Ciagl komunikaty o bledach i dziwny plik na pasku narzedzi

**Posty:** 8 · przez **zipi_15** 24 Sty 2009, 20:50

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - user 2009-01-24 19:40:28.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.568 [GMT 1:00] Uruchomiony z: d:\logi\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090123-0] *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-24 do 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-24 19:20 . 2009-01-24 19:20 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy) 2009-01-24 19:20 . 2009-01-24 19:20 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2009-01-24 19:20 . 2009-01-24 19:20 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2009-01-24 19:20 . 2009-01-24 19:20 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2009-01-24 19:05 . 2009-01-24 19:05 <DIR> d-------- c:\windows\system32\Plugins 2009-01-24 19:05 . 2009-01-24 19:05 <DIR> d-------- c:\windows\system32\ocr 2009-01-24 19:05 . 2009-01-24 19:05 <DIR> d-------- c:\windows\system32\Data 2009-01-24 19:05 . 2009-01-24 19:15 <DIR> d-------- c:\program files\temp 2009-01-20 16:01 . 2008-09-25 14:20 483,328 --a------ c:\windows\system32\actskn45.ocx 2009-01-15 00:40 . 2009-01-15 00:40 <DIR> d-------- c:\program files\Vuze 2009-01-15 00:40 . 2009-01-15 00:40 <DIR> d-------- c:\program files\AskBarDis 2009-01-15 00:40 . 2009-01-20 16:02 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Azureus 2009-01-15 00:40 . 2009-01-15 00:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Azureus . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-24 18:30 --------- d-----w c:\documents and settings\user\Dane aplikacji\Skype 2009-01-24 18:28 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-01-24 18:25 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-12-12 16:44 --------- d--h--w c:\program files\InstallShield Installation Information 2008-03-20 14:51 22,328 ----a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys 2007-01-03 07:36 1 ----a-w c:\documents and settings\user\SI.bin . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-12-09 18:40 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2008-01-15 6290944] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-03-30 25366056] "Gadu-Gadu"="d:\program files\Gadu-Gadu\gg.exe" [2007-05-10 2111176] "DAEMON Tools Pro Agent"="d:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-06-21 188416] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920] "avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "TWCU"="c:\program files\TP-LINK\TWCU\TWCU.exe" [2005-08-09 413696] "BearFlix"="d:\program files\BearFlix\bearflix.exe" [2006-08-25 3325952] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "ioCentre"="c:\genius\ioCentre\gTaskBar.exe" [2007-04-13 61440] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.EXE] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\user\Menu Start\Programy\Autostart\ nero.bat.lnk - c:\windows\system32\nero.bat [2008-11-20 180] winword.exe.lnk - c:\windows\system32\winword.exe [2008-10-16 1960448] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-05-30 113664] Microsoft Office.lnk - d:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] RtlWake.lnk - c:\program files\REALTEK Semiconductor Corp.\REALTEK RTL8180 Wireless LAN Driver and Utility\RtlWake.exe [2006-10-22 720896] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "d:\\Program Files\\flas_useros\\FlashFXP.v3.4.1.Build.1149.exe"= "d:\\gry\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"= "d:\\gry\\company of heroes\\RelicCOH.exe"= "d:\\gry\\company of heroes\\BugReport\\BugReport.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "d:\\Program Files\\BearFlix\\bearflix.exe"= "d:\\Program Files\\BearShare\\BearShare.exe"= "d:\\Program Files\\BitComet\\BitComet.exe"= "d:\\gry\\Test Drive Unlimited\\TestDriveUnlimited.exe"= "d:\\NAPI-PROJEKT\\napisy.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "d:\\gry\\BZFlag2.0.8\\bzfs.exe"= "d:\\gry\\BZFlag2.0.8\\bzflag.exe"= "d:\\gry\\Metin2_PL\\metin2.bin"= "d:\\Program Files\\BZFlag2.0.10\\bzflag.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\gry\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "d:\\gry\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"= "d:\\gry\\Rohan\\rohanclient.exe"= "d:\\gry\\Unreal Tournament 3\\Binaries\\UT3.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11230:TCP"= 11230:TCP:BitComet 11230 TCP "11230:UDP"= 11230:UDP:BitComet 11230 UDP "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-08 111184] R3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\drivers\gMouPS2.sys [2008-08-13 17408] R4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2009-01-15 464264] R4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-01-15 234888] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-08 20560] R4 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2006-10-22 8576] S3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\drivers\RTL8180.sys [2006-10-22 183680] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c6017c7d-e07f-11dd-8f48-00147871f937}] \Shell\Auto\command - J:\setup.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://10.1.1.1/ IE: Download all links using BitComet - d:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Download all videos using BitComet - d:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Download link using &BitComet - d:\program files\BitComet\BitComet.exe/AddLink.htm IE: E&ksport do programu Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\u6we8v16.default\ FF - prefs.js: browser.startup.homepage - hxxp://10.1.1.1/ FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: d:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-24 19:41:20 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-329068152-1614895754-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:9b,29,18,d1,e5,e5,0a,85,6c,7e,34,4c,0e,e7,39,55,af,43,dc,9e,c8,0c,00, f3,ba,16,9c,4b,18,f4,67,6c,b3,9e,ef,fb,61,29,72,a5,32,34,7d,1c,8c,b4,c0,16,\ "??"=hex:4b,86,b3,00,4a,ca,65,b2,1f,cc,1a,a3,5c,29,0a,fd . Czas ukończenia: 2009-01-24 19:42:40 ComboFix-quarantined-files.txt 2009-01-24 18:42:23 Przed: 1,964,785,664 bajtów wolnych Po: 2,056,630,272 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 168 --- E O F --- 2007-08-29 17:34:29

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:43:56, on 2009-01-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe D:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\REALTEK Semiconductor Corp\REALTEK RTL8180 Wireless LAN Driver and Utility\RtlWake.exe C:\WINDOWS\system32\winword.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\Program Files\AskBarDis\bar\bin\AskService.exe C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://10.1.1.1/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [TWCU] "C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui O4 - HKLM\..\Run: [BearFlix] "D:\Program Files\BearFlix\bearflix.exe" /pause O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: nero.bat.lnk = C:\WINDOWS\system32\nero.bat O4 - Startup: winword.exe.lnk = C:\WINDOWS\system32\winword.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: RtlWake.lnk = ? O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe -- End of file - 8561 bytes

znalazlem jakis program niby do rapida zeby szybciej sciagalo pliki jednak po zainstalowaniu go pojawily sie problemy na pasku narzedzi mam dziwny plik load! 0.48.13(jest spowodowany przez jakis plik winword) natomiast przy wlanczaniu kompa otwiera mi dos z napisem nero.bat na bardzo krotka chwile i pozniej pojawiaja sie komunikat o bledach na calym monitorze ktorego nie da si zamknac

**Posty:** 18165 · przez **wojtas** 25 Sty 2009, 12:06

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 5 · przez **pianiwo** 11 Mar 2009, 17:58

Witam serdecznie.... własnie szukam po necie co uczynic, bo tez mam taki sam problem - dokładnie ten sam.
CClinerem juz czyściłam, pobrałam HiJack i mam raport (czy jak to się zwie).... oto co wyszło...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:49:27, on 2009-03-11 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp3\winampa.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\vVX3000.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Program Files\Microsoft Office\Office\1045\OLFSNT40.EXE C:\WINDOWS\system32\winword.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\wpabaln.exe C:\Program Files\Java\jre6\bin\jucheck.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Właściciel\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: nero.bat.lnk = C:\WINDOWS\system32\nero.bat O4 - Startup: winword.exe.lnk = C:\WINDOWS\system32\winword.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1045\OLFSNT40.EXE O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5241 bytes

Co mam dalej zrobić?

Jestem początkująca w tych sprawach i nie wiem za bardzo co i jak.

Dodano Dzisiaj, 17:23:
I jeszcze raport z Combo Fix

Kod: Zaznacz wszystko: ComboFix 09-03-10.03 - Właściciel 2009-03-11 17:10:17.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1471.987 [GMT 1:00] Uruchomiony z: c:\documents and settings\Właściciel\Pulpit\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) FW: Kaspersky Internet Security *disabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\mdm.exe c:\windows\system32\Plugins c:\windows\system32\Plugins\Hoster\aCallbackMethods.dll c:\windows\system32\Plugins\Hoster\archivto.dll c:\windows\system32\Plugins\Hoster\bluehostto.dll c:\windows\system32\Plugins\Hoster\dataupde.dll c:\windows\system32\Plugins\Hoster\fastloadnet.dll c:\windows\system32\Plugins\Hoster\fastshareorg.dll c:\windows\system32\Plugins\Hoster\fileuploadnet.dll c:\windows\system32\Plugins\Hoster\megauploadcom.dll c:\windows\system32\Plugins\Hoster\meinuploadcom.dll c:\windows\system32\Plugins\Hoster\moosharede.dll c:\windows\system32\Plugins\Hoster\myvideode.dll c:\windows\system32\Plugins\Hoster\netloadin.dll c:\windows\system32\Plugins\Hoster\PluginSettings.ini c:\windows\system32\Plugins\Hoster\qsharecom.dll c:\windows\system32\Plugins\Hoster\rapidsharecom.dll c:\windows\system32\Plugins\Hoster\shareonlinebiz.dll c:\windows\system32\Plugins\Hoster\shareplacecom.dll c:\windows\system32\Plugins\Hoster\silofilescom.dll c:\windows\system32\Plugins\Hoster\speedysharecom.dll c:\windows\system32\Plugins\Hoster\uploadedto.dll c:\windows\system32\Plugins\Hoster\yourfilesbiz.dll c:\windows\system32\Plugins\Hoster\youtubecom.dll c:\windows\system32\Plugins\YouCrypt\callbackmethods.dll c:\windows\system32\Plugins\YouCrypt\captcha.dll c:\windows\system32\Plugins\YouCrypt\cineto.dll c:\windows\system32\Plugins\YouCrypt\datenbankorg.dll c:\windows\system32\Plugins\YouCrypt\datenschleuder.dll c:\windows\system32\Plugins\YouCrypt\ddlscene.dll c:\windows\system32\Plugins\YouCrypt\ddlwarez.dll c:\windows\system32\Plugins\YouCrypt\dreidl.dll c:\windows\system32\Plugins\YouCrypt\dxpdivxvidorg.dll c:\windows\system32\Plugins\YouCrypt\gameblog.dll c:\windows\system32\Plugins\YouCrypt\gamezam.dll c:\windows\system32\Plugins\YouCrypt\gapping.dll c:\windows\system32\Plugins\YouCrypt\gwarez.dll c:\windows\system32\Plugins\YouCrypt\linkbank.dll c:\windows\system32\Plugins\YouCrypt\linksafe.dll c:\windows\system32\Plugins\YouCrypt\LinkSave.dll c:\windows\system32\Plugins\YouCrypt\lix.dll c:\windows\system32\Plugins\YouCrypt\mirrorit.dll c:\windows\system32\Plugins\YouCrypt\netfolderin.dll c:\windows\system32\Plugins\YouCrypt\onekh.dll c:\windows\system32\Plugins\YouCrypt\rapidfolder.dll c:\windows\system32\Plugins\YouCrypt\rapidlayer.dll c:\windows\system32\Plugins\YouCrypt\rapidsafede.dll c:\windows\system32\Plugins\YouCrypt\rapidsafenet.dll c:\windows\system32\Plugins\YouCrypt\relinkus.dll c:\windows\system32\Plugins\YouCrypt\RScomLinkList.dll c:\windows\system32\Plugins\YouCrypt\rslayer.dll c:\windows\system32\Plugins\YouCrypt\saveraidrush.dll c:\windows\system32\Plugins\YouCrypt\secured.dll c:\windows\system32\Plugins\YouCrypt\securnet.dll c:\windows\system32\Plugins\YouCrypt\serienjunkies.dll c:\windows\system32\Plugins\YouCrypt\shareonall.dll c:\windows\system32\Plugins\YouCrypt\shareprotect.dll c:\windows\system32\Plugins\YouCrypt\stealth.dll c:\windows\system32\Plugins\YouCrypt\tinyurl.dll c:\windows\system32\Plugins\YouCrypt\UndergroundCMS.dll c:\windows\system32\Plugins\YouCrypt\uppicoasis.dll c:\windows\system32\Plugins\YouCrypt\urlcash.dll c:\windows\system32\Plugins\YouCrypt\usercashcom.dll c:\windows\system32\Plugins\YouCrypt\xlinkin.dll D:\Autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-11 do 2009-03-11 ))))))))))))))))))))))))))))))) . 2009-03-11 17:16 . 2009-03-11 17:16 <DIR> d-------- c:\windows\system32\Plugins 2009-03-11 13:01 . 2008-04-14 18:20 221,184 --a------ c:\windows\system32\wmpns.dll 2009-03-11 11:52 . 2009-03-11 11:52 <DIR> d-------- c:\windows\system32\pl-pl 2009-03-11 11:52 . 2009-03-11 11:52 <DIR> d-------- c:\windows\system32\pl 2009-03-11 11:52 . 2009-03-11 11:52 <DIR> d-------- c:\windows\system32\bits 2009-03-11 11:52 . 2009-03-11 11:52 <DIR> d-------- c:\windows\l2schemas 2009-03-11 11:50 . 2009-03-11 11:53 <DIR> d-------- c:\windows\ServicePackFiles 2009-03-11 11:38 . 2009-03-11 11:38 <DIR> d-------- c:\windows\EHome 2009-03-06 13:39 . 2009-03-06 13:40 <DIR> d-------- c:\program files\Gadu-Gadu 2009-03-04 15:28 . 2009-03-04 15:28 <DIR> d-------- c:\documents and settings\Właściciel\Dane aplikacji\Nowe Gadu-Gadu 2009-03-03 20:48 . 2009-03-03 20:48 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\FreshGames 2009-03-03 20:45 . 2009-03-03 20:45 <DIR> d-------- c:\windows\system32\ocr 2009-03-03 20:45 . 2009-03-03 20:45 <DIR> d-------- c:\windows\system32\Data 2009-03-03 20:45 . 2009-03-11 15:51 <DIR> d-------- c:\program files\temp 2009-03-03 20:44 . 2009-03-03 20:44 <DIR> d-------- c:\windows\Ranch Rush 2009-02-26 13:35 . 2009-02-26 13:51 259 --a------ c:\windows\Elf_v_3.iix . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-11 16:16 34,440,480 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-03-11 16:16 1,051,168 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-03-11 16:16 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\skypePM 2009-03-11 16:16 --------- d-----w c:\documents and settings\Właściciel\Dane aplikacji\Skype 2009-03-11 16:15 465,368 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-03-11 16:15 101,660 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-03-11 15:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-03-08 17:00 --------- d-----w c:\program files\Norton Security Scan 2009-03-06 17:01 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-02-10 12:59 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-06 17:26 --------- d-----w c:\program files\directx 2009-02-03 17:30 89,601 ----a-w c:\windows\system32\drivers\klick.dat 2009-02-03 17:30 101,287 ----a-w c:\windows\system32\drivers\klin.dat 2009-01-27 17:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Zylom 2009-01-12 21:30 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TEMP 1999-05-17 13:58 99,840 -c--a-w c:\program files\Common Files\IRAABOUT.DLL 1998-12-09 02:53 70,144 -c--a-w c:\program files\Common Files\IRAMDMTR.DLL 1998-12-09 02:53 48,640 -c--a-w c:\program files\Common Files\IRALPTTR.DLL 1998-12-09 02:53 31,744 -c--a-w c:\program files\Common Files\IRAWEBTR.DLL 1998-12-09 02:53 186,368 -c--a-w c:\program files\Common Files\IRAREG.DLL 1998-12-09 02:53 17,920 -c--a-w c:\program files\Common Files\IRASRIAL.DLL 2008-10-13 19:39 848 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688] "Google Update"="c:\documents and settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-11-13 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinampAgent"="c:\program files\Winamp3\winampa.exe" [2002-07-23 12288] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-13 7626752] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-13 86016] "VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-30 136600] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 218376] "RTHDCPL"="RTHDCPL.EXE" [2008-06-27 c:\windows\RTHDCPL.exe] "SoundMan"="SOUNDMAN.EXE" [2008-06-18 c:\windows\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2008-06-19 c:\windows\alcwzrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Waciciel\Menu Start\Programy\Autostart\ nero.bat.lnk - c:\windows\system32\nero.bat [2008-11-20 180] winword.exe.lnk - c:\windows\system32\winword.exe [2008-10-16 1960448] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1045\OLFSNT40.EXE [1999-05-17 46080] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-07-13 04:19 1519616 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\Właściciel\\Ustawienia lokalne\\Dane aplikacji\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Właściciel\\Ustawienia lokalne\\Dane aplikacji\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344] . Zawartość folderu 'Zaplanowane zadania' 2009-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-861567501-1229272821-725345543-1003.job - c:\documents and settings\WB [] 2009-03-08 c:\windows\Tasks\Norton Security Scan for Właściciel.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.interia.pl/ FF - ProfilePath - c:\documents and settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\vtfq0iiy.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.interia.pl/ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Real Alternative Real player\browser\plugins\nppl3260.dll FF - plugin: c:\program files\Real Alternative Real player\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-11 17:16:24 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1048) c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll c:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(1104) c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\rundll32.exe c:\documents and settings\Wc:\program files\Microsoft Office\Office\1045\OLFSNT40.EXE c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\wpabaln.exe . ************************************************************************** . Czas ukończenia: 2009-03-11 17:18:55 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-03-11 16:18:52 Przed: 1 003 966 464 bajtów wolnych Po: 1,008,955,392 bajtów wolnych 216 --- E O F --- 2009-03-11 10:59:38

Mam nadzieję, ze ktos mi pomoże !

Dodano Dzisiaj, 17:27:
Czekam.

**Posty:** 18165 · przez **wojtas** 11 Mar 2009, 22:40

pianiwo, zaloz swoj temat. opisz problem , wstaw logi