chamski trojan

**Posty:** 2042 · przez **Wojtaz** 03 Mar 2008, 20:02

Kumpel mi wysłał trojana, ma kontrolę nad kompem, nic nie działa, tzn CTRL+ALT+DELETE
Log z Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:59:48, on 2008-03-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\wt\updater\wcmdmgr.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Wojtaz\Pulpit\setup.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Wojtaz\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [V0230Mon.exe] F:\DRIVERS\English\V0230Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AntyVirus] C:\Windows\g-g.exe O4 - HKCU\..\Run: [gadu-gadu] C:\g.g.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: MySql - Unknown owner - D:\Program Files\Krasnal 2.6/MYSQL/bin/mysqld.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7039 bytes

Nic nie wykryłem, co mógłbym usunąć sam. ale pomóżcie mi

**Posty:** 8001 · przez **Okocza** 03 Mar 2008, 20:05

http://www.programosy.pl/program,windows-worms-doors-cleaner-1-4-1.html zamykasz porty (net bios może być żólty) i dajesz loga z combofixa dodatkowo.

**Posty:** 3854 · przez **Dzi@dek** 03 Mar 2008, 20:07

wojtaz13 napisał(a):Nic nie wykryłem, co mógłbym usunąć sam.

Robisz to co jest napisane w tym temacie:

http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

Zastosuj SDFix . Po pobraniu uruchom go - rozpakuje się do C:\SDFix.
Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w trybie awaryjnym uruchom plik

RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zrestartuje.

Później wejdź do folderu C:\SDFix i wrzuć zawartość pliku Report.txt + log z

Combofix-a oraz z Hijackthis

Autor postu otrzymał pochwałę

**Posty:** 2042 · przez **Wojtaz** 03 Mar 2008, 20:35

WWDC już miałem zrobione

Poszperałem, Menadżer Zadań odblokowałem, usunąłem plik g.g.exe oraz g-g.exe, czyli ten trojan.
Log z SDfix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.151 [/b] Run by Administrator on 2008-03-03 at 19:19 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-03 19:23:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40] "ujdew"=hex:20,02,00,00,a4,73,3d,fc,11,01,3f,39,34,48,c8,fc,83,d3,de,01,41,.. "ljej40"=hex:4b,19,55,81,8b,14,de,88,23,8f,c9,75,d0,d7,d9,e0,78,cd,3a,f7,d9,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120%" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil" "C:\\Program Files\\SightSpeed\\SightSpeed.exe"="C:\\Program Files\\SightSpeed\\SightSpeed.exe:*:Enabled:SightSpeed" "D:\\Program Files\\Skype\\Phone\\Skype.exe"="D:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 3 Mar 2008 792,619 ...H. --- "C:\WINDOWS\g-g.exe" Mon 3 Mar 2008 792,619 A..H. --- "C:\RECYCLER\S-1-5-21-1482476501-1644491937-839522115-1003\Dc89.exe" Fri 11 Jan 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" [b]Finished![/b]

Log z HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:27:28, on 2008-03-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\wt\updater\wcmdmgr.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Wojtaz\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [V0230Mon.exe] F:\DRIVERS\English\V0230Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 6650 bytes

Log z ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-03-03.15 - Wojtaz 2008-03-03 19:30:14.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.195 [GMT 1:00] Running from: C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-03 to 2008-03-03 ))))))))))))))))))))))))))))))) . 2008-03-03 19:18 . 2008-03-03 19:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-03 19:16 . 2008-03-03 19:25 <DIR> d-------- C:\SDFix 2008-02-29 15:30 . 2008-02-29 15:30 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Consultia 2008-02-28 15:26 . 2008-02-28 15:26 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\eSkiMoS R2 2008-02-26 13:52 . 2002-02-28 14:56 45,056 --a------ C:\WINDOWS\system32\wtcpl.cpl 2008-02-26 13:51 . 2008-03-03 19:25 <DIR> d-------- C:\WINDOWS\wt 2008-02-26 13:24 . 2006-02-17 21:34 58,288 -ra------ C:\WINDOWS\system32\drivers\k510bus.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510whnt.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510wh.sys 2008-02-23 09:22 . 2008-02-23 09:22 <DIR> d-------- C:\Program Files\MIKSOFT 2008-02-20 13:40 . 2008-03-03 15:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-20 13:40 . 2008-02-20 13:40 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-19 16:12 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-02-19 16:12 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-02-19 09:38 . 2008-02-19 09:38 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Apple Computer 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Program Files\Apple Software Update 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-02-18 15:12 . 2008-02-19 16:11 <DIR> d-------- C:\Program Files\Common Files\Real 2008-02-15 17:46 . 2008-02-15 17:46 <DIR> d-------- C:\Program Files\NokiaFREE Unlock Codes Calculator 2008-02-12 13:57 . 2008-02-12 13:57 <DIR> d-------- C:\Program Files\thriXXX 2008-02-05 15:33 . 2008-02-05 15:33 <DIR> d-------- C:\Program Files\MegauploadToolbar 2008-02-05 15:33 . 2008-02-28 22:53 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\MegauploadToolbar 2008-02-05 12:47 . 2008-02-05 12:47 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield Installation Information 2008-02-05 12:45 . 2008-02-05 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-02-04 22:10 . 2008-02-04 22:10 <DIR> d-------- C:\Program Files\gs 2008-02-04 22:10 . 2008-02-04 22:10 43 --a------ C:\WINDOWS\gswin32.ini 2008-02-04 21:53 . 2008-02-24 14:36 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\WordToPDF 2008-02-03 13:23 . 2008-02-03 13:23 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield 2008-02-03 13:22 . 2007-01-10 10:14 450,560 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2008-02-03 13:22 . 2005-06-17 10:26 114,688 --a------ C:\WINDOWS\system32\WLANUTL.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-02 20:26 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Skype 2008-03-02 19:35 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2008-03-02 19:10 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-02-19 08:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-02-04 13:23 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-03 12:23 --------- d-----w C:\Program Files\SAGEM 2008-02-02 07:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2008-01-27 15:51 --------- d-----w C:\Program Files\Common Files\DirectX 2008-01-27 15:51 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\THQ 2008-01-27 15:50 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-26 13:10 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\fltk.org 2008-01-22 08:16 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Teleca 2008-01-22 07:22 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Sony Ericsson 2008-01-22 07:20 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-01-22 07:19 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-20 15:42 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-01-20 12:12 --------- d-----w C:\Program Files\neostrada tp 2008-01-20 12:02 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-18 18:35 --------- d-----w C:\Program Files\Common Files\EZB Systems 2008-01-18 16:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-01-16 17:48 --------- d-----w C:\Program Files\Common Files\Ulead Systems 2008-01-16 17:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-01-16 14:44 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ulead Systems 2008-01-16 14:37 --------- d-----w C:\Program Files\Windows Media Components 2008-01-16 14:37 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-01-16 09:21 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AdobeUM 2008-01-14 15:13 --------- d-----w C:\Program Files\Microsoft Works 2008-01-14 15:12 --------- d-----w C:\Program Files\Microsoft.NET 2008-01-13 17:03 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AccurateRip 2008-01-11 12:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ahead 2008-01-11 11:39 --------- d-----w C:\Program Files\Media Player Classic 2008-01-11 11:39 --------- d-----w C:\Program Files\AviSynth 2.5 2008-01-11 08:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity 2008-01-09 12:40 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-01-07 14:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-01-07 12:22 --------- d-----w C:\Program Files\Creative 2008-01-06 19:08 --------- d-----w C:\Program Files\Java 2008-01-06 19:06 --------- d-----w C:\Program Files\Common Files\Java 2008-01-06 19:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Gadu-Gadu 2008-01-06 18:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-01-06 18:08 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Creative 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\muvee Technologies 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-01-06 16:42 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Media Player Classic 2008-01-06 16:40 --------- d-----w C:\Program Files\Common Files\muvee Technologies 2008-01-06 16:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies 2008-01-06 16:39 --------- d-----w C:\Program Files\SightSpeed 2008-01-06 16:12 --------- d-----w C:\Program Files\Common Files\Nero 2008-01-06 16:08 --------- d-----w C:\Program Files\Common Files\Ahead 2008-01-06 16:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-01-06 16:04 --------- d-----w C:\Program Files\Canon 2008-01-06 16:03 --------- d--h--w C:\Program Files\CanonBJ 2008-01-06 16:03 --------- d--h--w C:\Documents and Settings\All Users\Dane aplikacji\CanonBJ 2008-01-06 16:03 --------- d-----w C:\Program Files\Common Files\CANON 2008-01-06 15:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Light StartUp 2008-01-06 15:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-01-06 15:21 --------- d-----w C:\Program Files\Common Files\Skype 2008-01-06 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-01-06 15:19 --------- d-----w C:\Program Files\Winamp 2008-01-06 14:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Talkback 2008-01-06 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-01-06 14:28 --------- d-----w C:\Program Files\Analog Devices 2008-01-06 14:22 --------- d-----w C:\Program Files\AMD 2008-01-06 14:11 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-06 14:09 --------- d-----w C:\Program Files\Usługi online 2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 18:11 925696] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "V0230Mon.exe"="F:\DRIVERS\English\V0230Mon.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "wcmdmgr"="C:\WINDOWS\wt\updater\wcmdmgrl.exe" [2002-02-28 14:57 20480] "QuickTime Task"="D:\Program Files\QuickTime Alternative\qttask.exe" [2008-01-31 23:13 385024] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntyVirus] C:\Windows\g-g.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CubeDesktop] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gadu-gadu] C:\g.g.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --------- 2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-02-15 13:38 35328 D:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\SightSpeed\\SightSpeed.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25539:TCP"= 25539:TCP:BitComet 25539 TCP "25539:UDP"= 25539:UDP:BitComet 25539 UDP "11086:TCP"= 11086:TCP:BitComet 11086 TCP "11086:UDP"= 11086:UDP:BitComet 11086 UDP "21656:TCP"= 21656:TCP:BitComet 21656 TCP "21656:UDP"= 21656:UDP:BitComet 21656 UDP R3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 18:00] R3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-07-24 18:00] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] S3 gggen;Generic USB Flash Driver;C:\WINDOWS\system32\DRIVERS\gggen.sys [2006-09-28 13:10] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\DRIVERS\libusb0.sys [2007-09-19 10:02] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 10:14] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-02-23 08:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-03 19:31:16 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-03 19:31:45

Mam nadzieję, że wszystko dobrze sam sobie naprawiłem

**Posty:** 18165 · przez **wojtas** 03 Mar 2008, 20:55

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\g-g.exe
C:\RECYCLER\S-1-5-21-1482476501-1644491937-839522115-1003\Dc89.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntyVirus]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gadu-gadu]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 2042 · przez **Wojtaz** 03 Mar 2008, 21:18

Kod: Zaznacz wszystko: ComboFix 08-03-03.15 - Wojtaz 2008-03-03 20:16:47.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.104 [GMT 1:00] Running from: C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Wojtaz\Pulpit\cfscript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\RECYCLER\S-1-5-21-1482476501-1644491937-839522115-1003\Dc89.exe C:\WINDOWS\g-g.exe . ((((((((((((((((((((((((( Files Created from 2008-02-03 to 2008-03-03 ))))))))))))))))))))))))))))))) . 2008-03-03 19:18 . 2008-03-03 19:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-29 15:30 . 2008-02-29 15:30 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Consultia 2008-02-28 15:26 . 2008-02-28 15:26 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\eSkiMoS R2 2008-02-26 13:52 . 2002-02-28 14:56 45,056 --a------ C:\WINDOWS\system32\wtcpl.cpl 2008-02-26 13:51 . 2008-03-03 19:25 <DIR> d-------- C:\WINDOWS\wt 2008-02-26 13:24 . 2006-02-17 21:34 58,288 -ra------ C:\WINDOWS\system32\drivers\k510bus.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510whnt.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510wh.sys 2008-02-23 09:22 . 2008-02-23 09:22 <DIR> d-------- C:\Program Files\MIKSOFT 2008-02-20 13:40 . 2008-03-03 15:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-20 13:40 . 2008-02-20 13:40 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-19 16:12 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-02-19 16:12 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-02-19 09:38 . 2008-02-19 09:38 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Apple Computer 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Program Files\Apple Software Update 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-02-18 15:12 . 2008-02-19 16:11 <DIR> d-------- C:\Program Files\Common Files\Real 2008-02-15 17:46 . 2008-02-15 17:46 <DIR> d-------- C:\Program Files\NokiaFREE Unlock Codes Calculator 2008-02-12 13:57 . 2008-02-12 13:57 <DIR> d-------- C:\Program Files\thriXXX 2008-02-05 15:33 . 2008-02-05 15:33 <DIR> d-------- C:\Program Files\MegauploadToolbar 2008-02-05 15:33 . 2008-02-28 22:53 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\MegauploadToolbar 2008-02-05 12:47 . 2008-02-05 12:47 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield Installation Information 2008-02-05 12:45 . 2008-02-05 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-02-04 22:10 . 2008-02-04 22:10 <DIR> d-------- C:\Program Files\gs 2008-02-04 22:10 . 2008-02-04 22:10 43 --a------ C:\WINDOWS\gswin32.ini 2008-02-04 21:53 . 2008-02-24 14:36 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\WordToPDF 2008-02-03 13:23 . 2008-02-03 13:23 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield 2008-02-03 13:22 . 2007-01-10 10:14 450,560 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2008-02-03 13:22 . 2005-06-17 10:26 114,688 --a------ C:\WINDOWS\system32\WLANUTL.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-02 20:26 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Skype 2008-03-02 19:35 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2008-03-02 19:10 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-02-19 08:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-02-04 13:23 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-03 12:23 --------- d-----w C:\Program Files\SAGEM 2008-02-02 07:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2008-01-27 15:51 --------- d-----w C:\Program Files\Common Files\DirectX 2008-01-27 15:51 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\THQ 2008-01-27 15:50 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-26 13:10 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\fltk.org 2008-01-22 08:16 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Teleca 2008-01-22 07:22 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Sony Ericsson 2008-01-22 07:20 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-01-22 07:19 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-20 15:42 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-01-20 12:12 --------- d-----w C:\Program Files\neostrada tp 2008-01-20 12:02 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-18 18:35 --------- d-----w C:\Program Files\Common Files\EZB Systems 2008-01-18 16:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-01-16 17:48 --------- d-----w C:\Program Files\Common Files\Ulead Systems 2008-01-16 17:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-01-16 14:44 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ulead Systems 2008-01-16 14:37 --------- d-----w C:\Program Files\Windows Media Components 2008-01-16 14:37 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-01-16 09:21 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AdobeUM 2008-01-14 15:13 --------- d-----w C:\Program Files\Microsoft Works 2008-01-14 15:12 --------- d-----w C:\Program Files\Microsoft.NET 2008-01-13 17:03 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AccurateRip 2008-01-11 12:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ahead 2008-01-11 11:39 --------- d-----w C:\Program Files\Media Player Classic 2008-01-11 11:39 --------- d-----w C:\Program Files\AviSynth 2.5 2008-01-11 08:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity 2008-01-09 12:40 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-01-07 14:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-01-07 12:22 --------- d-----w C:\Program Files\Creative 2008-01-06 19:08 --------- d-----w C:\Program Files\Java 2008-01-06 19:06 --------- d-----w C:\Program Files\Common Files\Java 2008-01-06 19:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Gadu-Gadu 2008-01-06 18:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-01-06 18:08 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Creative 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\muvee Technologies 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-01-06 16:42 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Media Player Classic 2008-01-06 16:40 --------- d-----w C:\Program Files\Common Files\muvee Technologies 2008-01-06 16:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies 2008-01-06 16:39 --------- d-----w C:\Program Files\SightSpeed 2008-01-06 16:12 --------- d-----w C:\Program Files\Common Files\Nero 2008-01-06 16:08 --------- d-----w C:\Program Files\Common Files\Ahead 2008-01-06 16:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-01-06 16:04 --------- d-----w C:\Program Files\Canon 2008-01-06 16:03 --------- d--h--w C:\Program Files\CanonBJ 2008-01-06 16:03 --------- d--h--w C:\Documents and Settings\All Users\Dane aplikacji\CanonBJ 2008-01-06 16:03 --------- d-----w C:\Program Files\Common Files\CANON 2008-01-06 15:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Light StartUp 2008-01-06 15:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-01-06 15:21 --------- d-----w C:\Program Files\Common Files\Skype 2008-01-06 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-01-06 15:19 --------- d-----w C:\Program Files\Winamp 2008-01-06 14:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Talkback 2008-01-06 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-01-06 14:28 --------- d-----w C:\Program Files\Analog Devices 2008-01-06 14:22 --------- d-----w C:\Program Files\AMD 2008-01-06 14:11 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-06 14:09 --------- d-----w C:\Program Files\Usługi online 2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 18:11 925696] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "V0230Mon.exe"="F:\DRIVERS\English\V0230Mon.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "wcmdmgr"="C:\WINDOWS\wt\updater\wcmdmgrl.exe" [2002-02-28 14:57 20480] "QuickTime Task"="D:\Program Files\QuickTime Alternative\qttask.exe" [2008-01-31 23:13 385024] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CubeDesktop] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --------- 2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-02-15 13:38 35328 D:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\SightSpeed\\SightSpeed.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25539:TCP"= 25539:TCP:BitComet 25539 TCP "25539:UDP"= 25539:UDP:BitComet 25539 UDP "11086:TCP"= 11086:TCP:BitComet 11086 TCP "11086:UDP"= 11086:UDP:BitComet 11086 UDP "21656:TCP"= 21656:TCP:BitComet 21656 TCP "21656:UDP"= 21656:UDP:BitComet 21656 UDP R3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 18:00] R3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-07-24 18:00] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] S3 gggen;Generic USB Flash Driver;C:\WINDOWS\system32\DRIVERS\gggen.sys [2006-09-28 13:10] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\DRIVERS\libusb0.sys [2007-09-19 10:02] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 10:14] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-02-23 08:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-03 20:17:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-03 20:18:20

Takie coś mi wyskoczyło

**Posty:** 18165 · przez **wojtas** 03 Mar 2008, 21:34

czysto

Autor postu otrzymał pochwałę

**Posty:** 2042 · przez **Wojtaz** 04 Mar 2008, 16:20

Aha, fajnie, że

Kod: Zaznacz wszystko: czysto

jak on mi wysyła teraz logi z Hijack moje :!:

i miałem tam KeyLoggera :twisted:

**Posty:** 18165 · przez **wojtas** 05 Mar 2008, 22:36

daj nowe logi

**Posty:** 2042 · przez **Wojtaz** 05 Mar 2008, 23:37

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:26:33, on 2008-03-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\wt\updater\wcmdmgr.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Wojtaz\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [V0230Mon.exe] F:\DRIVERS\English\V0230Mon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{FA72B162-731E-4F52-836A-BC3F486FDAD5}: NameServer = 192.168.1.1,192.168.1.13 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7030 bytes

Sillent Runers:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 56, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMAXPnP" = "C:\Program Files\Analog Devices\Core\smax4pnp.exe" ["Analog Devices, Inc."] "SoundMAX" = ""C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray" ["Analog Devices, Inc."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "RemoteControl" = ""D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "V0230Mon.exe" = "F:\DRIVERS\English\V0230Mon.exe" [file not found] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] "avast!" = "D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "wcmdmgr" = "C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch" ["WildTangent, Inc."] "QuickTime Task" = ""D:\Program Files\QuickTime Alternative\qttask.exe" -atboottime" ["Apple Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll" ["BitComet"] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "D:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\OLKFSTUB.DLL" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "D:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{DBD8E168-244D-448C-9922-25508950D1DC}" = "Ulead UDF Driver" -> {HKLM...CLSID} = "USIShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ulead Systems\DVD\USIShex.dll" ["Ulead Systems, Inc."] "{AD392E40-428C-459F-961E-9B147782D099}" = "UltraISO" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "D:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager" -> {HKLM...CLSID} = "Sony Ericsson File Manager" \InProcServer32\(Default) = "D:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"] "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" = "Wyślij na Fotosik.pl" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "D:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] "{4C8174AB-181C-433D-87D4-842190BB25AD}" = "HexShell" -> {HKLM...CLSID} = "HexShell" \InProcServer32\(Default) = "D:\Program Files\Hexprobe\HexShell.dll" ["Hexprobe System"] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "D:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HexShell\(Default) = "{4C8174AB-181C-433D-87D4-842190BB25AD}" -> {HKLM...CLSID} = "HexShell" \InProcServer32\(Default) = "D:\Program Files\Hexprobe\HexShell.dll" ["Hexprobe System"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ UltraISO\(Default) = "{AD392E40-428C-459F-961E-9B147782D099}" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "D:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] {D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}\(Default) = "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "D:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "D:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] UltraISO\(Default) = "{AD392E40-428C-459F-961E-9B147782D099}" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "D:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Wojtaz" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader Speed Launch" -> shortcut to: "D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "BlueSoleil" -> shortcut to: "D:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" ["IVT Corporation"] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MEGAUPLOAD "] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D18A0B52-D63C-4ED0-AFC6-C1E3DC1AF43A}\ "ButtonText" = "BitComet" "Script" = "res://D:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206" ["BitComet"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\ <<H>> "Tabs" = "C:\Documents and Settings\Wojtaz\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html" [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""D:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] BlueSoleil Hid Service, BlueSoleil Hid Service, "D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data] Capture Device Service, Capture Device Service, ""C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe"" ["InterVideo Inc."] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind iSCSI Service, StarWindService, "D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Ulead Burning Helper, UleadBurningHelper, "C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe" ["Ulead Systems, Inc."] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor iP1800 series\Driver = "CNMLM8O.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2008-03-05 22:27:03) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 160 seconds. ---------- (total run time: 216 seconds)

ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-03-05.1 - Wojtaz 2008-03-05 22:34:37.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.132 [GMT 1:00] Running from: C:\Documents and Settings\Wojtaz\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-05 to 2008-03-05 ))))))))))))))))))))))))))))))) . 2008-03-05 22:33 . 2008-03-05 22:33 <DIR> d-------- C:\SDFix 2008-03-04 17:14 . 2008-03-05 07:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-04 17:14 . 2008-03-04 17:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-04 14:16 . 2008-03-04 14:16 <DIR> d-------- C:\WINDOWS\system32\pl-PL 2008-03-04 14:15 . 2008-03-04 14:15 <DIR> d-------- C:\Program Files\MSBuild 2008-03-04 14:10 . 2008-03-04 14:16 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-03-04 14:10 . 2008-03-04 14:10 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-03-04 14:09 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-03-04 14:06 . 2008-03-04 14:06 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-03-04 12:41 . 2004-10-12 14:40 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll 2008-03-04 12:41 . 2004-10-12 14:46 1,761,280 --a------ C:\WINDOWS\system32\ffdshow.ax 2008-03-04 12:41 . 2004-10-05 16:16 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll 2008-03-04 12:41 . 2003-03-30 20:08 372,736 --a------ C:\WINDOWS\system32\xvid.ax 2008-03-04 12:41 . 2004-10-12 14:42 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll 2008-03-04 12:41 . 2004-10-04 01:50 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll 2008-03-04 12:41 . 2004-09-10 13:50 34,820 --a------ C:\WINDOWS\system32\ffdshow.reg 2008-03-04 12:16 . 2008-03-04 12:16 <DIR> d-------- C:\Program Files\Live_TV 2008-03-04 12:09 . 2008-03-04 12:09 <DIR> d-------- C:\temp 2008-03-04 12:01 . 2008-03-04 12:01 287 --a------ C:\WINDOWS\game.ini 2008-03-03 21:26 . 1994-06-10 04:02 219,648 --a------ C:\WINDOWS\system\BC402RTL.DLL 2008-03-03 21:26 . 1994-04-20 08:48 157,472 --a------ C:\WINDOWS\system\BWCC.DLL 2008-03-03 21:26 . 1995-02-21 14:16 16,896 --a------ C:\WINDOWS\system\TMMETER.DLL 2008-03-03 19:18 . 2008-03-03 19:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-29 15:30 . 2008-02-29 15:30 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Consultia 2008-02-28 15:26 . 2008-02-28 15:26 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\eSkiMoS R2 2008-02-26 13:52 . 2002-02-28 14:56 45,056 --a------ C:\WINDOWS\system32\wtcpl.cpl 2008-02-26 13:51 . 2008-03-05 15:43 <DIR> d-------- C:\WINDOWS\wt 2008-02-26 13:24 . 2006-02-17 21:34 58,288 -ra------ C:\WINDOWS\system32\drivers\k510bus.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510whnt.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510wh.sys 2008-02-23 09:22 . 2008-02-23 09:22 <DIR> d-------- C:\Program Files\MIKSOFT 2008-02-19 16:12 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-02-19 16:12 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-02-19 09:38 . 2008-02-19 09:38 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Apple Computer 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Program Files\Apple Software Update 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-02-18 15:12 . 2008-02-19 16:11 <DIR> d-------- C:\Program Files\Common Files\Real 2008-02-15 17:46 . 2008-02-15 17:46 <DIR> d-------- C:\Program Files\NokiaFREE Unlock Codes Calculator 2008-02-12 13:57 . 2008-02-12 13:57 <DIR> d-------- C:\Program Files\thriXXX 2008-02-05 15:33 . 2008-02-05 15:33 <DIR> d-------- C:\Program Files\MegauploadToolbar 2008-02-05 15:33 . 2008-03-05 16:06 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\MegauploadToolbar 2008-02-05 12:47 . 2008-02-05 12:47 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield Installation Information 2008-02-05 12:45 . 2008-02-05 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-05 17:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Skype 2008-03-05 15:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2008-03-04 19:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-02 19:10 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-02-24 13:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\WordToPDF 2008-02-19 08:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-02-04 21:10 --------- d-----w C:\Program Files\gs 2008-02-03 12:23 --------- d-----w C:\Program Files\SAGEM 2008-02-03 12:23 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield 2008-02-02 07:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2008-01-27 15:51 --------- d-----w C:\Program Files\Common Files\DirectX 2008-01-27 15:51 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\THQ 2008-01-27 15:50 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-26 13:10 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\fltk.org 2008-01-22 08:16 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Teleca 2008-01-22 07:22 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Sony Ericsson 2008-01-22 07:20 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-01-22 07:19 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-20 15:42 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-01-20 12:12 --------- d-----w C:\Program Files\neostrada tp 2008-01-20 12:02 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-18 18:35 --------- d-----w C:\Program Files\Common Files\EZB Systems 2008-01-18 16:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-01-16 17:48 --------- d-----w C:\Program Files\Common Files\Ulead Systems 2008-01-16 17:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-01-16 14:44 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ulead Systems 2008-01-16 14:37 --------- d-----w C:\Program Files\Windows Media Components 2008-01-16 14:37 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-01-16 09:21 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AdobeUM 2008-01-14 15:13 --------- d-----w C:\Program Files\Microsoft Works 2008-01-14 15:12 --------- d-----w C:\Program Files\Microsoft.NET 2008-01-13 17:03 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AccurateRip 2008-01-11 12:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ahead 2008-01-11 11:39 --------- d-----w C:\Program Files\Media Player Classic 2008-01-11 11:39 --------- d-----w C:\Program Files\AviSynth 2.5 2008-01-11 08:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity 2008-01-09 12:40 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-01-07 14:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-01-07 12:22 --------- d-----w C:\Program Files\Creative 2008-01-06 19:08 --------- d-----w C:\Program Files\Java 2008-01-06 19:06 --------- d-----w C:\Program Files\Common Files\Java 2008-01-06 19:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Gadu-Gadu 2008-01-06 18:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-01-06 18:08 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Creative 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\muvee Technologies 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-01-06 16:42 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Media Player Classic 2008-01-06 16:40 --------- d-----w C:\Program Files\Common Files\muvee Technologies 2008-01-06 16:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies 2008-01-06 16:39 --------- d-----w C:\Program Files\SightSpeed 2008-01-06 16:12 --------- d-----w C:\Program Files\Common Files\Nero 2008-01-06 16:08 --------- d-----w C:\Program Files\Common Files\Ahead 2008-01-06 16:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-01-06 16:04 --------- d-----w C:\Program Files\Canon 2008-01-06 16:03 --------- d--h--w C:\Program Files\CanonBJ 2008-01-06 16:03 --------- d--h--w C:\Documents and Settings\All Users\Dane aplikacji\CanonBJ 2008-01-06 16:03 --------- d-----w C:\Program Files\Common Files\CANON 2008-01-06 15:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Light StartUp 2008-01-06 15:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-01-06 15:21 --------- d-----w C:\Program Files\Common Files\Skype 2008-01-06 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-01-06 15:19 --------- d-----w C:\Program Files\Winamp 2008-01-06 14:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Talkback 2008-01-06 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-01-06 14:28 --------- d-----w C:\Program Files\Analog Devices 2008-01-06 14:22 --------- d-----w C:\Program Files\AMD 2008-01-06 14:11 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-06 14:09 --------- d-----w C:\Program Files\Usługi online 2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 18:11 925696] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "V0230Mon.exe"="F:\DRIVERS\English\V0230Mon.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "wcmdmgr"="C:\WINDOWS\wt\updater\wcmdmgrl.exe" [2002-02-28 14:57 20480] "QuickTime Task"="D:\Program Files\QuickTime Alternative\qttask.exe" [2008-01-31 23:13 385024] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CubeDesktop] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --------- 2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-02-15 13:38 35328 D:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\SightSpeed\\SightSpeed.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25539:TCP"= 25539:TCP:BitComet 25539 TCP "25539:UDP"= 25539:UDP:BitComet 25539 UDP "11086:TCP"= 11086:TCP:BitComet 11086 TCP "11086:UDP"= 11086:UDP:BitComet 11086 UDP "21656:TCP"= 21656:TCP:BitComet 21656 TCP "21656:UDP"= 21656:UDP:BitComet 21656 UDP "12345:TCP"= 12345:TCP:BitComet 12345 TCP "12345:UDP"= 12345:UDP:BitComet 12345 UDP "19220:TCP"= 19220:TCP:BitComet 19220 TCP "19220:UDP"= 19220:UDP:BitComet 19220 UDP "32459:TCP"= 32459:TCP:BitComet 32459 TCP "32459:UDP"= 32459:UDP:BitComet 32459 UDP "11111:TCP"= 11111:TCP:BitComet 11111 TCP "11111:UDP"= 11111:UDP:BitComet 11111 UDP R3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 18:00] R3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-07-24 18:00] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] S3 gggen;Generic USB Flash Driver;C:\WINDOWS\system32\DRIVERS\gggen.sys [2006-09-28 13:10] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\DRIVERS\libusb0.sys [2007-09-19 10:02] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 10:14] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-02-23 08:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-05 22:36:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] "ImagePath"="D:\Program Files\Krasnal 2.6/MYSQL/bin/mysqld.exe" . Completion time: 2008-03-05 22:36:39

Jak potrzebne, to jutro dam z SDFix

**Posty:** 3854 · przez **Dzi@dek** 06 Mar 2008, 14:29

Wklej do notatnika:

File::
C:\WINDOWS\system\TMMETER.DLL

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix

**Posty:** 2042 · przez **Wojtaz** 06 Mar 2008, 16:25

Kod: Zaznacz wszystko: ComboFix 08-03-05.1 - Wojtaz 2008-03-06 15:23:55.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.152 [GMT 1:00] Running from: D:\Program Files\ComboFix.exe Command switches used :: D:\Program Files\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system\TMMETER.DLL . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system\TMMETER.DLL . ((((((((((((((((((((((((( Files Created from 2008-02-06 to 2008-03-06 ))))))))))))))))))))))))))))))) . 2008-03-04 17:14 . 2008-03-05 07:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-04 17:14 . 2008-03-04 17:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-04 14:16 . 2008-03-04 14:16 <DIR> d-------- C:\WINDOWS\system32\pl-PL 2008-03-04 14:15 . 2008-03-04 14:15 <DIR> d-------- C:\Program Files\MSBuild 2008-03-04 14:10 . 2008-03-04 14:16 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-03-04 14:10 . 2008-03-04 14:10 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-03-04 14:09 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-03-04 14:06 . 2008-03-04 14:06 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-03-04 12:41 . 2004-10-12 14:40 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll 2008-03-04 12:41 . 2004-10-12 14:46 1,761,280 --a------ C:\WINDOWS\system32\ffdshow.ax 2008-03-04 12:41 . 2004-10-05 16:16 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll 2008-03-04 12:41 . 2003-03-30 20:08 372,736 --a------ C:\WINDOWS\system32\xvid.ax 2008-03-04 12:41 . 2004-10-12 14:42 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll 2008-03-04 12:41 . 2004-10-04 01:50 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll 2008-03-04 12:41 . 2004-09-10 13:50 34,820 --a------ C:\WINDOWS\system32\ffdshow.reg 2008-03-04 12:16 . 2008-03-04 12:16 <DIR> d-------- C:\Program Files\Live_TV 2008-03-04 12:01 . 2008-03-04 12:01 287 --a------ C:\WINDOWS\game.ini 2008-03-03 21:26 . 1994-06-10 04:02 219,648 --a------ C:\WINDOWS\system\BC402RTL.DLL 2008-03-03 21:26 . 1994-04-20 08:48 157,472 --a------ C:\WINDOWS\system\BWCC.DLL 2008-03-03 19:18 . 2008-03-03 19:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-29 15:30 . 2008-02-29 15:30 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Consultia 2008-02-28 15:26 . 2008-02-28 15:26 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\eSkiMoS R2 2008-02-26 13:52 . 2002-02-28 14:56 45,056 --a------ C:\WINDOWS\system32\wtcpl.cpl 2008-02-26 13:51 . 2008-03-06 15:06 <DIR> d-------- C:\WINDOWS\wt 2008-02-26 13:24 . 2006-02-17 21:34 58,288 -ra------ C:\WINDOWS\system32\drivers\k510bus.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510whnt.sys 2008-02-26 13:24 . 2006-02-17 21:34 5,808 -ra------ C:\WINDOWS\system32\drivers\k510wh.sys 2008-02-23 09:22 . 2008-02-23 09:22 <DIR> d-------- C:\Program Files\MIKSOFT 2008-02-19 16:12 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-02-19 16:12 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-02-19 09:38 . 2008-02-19 09:38 <DIR> d-------- C:\Documents and Settings\Wojtaz\Dane aplikacji\Apple Computer 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Program Files\Apple Software Update 2008-02-19 09:35 . 2008-02-19 09:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-02-18 15:12 . 2008-02-19 16:11 <DIR> d-------- C:\Program Files\Common Files\Real 2008-02-15 17:46 . 2008-02-15 17:46 <DIR> d-------- C:\Program Files\NokiaFREE Unlock Codes Calculator 2008-02-12 13:57 . 2008-02-12 13:57 <DIR> d-------- C:\Program Files\thriXXX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-05 17:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Skype 2008-03-05 15:06 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\MegauploadToolbar 2008-03-05 15:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\skypePM 2008-03-04 19:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-02 19:10 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-02-24 13:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\WordToPDF 2008-02-19 08:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-02-05 14:33 --------- d-----w C:\Program Files\MegauploadToolbar 2008-02-05 11:47 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield Installation Information 2008-02-05 11:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-02-04 21:10 --------- d-----w C:\Program Files\gs 2008-02-03 12:23 --------- d-----w C:\Program Files\SAGEM 2008-02-03 12:23 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\InstallShield 2008-02-02 07:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2008-01-27 15:51 --------- d-----w C:\Program Files\Common Files\DirectX 2008-01-27 15:51 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\THQ 2008-01-27 15:50 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-26 13:10 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\fltk.org 2008-01-22 08:16 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Teleca 2008-01-22 07:22 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Sony Ericsson 2008-01-22 07:20 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2008-01-22 07:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-01-22 07:19 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-20 15:42 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-01-20 12:12 --------- d-----w C:\Program Files\neostrada tp 2008-01-20 12:02 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-18 18:35 --------- d-----w C:\Program Files\Common Files\EZB Systems 2008-01-18 16:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-01-16 17:48 --------- d-----w C:\Program Files\Common Files\Ulead Systems 2008-01-16 17:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-01-16 14:44 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ulead Systems 2008-01-16 14:37 --------- d-----w C:\Program Files\Windows Media Components 2008-01-16 14:37 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-01-16 09:21 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AdobeUM 2008-01-14 15:13 --------- d-----w C:\Program Files\Microsoft Works 2008-01-14 15:12 --------- d-----w C:\Program Files\Microsoft.NET 2008-01-13 17:03 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\AccurateRip 2008-01-11 12:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Ahead 2008-01-11 11:39 --------- d-----w C:\Program Files\Media Player Classic 2008-01-11 11:39 --------- d-----w C:\Program Files\AviSynth 2.5 2008-01-11 08:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity 2008-01-09 12:40 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-01-07 14:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-01-07 12:22 --------- d-----w C:\Program Files\Creative 2008-01-06 19:08 --------- d-----w C:\Program Files\Java 2008-01-06 19:06 --------- d-----w C:\Program Files\Common Files\Java 2008-01-06 19:04 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Gadu-Gadu 2008-01-06 18:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-01-06 18:08 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Creative 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\muvee Technologies 2008-01-06 18:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-01-06 16:42 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Media Player Classic 2008-01-06 16:40 --------- d-----w C:\Program Files\Common Files\muvee Technologies 2008-01-06 16:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies 2008-01-06 16:39 --------- d-----w C:\Program Files\SightSpeed 2008-01-06 16:12 --------- d-----w C:\Program Files\Common Files\Nero 2008-01-06 16:08 --------- d-----w C:\Program Files\Common Files\Ahead 2008-01-06 16:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-01-06 16:04 --------- d-----w C:\Program Files\Canon 2008-01-06 16:03 --------- d--h--w C:\Program Files\CanonBJ 2008-01-06 16:03 --------- d--h--w C:\Documents and Settings\All Users\Dane aplikacji\CanonBJ 2008-01-06 16:03 --------- d-----w C:\Program Files\Common Files\CANON 2008-01-06 15:36 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Light StartUp 2008-01-06 15:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth 2008-01-06 15:21 --------- d-----w C:\Program Files\Common Files\Skype 2008-01-06 15:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-01-06 15:19 --------- d-----w C:\Program Files\Winamp 2008-01-06 14:53 --------- d-----w C:\Documents and Settings\Wojtaz\Dane aplikacji\Talkback 2008-01-06 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-01-06 14:28 --------- d-----w C:\Program Files\Analog Devices 2008-01-06 14:22 --------- d-----w C:\Program Files\AMD 2008-01-06 14:11 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-06 14:09 --------- d-----w C:\Program Files\Usługi online 2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 18:11 925696] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "V0230Mon.exe"="F:\DRIVERS\English\V0230Mon.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "wcmdmgr"="C:\WINDOWS\wt\updater\wcmdmgrl.exe" [2002-02-28 14:57 20480] "QuickTime Task"="D:\Program Files\QuickTime Alternative\qttask.exe" [2008-01-31 23:13 385024] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CubeDesktop] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --------- 2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-02-15 13:38 35328 D:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\SightSpeed\\SightSpeed.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25539:TCP"= 25539:TCP:BitComet 25539 TCP "25539:UDP"= 25539:UDP:BitComet 25539 UDP "11086:TCP"= 11086:TCP:BitComet 11086 TCP "11086:UDP"= 11086:UDP:BitComet 11086 UDP "21656:TCP"= 21656:TCP:BitComet 21656 TCP "21656:UDP"= 21656:UDP:BitComet 21656 UDP "12345:TCP"= 12345:TCP:BitComet 12345 TCP "12345:UDP"= 12345:UDP:BitComet 12345 UDP "19220:TCP"= 19220:TCP:BitComet 19220 TCP "19220:UDP"= 19220:UDP:BitComet 19220 UDP "32459:TCP"= 32459:TCP:BitComet 32459 TCP "32459:UDP"= 32459:UDP:BitComet 32459 UDP "11111:TCP"= 11111:TCP:BitComet 11111 TCP "11111:UDP"= 11111:UDP:BitComet 11111 UDP R3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 18:00] R3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-07-24 18:00] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] S3 gggen;Generic USB Flash Driver;C:\WINDOWS\system32\DRIVERS\gggen.sys [2006-09-28 13:10] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\DRIVERS\libusb0.sys [2007-09-19 10:02] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 10:14] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-02-23 08:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-06 15:25:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] "ImagePath"="D:\Program Files\Krasnal 2.6/MYSQL/bin/mysqld.exe" . Completion time: 2008-03-06 15:25:31 ComboFix-quarantined-files.txt 2008-03-06 14:25:23

Coś jeszcze?

**Posty:** 18165 · przez **wojtas** 06 Mar 2008, 20:30

wydaj sie byc czysto

**Posty:** 2042 · przez **Wojtaz** 06 Mar 2008, 21:28

Kod: Zaznacz wszystko: wydaj sie byc czysto

No dobra, jak co, to na PM Ci wyślę, żebyś temat odblokował, jak na razie go zamknij

Nie wiem co jeszcze ten gościu wymyśli...

**Posty:** 3854 · przez **Dzi@dek** 07 Mar 2008, 11:14

wojtaz13 napisał(a):Nie wiem co jeszcze ten gościu wymyśli.

Lepiej żebyś Ty myślał przed kliknięciem myszka w jakiś link lub program niewiadomego pochodzenia.

chamski trojan

chamski trojan

Kto jest na forum