Amvo.exe

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 07:58

Witam
na moje komputery został przypuszczony zmasowany atak pliku amvo i jeszcze jakiegoś syfu:/. Nie mogę sobie z tym poradzić. Początkowo nic nie zauważyłem ale potem zaczął sę mulić system aż wczoraj nie mogłem odpalić żadnego dysku lokalnego po gruntownym skanie avastem zaczęły wyskakiwać komunikaty ze komputer zarażony w/w amvo i s.bot. Zrobiłem już log programem conbofix. Na razie jest to log z jednego komputera. Proszę o sprawdzenie.

Kod: Zaznacz wszystko: ComboFix 08-09-10.02 - Piotrek 2008-09-11 7:42:08.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.618 [GMT 2:00] Running from: C:\Documents and Settings\Piotrek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\s.bat C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo0.dll D:\Autorun.inf D:\s.bat E:\Autorun.inf E:\s.bat F:\Autorun.inf F:\s.bat G:\Autorun.inf G:\s.bat . ((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 ))))))))))))))))))))))))))))))) . 2008-09-03 10:54 . 2008-09-03 20:10 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\OpenOffice.org2 2008-09-01 17:37 . 2008-09-01 17:37 <DIR> d-------- C:\Documents and Settings\Piotrek\EurekaLog 2008-08-30 08:41 . 2007-03-08 01:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2008-08-28 17:21 . 2008-08-28 17:21 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-08-28 17:20 . 2008-08-28 17:20 <DIR> d-------- C:\Program Files\PC Connectivity Solution . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-03 08:53 --------- d-----w C:\Program Files\Java 2008-08-29 15:32 --------- d-----w C:\Program Files\InterActual 2008-08-28 15:21 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-28 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-07-20 10:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-07-20 10:07 --------- d-----w C:\Program Files\Nokia 2008-07-20 10:07 --------- d-----w C:\Program Files\MSXML 6.0 2008-07-19 15:34 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-07-19 15:34 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-19 15:34 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll . ------- Sigcheck ------- 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\svchost.exe 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\dllcache\svchost.exe 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\dllcache\user32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\winlogon.exe 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\dllcache\winlogon.exe 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\explorer.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 00:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\services.exe 2004-08-04 00:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\dllcache\services.exe 2004-08-04 00:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\lsass.exe 2004-08-04 00:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\dllcache\lsass.exe 2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe 2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe 2004-08-04 00:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\userinit.exe 2004-08-04 00:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\dllcache\userinit.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WireLessMouse"="D:\Programy\S-3200 Wireless Optical Slimline Deskset\MouseDrv.exe" [2005-08-30 303104] "WireLessKeyboard"="D:\Programy\S-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe" [2005-08-30 319488] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "avast!"="d:\Programy\Avast4\ashDisp.exe" [2008-07-19 78008] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "HP Software Update"="D:\Programy\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RemoteControl"="d:\Programy\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "WinampAgent"="d:\Programy\Winamp\winampa.exe" [2008-08-04 36352] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - D:\Programy\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Przyspieszenie uruchomienia programu AutoCAD.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Programy\\AQQ\\AQQ.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hposid01.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "D:\\Programy\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "D:\\Programy\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "D:\\Programy\\BearShare\\BearShare.exe"= "D:\\Programy\\Gadu-Gadu\\gg.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 L6TPortGX;Service - Line 6 TonePort GX;C:\WINDOWS\system32\Drivers\L6TPortGX.sys [2007-09-17 514432] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e01786-45fa-11dd-93b3-0016176acabf}] \Shell\AutoRun\command - qa8sywva.cmd \Shell\explore\Command - qa8sywva.cmd \Shell\open\Command - qa8sywva.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b03bc934-f457-11dc-928f-0016176acabf}] \Shell\Auto\command - activexdebugger32.exe f \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - activexdebugger32.exe f \Shell\open\Command - activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fce1da06-ba48-11dc-919d-0016176ac7c7}] \Shell\AutoRun\command - K:\s.bat \Shell\explore\Command - K:\s.bat \Shell\open\Command - K:\s.bat *Newly Created Service* - PROCEXP90 . - - - - ORPHANS REMOVED - - - - HKLM-Run-TkBellExe - realsched.exe HKU-Default-Run-Nokia.PCSync - D:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Piotrek\Dane aplikacji\Mozilla\Firefox\Profiles\xuwqo967.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ FF -: plugin - D:\Programy\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\np32dsw.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nppdf32.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nppl3260.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\nprpjplug.dll FF -: plugin - D:\Programy\Mozilla Firefox\plugins\NPSWF32.dll FF -: plugin - d:\Programy\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - d:\Programy\Real Alternative\browser\plugins\nprpjplug.dll FF -: plugin - d:\Programy\Real\RealPlayer\Netscape6\nppl3260.dll FF -: plugin - d:\Programy\Real\RealPlayer\Netscape6\nprjplug.dll FF -: plugin - d:\Programy\Real\RealPlayer\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-11 07:43:09 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-11 7:43:35 ComboFix-quarantined-files.txt 2008-09-11 05:43:33 Pre-Run: 30,589,550,592 bajtów wolnych Post-Run: 30,577,061,888 bajtów wolnych 187 --- E O F --- 2008-09-10 09:15:30

log z hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:30:58, on 2008-09-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe d:\Programy\Avast4\aswUpdSv.exe d:\Programy\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE D:\Programy\S-3200 Wireless Optical Slimline Deskset\MouseDrv.exe D:\Programy\S-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe D:\Programy\Winamp\winampa.exe D:\Programy\Avast4\ashDisp.exe D:\Programy\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe D:\Programy\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe D:\Programy\HP\Digital Imaging\bin\hpqtra08.exe D:\Programy\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\explorer.exe D:\Programy\Mozilla Firefox\firefox.exe C:\Programy\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WireLessMouse] D:\Programy\S-3200 Wireless Optical Slimline Deskset\MouseDrv.exe O4 - HKLM\..\Run: [WireLessKeyboard] D:\Programy\S-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [avast!] d:\Programy\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] D:\Programy\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "d:\Programy\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [WinampAgent] d:\Programy\Winamp\winampa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Programy\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.line6.net O17 - HKLM\System\CCS\Services\Tcpip\..\{173C8247-F0EA-4083-91C4-20D88AC9C0C8}: NameServer = 194.204.159.1,194.204.152.35 O17 - HKLM\System\CCS\Services\Tcpip\..\{CCCAD8AA-B9DB-46C2-8408-B63F881C6E32}: NameServer = 194.204.159.1,194.204.152.35 O17 - HKLM\System\CS1\Services\Tcpip\..\{173C8247-F0EA-4083-91C4-20D88AC9C0C8}: NameServer = 194.204.159.1,194.204.152.35 O17 - HKLM\System\CS2\Services\Tcpip\..\{173C8247-F0EA-4083-91C4-20D88AC9C0C8}: NameServer = 194.204.159.1,194.204.152.35 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Programy\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - d:\Programy\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Programy\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - d:\Programy\Avast4\ashWebSv.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6532 bytes

tutaj logi z drugiego komputera

Kod: Zaznacz wszystko: ComboFix 08-09-10.02 - Piotrek 2008-09-11 9:48:57.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2538 [GMT 2:00] Running from: C:\Documents and Settings\Piotrek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\WINDOWS\system32\amvo0.dll C:\WINDOWS\system32\amvo1.dll . ((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 ))))))))))))))))))))))))))))))) . 2008-09-10 22:23 . 2008-09-10 22:28 37,473 --a------ C:\WINDOWS\system32\muzika.xm 2008-09-10 22:08 . 2008-09-10 22:12 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\BSplayer 2008-09-10 22:05 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-10 10:15 . 2008-09-10 13:48 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\OpenOffice.org2 2008-09-09 19:23 . 2008-09-09 19:23 <DIR> d-------- C:\Program Files\OpenOffice.org 2.4 2008-09-08 09:32 . 2008-09-08 09:42 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\HP 2008-09-08 09:31 . 2008-09-08 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-09-08 09:29 . 2008-09-08 09:31 <DIR> d-------- C:\Program Files\Common Files\HP 2008-09-08 09:27 . 2008-09-08 09:27 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-09-08 09:26 . 2008-09-08 09:26 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-09-08 09:25 . 2006-02-01 02:48 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2008-09-08 09:25 . 2006-02-01 02:48 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-09-08 09:19 . 2008-09-08 09:32 121,395 --a------ C:\WINDOWS\hpoins09.dat 2008-09-07 22:38 . 2006-01-04 10:12 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll 2008-09-07 22:38 . 2006-02-09 15:45 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-09-07 22:38 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-09-07 22:38 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-09-07 22:37 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-09-07 22:37 . 2005-03-15 01:33 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-09-07 22:37 . 2005-03-15 01:35 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-09-07 22:37 . 2005-03-09 01:25 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-09-07 22:37 . 2005-11-22 21:58 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-09-07 22:37 . 2005-03-15 03:09 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-09-07 22:37 . 2005-03-09 01:25 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-09-07 22:35 . 2008-09-08 09:31 <DIR> d-------- C:\Program Files\HP 2008-09-07 22:34 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-09-07 22:34 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-09-07 22:34 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-07 22:34 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-09-06 13:19 . 2008-09-06 13:21 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Nowe Gadu-Gadu 2008-09-06 07:43 . 2008-09-06 07:43 <DIR> d-------- C:\Documents and Settings\Piotrek\Bluetooth Software 2008-09-05 19:12 . 2008-09-05 19:12 <DIR> d-------- C:\Program Files\AnswerWorks 4.0 2008-09-05 19:11 . 2008-09-05 19:11 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Autodesk 2008-09-05 19:11 . 2008-09-05 19:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk 2008-09-05 19:09 . 2008-09-05 19:12 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared 2008-09-05 19:09 . 2008-09-05 19:09 <DIR> d-------- C:\Program Files\Autodesk 2008-09-05 17:32 . 2008-09-05 17:33 44 --a------ C:\WINDOWS\SMWizard.INI 2008-09-05 17:09 . 2008-09-05 17:09 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-09-04 21:45 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-09-04 21:45 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys 2008-09-04 21:44 . 2008-09-04 21:44 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-04 21:44 . 2008-09-04 21:44 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-04 20:00 . 2008-09-04 20:00 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-09-04 19:59 . 2008-09-04 19:59 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-09-04 19:59 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-09-04 19:48 . 2008-09-04 19:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-09-04 19:43 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-09-04 19:43 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-09-04 19:43 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-09-04 19:43 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-09-04 19:43 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-09-04 19:42 . 2008-09-10 13:31 <DIR> d-------- C:\Program Files\Nokia 2008-09-04 19:42 . 2008-09-04 19:42 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-09-04 18:15 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-09-04 18:15 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-09-04 18:03 . 2008-09-04 18:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-09-04 10:39 . 2008-09-04 10:39 <DIR> d-------- C:\_SMA 2008-09-04 09:37 . 2008-09-04 11:23 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-09-04 08:41 . 2008-09-04 08:41 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Leadertech 2008-09-04 08:20 . 2008-09-04 08:20 <DIR> d-------- C:\Documents and Settings\Piotrek\WapSter 2008-09-04 08:19 . 2008-09-04 08:19 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Gadu-Gadu 2008-09-04 08:16 . 2008-09-04 08:19 <DIR> d-------- C:\Documents and Settings\Piotrek\Gadu-Gadu 2008-09-04 07:38 . 2008-09-04 07:38 <DIR> d-------- C:\Program Files\DIFX 2008-09-04 07:38 . 2008-09-04 20:00 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-09-04 07:38 . 2008-09-04 21:45 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\PC Suite 2008-09-04 07:38 . 2008-09-04 21:44 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Nokia 2008-09-04 07:38 . 2008-09-04 07:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-09-04 07:38 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-09-04 07:38 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-09-04 07:38 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-09-04 07:38 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-09-04 07:38 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-09-04 07:38 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-09-04 07:37 . 2008-09-04 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-09-04 07:34 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2008-09-04 07:33 . 2008-09-04 07:33 <DIR> d-------- C:\Program Files\MSBuild 2008-09-04 07:33 . 2008-09-04 07:33 <DIR> d-------- C:\Program Files\Microsoft Works 2008-09-04 07:31 . 2008-09-04 07:31 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-09-04 07:28 . 2008-09-04 07:28 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8 2008-09-04 07:27 . 2008-09-04 07:32 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-09-04 07:27 . 2008-09-10 15:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-04 07:26 . 2008-09-04 07:26 <DIR> dr-h----- C:\MSOCache 2008-09-04 03:56 . 2008-09-03 20:34 <DIR> d-a------ C:\drivers 2008-09-03 23:01 . 2008-09-03 23:02 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Winamp 2008-09-03 21:29 . 2008-09-10 22:22 <DIR> d-------- C:\Programy 2008-09-03 21:29 . 2008-09-03 21:29 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Talkback 2008-09-03 21:29 . 2008-09-03 21:29 0 --a------ C:\WINDOWS\nsreg.dat 2008-09-03 21:26 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-09-03 19:59 . 2006-10-23 13:14 30,208 --a------ C:\WINDOWS\system32\drivers\usbehci.sys 2008-09-03 19:59 . 2004-08-03 23:07 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys 2008-09-03 19:59 . 2001-08-17 21:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys 2008-09-03 19:59 . 2001-08-17 21:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys 2008-09-03 19:59 . 2004-08-04 00:44 7,168 --a------ C:\WINDOWS\system32\hccoin.dll 2008-09-03 19:58 . 2004-08-03 23:10 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys 2008-09-03 19:58 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys 2008-09-03 19:58 . 2004-08-03 23:07 8,832 --a------ C:\WINDOWS\system32\drivers\wmiacpi.sys 2008-09-03 19:58 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-10 20:05 --------- d-----w C:\Program Files\Java 2008-09-10 16:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-09-10 11:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-09-05 18:35 --------- d-----w C:\Program Files\PCDR5 2008-09-04 07:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-03 18:54 --------- d-----w C:\Program Files\Windows Live Toolbar 2008-09-03 18:53 50 ----a-w C:\WINDOWS\system32\drivers\LENOVO_7664_1KU.MRK 2008-09-03 18:53 --------- d-----w C:\Program Files\ThinkVantage Fingerprint Software 2008-09-03 18:47 --------- d-----w C:\Program Files\microsoft frontpage 2008-09-03 18:39 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Program Files\Common Files\ThinkVantage Fingerprint Software 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\UIB 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Lenovo 2008-09-03 18:34 33,536 ----a-w C:\WINDOWS\system32\drivers\tvtfilter.sys 2008-09-03 18:34 --------- d-----w C:\Program Files\Lenovo 2008-09-03 18:34 --------- d-----w C:\Program Files\Common Files\Lenovo 2008-09-03 18:33 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys 2008-09-03 18:33 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-03 18:33 --------- d-----w C:\Program Files\ThinkPad 2008-09-03 18:33 --------- d-----w C:\Program Files\Picasa2 2008-09-03 18:33 --------- d-----w C:\Program Files\Google 2008-09-03 18:32 --------- d-----w C:\Program Files\Diskeeper Corporation 2008-09-03 18:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC-Doctor 2008-09-03 18:28 --------- d-----w C:\Program Files\ThinkVantage 2008-09-03 18:28 --------- d-----w C:\Program Files\Lenovo Registration 2008-09-03 18:27 --------- d-----w C:\Program Files\Common Files\Installshield 2008-09-03 18:26 --------- d-----w C:\Program Files\Sonic Icons for Lenovo 2008-09-03 18:26 --------- d-----w C:\Program Files\Sonic 2008-09-03 18:26 --------- d-----w C:\Program Files\Multimedia Center for Think Offerings 2008-09-03 18:26 --------- d-----w C:\Program Files\Common Files\SureThing Shared 2008-09-03 18:26 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-09-03 18:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-09-03 18:25 --------- d-----w C:\Program Files\InterVideo 2008-09-03 18:25 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-09-03 18:23 --------- d-----w C:\Program Files\Common Files\Java 2008-09-03 18:18 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\Intel 2008-09-03 18:17 --------- d-----w C:\Program Files\Analog Devices 2008-09-03 18:15 --------- d-----w C:\Program Files\NetWaiting 2008-09-03 18:15 --------- d-----w C:\Program Files\Digital Line Detect 2008-09-03 18:15 --------- d-----w C:\Program Files\CONEXANT 2008-09-03 18:12 21,393 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-03 18:12 21,393 ----a-w C:\WINDOWS\AegisP.sys 2008-09-03 18:12 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Intel 2008-09-03 18:12 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\InstallShield 2008-09-03 18:12 --------- d-----w C:\Program Files\Common Files\snp2uvc 2008-09-03 18:12 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\InstallShield 2008-09-03 18:12 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield 2008-09-03 18:11 --------- d-----w C:\Program Files\Synaptics 2008-09-03 18:11 --------- d-----w C:\Program Files\Intel 2008-09-03 18:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Intel 2008-09-03 18:05 --------- d-----w C:\Program Files\Windows Media Connect 2 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000] "PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2007-06-17 200704] "BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2007-06-17 208896] "TPFNF7"="C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2007-04-09 58416] "TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2007-03-09 66176] "EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-03-28 243248] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-04-09 1015808] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-17 8433664] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-17 81920] "TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2007-02-08 536576] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "AwaySch"="C:\Program Files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 91688] "LPManager"="C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe" [2007-03-22 120368] "AMSG"="C:\Program Files\ThinkVantage\AMSG\Amsg.exe" [2007-02-01 419376] "DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696] "cssauth"="C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" [2007-01-30 2618944] "WinampAgent"="C:\Programy\Winamp\winampa.exe" [2008-08-04 36352] "GrooveMonitor"="C:\Programy\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "TpShocks"="TpShocks.exe" [2007-03-29 C:\WINDOWS\system32\TpShocks.exe] "nwiz"="nwiz.exe" [2007-05-17 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ BTTray.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2007-02-27 561213] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-09-03 50688] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Przyspieszenie uruchomienia programu AutoCAD.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2007-03-14 22:17 89600 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2006-09-06 09:37 34344 C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2006-12-14 04:06 28672 C:\Program Files\Lenovo\HOTKEY\tphklock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify] 2007-07-05 14:52 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Programy\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Programy\\WapSter\\AQQ\\AQQ.exe"= "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "C:\\Programy\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx86.sys [2007-03-02 100656] R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsHM86.sys [2007-03-02 19760] R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 11520] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2007-04-02 4224] R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2007-06-17 4442] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2007-03-14 11152] R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-02-08 569344] R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2006-09-13 35264] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52ee80e4-79e8-11dd-81e1-001de089787f}] \Shell\AutoRun\command - E:\s.bat \Shell\explore\Command - E:\s.bat \Shell\open\Command - E:\s.bat . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - HKU-Default-Run-Nokia.PCSync - C:\Programy\Nokia\Nokia PC Suite 6\PcSync2.exe MSConfigStartUp-amva - C:\WINDOWS\system32\amvo.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Piotrek\Dane aplikacji\Mozilla\Firefox\Profiles\sufxto4g.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl FF -: plugin - C:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nppdf32.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-11 09:52:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Lenovo\HOTKEY\tphklock.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\nview.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ibmpmsvc.exe C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Programy\Avast4\aswUpdSv.exe C:\Programy\Avast4\ashServ.exe C:\WINDOWS\system32\IPSSVC.EXE C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Lenovo\System Update\SUService.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\WINDOWS\system32\TPHDEXLG.exe C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe C:\Programy\Avast4\ashMaiSv.exe C:\Programy\Avast4\ashWebSv.exe C:\Program Files\Common Files\Lenovo\Logger\logmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\ZOOM\TpScrex.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Completion time: 2008-09-11 9:54:47 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-11 07:54:43 Pre-Run: 137,018,589,184 bajtów wolnych Post-Run: 136,930,209,792 bajt˘w wolnych 341 --- E O F --- 2008-09-05 15:15:04

mam nadzieję ze zrobiłem wszystko dobrze

**Posty:** 8001 · przez **Okocza** 11 Wrz 2008, 07:59

pypsior, zastosuj się do:

przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

**Posty:** 684 · przez **djarta** 11 Wrz 2008, 15:00

1)

Wylecz pendriva lub kartę pamięci
Perlovga Removal Tool
Flash Disinfector
lub format

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\s.bat D:\s.bat E:\s.bat F:\s.bat G:\s.bat K:\s.bat Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e01786-45fa-11dd-93b3-0016176acabf}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b03bc934-f457-11dc-928f-0016176acabf}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fce1da06-ba48-11dc-919d-0016176ac7c7}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

====================
K.

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 15:44

takie pytanie techniczne mam to zrobic na obu komputerach??

**Posty:** 8001 · przez **Okocza** 11 Wrz 2008, 15:49

pypsior napisał(a):takie pytanie techniczne mam to zrobic na obu komputerach??

zrób to z komputera z którego był log

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 15:52

aha ale pierwsze dwa logi były z innego kompa a ostatni z laptopa czyli ta operacje ma zastosowac do pierwszych 2 logów czy do ostatniego??

**Posty:** 684 · przez **djarta** 11 Wrz 2008, 15:57

Najpierw zrób to o co Cię prosiłem wyżej, potem zajmiemy się drugim kompem.

==========================
K.

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 15:59

ok

Dodano 11.09.2008 15:04:20:
oto log

Kod: Zaznacz wszystko: ComboFix 08-09-10.04 - Piotrek 2008-09-11 15:59:42.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.625 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Piotrek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Piotrek\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-11 do 2008-09-11 ))))))))))))))))))))))))))))))) . 2008-09-11 08:30 . 2008-09-11 08:30 <DIR> d-------- C:\Programy 2008-09-03 10:54 . 2008-09-03 20:10 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\OpenOffice.org2 2008-09-01 17:37 . 2008-09-01 17:37 <DIR> d-------- C:\Documents and Settings\Piotrek\EurekaLog 2008-08-30 08:41 . 2007-03-08 01:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2008-08-28 17:21 . 2008-08-28 17:21 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-08-28 17:20 . 2008-08-28 17:20 <DIR> d-------- C:\Program Files\PC Connectivity Solution . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-03 08:53 --------- d-----w C:\Program Files\Java 2008-08-29 15:32 --------- d-----w C:\Program Files\InterActual 2008-08-28 15:21 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-28 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-07-20 10:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-07-20 10:07 --------- d-----w C:\Program Files\Nokia 2008-07-20 10:07 --------- d-----w C:\Program Files\MSXML 6.0 2008-07-19 15:34 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-07-19 15:34 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-19 15:34 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll . ------- Sigcheck ------- 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\svchost.exe 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\dllcache\svchost.exe 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\dllcache\user32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\winlogon.exe 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\dllcache\winlogon.exe 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\explorer.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 00:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\services.exe 2004-08-04 00:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\dllcache\services.exe 2004-08-04 00:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\lsass.exe 2004-08-04 00:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\dllcache\lsass.exe 2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe 2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe 2004-08-04 00:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\userinit.exe 2004-08-04 00:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\dllcache\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-09-11_ 9.43.33.62 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-11 13:36:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_648.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WireLessMouse"="D:\Programy\S-3200 Wireless Optical Slimline Deskset\MouseDrv.exe" [2005-08-30 303104] "WireLessKeyboard"="D:\Programy\S-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe" [2005-08-30 319488] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "avast!"="d:\Programy\Avast4\ashDisp.exe" [2008-07-19 78008] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "HP Software Update"="D:\Programy\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RemoteControl"="d:\Programy\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "WinampAgent"="d:\Programy\Winamp\winampa.exe" [2008-08-04 36352] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - D:\Programy\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Przyspieszenie uruchomienia programu AutoCAD.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Programy\\AQQ\\AQQ.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hposid01.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "D:\\Programy\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "D:\\Programy\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "D:\\Programy\\BearShare\\BearShare.exe"= "D:\\Programy\\Gadu-Gadu\\gg.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 L6TPortGX;Service - Line 6 TonePort GX;C:\WINDOWS\system32\Drivers\L6TPortGX.sys [2007-09-17 514432] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fce1da06-ba48-11dc-919d-0016176ac7c7}] \Shell\AutoRun\command - K:\s.bat \Shell\explore\Command - K:\s.bat \Shell\open\Command - K:\s.bat . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-11 16:00:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-11 16:01:09 ComboFix-quarantined-files.txt 2008-09-11 14:01:06 ComboFix2.txt 2008-09-11 05:43:37 Przed: 30,559,653,888 bajt˘w wolnych Po: 30,548,066,304 bajt˘w wolnych 147 --- E O F --- 2008-09-10 09:15:30

**Posty:** 684 · przez **djarta** 11 Wrz 2008, 16:08

Nic się nie usunęło - powtórka!

=======================
K.

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 16:12

Kod: Zaznacz wszystko: ComboFix 08-09-10.04 - Piotrek 2008-09-11 16:07:51.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.614 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Piotrek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Piotrek\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-11 do 2008-09-11 ))))))))))))))))))))))))))))))) . 2008-09-11 08:30 . 2008-09-11 08:30 <DIR> d-------- C:\Programy 2008-09-03 10:54 . 2008-09-03 20:10 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\OpenOffice.org2 2008-09-01 17:37 . 2008-09-01 17:37 <DIR> d-------- C:\Documents and Settings\Piotrek\EurekaLog 2008-08-30 08:41 . 2007-03-08 01:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2008-08-28 17:21 . 2008-08-28 17:21 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-08-28 17:20 . 2008-08-28 17:20 <DIR> d-------- C:\Program Files\PC Connectivity Solution . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-03 08:53 --------- d-----w C:\Program Files\Java 2008-08-29 15:32 --------- d-----w C:\Program Files\InterActual 2008-08-28 15:21 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-28 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-07-20 10:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-07-20 10:07 --------- d-----w C:\Program Files\Nokia 2008-07-20 10:07 --------- d-----w C:\Program Files\MSXML 6.0 2008-07-19 15:34 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-07-19 15:34 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-19 15:34 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll . ------- Sigcheck ------- 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\svchost.exe 2004-08-04 00:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\dllcache\svchost.exe 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\dllcache\user32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll 2004-08-04 00:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\dllcache\ws2_32.dll 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\winlogon.exe 2004-08-04 00:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\dllcache\winlogon.exe 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys 2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys 2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\explorer.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 00:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\services.exe 2004-08-04 00:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\dllcache\services.exe 2004-08-04 00:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\lsass.exe 2004-08-04 00:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\dllcache\lsass.exe 2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe 2004-08-04 00:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\dllcache\ctfmon.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe 2004-08-04 00:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\userinit.exe 2004-08-04 00:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\dllcache\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-09-11_ 9.43.33.62 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-11 13:36:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_648.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WireLessMouse"="D:\Programy\S-3200 Wireless Optical Slimline Deskset\MouseDrv.exe" [2005-08-30 303104] "WireLessKeyboard"="D:\Programy\S-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe" [2005-08-30 319488] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "avast!"="d:\Programy\Avast4\ashDisp.exe" [2008-07-19 78008] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "HP Software Update"="D:\Programy\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RemoteControl"="d:\Programy\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "WinampAgent"="d:\Programy\Winamp\winampa.exe" [2008-08-04 36352] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - D:\Programy\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Przyspieszenie uruchomienia programu AutoCAD.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Programy\\AQQ\\AQQ.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hposid01.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "D:\\Programy\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "D:\\Programy\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "D:\\Programy\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "D:\\Programy\\BearShare\\BearShare.exe"= "D:\\Programy\\Gadu-Gadu\\gg.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 L6TPortGX;Service - Line 6 TonePort GX;C:\WINDOWS\system32\Drivers\L6TPortGX.sys [2007-09-17 514432] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-11 16:08:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-11 16:08:55 ComboFix-quarantined-files.txt 2008-09-11 14:08:50 ComboFix2.txt 2008-09-11 14:01:11 ComboFix3.txt 2008-09-11 05:43:37 Przed: 30,522,703,872 bajt˘w wolnych Po: 30,511,431,680 bajt˘w wolnych 144 --- E O F --- 2008-09-10 09:15:30

**Posty:** 684 · przez **djarta** 11 Wrz 2008, 16:16

Log wygląda na czysty.Ale choć widać, że Script niczego nie usuwał - czyżby wyparowało?

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

EDIT:
Daj log z ComboFixa z drugiego kompa.

=======================
K.

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 16:35

zaraz wyśle log z drugiego kompa. Zrobiłem to z tego linku bad-generic-host-process-for-win32-services-vt79489.html i przy biosie pokazało się zamiast zielonego żółty trójkącik. Nie znam się na tym ale to jest ważne??
Sprawdzam obecnie wszystkie dyski w celu optymalizacji

**Posty:** 8001 · przez **Okocza** 11 Wrz 2008, 16:36

pypsior napisał(a):biosie pokazało się zamiast zielonego żółty trójkącik. Nie znam się na tym ale to jest ważne??

netbiosie

może być

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 17:00

log z drugiego kompa

Kod: Zaznacz wszystko: ComboFix 08-09-10.04 - Piotrek 2008-09-11 16:37:44.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2540 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Piotrek\Pulpit\ComboFix.exe [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-11 do 2008-09-11 ))))))))))))))))))))))))))))))) . 2008-09-10 22:23 . 2008-09-10 22:28 37,473 --a------ C:\WINDOWS\system32\muzika.xm 2008-09-10 22:08 . 2008-09-10 22:12 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\BSplayer 2008-09-10 22:05 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-10 10:15 . 2008-09-10 13:48 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\OpenOffice.org2 2008-09-09 19:23 . 2008-09-09 19:23 <DIR> d-------- C:\Program Files\OpenOffice.org 2.4 2008-09-08 09:32 . 2008-09-08 09:42 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\HP 2008-09-08 09:31 . 2008-09-08 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-09-08 09:29 . 2008-09-08 09:31 <DIR> d-------- C:\Program Files\Common Files\HP 2008-09-08 09:27 . 2008-09-08 09:27 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-09-08 09:26 . 2008-09-08 09:26 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-09-08 09:25 . 2006-02-01 02:48 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2008-09-08 09:25 . 2006-02-01 02:48 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-09-08 09:19 . 2008-09-08 09:32 121,395 --a------ C:\WINDOWS\hpoins09.dat 2008-09-07 22:38 . 2006-01-04 10:12 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll 2008-09-07 22:38 . 2006-02-09 15:45 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-09-07 22:38 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-09-07 22:38 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-09-07 22:37 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-09-07 22:37 . 2005-03-15 01:33 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-09-07 22:37 . 2005-03-15 01:35 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-09-07 22:37 . 2005-03-09 01:25 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-09-07 22:37 . 2005-11-22 21:58 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-09-07 22:37 . 2005-03-15 03:09 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-09-07 22:37 . 2005-03-09 01:25 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-09-07 22:35 . 2008-09-08 09:31 <DIR> d-------- C:\Program Files\HP 2008-09-07 22:34 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-09-07 22:34 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-09-07 22:34 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-07 22:34 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-09-06 13:19 . 2008-09-06 13:21 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Nowe Gadu-Gadu 2008-09-06 07:43 . 2008-09-06 07:43 <DIR> d-------- C:\Documents and Settings\Piotrek\Bluetooth Software 2008-09-05 19:12 . 2008-09-05 19:12 <DIR> d-------- C:\Program Files\AnswerWorks 4.0 2008-09-05 19:11 . 2008-09-05 19:11 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Autodesk 2008-09-05 19:11 . 2008-09-05 19:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk 2008-09-05 19:09 . 2008-09-05 19:12 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared 2008-09-05 19:09 . 2008-09-05 19:09 <DIR> d-------- C:\Program Files\Autodesk 2008-09-05 17:32 . 2008-09-05 17:33 44 --a------ C:\WINDOWS\SMWizard.INI 2008-09-05 17:09 . 2008-09-05 17:09 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-09-04 21:45 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-09-04 21:45 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys 2008-09-04 21:44 . 2008-09-04 21:44 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-04 21:44 . 2008-09-04 21:44 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-04 20:00 . 2008-09-04 20:00 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-09-04 19:59 . 2008-09-04 19:59 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-09-04 19:59 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-09-04 19:48 . 2008-09-04 19:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-09-04 19:43 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-09-04 19:43 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-09-04 19:43 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-09-04 19:43 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-09-04 19:43 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-09-04 19:42 . 2008-09-10 13:31 <DIR> d-------- C:\Program Files\Nokia 2008-09-04 19:42 . 2008-09-04 19:42 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-09-04 18:15 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-09-04 18:15 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-09-04 18:03 . 2008-09-04 18:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-09-04 10:39 . 2008-09-04 10:39 <DIR> d-------- C:\_SMA 2008-09-04 09:37 . 2008-09-04 11:23 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-09-04 08:41 . 2008-09-04 08:41 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Leadertech 2008-09-04 08:20 . 2008-09-04 08:20 <DIR> d-------- C:\Documents and Settings\Piotrek\WapSter 2008-09-04 08:19 . 2008-09-04 08:19 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Gadu-Gadu 2008-09-04 08:16 . 2008-09-04 08:19 <DIR> d-------- C:\Documents and Settings\Piotrek\Gadu-Gadu 2008-09-04 07:38 . 2008-09-04 07:38 <DIR> d-------- C:\Program Files\DIFX 2008-09-04 07:38 . 2008-09-04 20:00 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-09-04 07:38 . 2008-09-04 21:45 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\PC Suite 2008-09-04 07:38 . 2008-09-04 21:44 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Nokia 2008-09-04 07:38 . 2008-09-04 07:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-09-04 07:38 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-09-04 07:38 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-09-04 07:38 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-09-04 07:38 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-09-04 07:38 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-09-04 07:38 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-09-04 07:37 . 2008-09-04 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-09-04 07:34 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2008-09-04 07:33 . 2008-09-04 07:33 <DIR> d-------- C:\Program Files\MSBuild 2008-09-04 07:33 . 2008-09-04 07:33 <DIR> d-------- C:\Program Files\Microsoft Works 2008-09-04 07:31 . 2008-09-04 07:31 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-09-04 07:28 . 2008-09-04 07:28 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8 2008-09-04 07:27 . 2008-09-04 07:32 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-09-04 07:27 . 2008-09-10 15:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-04 07:26 . 2008-09-04 07:26 <DIR> dr-h----- C:\MSOCache 2008-09-04 03:56 . 2008-09-03 20:34 <DIR> d-a------ C:\drivers 2008-09-03 23:01 . 2008-09-03 23:02 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Winamp 2008-09-03 21:29 . 2008-09-11 16:21 <DIR> d-------- C:\Programy 2008-09-03 21:29 . 2008-09-03 21:29 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Talkback 2008-09-03 21:29 . 2008-09-03 21:29 0 --a------ C:\WINDOWS\nsreg.dat 2008-09-03 21:26 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-09-03 19:59 . 2006-10-23 13:14 30,208 --a------ C:\WINDOWS\system32\drivers\usbehci.sys 2008-09-03 19:59 . 2004-08-03 23:07 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys 2008-09-03 19:59 . 2001-08-17 21:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys 2008-09-03 19:59 . 2001-08-17 21:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys 2008-09-03 19:59 . 2004-08-04 00:44 7,168 --a------ C:\WINDOWS\system32\hccoin.dll 2008-09-03 19:58 . 2004-08-03 23:10 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys 2008-09-03 19:58 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys 2008-09-03 19:58 . 2004-08-03 23:07 8,832 --a------ C:\WINDOWS\system32\drivers\wmiacpi.sys 2008-09-03 19:58 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-10 20:05 --------- d-----w C:\Program Files\Java 2008-09-10 16:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-09-10 11:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-09-05 18:35 --------- d-----w C:\Program Files\PCDR5 2008-09-04 07:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-03 18:54 --------- d-----w C:\Program Files\Windows Live Toolbar 2008-09-03 18:53 50 ----a-w C:\WINDOWS\system32\drivers\LENOVO_7664_1KU.MRK 2008-09-03 18:53 --------- d-----w C:\Program Files\ThinkVantage Fingerprint Software 2008-09-03 18:47 --------- d-----w C:\Program Files\microsoft frontpage 2008-09-03 18:39 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Program Files\Common Files\ThinkVantage Fingerprint Software 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\UIB 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Lenovo 2008-09-03 18:34 33,536 ----a-w C:\WINDOWS\system32\drivers\tvtfilter.sys 2008-09-03 18:34 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-09-03 18:34 115,960 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-09-03 18:34 --------- d-----w C:\Program Files\Lenovo 2008-09-03 18:34 --------- d-----w C:\Program Files\Common Files\Lenovo 2008-09-03 18:33 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys 2008-09-03 18:33 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-03 18:33 --------- d-----w C:\Program Files\ThinkPad 2008-09-03 18:33 --------- d-----w C:\Program Files\Picasa2 2008-09-03 18:33 --------- d-----w C:\Program Files\Google 2008-09-03 18:32 --------- d-----w C:\Program Files\Diskeeper Corporation 2008-09-03 18:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC-Doctor 2008-09-03 18:28 --------- d-----w C:\Program Files\ThinkVantage 2008-09-03 18:28 --------- d-----w C:\Program Files\Lenovo Registration 2008-09-03 18:27 --------- d-----w C:\Program Files\Common Files\Installshield 2008-09-03 18:26 --------- d-----w C:\Program Files\Sonic Icons for Lenovo 2008-09-03 18:26 --------- d-----w C:\Program Files\Sonic 2008-09-03 18:26 --------- d-----w C:\Program Files\Multimedia Center for Think Offerings 2008-09-03 18:26 --------- d-----w C:\Program Files\Common Files\SureThing Shared 2008-09-03 18:26 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-09-03 18:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-09-03 18:25 --------- d-----w C:\Program Files\InterVideo 2008-09-03 18:25 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-09-03 18:23 --------- d-----w C:\Program Files\Common Files\Java 2008-09-03 18:18 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\Intel 2008-09-03 18:17 --------- d-----w C:\Program Files\Analog Devices 2008-09-03 18:15 --------- d-----w C:\Program Files\NetWaiting 2008-09-03 18:15 --------- d-----w C:\Program Files\Digital Line Detect 2008-09-03 18:15 --------- d-----w C:\Program Files\CONEXANT 2008-09-03 18:12 21,393 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-03 18:12 21,393 ----a-w C:\WINDOWS\AegisP.sys 2008-09-03 18:12 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Intel 2008-09-03 18:12 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\InstallShield 2008-09-03 18:12 --------- d-----w C:\Program Files\Common Files\snp2uvc 2008-09-03 18:12 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\InstallShield 2008-09-03 18:12 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield 2008-09-03 18:11 --------- d-----w C:\Program Files\Synaptics 2008-09-03 18:11 --------- d-----w C:\Program Files\Intel 2008-09-03 18:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Intel 2008-09-03 18:05 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:33 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:24 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-24 08:42 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-23 09:23 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:23 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:37 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:37 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:37 147,968 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 10:44 360,960 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 09:32 225,920 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll . ((((((((((((((((((((((((((((( snapshot@2008-09-11_ 9.54.30.50 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-17 03:00:00 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll + 2008-08-17 03:00:00 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll + 2008-08-17 03:00:00 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll + 2008-08-17 03:00:00 185,944 ----a-w C:\WINDOWS\system32\rmoc3260.dll + 2007-09-04 16:56:10 164,352 ----a-w C:\WINDOWS\system32\unrar.dll + 2008-01-10 12:15:30 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll + 2008-01-10 12:16:20 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll + 2004-01-25 16:18:44 217,088 ----a-w C:\WINDOWS\system32\yv12vfw.dll + 2008-09-11 13:55:48 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_260.dat + 2008-09-11 13:55:47 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_790.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000] "PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2007-06-17 200704] "BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2007-06-17 208896] "TPFNF7"="C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2007-04-09 58416] "TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2007-03-09 66176] "EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-03-28 243248] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-04-09 1015808] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-17 8433664] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-17 81920] "TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2007-02-08 536576] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "AwaySch"="C:\Program Files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 91688] "LPManager"="C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe" [2007-03-22 120368] "AMSG"="C:\Program Files\ThinkVantage\AMSG\Amsg.exe" [2007-02-01 419376] "DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696] "cssauth"="C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" [2007-01-30 2618944] "WinampAgent"="C:\Programy\Winamp\winampa.exe" [2008-08-04 36352] "GrooveMonitor"="C:\Programy\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "TpShocks"="TpShocks.exe" [2007-03-29 C:\WINDOWS\system32\TpShocks.exe] "nwiz"="nwiz.exe" [2007-05-17 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ BTTray.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2007-02-27 561213] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-09-03 50688] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Przyspieszenie uruchomienia programu AutoCAD.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2007-03-14 22:17 89600 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2006-09-06 09:37 34344 C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2006-12-14 04:06 28672 C:\Program Files\Lenovo\HOTKEY\tphklock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify] 2007-07-05 14:52 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Programy\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Programy\\WapSter\\AQQ\\AQQ.exe"= "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "C:\\Programy\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx86.sys [2007-03-02 100656] R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsHM86.sys [2007-03-02 19760] R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 11520] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2007-04-02 4224] R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2007-06-17 4442] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2007-03-14 11152] R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-02-08 569344] R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2006-09-13 35264] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] . Zawartość folderu 'Zaplanowane zadania' . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Piotrek\Dane aplikacji\Mozilla\Firefox\Profiles\sufxto4g.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl FF -: plugin - C:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nppdf32.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-11 16:39:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Lenovo\HOTKEY\tphklock.dll . Czas ukończenia: 2008-09-11 16:39:43 ComboFix-quarantined-files.txt 2008-09-11 14:39:36 ComboFix2.txt 2008-09-11 13:49:22 ComboFix3.txt 2008-09-11 07:54:48 Przed: 136,841,334,784 bajt˘w wolnych Po: 136,827,699,200 bajt˘w wolnych 325 --- E O F --- 2008-09-05 15:15:04

jest to już drugi raz robiony combofix pierwszy zamieściłem jako ostatni w pierwszym poście

niebawem wyśłe raport z kasperskiego i log o który prosiłeś z pierwszego kompa

Dodano 11.09.2008 16:06:02:
niestety nie moge urzyć kasperskiego nie wiem dlaczego nie urzywam kasperskiego na komputerze tylko avast a mimo to nie che sie otworzyc:/
log z FixIDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.9.6104 * * * ******************************************************************************** Created at 17:01:50 on Thursday, September 11, 2008 Time Zone : Logged On User : Piotrek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 Processor 3800+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 1047920 KB Free Physical Memory : 652528 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2020588 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 11 Wrz 2008, 20:26

te plik/i :

C:\WINDOWS\system32\muzika.xm

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 22 · przez **pypsior** 11 Wrz 2008, 21:25

Kod: Zaznacz wszystko: | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Français | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Español | English Virus Total Virustotal to usługa udostępniająca skanowanie plików i szybkie rozpoznawanie wirusów, robaków, trojanów i wszelkiego rodzaju podejrzanego oprogramowania, które jest identyfikowane przez dostępne na rynku programy antywirusowe. Więcej informacji... Plik muzika.xm otrzymany 2008.09.11 21:23:38 (CET) Obecny status: Ładowanie ... w kolejce oczekuje skanowanie zakończono NIE ZNALEZIONO ZATRZYMANE Wynik: 0/36 (0%) Ładowanie informacji serwera... Twój plik czeka w kolejce na pozycji: 1. Oczekiwany czas rozpoczęcia zawiera się między 39 i 56 sekundy. Nie zamykaj tego okna, dopóki skanowanie nie zostanie ukończone. Skaner nie odpowiada, trwają próby odzyskania wyników skanowania. Jeśli potrwa to dłużej niż 5 minut, wyślik plik ponownie. Twój plik jest obecnie skanowany, wyniki będą pojawiać się stopniowo. Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Twój plik wygasł lub nie istnieje. Usługa została wstrzymana. Twój plik będzie czekać na skanowanie (na pozycji: ) przez nieokreślony czas. Możesz czekać na odpowiedź (automatyczne przeładowanie) lub podać swój email poniżej i kliknąć "przypomnij", wtedy system poinformuje Cię o zakończeniu skanowania wysyłając email. Przypomnij: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.9.12.0 2008.09.11 - AntiVir 7.8.1.28 2008.09.11 - Authentium 5.1.0.4 2008.09.11 - Avast 4.8.1195.0 2008.09.11 - AVG 8.0.0.161 2008.09.11 - BitDefender 7.2 2008.09.11 - CAT-QuickHeal 9.50 2008.09.11 - ClamAV 0.93.1 2008.09.11 - DrWeb 4.44.0.09170 2008.09.11 - eSafe 7.0.17.0 2008.09.11 - eTrust-Vet 31.6.6084 2008.09.11 - Ewido 4.0 2008.09.11 - F-Prot 4.4.4.56 2008.09.11 - F-Secure 8.0.14332.0 2008.09.11 - Fortinet 3.113.0.0 2008.09.11 - GData 19 2008.09.11 - Ikarus T3.1.1.34.0 2008.09.11 - K7AntiVirus 7.10.452 2008.09.11 - Kaspersky 7.0.0.125 2008.09.11 - McAfee 5382 2008.09.11 - Microsoft 1.3903 2008.09.11 - NOD32v2 3435 2008.09.11 - Norman 5.80.02 2008.09.11 - Panda 9.0.0.4 2008.09.11 - PCTools 4.4.2.0 2008.09.11 - Prevx1 V2 2008.09.11 - Rising 20.61.32.00 2008.09.11 - Sophos 4.33.0 2008.09.11 - Sunbelt 3.1.1628.1 2008.09.11 - Symantec 10 2008.09.11 - TheHacker 6.3.0.9.077 2008.09.10 - TrendMicro 8.700.0.1004 2008.09.11 - VBA32 3.12.8.5 2008.09.10 - ViRobot 2008.9.11.1373 2008.09.11 - VirusBuster 4.5.11.0 2008.09.11 - Webwasher-Gateway 6.6.2 2008.09.11 - Dodatkowe informacje File size: 37473 bytes MD5...: b772b40cebaf3d28cc11f87bb2737e94 SHA1..: acf2fff51526890252b8b524fa340f161b787f3d SHA256: aacd66c4afc210a6e014b946a6c19886161896fa0e4ec8f85cba060d1f55acae SHA512: 9bba3d22d3f21ddc4bbaed057865cbc59d2855dec6e63d61c36552a6bfbc2efe ce525a507f0bcdc08964d3270f649ecf048efa22b493d2098263f3d6386b7d54 PEiD..: - TrID..: File type identification Fast Tracker 2 Extended Module (100.0%) PEInfo: - UWAGA UWAGA: VirusTotal jest darmową usługą utrzymywaną przez Hispasec Sistemas. Nie ma żadnych gwarancji co do dostępności lub ciągłości tej usługi. Pomimo, że wykrywalność złośliwego oprogramowania w przypadku kilku skanerów antywirusowych jest o wiele większa, niż tylko jednego, raporty nie mogą być 100% miernikiem szkodliwości lub nieszkodliwości danego pliku. Obecnie nie istnieje rozwiązanie gwarantujące 100% wykrywalność złośliwego oprogramowania. VirusTotal © Hispasec Sistemas - Blog - Kontakt: info@virustotal.com - Terms of Service & Privacy Policy

Kod: Zaznacz wszystko: Service load: 0% 100% File: muzika.xm Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: b772b40cebaf3d28cc11f87bb2737e94 Packers detected: - Scanner results Scan taken on 11 Sep 2008 19:26:15 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

**Posty:** 18165 · przez **wojtas** 11 Wrz 2008, 21:41

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Amvo.exe

Amvo.exe

Amvo- jak usunąć???

Amvo.exe

Amvo.exe

Amvo.exe

Re: amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Amvo.exe

Re: amvo.exe

Amvo.exe

Kto jest na forum