Aktualizacje automatyczne wyłączone i nie da się ich włączyć

**Posty:** 2 · przez **mist** 20 Sie 2008, 18:46

Od kilku dni pojawia mi się na pasku alert zabezpieczeń /komputer może być zagrożony aktualizacje automatyczne są wyłączone\ w panelu sterowania są ustawione na włączone.
Dziś na dokładkę nagle włączyło mi się okno pobierania IE ale wyskoczył jakiś błąd i znikło?? /używam Firefoxa a nie IE/
AntyVirem wykryłem jakieś trojany ale je usuną
Proszę o pomoc i wyrozumiałość jestem zielony w tych sprawach

Log z ComboFix

Kod: Zaznacz wszystko: ComboFix 08-08-19.02 - Mist 2008-08-20 18:10:54.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.531 [GMT 2:00] Running from: C:\Documents and Settings\Mist\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_NPF ((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))) . 2008-08-20 09:31 . 2008-08-20 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion 2008-08-17 21:31 . 2008-08-18 09:21 <DIR> d-------- C:\Program Files\Unlocker 2008-08-17 21:26 . 2008-08-17 21:26 <DIR> d-------- C:\Program Files\Yahoo! 2008-08-17 16:38 . 2008-08-17 16:38 <DIR> d-------- C:\Program Files\18 Wheels of Steel Haulin 2008-08-16 23:09 . 2008-08-16 23:09 <DIR> d-------- C:\Program Files\Motorola Tools 2008-08-16 22:26 . 2008-08-16 22:26 <DIR> d-------- C:\Program Files\LiveUpdate 2008-08-16 22:25 . 2008-08-16 22:26 <DIR> d-------- C:\Program Files\mobile PhoneTools 2008-08-16 21:33 . 2008-08-16 21:33 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2008-08-16 21:33 . 2008-08-16 21:33 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2008-08-16 21:28 . 2008-08-16 21:28 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-08-16 21:28 . 2008-08-16 21:28 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-08-16 21:27 . 2008-08-16 21:27 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared 2008-08-16 21:27 . 2006-11-13 14:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-08-16 21:27 . 2007-10-10 16:41 42,112 --a------ C:\WINDOWS\system32\drivers\motodrv.sys 2008-08-16 21:27 . 2007-06-18 14:18 23,680 --a------ C:\WINDOWS\system32\drivers\motmodem.sys 2008-08-16 21:27 . 2007-11-02 14:36 18,176 --a------ C:\WINDOWS\system32\drivers\motccgp.sys 2008-08-16 21:27 . 2007-01-22 18:33 7,680 --a------ C:\WINDOWS\system32\drivers\motccgpfl.sys 2008-08-16 21:27 . 2007-11-02 14:51 6,400 --a------ C:\WINDOWS\system32\drivers\motswch.sys 2008-08-16 20:56 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-08-16 20:56 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-08-16 20:45 . 2008-08-16 21:33 <DIR> d-------- C:\Program Files\Motorola 2008-08-16 14:18 . 2008-08-16 14:18 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-16 13:33 . 2008-08-16 14:17 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-08-16 12:52 . 2008-08-16 14:04 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-16 12:52 . 2008-08-16 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-16 12:35 . 2008-08-16 12:35 <DIR> d---s---- C:\Documents and Settings\Mist\UserData 2008-08-16 12:19 . 2008-08-16 12:19 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\GlarySoft 2008-08-16 12:17 . 2008-08-16 12:18 <DIR> d-------- C:\Program Files\Glary Utilities 2008-08-16 08:41 . 2008-08-16 08:41 <DIR> d---s---- C:\Documents and Settings\Nowy\UserData 2008-08-16 08:38 . 2008-08-20 18:12 <DIR> d--h----- C:\Documents and Settings\Nowy\Ustawienia lokalne 2008-08-16 08:38 . 2008-08-16 08:38 <DIR> dr------- C:\Documents and Settings\Nowy\Ulubione 2008-08-16 08:38 . 2008-07-27 14:17 <DIR> d--h----- C:\Documents and Settings\Nowy\Szablony 2008-08-16 08:38 . 2008-07-27 16:11 <DIR> d-------- C:\Documents and Settings\Nowy\Pulpit 2008-08-16 08:38 . 2008-08-16 08:38 <DIR> dr------- C:\Documents and Settings\Nowy\Moje dokumenty 2008-08-16 08:38 . 2008-07-27 16:11 <DIR> dr------- C:\Documents and Settings\Nowy\Menu Start 2008-08-16 08:38 . 2008-08-16 08:41 <DIR> dr-h----- C:\Documents and Settings\Nowy\Dane aplikacji 2008-08-16 08:38 . 2008-08-16 08:41 <DIR> d-------- C:\Documents and Settings\Nowy 2008-08-15 19:49 . 2008-08-15 19:49 <DIR> d-------- C:\Program Files\Euro Truck Simulator 2008-08-15 19:49 . 2008-08-19 08:45 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-15 17:40 . 2008-08-15 17:40 <DIR> d-------- C:\Program Files\NCH Software 2008-08-15 17:39 . 2008-08-15 17:39 <DIR> d-------- C:\Program Files\NCH Swift Sound 2008-08-15 17:39 . 2008-08-15 17:39 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\NCH Swift Sound 2008-08-15 17:39 . 2008-08-15 17:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NCH Swift Sound 2008-08-15 17:36 . 2008-08-15 17:37 <DIR> d-------- C:\Program Files\4Musics OGG to MP3 Converter 2008-08-15 17:36 . 2007-11-01 17:53 42,880 --a------ C:\WINDOWS\system32\drivers\vacs2xkd.sys 2008-08-15 17:36 . 2001-03-17 21:34 22,528 --a------ C:\WINDOWS\system32\WNASPI32.DLL 2008-08-15 17:36 . 2002-07-17 08:05 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS 2008-08-15 12:37 . 2008-08-15 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-08-15 12:35 . 2008-08-15 14:33 <DIR> d-------- C:\Program Files\18 Wheels of Steel American Long Haul 2008-08-13 15:51 . 2008-08-19 19:16 37,440 --a------ C:\WINDOWS\system32\drivers\pssdklbf.drv 2008-08-13 15:51 . 2008-08-19 19:16 30,272 --a------ C:\WINDOWS\system32\drivers\pssdk31.drv 2008-08-12 21:15 . 2008-08-12 21:15 <DIR> d-------- C:\Program Files\Google 2008-08-12 18:47 . 2008-08-12 18:47 <DIR> d-------- C:\Program Files\Common Files\DirectX 2008-08-11 16:39 . 2008-08-11 16:39 <DIR> d-------- C:\Program Files\Arjaloc 2008-08-10 21:34 . 2008-08-20 18:12 <DIR> d--h----- C:\Documents and Settings\Maco\Ustawienia lokalne 2008-08-10 21:34 . 2008-08-10 21:35 <DIR> dr------- C:\Documents and Settings\Maco\Ulubione 2008-08-10 21:34 . 2008-07-27 14:17 <DIR> d--h----- C:\Documents and Settings\Maco\Szablony 2008-08-10 21:34 . 2008-07-27 16:11 <DIR> d-------- C:\Documents and Settings\Maco\Pulpit 2008-08-10 21:34 . 2008-08-10 21:35 <DIR> dr------- C:\Documents and Settings\Maco\Moje dokumenty 2008-08-10 21:34 . 2008-07-27 16:11 <DIR> dr------- C:\Documents and Settings\Maco\Menu Start 2008-08-10 21:34 . 2008-08-10 21:35 <DIR> dr-h----- C:\Documents and Settings\Maco\Dane aplikacji 2008-08-10 21:34 . 2008-08-10 21:34 <DIR> d-------- C:\Documents and Settings\Maco 2008-08-10 09:12 . 2008-08-10 09:12 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\Media Player Classic 2008-08-09 15:53 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-09 10:29 . 2008-08-09 10:29 <DIR> d-------- C:\Program Files\JoWooD 2008-08-09 10:29 . 2008-08-09 10:29 113 --a------ C:\htsetup.err 2008-08-08 10:43 . 2000-12-08 21:59 122,880 --a------ C:\WINDOWS\UnGins.exe 2008-08-08 10:41 . 2008-08-20 14:54 <DIR> d-------- C:\Program Files\Honor_pol 2008-08-07 09:40 . 2008-08-07 09:40 <DIR> d-------- C:\Avalon 2008-08-06 19:31 . 2008-08-06 19:34 <DIR> d-------- C:\Program Files\GetASFStream 2008-08-02 18:43 . 2008-08-02 18:43 <DIR> d-------- C:\Program Files\EA SPORTS 2008-08-02 12:03 . 2008-08-02 12:03 <DIR> d-------- C:\Program Files\FaxTools 2008-08-02 12:03 . 2008-08-02 12:03 <DIR> d-------- C:\Program Files\ABBYY FineReader 6.0 2008-08-02 12:03 . 2008-08-02 12:03 <DIR> d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint 2008-08-02 12:03 . 2008-08-16 22:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\BVRP Software 2008-08-02 12:00 . 2008-08-16 19:06 254 --a------ C:\WINDOWS\lexstat.ini 2008-08-02 12:00 . 2008-08-02 12:00 84 --a------ C:\WINDOWS\dellstat.ini 2008-08-02 11:58 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-08-02 11:58 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-08-01 11:10 . 1998-11-13 13:10 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2008-07-31 16:19 . 2008-07-31 16:19 <DIR> d-------- C:\WINDOWS\Sun 2008-07-31 16:17 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-31 16:16 . 2008-07-31 16:17 <DIR> d-------- C:\Program Files\Java 2008-07-31 16:16 . 2008-07-31 16:16 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-31 07:09 . 2008-07-31 07:09 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\vlc 2008-07-31 07:08 . 2008-07-31 07:08 <DIR> d-------- C:\Program Files\VideoLAN 2008-07-28 10:44 . 2008-08-16 19:01 462 --a------ C:\WINDOWS\EAGRAPH.INI 2008-07-28 10:09 . 2008-07-28 10:09 <DIR> d-------- C:\WINDOWS\system32\URTTemp 2008-07-28 09:54 . 2008-07-28 09:54 <DIR> dr-h----- C:\Documents and Settings\Mist\Dane aplikacji\SecuROM 2008-07-28 09:54 . 2008-07-28 09:54 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-07-28 08:16 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-07-28 08:16 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-07-27 15:57 . 2008-07-27 15:57 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-07-27 15:56 . 2008-08-01 11:13 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-07-27 15:28 . 2008-08-16 14:07 <DIR> d-------- C:\Downloads 2008-07-27 15:27 . 2008-08-16 14:17 <DIR> d-------- C:\Program Files\BitComet 2008-07-27 15:21 . 2008-07-27 15:21 <DIR> d-------- C:\Program Files\DAEMON Tools Toolbar 2008-07-27 15:21 . 2008-07-27 15:21 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-07-27 15:19 . 2008-07-27 15:19 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\DAEMON Tools 2008-07-27 15:19 . 2008-07-27 15:19 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-16 20:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-12 19:09 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-27 12:56 --------- d-----w C:\Program Files\SubEdit-Player 2008-07-27 12:52 --------- d-----w C:\Documents and Settings\Mist\Dane aplikacji\Gadu-Gadu 2008-07-27 12:50 --------- d-----w C:\Program Files\GaduGadu 2008-07-27 12:42 --------- d-----w C:\Program Files\Alwil Software 2008-07-27 12:34 15,600 ----a-w C:\WINDOWS\gdrv.sys 2008-07-27 12:32 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-27 12:32 --------- d-----w C:\Program Files\Realtek 2008-07-27 12:31 --------- d-----w C:\Program Files\DIFX 2008-07-27 12:28 --------- d-----w C:\Documents and Settings\Mist\Dane aplikacji\InstallShield 2008-07-27 12:21 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-27 12:19 --------- d-----w C:\Program Files\Usługi online 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 08:35 7634944] "nwiz"="nwiz.exe" [2006-10-31 08:35 1622016 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-08-01 11:13:52 113664] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-10-31 08:35 7634944 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-10-31 08:35 86016 C:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "WatchDog"=C:\Program Files\mobile PhoneTools\WatchDog.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program files\\SopCast\\SopCast.exe"= "D:\\Program files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Honor_pol\\MOHAA.EXE"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "21548:TCP"= 21548:TCP:BitComet 21548 TCP "21548:UDP"= 21548:UDP:BitComet 21548 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R3 EuMusDesignVirtualAudioCableWdm_s2x;Sound2x Audio Cable (WDM);C:\WINDOWS\system32\DRIVERS\vacs2xkd.sys [2007-11-01 17:53] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05] S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 14:36] S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-22 18:33] S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2007-10-10 16:41] S3 PsSdk31;PsSdk31;C:\WINDOWS\system32\Drivers\pssdk31.drv [2008-08-19 19:16] S3 PsSdkLBF;PsSdkLBF;C:\WINDOWS\system32\Drivers\pssdklbf.drv [2008-08-19 19:16] . Contents of the 'Scheduled Tasks' folder 2008-08-20 C:\WINDOWS\Tasks\GlaryInitialize.job - C:\Program Files\Glary Utilities\initialize.exe [2008-07-18 11:08] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-Download Manager - sdchost.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Mist\Dane aplikacji\Mozilla\Firefox\Profiles\j7gapn20.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ig?ct=1056755551 FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll FF -: plugin - D:\Program Files\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - D:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 18:13:28 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\DOCUME~1\Mist\USTAWI~1\Temp\RGI2.tmp scan completed successfully hidden files: 1 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk31] "ImagePath"="\??\C:\WINDOWS\system32\Drivers\pssdk31.drv" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdkLBF] "ImagePath"="\??\C:\WINDOWS\system32\Drivers\pssdklbf.drv" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-08-20 18:14:58 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-20 16:14:54 Pre-Run: 7,085,887,488 bajtów wolnych Post-Run: 7,078,498,304 bajt˘w wolnych 236 --- E O F --- 2008-08-14 06:38:31

A tu z Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:44:15, on 2008-08-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218890048593 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4722 bytes

Mam nadzieję że już jest ok Okocza

**Posty:** 8001 · przez **Okocza** 20 Sie 2008, 18:48

mist,

przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

**Posty:** 35 · przez **huber2t** 20 Sie 2008, 19:08

W logach nic nie widzę

**Posty:** 8001 · przez **Okocza** 20 Sie 2008, 19:10

huber2t, po co ten nic nie wnoszący post :roll:

===========================================

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 2 · przez **mist** 20 Sie 2008, 19:39

Kod: Zaznacz wszystko: [b]SDFix: Version 1.218 [/b] Run by Mist on 2008-08-20 at 19:22 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Folder C:\Documents and Settings\Mist\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 19:28:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:58,91,67,92,eb,26,ec,b8,34,5d,3e,3d,13,c2,7f,e4,03,21,c6,1a,82,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5a,c8,9f,d2,42,08,3d,e6,66,7a,7d,f4,6a,97,bb,eb,5c,.. "khjeh"=hex:4c,6b,c9,18,93,5c,e7,f2,a7,d1,9f,11,8a,6e,1a,37,3f,79,68,3a,7a,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:58,3b,15,2b,a7,40,f7,d3,50,6b,07,19,d1,c7,17,bf,29,f1,7e,15,0f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:58,91,67,92,eb,26,ec,b8,34,5d,3e,3d,13,c2,7f,e4,03,21,c6,1a,82,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5a,c8,9f,d2,42,08,3d,e6,66,7a,7d,f4,6a,97,bb,eb,5c,.. "khjeh"=hex:4c,6b,c9,18,93,5c,e7,f2,a7,d1,9f,11,8a,6e,1a,37,3f,79,68,3a,7a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:58,3b,15,2b,a7,40,f7,d3,50,6b,07,19,d1,c7,17,bf,29,f1,7e,15,0f,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Program files\\SopCast\\SopCast.exe"="D:\\Program files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "D:\\Program files\\SopCast\\adv\\SopAdver.exe"="D:\\Program files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "C:\\Program Files\\Honor_pol\\MOHAA.EXE"="C:\\Program Files\\Honor_pol\\MOHAA.EXE:*:Disabled:Medal of Honor Allied Assault" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE" "C:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"="C:\\Program Files\\Motorola\\RSD Lite\\SDL.exe:*:Enabled:SDL" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 28 Jul 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 14 Aug 2008 52,736 ...H. --- "C:\Documents and Settings\Mist\Pulpit\Nowy folder (2)\~WRL0002.tmp" Thu 1 Nov 2007 15,872 A.SH. --- "C:\Program Files\4Musics OGG to MP3 Converter\wdmdrvmgr\amd64\wdmdrvmgr.exe" Thu 1 Nov 2007 9,216 A.SH. --- "C:\Program Files\4Musics OGG to MP3 Converter\wdmdrvmgr\i386\wdmdrvmgr.exe" Mon 13 Nov 2006 319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll" Tue 29 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3dbc83ff5f16e1a91f17471a2831f4be\BITA.tmp" Tue 29 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8a7603e7cf792509c9ebbd8c74c82553\BITB.tmp" Tue 29 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BITA.tmp" Mon 28 Jul 2008 4,348 ...H. --- "C:\Documents and Settings\Mist\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Mon 28 Jul 2008 20 A..H. --- "C:\Documents and Settings\Mist\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Mon 28 Jul 2008 9,655 A.SH. --- "C:\Documents and Settings\Mist\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" [b]Finished![/b]

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:31:40, on 2008-08-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218890048593 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4811 bytes

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-08-19.02 - Mist 2008-08-20 19:34:39.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.622 [GMT 2:00] Running from: C:\Documents and Settings\Mist\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))) . 2008-08-20 19:21 . 2008-08-20 19:22 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-20 19:19 . 2008-08-20 19:28 <DIR> d-------- C:\SDFix 2008-08-20 09:31 . 2008-08-20 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion 2008-08-17 21:31 . 2008-08-18 09:21 <DIR> d-------- C:\Program Files\Unlocker 2008-08-17 21:26 . 2008-08-17 21:26 <DIR> d-------- C:\Program Files\Yahoo! 2008-08-17 16:38 . 2008-08-17 16:38 <DIR> d-------- C:\Program Files\18 Wheels of Steel Haulin 2008-08-16 23:09 . 2008-08-16 23:09 <DIR> d-------- C:\Program Files\Motorola Tools 2008-08-16 22:26 . 2008-08-16 22:26 <DIR> d-------- C:\Program Files\LiveUpdate 2008-08-16 22:25 . 2008-08-16 22:26 <DIR> d-------- C:\Program Files\mobile PhoneTools 2008-08-16 21:33 . 2008-08-16 21:33 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2008-08-16 21:33 . 2008-08-16 21:33 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2008-08-16 21:28 . 2008-08-16 21:28 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-08-16 21:28 . 2008-08-16 21:28 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-08-16 21:27 . 2008-08-16 21:27 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared 2008-08-16 21:27 . 2006-11-13 14:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-08-16 21:27 . 2007-10-10 16:41 42,112 --a------ C:\WINDOWS\system32\drivers\motodrv.sys 2008-08-16 21:27 . 2007-06-18 14:18 23,680 --a------ C:\WINDOWS\system32\drivers\motmodem.sys 2008-08-16 21:27 . 2007-11-02 14:36 18,176 --a------ C:\WINDOWS\system32\drivers\motccgp.sys 2008-08-16 21:27 . 2007-01-22 18:33 7,680 --a------ C:\WINDOWS\system32\drivers\motccgpfl.sys 2008-08-16 21:27 . 2007-11-02 14:51 6,400 --a------ C:\WINDOWS\system32\drivers\motswch.sys 2008-08-16 20:56 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-08-16 20:56 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-08-16 20:45 . 2008-08-16 21:33 <DIR> d-------- C:\Program Files\Motorola 2008-08-16 14:18 . 2008-08-16 14:18 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-16 13:33 . 2008-08-16 14:17 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-08-16 12:52 . 2008-08-16 14:04 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-16 12:52 . 2008-08-16 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-16 12:35 . 2008-08-16 12:35 <DIR> d---s---- C:\Documents and Settings\Mist\UserData 2008-08-16 12:19 . 2008-08-16 12:19 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\GlarySoft 2008-08-16 12:17 . 2008-08-16 12:18 <DIR> d-------- C:\Program Files\Glary Utilities 2008-08-16 08:41 . 2008-08-16 08:41 <DIR> d---s---- C:\Documents and Settings\Nowy\UserData 2008-08-16 08:38 . 2008-08-20 19:35 <DIR> d--h----- C:\Documents and Settings\Nowy\Ustawienia lokalne 2008-08-16 08:38 . 2008-08-16 08:38 <DIR> dr------- C:\Documents and Settings\Nowy\Ulubione 2008-08-16 08:38 . 2008-07-27 14:17 <DIR> d--h----- C:\Documents and Settings\Nowy\Szablony 2008-08-16 08:38 . 2008-07-27 16:11 <DIR> d-------- C:\Documents and Settings\Nowy\Pulpit 2008-08-16 08:38 . 2008-08-16 08:38 <DIR> dr------- C:\Documents and Settings\Nowy\Moje dokumenty 2008-08-16 08:38 . 2008-07-27 16:11 <DIR> dr------- C:\Documents and Settings\Nowy\Menu Start 2008-08-16 08:38 . 2008-08-16 08:41 <DIR> dr-h----- C:\Documents and Settings\Nowy\Dane aplikacji 2008-08-16 08:38 . 2008-08-16 08:41 <DIR> d-------- C:\Documents and Settings\Nowy 2008-08-15 19:49 . 2008-08-15 19:49 <DIR> d-------- C:\Program Files\Euro Truck Simulator 2008-08-15 19:49 . 2008-08-19 08:45 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-15 17:40 . 2008-08-15 17:40 <DIR> d-------- C:\Program Files\NCH Software 2008-08-15 17:39 . 2008-08-15 17:39 <DIR> d-------- C:\Program Files\NCH Swift Sound 2008-08-15 17:39 . 2008-08-15 17:39 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\NCH Swift Sound 2008-08-15 17:39 . 2008-08-15 17:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NCH Swift Sound 2008-08-15 17:36 . 2008-08-15 17:37 <DIR> d-------- C:\Program Files\4Musics OGG to MP3 Converter 2008-08-15 17:36 . 2007-11-01 17:53 42,880 --a------ C:\WINDOWS\system32\drivers\vacs2xkd.sys 2008-08-15 17:36 . 2001-03-17 21:34 22,528 --a------ C:\WINDOWS\system32\WNASPI32.DLL 2008-08-15 17:36 . 2002-07-17 08:05 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS 2008-08-15 12:37 . 2008-08-15 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia 2008-08-15 12:35 . 2008-08-15 14:33 <DIR> d-------- C:\Program Files\18 Wheels of Steel American Long Haul 2008-08-13 15:51 . 2008-08-19 19:16 37,440 --a------ C:\WINDOWS\system32\drivers\pssdklbf.drv 2008-08-13 15:51 . 2008-08-19 19:16 30,272 --a------ C:\WINDOWS\system32\drivers\pssdk31.drv 2008-08-12 21:15 . 2008-08-12 21:15 <DIR> d-------- C:\Program Files\Google 2008-08-12 18:47 . 2008-08-12 18:47 <DIR> d-------- C:\Program Files\Common Files\DirectX 2008-08-11 16:39 . 2008-08-11 16:39 <DIR> d-------- C:\Program Files\Arjaloc 2008-08-10 21:34 . 2008-08-20 19:35 <DIR> d--h----- C:\Documents and Settings\Maco\Ustawienia lokalne 2008-08-10 21:34 . 2008-08-10 21:35 <DIR> dr------- C:\Documents and Settings\Maco\Ulubione 2008-08-10 21:34 . 2008-07-27 14:17 <DIR> d--h----- C:\Documents and Settings\Maco\Szablony 2008-08-10 21:34 . 2008-07-27 16:11 <DIR> d-------- C:\Documents and Settings\Maco\Pulpit 2008-08-10 21:34 . 2008-08-10 21:35 <DIR> dr------- C:\Documents and Settings\Maco\Moje dokumenty 2008-08-10 21:34 . 2008-07-27 16:11 <DIR> dr------- C:\Documents and Settings\Maco\Menu Start 2008-08-10 21:34 . 2008-08-10 21:35 <DIR> dr-h----- C:\Documents and Settings\Maco\Dane aplikacji 2008-08-10 21:34 . 2008-08-10 21:34 <DIR> d-------- C:\Documents and Settings\Maco 2008-08-10 09:12 . 2008-08-10 09:12 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\Media Player Classic 2008-08-09 15:53 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-09 10:29 . 2008-08-09 10:29 <DIR> d-------- C:\Program Files\JoWooD 2008-08-09 10:29 . 2008-08-09 10:29 113 --a------ C:\htsetup.err 2008-08-08 10:43 . 2000-12-08 21:59 122,880 --a------ C:\WINDOWS\UnGins.exe 2008-08-08 10:41 . 2008-08-20 14:54 <DIR> d-------- C:\Program Files\Honor_pol 2008-08-07 09:40 . 2008-08-07 09:40 <DIR> d-------- C:\Avalon 2008-08-06 19:31 . 2008-08-06 19:34 <DIR> d-------- C:\Program Files\GetASFStream 2008-08-02 18:43 . 2008-08-02 18:43 <DIR> d-------- C:\Program Files\EA SPORTS 2008-08-02 12:03 . 2008-08-02 12:03 <DIR> d-------- C:\Program Files\FaxTools 2008-08-02 12:03 . 2008-08-02 12:03 <DIR> d-------- C:\Program Files\ABBYY FineReader 6.0 2008-08-02 12:03 . 2008-08-02 12:03 <DIR> d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint 2008-08-02 12:03 . 2008-08-16 22:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\BVRP Software 2008-08-02 12:00 . 2008-08-16 19:06 254 --a------ C:\WINDOWS\lexstat.ini 2008-08-02 12:00 . 2008-08-02 12:00 84 --a------ C:\WINDOWS\dellstat.ini 2008-08-02 11:58 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-08-02 11:58 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-08-01 11:10 . 1998-11-13 13:10 307,200 --a------ C:\WINDOWS\IsUn0415.exe 2008-07-31 16:19 . 2008-07-31 16:19 <DIR> d-------- C:\WINDOWS\Sun 2008-07-31 16:17 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-31 16:16 . 2008-07-31 16:17 <DIR> d-------- C:\Program Files\Java 2008-07-31 16:16 . 2008-07-31 16:16 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-31 07:09 . 2008-07-31 07:09 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\vlc 2008-07-31 07:08 . 2008-07-31 07:08 <DIR> d-------- C:\Program Files\VideoLAN 2008-07-28 10:44 . 2008-08-16 19:01 462 --a------ C:\WINDOWS\EAGRAPH.INI 2008-07-28 10:09 . 2008-07-28 10:09 <DIR> d-------- C:\WINDOWS\system32\URTTemp 2008-07-28 09:54 . 2008-07-28 09:54 <DIR> dr-h----- C:\Documents and Settings\Mist\Dane aplikacji\SecuROM 2008-07-28 09:54 . 2008-07-28 09:54 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-07-28 08:16 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-07-28 08:16 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-07-27 15:57 . 2008-07-27 15:57 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-07-27 15:56 . 2008-08-01 11:13 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-07-27 15:28 . 2008-08-16 14:07 <DIR> d-------- C:\Downloads 2008-07-27 15:27 . 2008-08-16 14:17 <DIR> d-------- C:\Program Files\BitComet 2008-07-27 15:21 . 2008-07-27 15:21 <DIR> d-------- C:\Program Files\DAEMON Tools Toolbar 2008-07-27 15:21 . 2008-07-27 15:21 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-07-27 15:19 . 2008-07-27 15:19 <DIR> d-------- C:\Documents and Settings\Mist\Dane aplikacji\DAEMON Tools 2008-07-27 15:19 . 2008-07-27 15:19 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-16 20:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-12 19:09 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-09 08:33 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2008-08-09 08:33 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll 2008-07-27 12:56 --------- d-----w C:\Program Files\SubEdit-Player 2008-07-27 12:52 --------- d-----w C:\Documents and Settings\Mist\Dane aplikacji\Gadu-Gadu 2008-07-27 12:50 --------- d-----w C:\Program Files\GaduGadu 2008-07-27 12:42 --------- d-----w C:\Program Files\Alwil Software 2008-07-27 12:34 15,600 ----a-w C:\WINDOWS\gdrv.sys 2008-07-27 12:32 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-27 12:32 --------- d-----w C:\Program Files\Realtek 2008-07-27 12:31 --------- d-----w C:\Program Files\DIFX 2008-07-27 12:28 --------- d-----w C:\Documents and Settings\Mist\Dane aplikacji\InstallShield 2008-07-27 12:21 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-27 12:19 --------- d-----w C:\Program Files\Usługi online 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((( snapshot@2008-08-20_18.14.38.25 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-20 17:22:01 2,727,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-20 17:22:01 159,744 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-20 17:22:00 2,727,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-20 17:22:00 159,744 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-20 17:27:28 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_584.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 08:35 7634944] "nwiz"="nwiz.exe" [2006-10-31 08:35 1622016 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-08-01 11:13:52 113664] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 00:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-10-31 08:35 7634944 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-10-31 08:35 86016 C:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "WatchDog"=C:\Program Files\mobile PhoneTools\WatchDog.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program files\\SopCast\\SopCast.exe"= "D:\\Program files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Honor_pol\\MOHAA.EXE"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "21548:TCP"= 21548:TCP:BitComet 21548 TCP "21548:UDP"= 21548:UDP:BitComet 21548 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R3 EuMusDesignVirtualAudioCableWdm_s2x;Sound2x Audio Cable (WDM);C:\WINDOWS\system32\DRIVERS\vacs2xkd.sys [2007-11-01 17:53] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05] S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 14:36] S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-22 18:33] S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2007-10-10 16:41] S3 PsSdk31;PsSdk31;C:\WINDOWS\system32\Drivers\pssdk31.drv [2008-08-19 19:16] S3 PsSdkLBF;PsSdkLBF;C:\WINDOWS\system32\Drivers\pssdklbf.drv [2008-08-19 19:16] . Contents of the 'Scheduled Tasks' folder 2008-08-20 C:\WINDOWS\Tasks\GlaryInitialize.job - C:\Program Files\Glary Utilities\initialize.exe [2008-07-18 11:08] . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Mist\Dane aplikacji\Mozilla\Firefox\Profiles\j7gapn20.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ig?ct=1056755551 FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll FF -: plugin - D:\Program Files\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - D:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 19:35:46 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PsSdk31] "ImagePath"="\??\C:\WINDOWS\system32\Drivers\pssdk31.drv" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PsSdkLBF] "ImagePath"="\??\C:\WINDOWS\system32\Drivers\pssdklbf.drv" . Completion time: 2008-08-20 19:36:39 ComboFix-quarantined-files.txt 2008-08-20 17:36:37 ComboFix2.txt 2008-08-20 16:14:59 Pre-Run: 7,069,822,976 bajtów wolnych Post-Run: 7,058,563,072 bajtów wolnych 228 --- E O F --- 2008-08-14 06:38:31

Dalej pojawia się ta czerwona tarcza i komunikat
ale znikły też ikonki avasta av ,tak ma być ??

**Posty:** 35 · przez **huber2t** 20 Sie 2008, 19:53

Daj loga z tego: kaspersky-virus-removal-tool-i-system-repair-engineer-vt100058.html

**Posty:** 18165 · przez **wojtas** 20 Sie 2008, 19:53

Kliknij prawym klawiszem na plik:

C:\WINDOWS\inf\au.inf

i przycisnij opcje zainstaluj i reset kompa i sprawdz czy dziala...