[log] wirus winctrl2.dll

**Posty:** 45 · przez **Misior** 07 Paź 2008, 23:38

Witam pojawił się u mnie ten upierdliwy wirus.

**Posty:** 7956 · przez **Magik** 08 Paź 2008, 00:00

Misior napisał(a):Witam pojawił się u mnie ten upierdliwy wirus.

Yhy...to juz wiemy...heheheh

moze jakies logi bys wkleil np, z combofix'a i HiJackThis'a

http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

http://forum.programosy.pl/hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

**Posty:** 45 · przez **Misior** 08 Paź 2008, 00:04

właśnie w miedzy czasdie to robiłem

Kod: Zaznacz wszystko: ComboFix 08-10-07.03 - Misior 2008-10-07 23:39:10.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1448 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Misior\Pulpit\fff\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\AutoRun.inf C:\WINDOWS\system32\WinCtrl32.dl_ C:\WINDOWS\system32\WinCtrl32.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-07 do 2008-10-07 ))))))))))))))))))))))))))))))) . 2008-10-07 23:04 . 2008-10-07 23:04 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-07 22:52 . 2008-10-07 22:55 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2008-10-05 14:16 . 2008-10-05 14:18 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-09-23 14:52 . 2008-09-23 14:52 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2008-09-23 14:52 . 2008-09-23 14:52 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2008-09-23 14:52 . 2008-09-23 14:52 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2008-09-23 14:21 . 2008-09-23 14:21 106,496 --a------ C:\WINDOWS\DIIUnin.exe 2008-09-23 14:21 . 2008-09-23 14:54 29,693 --a------ C:\WINDOWS\DIIUnin.dat 2008-09-23 14:21 . 2008-09-23 14:21 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2008-09-17 15:51 . 2008-09-17 15:51 <DIR> dr-h----- C:\Documents and Settings\Misior\Dane aplikacji\SecuROM 2008-09-17 15:51 . 2008-09-17 15:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-09-17 09:34 . 2008-09-17 09:34 <DIR> d--hs---- C:\found.002 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-07 18:13 --------- d-----w C:\Documents and Settings\Misior\Dane aplikacji\Skype 2008-10-07 17:59 --------- d-----w C:\Documents and Settings\Misior\Dane aplikacji\skypePM 2008-10-06 20:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-03 17:00 138,744 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-30 18:02 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-08-30 11:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 16:43 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-22 12:17 --------- d-----w C:\Program Files\Crazy Browser 2008-08-21 17:26 --------- d-----w C:\Program Files\Nokia 2008-08-21 17:26 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-08-21 17:26 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-21 17:25 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-08-21 17:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-08-21 10:51 --------- d-----w C:\Program Files\Common Files\Skype 2008-08-21 10:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-08-08 15:23 --------- d-----w C:\Program Files\Common Files\ATI Technologies 2008-08-08 15:23 --------- d-----w C:\Program Files\ATI Technologies 2008-08-08 15:21 --------- d-----w C:\Program Files\Common Files\InstallShield . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 1267040] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 36352] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-08-02 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winai50.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfu84.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winip72.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkv77.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winrt47.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "E:\\Dysk lokalny (I)\\Battlrfield1942\\The All-Seeing Eye\\eye.exe"= "D:\\Dysk lokalny (H)\\Program Files\\The All-Seeing Eye\\eye.exe"= "E:\\Dysk lokalny (J)\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 pqeauto.database.dbmonitor.GMG;pqeauto.database.dbmonitor.GMG;C:\Program Files\BHPS\Gmg\bin\DBMonService.exe -snpqeauto.database.dbmonitor.GMG [ ] R2 pqeauto.energy.mappermonitor;pqeauto.energy.mappermonitor;C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe [2008-06-17 69632] R2 pqeauto.engine.tomcatmonitor.GMG;pqeauto.engine.tomcatmonitor.GMG;C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe [2008-06-17 69632] S0 Winip72;Winip72;C:\WINDOWS\system32\Drivers\Winip72.sys [ ] S0 Winkv77;Winkv77;C:\WINDOWS\system32\Drivers\Winkv77.sys [ ] S0 Winrt47;Winrt47;C:\WINDOWS\system32\Drivers\Winrt47.sys [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21394da4-3644-11dd-beaa-00304f1b899e}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6d05501-84ba-11dd-bf97-00304f1b899e}] \Shell\AutoRun\command - J:\Autorun.exe . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Misior\Dane aplikacji\Mozilla\Firefox\Profiles\mhycppvw.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.hattrick.ws/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-07 23:55:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\BHPS\JRE142\bin\javaw.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\BHPS\Gmg\bin\DBMonService.exe C:\Program Files\BHPS\JRE142\bin\java.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\BHPS\Gmg\bin\tbmux32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\ComboFix\pv.cfexe . ************************************************************************** . Czas ukończenia: 2008-10-08 0:00:11 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-07 22:00:07 Przed: 75 078 856 704 bajtów wolnych Po: 83,896,037,376 bajtów wolnych 160 --- E O F --- 2008-06-06 23:19:17

a teraz log z hijacka

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:04:45, on 2008-10-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe C:\Program Files\BHPS\JRE142\bin\javaw.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\BHPS\Gmg\bin\DBMonService.exe C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe C:\Program Files\BHPS\JRE142\bin\java.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\BHPS\Gmg\bin\tbmux32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\WINDOWS\explorer.exe C:\Program Files\Crazy Browser\Crazy Browser.exe C:\Documents and Settings\Misior\Pulpit\fff\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: pqeauto.database.dbmonitor.GMG - ProQuest Business Solutions - C:\Program Files\BHPS\Gmg\bin\DBMonService.exe O23 - Service: pqeauto.energy.mappermonitor - ProQuest Business Solutions - C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe O23 - Service: pqeauto.engine.tomcatmonitor.GMG - ProQuest Business Solutions - C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 8477 bytes

pozdrawiam

Dodano 07.10.2008 23:12:52:
zniknęła mi ikonka avasta z paska. czy to oznacza że nie mam ochrony teraz?

**Posty:** 7956 · przez **Magik** 08 Paź 2008, 00:28

Misior napisał(a):właśnie w miedzy czasdie to robiłem

ok ok:)

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21394da4-3644-11dd-beaa-00304f1b899e}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6d05501-84ba-11dd-bf97-00304f1b899e}]

zapisz jako fix.reg i odpal

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\found.002

zapisz jako CFScript.txt, przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

co do tego Avasta to tak.....modol ochrony jest wylaczony/uszkodzony-->BTW, zmien antywirusa avast to *****

**Posty:** 45 · przez **Misior** 08 Paź 2008, 11:42

Co polecasz zamiast AVASTa?

zrobiłem wszystko jak napisałeś

Kod: Zaznacz wszystko: [b]SDFix: Version 1.233 [/b] Run by Administrator on 2008-10-08 at 11:49 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 11:54:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:f4,2e,78,77,97,fd,33,58,ce,2b,53,2a,b2,d1,fd,c5,93,93,26,82,3c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:f4,2e,78,77,97,fd,33,58,ce,2b,53,2a,b2,d1,fd,c5,93,93,26,82,3c,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "E:\\Dysk lokalny (I)\\Battlrfield1942\\The All-Seeing Eye\\eye.exe"="E:\\Dysk lokalny (I)\\Battlrfield1942\\The All-Seeing Eye\\eye.exe:*:Enabled:The All-Seeing Eye" "D:\\Dysk lokalny (H)\\Program Files\\The All-Seeing Eye\\eye.exe"="D:\\Dysk lokalny (H)\\Program Files\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye" "E:\\Dysk lokalny (J)\\Program Files\\Skype\\Phone\\Skype.exe"="E:\\Dysk lokalny (J)\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sat 30 Aug 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Tue 7 Oct 2008 58,271,907 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8a7603e7cf792509c9ebbd8c74c82553\download\BIT142.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:58:24, on 2008-10-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe C:\Program Files\BHPS\JRE142\bin\javaw.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\BHPS\Gmg\bin\DBMonService.exe C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe C:\Program Files\BHPS\JRE142\bin\java.exe C:\Program Files\BHPS\Gmg\bin\tbmux32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Crazy Browser\Crazy Browser.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Documents and Settings\Misior\Pulpit\fff\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: pqeauto.database.dbmonitor.GMG - ProQuest Business Solutions - C:\Program Files\BHPS\Gmg\bin\DBMonService.exe O23 - Service: pqeauto.energy.mappermonitor - ProQuest Business Solutions - C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe O23 - Service: pqeauto.engine.tomcatmonitor.GMG - ProQuest Business Solutions - C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 8584 bytes

**Posty:** 684 · przez **djarta** 08 Paź 2008, 14:43

Gdzie ComboFix?

===========================
K.

**Posty:** 45 · przez **Misior** 08 Paź 2008, 14:57

djarta napisał(a):Gdzie ComboFix?

===========================
K.

prosze bardzo

Kod: Zaznacz wszystko: ComboFix 08-10-07.03 - Misior 2008-10-08 14:53:46.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1428 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Misior\Pulpit\fff\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-08 do 2008-10-08 ))))))))))))))))))))))))))))))) . 2008-10-08 11:47 . 2008-10-08 11:47 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-08 11:46 . 2008-10-08 11:46 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-08 11:30 . 2008-10-08 11:55 <DIR> d-------- C:\SDFix 2008-10-08 00:43 . 2008-10-08 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-08 00:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-08 00:00 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-10-07 23:04 . 2008-10-07 23:04 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-07 22:52 . 2008-07-18 22:09 29,896 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-10-05 14:16 . 2008-10-05 14:18 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-09-23 14:52 . 2008-09-23 14:52 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2008-09-23 14:52 . 2008-09-23 14:52 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2008-09-23 14:52 . 2008-09-23 14:52 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2008-09-23 14:21 . 2008-09-23 14:21 106,496 --a------ C:\WINDOWS\DIIUnin.exe 2008-09-23 14:21 . 2008-09-23 14:54 29,693 --a------ C:\WINDOWS\DIIUnin.dat 2008-09-23 14:21 . 2008-09-23 14:21 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2008-09-17 15:51 . 2008-09-17 15:51 <DIR> dr-h----- C:\Documents and Settings\Misior\Dane aplikacji\SecuROM 2008-09-17 15:51 . 2008-09-17 15:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-09-17 09:34 . 2008-09-17 09:34 <DIR> d--hs---- C:\found.002 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-07 18:13 --------- d-----w C:\Documents and Settings\Misior\Dane aplikacji\Skype 2008-10-07 17:59 --------- d-----w C:\Documents and Settings\Misior\Dane aplikacji\skypePM 2008-10-06 20:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-03 17:00 138,744 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-03 16:59 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-08-30 18:02 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-08-30 11:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 16:43 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-22 12:17 --------- d-----w C:\Program Files\Crazy Browser 2008-08-21 17:26 --------- d-----w C:\Program Files\Nokia 2008-08-21 17:26 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-08-21 17:26 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-21 17:25 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-08-21 17:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-08-21 10:51 --------- d-----w C:\Program Files\Common Files\Skype 2008-08-21 10:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-08-08 15:23 --------- d-----w C:\Program Files\Common Files\ATI Technologies 2008-08-08 15:23 --------- d-----w C:\Program Files\ATI Technologies 2008-08-08 15:21 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((( snapshot_2008-10-08_11.27.00.85 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-10-08 09:47:32 376,832 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-08 09:47:32 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-10-08 09:47:22 376,832 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-08 09:47:23 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-10-08 09:52:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_570.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 1267040] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 36352] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-08-02 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winai50.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfu84.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winip72.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkv77.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winrt47.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "E:\\Dysk lokalny (I)\\Battlrfield1942\\The All-Seeing Eye\\eye.exe"= "D:\\Dysk lokalny (H)\\Program Files\\The All-Seeing Eye\\eye.exe"= "E:\\Dysk lokalny (J)\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 pqeauto.database.dbmonitor.GMG;pqeauto.database.dbmonitor.GMG;C:\Program Files\BHPS\Gmg\bin\DBMonService.exe -snpqeauto.database.dbmonitor.GMG [ ] R2 pqeauto.energy.mappermonitor;pqeauto.energy.mappermonitor;C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe [2008-06-17 69632] R2 pqeauto.engine.tomcatmonitor.GMG;pqeauto.engine.tomcatmonitor.GMG;C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe [2008-06-17 69632] S0 Winip72;Winip72;C:\WINDOWS\system32\Drivers\Winip72.sys [ ] S0 Winkv77;Winkv77;C:\WINDOWS\system32\Drivers\Winkv77.sys [ ] S0 Winrt47;Winrt47;C:\WINDOWS\system32\Drivers\Winrt47.sys [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Misior\Dane aplikacji\Mozilla\Firefox\Profiles\mhycppvw.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.hattrick.ws/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 14:54:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-08 14:55:53 ComboFix-quarantined-files.txt 2008-10-08 12:55:48 ComboFix2.txt 2008-10-08 09:27:21 ComboFix3.txt 2008-10-07 22:00:12 Przed: 84 595 273 728 bajtów wolnych Po: 84,601,978,880 bajtów wolnych 145 --- E O F --- 2008-10-07 22:46:01

**Posty:** 684 · przez **djarta** 08 Paź 2008, 15:06

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\Drivers\Winip72.sys C:\WINDOWS\system32\Drivers\Winkv77.sys C:\WINDOWS\system32\Drivers\Winrt47.sys C:\WINDOWS\system32\Drivers\Winfu84.sys C:\WINDOWS\system32\Drivers\Winip72.sys C:\WINDOWS\system32\Drivers\Winkv77.sys C:\WINDOWS\system32\Drivers\Winrt47.sys Folder:: C:\found.002 Driver:: Winip72 Winkv77 Winrt47 Winfu84 Winrt47 Registry:: [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winai50.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfu84.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winip72.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkv77.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winrt47.sys]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

=============================
K.

**Posty:** 7956 · przez **Magik** 08 Paź 2008, 15:35

Misior napisał(a):Co polecasz zamiast AVASTa?

Zdanych wynalazkow typu AVG, AVira itd

Zainteresuj sie NoD, Kaspersky, McAfee

**Posty:** 45 · przez **Misior** 08 Paź 2008, 15:42

Magik napisał(a):
Misior napisał(a):Co polecasz zamiast AVASTa?

Zdanych wynalazkow typu AVG, AVira itd

Zainteresuj sie NoD, Kaspersky, McAfee

NoDa kiedyś miałem ale nie byłem zainteresowany
sprobóje mcafee

Kod: Zaznacz wszystko: ComboFix 08-10-07.03 - Misior 2008-10-08 15:31:37.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1386 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Misior\Pulpit\fff\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Misior\Pulpit\fff\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\WINDOWS\system32\Drivers\Winfu84.sys C:\WINDOWS\system32\Drivers\Winip72.sys C:\WINDOWS\system32\Drivers\Winkv77.sys C:\WINDOWS\system32\Drivers\Winrt47.sys . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\found.002 C:\found.002\file0000.chk . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINFU84 -------\Service_Winfu84 -------\Service_Winip72 -------\Service_Winkv77 -------\Service_Winrt47 ((((((((((((((((((((((((( Pliki utworzone od 2008-09-08 do 2008-10-08 ))))))))))))))))))))))))))))))) . 2008-10-08 11:47 . 2008-10-08 11:47 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-08 11:46 . 2008-10-08 11:46 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-08 11:30 . 2008-10-08 11:55 <DIR> d-------- C:\SDFix 2008-10-08 00:43 . 2008-10-08 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-08 00:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-08 00:00 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-10-07 23:04 . 2008-10-07 23:04 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-07 22:52 . 2008-07-18 22:09 29,896 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-10-05 14:16 . 2008-10-05 14:18 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-09-23 14:52 . 2008-09-23 14:52 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2008-09-23 14:52 . 2008-09-23 14:52 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2008-09-23 14:52 . 2008-09-23 14:52 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2008-09-23 14:21 . 2008-09-23 14:21 106,496 --a------ C:\WINDOWS\DIIUnin.exe 2008-09-23 14:21 . 2008-09-23 14:54 29,693 --a------ C:\WINDOWS\DIIUnin.dat 2008-09-23 14:21 . 2008-09-23 14:21 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2008-09-17 15:51 . 2008-09-17 15:51 <DIR> dr-h----- C:\Documents and Settings\Misior\Dane aplikacji\SecuROM 2008-09-17 15:51 . 2008-09-17 15:51 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-07 18:13 --------- d-----w C:\Documents and Settings\Misior\Dane aplikacji\Skype 2008-10-07 17:59 --------- d-----w C:\Documents and Settings\Misior\Dane aplikacji\skypePM 2008-10-06 20:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-03 17:00 138,744 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-10-03 16:59 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-08-30 18:02 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-08-30 11:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-25 16:43 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-22 12:17 --------- d-----w C:\Program Files\Crazy Browser 2008-08-21 17:26 --------- d-----w C:\Program Files\Nokia 2008-08-21 17:26 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-08-21 17:26 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-21 17:25 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-08-21 17:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-08-21 10:51 --------- d-----w C:\Program Files\Common Files\Skype 2008-08-21 10:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-08-08 15:23 --------- d-----w C:\Program Files\Common Files\ATI Technologies 2008-08-08 15:23 --------- d-----w C:\Program Files\ATI Technologies 2008-08-08 15:21 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((( snapshot_2008-10-08_11.27.00.85 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-10-08 09:47:32 376,832 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-08 09:47:32 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-10-08 09:47:22 376,832 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-08 09:47:23 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-10-08 13:34:06 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_568.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 1267040] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 36352] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-08-02 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "E:\\Dysk lokalny (I)\\Battlrfield1942\\The All-Seeing Eye\\eye.exe"= "D:\\Dysk lokalny (H)\\Program Files\\The All-Seeing Eye\\eye.exe"= "E:\\Dysk lokalny (J)\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 pqeauto.database.dbmonitor.GMG;pqeauto.database.dbmonitor.GMG;C:\Program Files\BHPS\Gmg\bin\DBMonService.exe -snpqeauto.database.dbmonitor.GMG [ ] R2 pqeauto.energy.mappermonitor;pqeauto.energy.mappermonitor;C:\Program Files\BHPS\Pmap1\bin\MapperMonService.exe [2008-06-17 69632] R2 pqeauto.engine.tomcatmonitor.GMG;pqeauto.engine.tomcatmonitor.GMG;C:\Program Files\BHPS\Gmg\bin\TomcatMonService.exe [2008-06-17 69632] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 15:34:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\BHPS\JRE142\bin\javaw.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\BHPS\Gmg\bin\DBMonService.exe C:\Program Files\BHPS\JRE142\bin\java.exe C:\Program Files\BHPS\Gmg\bin\tbmux32.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\Program Files\BHPS\Gmg\bin\tbkern32.exe C:\ComboFix\pv.cfexe . ************************************************************************** . Czas ukończenia: 2008-10-08 15:39:13 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-08 13:39:09 ComboFix2.txt 2008-10-08 12:55:54 ComboFix3.txt 2008-10-08 09:27:21 ComboFix4.txt 2008-10-07 22:00:12 Przed: 84 563 456 000 bajtów wolnych Po: 84,521,324,544 bajtów wolnych 175 --- E O F --- 2008-10-07 22:46:01

**Posty:** 18165 · przez **wojtas** 08 Paź 2008, 19:10

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.