2fiji.com i cvko.exe

**Posty:** 7 · przez **sekretmnicha** 21 Paź 2008, 00:13

Witam, mam ogromny problem.
Kolega przyniósł m dzisiaj swojego "super pendriva" ;/ i wiem iż napewno mam na kompie te 2 wirusy ale sądzę iż jest tego więcej.
Po pierwsze nie mogę niz zeskanować Kasperskym 8. Co chwilę wywala mi program i pisze błąd: Uploading collected memory file and traces to Kaspersky lab.
Dzieje się to po tym jak widząc iż chce się uruchomić CVKO.EXE dałem żeby Kaspersky zablokował ten program.
Po 2gie nie mogę wejść na żaden dysk, Kaspersky wyświetla czy chce uruchomić 2FIJI.COM.
Po 3cie co najgorsze z 2giga wolnego na dysku C zrobiło mi sie 0 bajtów:( nie mogę nawet zainstalować ComboFixa. Prosił bym o szybką pomoc co do tego ostatniego problemu żebym mógł wkleić log z programu i rozwiązać te 2 poprzednie.

Bardzo dziękuje za każdą pomoc.

**Posty:** 7956 · przez **Magik** 21 Paź 2008, 00:26

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 7 · przez **sekretmnicha** 21 Paź 2008, 00:28

Udało mi się zainstalować ComboFixa, usunełem kilka plików i na szybko zainstalowałem program. Po uruchomieniu programu pokazuje normalną wolną przestrzeń na dysku C. Prosze o sprawdzenie loga.

Kod: Zaznacz wszystko: ComboFix 08-10-19.04 - Robert 2008-10-21 0:19:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2441 [GMT 2:00] Uruchomiony z: D:\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\ev60a2.cmd C:\WINDOWS\system32\AutoRun.inf C:\WINDOWS\system32\ckvo.exe C:\WINDOWS\system32\ckvo0.dll C:\WINDOWS\system32\ckvo1.dll D:\Autorun.inf D:\ev60a2.cmd . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-20 do 2008-10-20 ))))))))))))))))))))))))))))))) . 2008-10-20 22:52 . 2008-10-20 20:47 106,249 -r-hs---- C:\2fiji.com 2008-10-20 21:04 . 2008-10-20 21:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-16 20:27 . 2008-10-16 20:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-16 20:26 . 2008-10-16 20:26 <DIR> d-------- C:\Program Files\DIFX 2008-10-16 20:26 . 2008-10-16 20:29 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\Nokia 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-16 20:25 . 2008-10-16 20:31 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\PC Suite 2008-10-16 20:25 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-10-16 20:25 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-16 20:25 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-16 20:25 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-10-16 20:25 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-10-16 20:25 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-10-16 20:23 . 2008-10-16 20:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-16 10:46 . 2008-10-16 10:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-15 12:39 . 2008-09-15 17:27 1,846,656 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 12:39 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 12:38 . 2008-08-14 15:26 2,190,464 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,146,816 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,067,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,025,472 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-11 18:59 . 2008-10-11 18:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TechSmith 2008-10-11 12:18 . 2008-10-15 15:26 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-10-09 10:18 . 2008-10-20 16:05 23 --a------ C:\WINDOWS\BlendSettings.ini 2008-10-09 08:43 . 2008-07-28 17:19 116,736 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys 2008-10-08 12:10 . 2008-10-08 12:10 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\teamspeak2 2008-10-08 12:10 . 2008-10-08 12:10 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-10-06 17:14 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll 2008-10-06 17:14 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll 2008-10-06 17:14 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll 2008-10-06 17:14 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll 2008-10-06 17:14 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll 2008-10-06 17:14 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll 2008-10-06 17:14 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll 2008-10-06 17:14 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll 2008-10-06 17:14 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll 2008-10-06 17:13 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2008-10-06 17:13 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2008-10-06 17:13 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2008-10-06 17:13 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2008-10-06 17:13 . 2007-10-22 03:37 17,928 --a------ C:\WINDOWS\system32\X3DAudio1_2.dll 2008-10-05 19:16 . 2008-10-05 20:17 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-04 15:17 . 2008-10-04 15:18 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\SPORE 2008-10-02 16:34 . 2008-10-02 16:34 <DIR> d-------- C:\Documents and Settings\Robert\Bluetooth Software 2008-10-02 09:33 . 2008-10-07 16:57 10,503 --a------ C:\WINDOWS\system32\%LocalXml% 2008-09-26 14:45 . 2008-07-23 15:24 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-09-26 09:45 . 2008-09-26 09:50 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\GanymedeNet 2008-09-25 12:54 . 2008-09-25 12:54 <DIR> d-------- C:\WINDOWS\Sun 2008-09-24 20:17 . 2008-09-24 20:17 <DIR> d-------- C:\Program Files\Java 2008-09-24 20:17 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-24 20:10 . 2008-09-24 20:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-09-20 13:45 . 2008-04-14 19:20 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-09-20 13:45 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 22:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-20 22:18 458,784 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-20 22:18 3,696 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-20 19:58 20,900 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-20 19:58 2,268,704 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-20 16:34 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\uTorrent 2008-10-19 12:39 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2008-10-15 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-10-11 16:58 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-10-09 07:52 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-01 17:02 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-09-03 11:04 --------- d-----w C:\Program Files\MSXML 4.0 2008-08-29 20:26 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\HPAppData 2008-08-29 20:18 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\HP 2008-08-29 17:11 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\HP 2008-08-29 17:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WEBREG 2008-08-29 17:09 --------- d-----w C:\Program Files\HP 2008-08-29 17:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY 2008-08-29 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2008-08-29 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-08-29 17:06 --------- d-----w C:\Program Files\Hewlett-Packard 2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\HP 2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2008-08-29 17:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard 2008-08-24 16:13 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-08-23 17:42 --------- d-----w C:\Program Files\Common Files\DirectX 2008-08-21 21:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2008-08-21 21:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-08-21 21:36 --------- d-----w C:\Program Files\Common Files\Logishrd 2008-08-21 21:36 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\Logitech 2008-08-21 21:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LogiShrd 2008-08-21 21:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Logitech 2008-08-21 21:07 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-21 21:07 --------- d--h--r C:\Documents and Settings\Robert\Dane aplikacji\SecuROM 2008-08-21 20:30 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-08-21 20:30 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-08-21 20:30 --------- d-----w C:\Program Files\OpenAL 2008-08-20 05:11 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 11:01 60,911 ----a-w C:\WINDOWS\BricoPackUninst.cmd 2008-08-14 11:01 5,332 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-08-14 11:01 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-08-13 14:25 356,352 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe 2008-08-13 14:25 21,393 ----a-w C:\WINDOWS\AegisP.sys 2008-08-13 14:06 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-29 18:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll . ------- Sigcheck ------- 2008-04-14 19:21 977408 f042e3426d45d86d9bb55f6a79ab441a C:\WINDOWS\explorer.exe 2004-08-04 01:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2008-04-14 19:21 977408 f042e3426d45d86d9bb55f6a79ab441a C:\WINDOWS\ServicePackFiles\i386\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880] "snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-29 569344] "Adobe Reader Speed Launcher"="D:\Programy\Adobe Reader\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="D:\Programy\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "GrooveMonitor"="D:\Programy\Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-07 8462336] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2007-08-07 81920] "AVP"="D:\Programy\Kaspersky Internet Security\avp.exe" [2008-07-29 206088] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 C:\WINDOWS\RTHDCPL.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 C:\WINDOWS\KHALMNPR.Exe] "nwiz"="nwiz.exe" [2007-08-07 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] "Nokia.PCSync"="D:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336] C:\Documents and Settings\Robert\Menu Start\Programy\Autostart\ RocketDock.lnk - D:\Programy\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784] TransBar.lnk - D:\Programy\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536] UberIcon.lnk - D:\Programy\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224] Y'z Shadow.lnk - D:\Programy\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - D:\Programy\Logitech\SetPoint\SetPoint.exe [2008-08-21 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2007-08-24 07:00 33648 D:\Programy\Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2007-06-01 10:49 974848 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] --a------ 2007-06-01 10:51 823296 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] --a------ 2007-12-10 10:12 695808 D:\Programy\Nokia\Nokia PC Suite 6\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WLSS] --a------ 2007-04-23 18:55 190000 C:\Program Files\Compal\Wireless Select Switch\WLSS.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\Programy\\Office\\Office12\\OUTLOOK.EXE"= "D:\\Programy\\Office\\Office12\\GROOVE.EXE"= "D:\\Programy\\Office\\Office12\\ONENOTE.EXE"= "D:\\Programy\\uTorrent\\uTorrent.exe"= "D:\\Gry\\Pro Evo 9\\pes2009.exe"= R0 EMSC;COMPAL Embedded System Control;C:\WINDOWS\system32\DRIVERS\EMSC.SYS [2007-03-14 9856] R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592] R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-11-18 27776] S3 AVPsys;AVPsys;C:\WINDOWS\system32\drivers\cdaudio.sys [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - C:\2fiji.com \Shell\explore\Command - C:\2fiji.com \Shell\open\Command - C:\2fiji.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\2fiji.com \Shell\explore\Command - D:\2fiji.com \Shell\open\Command - D:\2fiji.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\OblivionLauncher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aa5f358-9af8-11dd-ae73-00508a6d771a}] \Shell\AutoRun\command - H:\9.cmd \Shell\explore\Command - H:\9.cmd \Shell\open\Command - H:\9.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a9f5e-9dff-11dd-ae80-001b385c57a7}] \Shell\AutoRun\command - H:\ev60a2.cmd \Shell\explore\Command - H:\ev60a2.cmd \Shell\open\Command - H:\ev60a2.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a9f6c-9dff-11dd-ae80-001b385c57a7}] \Shell\AutoRun\command - H:\2fiji.com \Shell\explore\Command - H:\2fiji.com \Shell\open\Command - H:\2fiji.com *Newly Created Service* - PROCEXP90 . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file) HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Robert\Dane aplikacji\Mozilla\Firefox\Profiles\ealinawe.default\ FF -: plugin - D:\Programy\Adobe Reader\Reader\browser\nppdf32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\np-mswmp.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\np32dsw.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npdjvu.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npganymedenet.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nppdf32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nppl3260.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nprpjplug.dll FF -: plugin - D:\Programy\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - D:\Programy\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 00:22:25 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-21 0:23:22 ComboFix-quarantined-files.txt 2008-10-20 22:23:19 Przed: 1 126 178 816 bajtów wolnych Po: 960,106,496 bajtów wolnych 270 --- E O F --- 2008-10-15 15:08:03

**Posty:** 7956 · przez **Magik** 21 Paź 2008, 00:39

sekretmnicha napisał(a):Udało mi się zainstalować ComboFixa,

ale odpal tez sdfix j/w, do tego

http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aa5f358-9af8-11dd-ae73-00508a6d771a}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a9f5e-9dff-11dd-ae80-001b385c57a7}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a9f6c-9dff-11dd-ae80-001b385c57a7}]

zapisz jako fix.reg

i wroc z 4 logami: z sdfix, FixIEdef, Hijack i combofix

**Posty:** 7 · przez **sekretmnicha** 21 Paź 2008, 00:49

Wyskakuje błąd iż wpis nie jest skryptem rejestru.

Tutaj log z SDFix ale przed dodaniem wpisów przez Pana podanych do rejestru.

Kod: Zaznacz wszystko: [b]SDFix: Version 1.236 [/b] Run by Robert on 2008-10-21 at 00:36 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 00:40:38 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="D:\Programy\DAEMON Tools Pro\" "h0"=dword:00000000 "hdf12"=hex:1c,c0,02,fd,59,97,28,04,4d,7c,f4,49,82,d8,d9,64,cd,6c,17,2c,1d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,65,b4,5a,a9,a8,bb,8a,82,ad,00,b1,de,23,33,cf,53,1b,.. "hdf12"=hex:f0,a6,dc,d2,79,80,7e,99,2a,f6,71,e7,c2,82,35,c6,e1,75,af,57,d7,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:30,c9,9f,82,e8,ef,26,e4,f9,75,b2,e8,c4,c4,ac,12,62,c0,56,70,ce,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="D:\Programy\DAEMON Tools Pro\" "h0"=dword:00000000 "hdf12"=hex:1c,c0,02,fd,59,97,28,04,4d,7c,f4,49,82,d8,d9,64,cd,6c,17,2c,1d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,65,b4,5a,a9,a8,bb,8a,82,ad,00,b1,de,23,33,cf,53,1b,.. "hdf12"=hex:f0,a6,dc,d2,79,80,7e,99,2a,f6,71,e7,c2,82,35,c6,e1,75,af,57,d7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:30,c9,9f,82,e8,ef,26,e4,f9,75,b2,e8,c4,c4,ac,12,62,c0,56,70,ce,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "D:\\Programy\\Office\\Office12\\OUTLOOK.EXE"="D:\\Programy\\Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "D:\\Programy\\Office\\Office12\\GROOVE.EXE"="D:\\Programy\\Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "D:\\Programy\\Office\\Office12\\ONENOTE.EXE"="D:\\Programy\\Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "D:\\Programy\\uTorrent\\uTorrent.exe"="D:\\Programy\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "D:\\Gry\\Pro Evo 9\\pes2009.exe"="D:\\Gry\\Pro Evo 9\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 20 Oct 2008 106,249 ..SHR --- "C:\2fiji.com" Wed 1 Oct 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" [b]Finished![/b]

**Posty:** 7956 · przez **Magik** 21 Paź 2008, 01:09

sekretmnicha napisał(a):Wyskakuje błąd iż wpis nie jest skryptem rejestru.

hmm moj blad bo juz pozna pora, zjadlem slowo. Teraz jest juz ok

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aa5f358-9af8-11dd-ae73-00508a6d771a}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a9f5e-9dff-11dd-ae80-001b385c57a7}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a9f6c-9dff-11dd-ae80-001b385c57a7}]

postepujesz jak wczesniej i po zrobieniu tego pozostale 3 logi

**Posty:** 7 · przez **sekretmnicha** 21 Paź 2008, 09:10

Wklejam pozostałe 3 logi, bo dodaniu już tego wpisu do rejestru.

ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-10-19.04 - Robert 2008-10-21 9:03:44.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2620 [GMT 2:00] Uruchomiony z: D:\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-21 do 2008-10-21 ))))))))))))))))))))))))))))))) . 2008-10-21 00:54 . 2008-10-21 00:54 <DIR> d-------- C:\!FixIEDef 2008-10-21 00:51 . 2008-10-21 09:02 <DIR> d-------- C:\HijackThis 2008-10-21 00:36 . 2008-10-21 00:36 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-10-21 00:34 . 2008-10-21 00:35 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-21 00:31 . 2008-10-21 00:41 <DIR> d-------- C:\SDFix 2008-10-20 22:52 . 2008-10-20 20:47 106,249 -r-hs---- C:\2fiji.com 2008-10-20 21:04 . 2008-10-20 21:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-16 20:27 . 2008-10-16 20:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-16 20:26 . 2008-10-16 20:26 <DIR> d-------- C:\Program Files\DIFX 2008-10-16 20:26 . 2008-10-16 20:29 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\Nokia 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-16 20:25 . 2008-10-16 20:31 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\PC Suite 2008-10-16 20:25 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-10-16 20:25 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-16 20:25 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-16 20:25 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-10-16 20:25 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-10-16 20:25 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-10-16 20:23 . 2008-10-16 20:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-16 10:46 . 2008-10-16 10:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-15 12:39 . 2008-09-15 17:27 1,846,656 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 12:39 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 12:38 . 2008-08-14 15:26 2,190,464 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,146,816 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,067,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,025,472 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-11 18:59 . 2008-10-11 18:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TechSmith 2008-10-11 12:18 . 2008-10-15 15:26 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-10-09 10:18 . 2008-10-20 16:05 23 --a------ C:\WINDOWS\BlendSettings.ini 2008-10-09 08:43 . 2008-07-28 17:19 116,736 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys 2008-10-08 12:10 . 2008-10-08 12:10 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\teamspeak2 2008-10-08 12:10 . 2008-10-08 12:10 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-10-06 17:14 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll 2008-10-06 17:14 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll 2008-10-06 17:14 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll 2008-10-06 17:14 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll 2008-10-06 17:14 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll 2008-10-06 17:14 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll 2008-10-06 17:14 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll 2008-10-06 17:14 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll 2008-10-06 17:14 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll 2008-10-06 17:13 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2008-10-06 17:13 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2008-10-06 17:13 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2008-10-06 17:13 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2008-10-06 17:13 . 2007-10-22 03:37 17,928 --a------ C:\WINDOWS\system32\X3DAudio1_2.dll 2008-10-05 19:16 . 2008-10-05 20:17 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-04 15:17 . 2008-10-04 15:18 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\SPORE 2008-10-02 16:34 . 2008-10-02 16:34 <DIR> d-------- C:\Documents and Settings\Robert\Bluetooth Software 2008-10-02 09:33 . 2008-10-07 16:57 10,503 --a------ C:\WINDOWS\system32\%LocalXml% 2008-09-26 14:45 . 2008-07-23 15:24 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-09-26 09:45 . 2008-09-26 09:50 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\GanymedeNet 2008-09-25 12:54 . 2008-09-25 12:54 <DIR> d-------- C:\WINDOWS\Sun 2008-09-24 20:17 . 2008-09-24 20:17 <DIR> d-------- C:\Program Files\Java 2008-09-24 20:17 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-24 20:10 . 2008-09-24 20:10 <DIR> d-------- C:\Program Files\Common Files\Java . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-21 06:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-20 23:01 458,784 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-20 23:01 3,696 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-20 23:01 20,900 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-20 23:01 2,268,704 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-20 16:34 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\uTorrent 2008-10-19 12:39 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2008-10-15 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-10-11 16:58 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-10-09 07:52 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-01 17:02 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-09-03 11:04 --------- d-----w C:\Program Files\MSXML 4.0 2008-08-29 20:26 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\HPAppData 2008-08-29 20:18 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\HP 2008-08-29 17:11 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\HP 2008-08-29 17:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WEBREG 2008-08-29 17:09 --------- d-----w C:\Program Files\HP 2008-08-29 17:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY 2008-08-29 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2008-08-29 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-08-29 17:06 --------- d-----w C:\Program Files\Hewlett-Packard 2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\HP 2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2008-08-29 17:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard 2008-08-24 16:13 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-08-23 17:42 --------- d-----w C:\Program Files\Common Files\DirectX 2008-08-21 21:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2008-08-21 21:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-08-21 21:36 --------- d-----w C:\Program Files\Common Files\Logishrd 2008-08-21 21:36 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\Logitech 2008-08-21 21:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LogiShrd 2008-08-21 21:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Logitech 2008-08-21 21:07 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-21 21:07 --------- d--h--r C:\Documents and Settings\Robert\Dane aplikacji\SecuROM 2008-08-21 20:30 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-08-21 20:30 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-08-21 20:30 --------- d-----w C:\Program Files\OpenAL 2008-08-20 05:11 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 11:01 60,911 ----a-w C:\WINDOWS\BricoPackUninst.cmd 2008-08-14 11:01 5,332 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-08-14 11:01 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-08-13 14:25 356,352 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe 2008-08-13 14:25 21,393 ----a-w C:\WINDOWS\AegisP.sys 2008-08-13 14:06 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-29 18:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll . ------- Sigcheck ------- 2008-04-14 19:21 977408 f042e3426d45d86d9bb55f6a79ab441a C:\WINDOWS\explorer.exe 2004-08-04 01:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2008-04-14 19:21 977408 f042e3426d45d86d9bb55f6a79ab441a C:\WINDOWS\ServicePackFiles\i386\explorer.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-21_ 0.23.00.84 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-10-20 22:35:29 4,431,872 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-20 22:35:29 184,320 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-10-20 22:35:11 4,431,872 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-20 22:35:11 184,320 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-10-20 20:04:13 58,596 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-21 07:03:11 58,930 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-10-20 20:04:13 74,230 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-10-21 07:03:11 74,648 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-10-20 20:04:13 392,296 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-21 07:03:11 392,630 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-10-20 20:04:14 448,004 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-21 07:03:11 448,586 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880] "snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-29 569344] "Adobe Reader Speed Launcher"="D:\Programy\Adobe Reader\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="D:\Programy\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "GrooveMonitor"="D:\Programy\Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-07 8462336] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2007-08-07 81920] "AVP"="D:\Programy\Kaspersky Internet Security\avp.exe" [2008-07-29 206088] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 C:\WINDOWS\RTHDCPL.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 C:\WINDOWS\KHALMNPR.Exe] "nwiz"="nwiz.exe" [2007-08-07 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] "Nokia.PCSync"="D:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336] C:\Documents and Settings\Robert\Menu Start\Programy\Autostart\ RocketDock.lnk - D:\Programy\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784] TransBar.lnk - D:\Programy\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536] UberIcon.lnk - D:\Programy\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224] Y'z Shadow.lnk - D:\Programy\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - D:\Programy\Logitech\SetPoint\SetPoint.exe [2008-08-21 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2007-08-24 07:00 33648 D:\Programy\Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2007-06-01 10:49 974848 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] --a------ 2007-06-01 10:51 823296 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] --a------ 2007-12-10 10:12 695808 D:\Programy\Nokia\Nokia PC Suite 6\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WLSS] --a------ 2007-04-23 18:55 190000 C:\Program Files\Compal\Wireless Select Switch\WLSS.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\Programy\\Office\\Office12\\OUTLOOK.EXE"= "D:\\Programy\\Office\\Office12\\GROOVE.EXE"= "D:\\Programy\\Office\\Office12\\ONENOTE.EXE"= "D:\\Programy\\uTorrent\\uTorrent.exe"= "D:\\Gry\\Pro Evo 9\\pes2009.exe"= R0 EMSC;COMPAL Embedded System Control;C:\WINDOWS\system32\DRIVERS\EMSC.SYS [2007-03-14 9856] R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592] R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-11-18 27776] S3 AVPsys;AVPsys;C:\WINDOWS\system32\drivers\cdaudio.sys [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Robert\Dane aplikacji\Mozilla\Firefox\Profiles\ealinawe.default\ FF -: plugin - D:\Programy\Adobe Reader\Reader\browser\nppdf32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\np-mswmp.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\np32dsw.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npdjvu.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npganymedenet.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nppdf32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nppl3260.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nprpjplug.dll FF -: plugin - D:\Programy\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - D:\Programy\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 09:05:30 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... C:\DOCUME~1\Robert\USTAWI~1\Temp\RGI1C.tmp skanowanie pomyślnie ukończone ukryte pliki: 1 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\explorer.exe -> D:\Programy\Vista Inspirat 2\RocketDock\RocketDock.dll -> D:\Programy\Vista Inspirat 2\UberIcon\UberIcon.dll . Czas ukończenia: 2008-10-21 9:06:05 ComboFix-quarantined-files.txt 2008-10-21 07:06:02 ComboFix2.txt 2008-10-20 22:23:23 Przed: 214 900 736 bajtów wolnych Po: 201,666,560 bajtów wolnych 255 --- E O F --- 2008-10-15 15:08:03

HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:02:14, on 2008-10-21 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe D:\Programy\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\WINDOWS\vsnp2uvc.exe D:\Programy\Adobe Reader\Reader\Reader_sl.exe D:\Programy\HP\HP Software Update\HPWuSchd2.exe D:\Programy\Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe D:\Programy\Logitech\SetPoint\SetPoint.exe D:\Programy\Vista Inspirat 2\RocketDock\RocketDock.exe D:\Programy\Vista Inspirat 2\UberIcon\UberIcon Manager.exe D:\Programy\Vista Inspirat 2\YzShadow\YzShadow.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Programy\Snag It\SnagItBHO.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - D:\Programy\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - D:\Programy\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Programy\Kaspersky Internet Security\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programy\Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Programy\Snag It\SnagItIEAddin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programy\Adobe Reader\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [HP Software Update] D:\Programy\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Programy\Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKLM\..\Run: [AVP] "D:\Programy\Kaspersky Internet Security\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: RocketDock.lnk = D:\Programy\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = D:\Programy\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = D:\Programy\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O4 - Startup: Y'z Shadow.lnk = D:\Programy\Vista Inspirat 2\YzShadow\YzShadow.exe O4 - Global Startup: Logitech SetPoint.lnk = D:\Programy\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\Programy\Office\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Programy\Kaspersky Internet Security\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programy\Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programy\Office\Office12\ONBttnIE.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - D:\Programy\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - D:\Programy\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\Office\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218644624890 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221042401968 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programy\Office\Office12\GrooveSystemServices.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Programy\Ad-Aware\aawservice.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Programy\Kaspersky Internet Security\avp.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 8431 bytes

FixIEDef:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6697 * * * ******************************************************************************** Created at 09:07:40 on Tuesday, October 21, 2008 Time Zone : Logged On User : Robert Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 10 GB System Drive Free : 211.55 MB Total Physical Memory: 3070 MB Free Physical Memory : 2612 MB Total Page File : 3070 MB Free Page File : 4661 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1967 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 684 · przez **djarta** 21 Paź 2008, 09:20

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\2fiji.com D:\2fiji.com

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

HJT - czysto.

FixIEDef - czysto.

=================
K.

**Posty:** 7 · przez **sekretmnicha** 21 Paź 2008, 09:55

Kod: Zaznacz wszystko: ComboFix 08-10-19.04 - Robert 2008-10-21 9:52:32.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2622 [GMT 2:00] Uruchomiony z: D:\ComboFix.exe Użyto następujących komend :: D:\CfScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\2fiji.com D:\2fiji.com . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\2fiji.com D:\2fiji.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-21 do 2008-10-21 ))))))))))))))))))))))))))))))) . 2008-10-21 00:54 . 2008-10-21 00:54 <DIR> d-------- C:\!FixIEDef 2008-10-21 00:51 . 2008-10-21 09:02 <DIR> d-------- C:\HijackThis 2008-10-21 00:36 . 2008-10-21 00:36 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-10-21 00:34 . 2008-10-21 00:35 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-21 00:31 . 2008-10-21 00:41 <DIR> d-------- C:\SDFix 2008-10-20 21:04 . 2008-10-20 21:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-16 20:27 . 2008-10-16 20:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-16 20:26 . 2008-10-16 20:26 <DIR> d-------- C:\Program Files\DIFX 2008-10-16 20:26 . 2008-10-16 20:29 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\Nokia 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-16 20:25 . 2008-10-16 20:25 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-16 20:25 . 2008-10-16 20:31 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\PC Suite 2008-10-16 20:25 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-10-16 20:25 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-16 20:25 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-16 20:25 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-10-16 20:25 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-10-16 20:25 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-10-16 20:23 . 2008-10-16 20:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-16 10:46 . 2008-10-16 10:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-15 12:39 . 2008-09-15 17:27 1,846,656 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 12:39 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 12:38 . 2008-08-14 15:26 2,190,464 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,146,816 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,067,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-15 12:38 . 2008-08-14 15:26 2,025,472 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-11 18:59 . 2008-10-11 18:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TechSmith 2008-10-11 12:18 . 2008-10-15 15:26 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-10-09 10:18 . 2008-10-20 16:05 23 --a------ C:\WINDOWS\BlendSettings.ini 2008-10-09 08:43 . 2008-07-28 17:19 116,736 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys 2008-10-08 12:10 . 2008-10-08 12:10 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\teamspeak2 2008-10-08 12:10 . 2008-10-08 12:10 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-10-06 17:14 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll 2008-10-06 17:14 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll 2008-10-06 17:14 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll 2008-10-06 17:14 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll 2008-10-06 17:14 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll 2008-10-06 17:14 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll 2008-10-06 17:14 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll 2008-10-06 17:14 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll 2008-10-06 17:14 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll 2008-10-06 17:13 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2008-10-06 17:13 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2008-10-06 17:13 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2008-10-06 17:13 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2008-10-06 17:13 . 2007-10-22 03:37 17,928 --a------ C:\WINDOWS\system32\X3DAudio1_2.dll 2008-10-05 19:16 . 2008-10-05 20:17 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-04 15:17 . 2008-10-04 15:18 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\SPORE 2008-10-02 16:34 . 2008-10-02 16:34 <DIR> d-------- C:\Documents and Settings\Robert\Bluetooth Software 2008-10-02 09:33 . 2008-10-07 16:57 10,503 --a------ C:\WINDOWS\system32\%LocalXml% 2008-09-26 14:45 . 2008-07-23 15:24 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-09-26 09:45 . 2008-09-26 09:50 <DIR> d-------- C:\Documents and Settings\Robert\Dane aplikacji\GanymedeNet 2008-09-25 12:54 . 2008-09-25 12:54 <DIR> d-------- C:\WINDOWS\Sun 2008-09-24 20:17 . 2008-09-24 20:17 <DIR> d-------- C:\Program Files\Java 2008-09-24 20:17 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-24 20:10 . 2008-09-24 20:10 <DIR> d-------- C:\Program Files\Common Files\Java . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-21 07:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-21 07:48 458,784 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-21 07:48 3,696 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-21 07:48 20,900 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-21 07:48 2,268,704 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-20 16:34 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\uTorrent 2008-10-19 12:39 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2008-10-15 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-10-11 16:58 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-10-09 07:52 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-01 17:02 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-09-03 11:04 --------- d-----w C:\Program Files\MSXML 4.0 2008-08-29 20:26 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\HPAppData 2008-08-29 20:18 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\HP 2008-08-29 17:11 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\HP 2008-08-29 17:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WEBREG 2008-08-29 17:09 --------- d-----w C:\Program Files\HP 2008-08-29 17:09 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY 2008-08-29 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2008-08-29 17:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-08-29 17:06 --------- d-----w C:\Program Files\Hewlett-Packard 2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\HP 2008-08-29 17:06 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2008-08-29 17:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard 2008-08-24 16:13 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-08-23 17:42 --------- d-----w C:\Program Files\Common Files\DirectX 2008-08-21 21:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2008-08-21 21:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-08-21 21:36 --------- d-----w C:\Program Files\Common Files\Logishrd 2008-08-21 21:36 --------- d-----w C:\Documents and Settings\Robert\Dane aplikacji\Logitech 2008-08-21 21:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LogiShrd 2008-08-21 21:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Logitech 2008-08-21 21:07 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-21 21:07 --------- d--h--r C:\Documents and Settings\Robert\Dane aplikacji\SecuROM 2008-08-21 20:30 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-08-21 20:30 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-08-21 20:30 --------- d-----w C:\Program Files\OpenAL 2008-08-20 05:11 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 11:01 60,911 ----a-w C:\WINDOWS\BricoPackUninst.cmd 2008-08-14 11:01 5,332 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-08-14 11:01 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-08-13 14:25 356,352 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe 2008-08-13 14:25 21,393 ----a-w C:\WINDOWS\AegisP.sys 2008-08-13 14:06 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-29 18:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll . ------- Sigcheck ------- 2008-04-14 19:21 977408 f042e3426d45d86d9bb55f6a79ab441a C:\WINDOWS\explorer.exe 2004-08-04 01:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2008-04-14 19:21 977408 f042e3426d45d86d9bb55f6a79ab441a C:\WINDOWS\ServicePackFiles\i386\explorer.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-21_ 0.23.00.84 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-10-20 22:35:29 4,431,872 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-20 22:35:29 184,320 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-10-20 22:35:11 4,431,872 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-10-20 22:35:11 184,320 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-10-20 20:04:13 58,596 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-21 07:54:13 58,930 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-10-20 20:04:13 74,230 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-10-21 07:54:13 74,648 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-10-20 20:04:13 392,296 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-21 07:54:13 392,630 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-10-20 20:04:14 448,004 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-21 07:54:13 448,586 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880] "snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-29 569344] "Adobe Reader Speed Launcher"="D:\Programy\Adobe Reader\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="D:\Programy\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "GrooveMonitor"="D:\Programy\Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-07 8462336] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2007-08-07 81920] "AVP"="D:\Programy\Kaspersky Internet Security\avp.exe" [2008-07-29 206088] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 C:\WINDOWS\RTHDCPL.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 C:\WINDOWS\KHALMNPR.Exe] "nwiz"="nwiz.exe" [2007-08-07 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] "Nokia.PCSync"="D:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336] C:\Documents and Settings\Robert\Menu Start\Programy\Autostart\ RocketDock.lnk - D:\Programy\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784] TransBar.lnk - D:\Programy\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536] UberIcon.lnk - D:\Programy\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224] Y'z Shadow.lnk - D:\Programy\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - D:\Programy\Logitech\SetPoint\SetPoint.exe [2008-08-21 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2007-08-24 07:00 33648 D:\Programy\Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2007-06-01 10:49 974848 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] --a------ 2007-06-01 10:51 823296 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] --a------ 2007-12-10 10:12 695808 D:\Programy\Nokia\Nokia PC Suite 6\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WLSS] --a------ 2007-04-23 18:55 190000 C:\Program Files\Compal\Wireless Select Switch\WLSS.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\Programy\\Office\\Office12\\OUTLOOK.EXE"= "D:\\Programy\\Office\\Office12\\GROOVE.EXE"= "D:\\Programy\\Office\\Office12\\ONENOTE.EXE"= "D:\\Programy\\uTorrent\\uTorrent.exe"= "D:\\Gry\\Pro Evo 9\\pes2009.exe"= R0 EMSC;COMPAL Embedded System Control;C:\WINDOWS\system32\DRIVERS\EMSC.SYS [2007-03-14 9856] R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592] R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-11-18 27776] S3 AVPsys;AVPsys;C:\WINDOWS\system32\drivers\cdaudio.sys [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 09:54:20 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-21 9:54:54 ComboFix-quarantined-files.txt 2008-10-21 07:54:51 ComboFix2.txt 2008-10-21 07:06:06 ComboFix3.txt 2008-10-20 22:23:23 Przed: 85 184 512 bajtów wolnych Po: 71,405,568 bajtów wolnych 242 --- E O F --- 2008-10-15 15:08:03

**Posty:** 684 · przez **djarta** 21 Paź 2008, 09:59

Czysto.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=======================
K.

**Posty:** 7 · przez **sekretmnicha** 21 Paź 2008, 11:49

Bardzo dziękuje za okazaną pomoc.
Pozdrawiam serdecznie