81 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-29 20:07:53 58,360 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-08-29 20:15:44 58,360 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-08-29 20:07:53 16,726 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-08-29 20:15:44 16,726 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-08-29 20:07:53 391,488 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-08-29 20:15:44 391,488 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-08-29 20:07:53 30,042 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-08-29 20:15:44 30,042 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 09:56 122880] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-25 15:59 98304] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824] "WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2007-05-22 10:14 405504] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-06-10 21:22 1163656] "LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-04-27 16:21 69632] "P17Helper"="SPIRun.dll" [2006-07-03 06:43 10752 C:\WINDOWS\system32\SPIRun.dll] "nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "VIDC.XFR1"= xfcodec.dll "VIDC.YV12"= yv12vfw.dll "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.mpegacm"= mpegacm.acm "msacm.ulmp3acm"= ulmp3acm.acm "VIDC.MJPG"= Pvmjpg30.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\lxcgcoms.exe"= "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcgPSWX.EXE"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"= "D:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"= "D:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "D:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"= "D:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"= "D:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"= 135:TCP:TCP Port 135 "5000:TCP"= 5000:TCP:TCP Port 5000 "5001:TCP"= 5001:TCP:TCP Port 5001 "5002:TCP"= 5002:TCP:TCP Port 5002 "5003:TCP"= 5003:TCP:TCP Port 5003 "5004:TCP"= 5004:TCP:TCP Port 5004 "5005:TCP"= 5005:TCP:TCP Port 5005 "5006:TCP"= 5006:TCP:TCP Port 5006 "5007:TCP"= 5007:TCP:TCP Port 5007 "5008:TCP"= 5008:TCP:TCP Port 5008 "5009:TCP"= 5009:TCP:TCP Port 5009 "5010:TCP"= 5010:TCP:TCP Port 5010 "5011:TCP"= 5011:TCP:TCP Port 5011 "5012:TCP"= 5012:TCP:TCP Port 5012 "5013:TCP"= 5013:TCP:TCP Port 5013 "5014:TCP"= 5014:TCP:TCP Port 5014 "5015:TCP"= 5015:TCP:TCP Port 5015 "5016:TCP"= 5016:TCP:TCP Port 5016 "5017:TCP"= 5017:TCP:TCP Port 5017 "5018:TCP"= 5018:TCP:TCP Port 5018 "5019:TCP"= 5019:TCP:TCP Port 5019 "5020:TCP"= 5020:TCP:TCP Port 5020 R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2006-09-13 18:19] R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2005-01-06 16:55] S3 CoachUsb;Coach Digital Camera on USB;C:\WINDOWS\system32\DRIVERS\CoachUsb.sys [2004-11-24 14:34] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autorun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-29 22:33:15 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCGCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-29 22:34:09 ComboFix-quarantined-files.txt 2008-08-29 20:34:05 ComboFix2.txt 2008-08-29 20:14:37 Pre-Run: 5,375,803,392 bajtów wolnych Post-Run: 5,367,033,856 bajtów wolnych 198

HiJackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:35:21, on 2008-08-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 5052 bytes

**Posty:** 8001 · przez **Okocza** 29 Sie 2008, 22:41

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 13 · przez **Zollek** 29 Sie 2008, 23:00

oto screen

Kod: Zaznacz wszystko: http://img149.imageshack.us/img149/9673/uruchomgp8.jpg

**Posty:** 8001 · przez **Okocza** 29 Sie 2008, 23:03

advantage
pctstray
nwiz

to możesz wyłączyć

**Posty:** 13 · przez **Zollek** 29 Sie 2008, 23:09

OK zrobione dziekuje za pomoc