Brak dzwięku przez wirusy

**Posty:** 13 · przez **NIKI4355** 09 Gru 2008, 11:53

Witam, mam problem z brakiem dzwięku, po zaifekowaniu kopmutera wirusami nagle kpomuter zresetowal sie na starszego windowsa, zniknal pasek startowy i zniknely wszystkie sterowniki dzwięku. Mam płytke główna na ktorej sa te sterowniki dzwięku ale nie mogę jej zainstalowac poniewaz system mowi mi ze nie moze odnales serwera RPC :roll:

Próbowalam takze odinstalowac i ponownie przywrocic sterowniki, tez nic to nie dalo.

Prosze o pomoc

**Posty:** 3874 · przez **Wojtasgls** 09 Gru 2008, 12:55

1. Przydalo by sie najpierw oczyscic komputer z syfu wstaw logi z hijacka:
http://forum.programosy.pl/hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html
pozniej z combofixa:
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-rsita-vt95026.html

2. Jaki system i jaki service pack
3. Jaka plyta glowna:
http://forum.programosy.pl/zanim-poprosisz-o-pomoc-w-tym-dziale-przeczytaj-vt96525.html

**Posty:** 13 · przez **NIKI4355** 09 Gru 2008, 13:08

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:07:28, on 08-12-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\windows\RTHDCPL.EXE C:\Program Files\BitComet\BitComet.exe C:\windows\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Ares\Ares.exe C:\windows\explorer.exe C:\Program Files\Opera\opera.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\windows\system32\rundll32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file) O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\MpcStar\Codecs\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User '?') O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: BitComet - {d18a0b52-d63c-4ed0-afc6-c1e3dc1af43a} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{516B060E-FEC8-4FC3-91CF-D8F34D0B0B03}: NameServer = 80.85.224.2,80.85.224.50 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Zarządzanie aplikacjami (AppMgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Przeglądarka komputera (Browser) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługi kryptograficzne (CryptSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Program uruchamiający proces serwera DCOM (DcomLaunch) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Klient DHCP (Dhcp) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer dysków logicznych (dmserver) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Klient DNS (Dnscache) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Automatyczna konfiguracja sieci przewodowej (Dot3svc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa protokołu uwierzytelniania rozszerzonego (EAP) (EapHost) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: System zdarzeń COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing) O23 - Service: Zgodność szybkiego przełączania użytkowników (FastUserSwitchingCompatibility) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Pomoc i obsługa techniczna (helpsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa zarządzania kluczami i certyfikatami kondycji (hkmsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Serwer (LanmanServer) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Stacja robocza (lanmanworkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Pomoc TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Agent ochrony dostępu do sieci (napagent) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Połączenia sieciowe (Netman) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Rozpoznawanie lokalizacji w sieci (NLA) (Nla) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Magazyn wymienny (NtmsSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa klienta dla systemu NetWare (NWCWorkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer autopołączenia dostępu zdalnego (RasAuto) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer połączeń usługi Dostęp zdalny (RasMan) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Rejestr zdalny (RemoteRegistry) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Zdalne wywoływanie procedur (RPC) (RpcSs) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Logowanie pomocnicze (seclogon) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Zawiadomienie o zdarzeniu systemowym (SENS) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Zapora systemu Windows/Udostępnianie połączenia internetowego (SharedAccess) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Wykrywanie sprzętu powłoki (ShellHWDetection) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa przywracania systemu (srservice) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa odnajdywania SSDP (SSDPSRV) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Telefonia (TapiSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługi terminalowe (TermService) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Kompozycje (Themes) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Klient śledzenia łączy rozproszonych (TrkWks) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Host uniwersalnego urządzenia Plug and Play (upnphost) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa Czas systemu Windows (W32Time) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: WebClient - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Instrumentacja zarządzania Windows (winmgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa numeru seryjnego multimediów przenośnych (WmdmPmSN) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Rozszerzenia sterownika Instrumentacji zarządzania Windows (Wmi) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Centrum zabezpieczeń (wscsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Konfiguracja zerowej sieci bezprzewodowej (WZCSVC) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa dostarczania sieci (xmlprov) - Unknown owner - C:\windows\System32\svchost.exe (file missing) -- End of file - 14663 bytes [code][*][/code]

Dodano Dzisiaj, 12:09:

Kod: Zaznacz wszystko: ComboFix 08-12-07.04 - Ewelina 2008-12-09 11:09:04.5 - NTFSx86 Uruchomiony z: c:\documents and settings\Ewelina\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-09 do 2008-12-09 ))))))))))))))))))))))))))))))) . 2008-12-06 14:15 . 2008-12-06 14:15 <DIR> d-------- c:\program files\Bus Driver 2008-12-05 20:27 . 2008-12-05 20:27 <DIR> d-------- c:\program files\Sierra On-Line 2008-12-05 20:27 . 2008-12-05 20:27 173 --a------ c:\windows\SIERRA.INI 2008-12-05 20:26 . 2008-12-05 20:26 <DIR> d-------- c:\documents and settings\Luque\WINDOWS 2008-12-05 17:01 . 2008-12-05 17:01 <DIR> d-------- c:\windows\compro 2008-12-05 10:56 . 2008-12-05 10:56 <DIR> d-------- C:\rsit 2008-12-04 18:02 . 2008-12-05 10:36 <DIR> d-------- C:\fixwareout 2008-12-04 16:36 . 2008-12-04 16:36 <DIR> d-------- c:\program files\Trend Micro 2008-12-04 11:40 . 2008-12-04 11:40 76,560 --a------ c:\documents and settings\Wojciech Potcatchme.zip 2008-12-04 11:37 . 2008-12-04 11:37 <DIR> d-------- c:\windows\ERUNT 2008-12-04 11:29 . 2008-12-04 16:30 <DIR> d-------- C:\SDFix 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\program files\Avira 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Avira 2008-12-02 12:10 . 2008-12-02 12:10 <DIR> d-------- c:\documents and settings\Ewelina\Dane aplikacji\BearShare 2008-11-30 11:02 . 2008-11-30 11:02 <DIR> d--hs---- c:\windows\ftpcache 2008-11-26 14:17 . 2008-11-26 14:17 <DIR> d-------- c:\program files\Common Files\Futuremark Shared 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\documents and settings\Luque\SystemRequirementsLab 2008-11-24 06:39 . 2008-11-24 06:39 <DIR> d-------- c:\windows\system32\Futuremark 2008-11-24 06:39 . 2008-05-29 12:33 27,672 -ra------ c:\windows\system32\drivers\Entech.sys 2008-11-24 06:39 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys 2008-11-24 06:38 . 2008-11-24 06:38 <DIR> d-------- c:\program files\Futuremark 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\program files\Auslogics 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\Auslogics 2008-11-16 11:31 . 2008-11-16 11:31 <DIR> d-------- c:\program files\Apple Software Update 2008-11-15 12:49 . 2008-11-15 12:49 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\TigerPlayer 2008-11-09 17:32 . 2008-11-09 17:32 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\ipla 2008-11-09 11:46 . 2008-11-29 17:50 4,876 --a------ c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-09 10:16 --------- d-----w c:\program files\DNA 2008-12-09 10:16 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DNA 2008-12-09 10:10 --------- d-----w c:\program files\BitComet 2008-12-08 19:34 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Nowe Gadu-Gadu 2008-12-05 14:56 --------- d-----w c:\program files\Opera 2008-12-04 19:47 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Hamachi 2008-12-04 07:19 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\uTorrent 2008-12-03 16:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Hamachi 2008-12-02 06:55 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\ipla 2008-11-30 15:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Skype 2008-11-30 15:07 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\skypePM 2008-11-28 21:43 --------- d-----w c:\program files\Common Files\Adobe 2008-11-26 13:17 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-25 19:22 --------- d-----w c:\program files\NAPI-PROJEKT 2008-11-24 18:40 --------- d-----w c:\program files\Gadu-Gadu 2008-11-20 15:35 579,072 ----a-w c:\windows\system32\user32.DLL 2008-11-17 15:45 --------- d-----w c:\program files\Nowe Gadu-Gadu 2008-11-11 14:53 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Sports Interactive 2008-11-10 15:52 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Sports Interactive 2008-11-10 15:01 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\BearShare 2008-11-10 13:47 --------- d-----w c:\program files\Winamp 2008-11-08 14:13 --------- d-----w c:\program files\Google 2008-11-03 15:10 --------- d-----w c:\program files\Prawo Jazdy 2006 2008-11-02 19:12 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Sports Interactive 2008-11-02 19:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-11-02 19:03 --------- d-----w c:\program files\Sports Interactive 2008-11-02 10:18 --------- d-----w c:\program files\Live_TV 2008-10-31 17:35 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\BearShare 2008-10-29 21:13 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Skype 2008-10-29 20:05 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\skypePM 2008-10-28 21:44 1,982 ----a-w c:\windows\system32\ealregsnapshot1.reg 2008-10-28 21:44 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Leadertech 2008-10-27 18:59 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Canon 2008-10-22 17:07 --------- d-----w c:\program files\AbiSuite2 2008-10-22 08:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-10-21 10:36 --------- d-----w c:\program files\F-Secure Internet Security 2008-10-21 10:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\f-secure 2008-10-21 09:35 101,888 ----a-w c:\windows\system32\vwbtxu.dll 2008-10-20 17:42 --------- d-----w c:\program files\Hamachi 2008-10-20 17:41 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys 2008-10-16 17:53 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Nowe Gadu-Gadu 2008-10-16 09:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Skype 2008-10-16 08:27 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\skypePM 2008-10-15 12:09 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Leadertech 2008-10-15 11:22 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DAEMON Tools 2008-10-15 07:31 --------- d-----w c:\program files\Chemix 2008-10-15 06:26 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\DAEMON Tools 2008-10-14 20:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\F-Secure 2008-10-14 19:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Ahead 2008-10-14 19:34 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-14 19:33 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Leadertech 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-14 19:10 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\DAEMON Tools 2008-10-14 19:05 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-14 19:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\DAEMON Tools 2008-10-12 11:42 --------- d-----w c:\program files\Common Files\NSV 2008-10-11 17:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Trymedia 2008-10-09 15:47 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\F-Secure 2008-10-09 12:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\F-Secure 2008-10-09 12:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\fssg 2008-10-09 12:06 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\TigerPlayer 2008-09-30 13:20 4,608 ----a-w c:\windows\system32\w95inf32.dll 2008-09-30 13:20 2,272 ----a-w c:\windows\system32\w95inf16.dll . [color=red] c:\windows\system32\user32.dll ... jest zarażony !! [/color] 578,560 2005-03-02 18:21:08 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll 579,584 2007-03-08 15:51:57 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll 578,560 2004-08-03 22:44:14 c:\windows\$NtUninstallKB890859$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll.000 579,072 2008-11-20 15:35:35 c:\windows\system32\user32.DLL 579,072 2008-11-20 15:35:35 c:\windows\system32\dllcache\user32.dll ((((((((((((((((((((((((((((( snapshot_2008-12-04_17.12.44.00 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-03 21:08:00 60,288 ----a-w c:\windows\system32\drivers\drmk.sys + 2004-08-03 22:08:00 60,288 ----a-w c:\windows\system32\drivers\drmk.sys - 2004-08-03 21:15:22 140,928 ----a-w c:\windows\system32\drivers\ks.sys + 2004-08-03 22:15:22 140,928 ----a-w c:\windows\system32\drivers\ks.sys - 2004-08-03 21:08:04 48,640 ----a-w c:\windows\system32\drivers\stream.sys + 2004-08-03 22:08:04 48,640 ----a-w c:\windows\system32\drivers\stream.sys - 2004-08-03 22:44:02 4,096 ------w c:\windows\system32\ksuser.dll + 2004-08-03 23:44:02 4,096 ----a-w c:\windows\system32\ksuser.dll + 2004-08-30 05:50:00 43,128 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]015\DriverFiles\alcxnt.dll + 2004-08-30 05:50:00 209,656 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]015\DriverFiles\alcxnt.sys + 2004-08-30 05:50:00 43,128 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]016\DriverFiles\alcxnt.dll + 2004-08-30 05:50:00 209,656 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]016\DriverFiles\alcxnt.sys - 2004-08-03 22:54:52 23,552 ----a-w c:\windows\system32\wdmaud.drv + 2004-08-03 23:44:32 23,552 ----a-w c:\windows\system32\wdmaud.drv . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-12-03 2514744] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336] "ares"="c:\program files\Ares\Ares.exe" [2008-11-23 880640] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304] "QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-01 185896] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "RTHDCPL"="RTHDCPL.EXE" [2008-05-07 c:\windows\RTHDCPL.EXE] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "EditLevel"= 0 (0x0) "NoCommonGroups"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll "vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproRemote.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproRemote.lnk backup=c:\windows\pss\ComproRemote.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproScheduler.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproScheduler.lnk backup=c:\windows\pss\ComproScheduler.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproSchedulerDTV.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproSchedulerDTV.lnk backup=c:\windows\pss\ComproSchedulerDTV.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TweakYC.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TweakYC.lnk backup=c:\windows\pss\TweakYC.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] -ra------ 2005-11-28 06:52 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] -ra------ 2005-11-28 06:55 118784 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] -ra------ 2005-11-28 06:55 98304 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2007-01-08 21:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 13:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu] --a------ 2008-10-10 10:50 6500960 c:\program files\Nowe Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2007-03-14 20:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-09-29 16:57 21755688 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-09-01 16:42 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 17:43 69632 c:\windows\ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2008-05-07 14:39 16862208 c:\windows\RTHDCPL.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\EA Sports\\FIFA 08\\FIFA08.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\Program Files\\FIFA09.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2009 Demo\\fm.exe"= "c:\\Documents and Settings\\Piter\\Pulpit\\Skype.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Ares Destiny\\AresDestiny.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12475:TCP"= 12475:TCP:BitComet 12475 TCP "12475:UDP"= 12475:UDP:BitComet 12475 UDP "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "20950:TCP"= 20950:TCP:TORRENT "49438:TCP"= 49438:TCP:torrent "9433:TCP"= 9433:TCP:BitComet 9433 TCP "9433:UDP"= 9433:UDP:BitComet 9433 UDP . Zawartość folderu 'Zaplanowane zadania' 2008-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.atcomet.com/b/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm TCP: {516B060E-FEC8-4FC3-91CF-D8F34D0B0B03} = 80.85.224.2,80.85.224.50 O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd FireFox -: Profile - c:\documents and settings\Ewelina\Dane aplikacji\Mozilla\Firefox\Profiles\icsp1s7t.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin2.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin3.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin4.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin5.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin6.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin7.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-09 11:15:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe . ************************************************************************** . Czas ukończenia: 2008-12-09 11:17:25 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-09 10:17:23 ComboFix2.txt 2008-12-04 16:13:13 ComboFix3.txt 2008-12-04 09:34:16 Przed: 5 838 000 128 bajtów wolnych Po: 5,864,275,968 bajtów wolnych 291 --- E O F --- 2008-10-08 09:38:45 [code][*][/code]

Dodano Dzisiaj, 12:17:
Pole Wartość
ID płyty głównej 03/13/2007-I945-6A79TG0RC-00

System

Microsoft Windows XP
Professional
Wersja 2002
Dodatek Service Pack 2