Dysk d - otwórz przez?

**Posty:** 188 · przez **czesieK** 26 Lis 2008, 15:05

Witam kiedy próbuje wejść na dysk D wyskakuje mi okno "Otwórz za pomocą" i lista programów. Co zrobić aby to nie wyskakiwało i można było wejść normalnie na Dysk D:?
Dodam, że zanim to wyskakiwało Avast poinformował mnie o trojanie na owym dysku.

**Posty:** 591 · przez **Gazprom** 26 Lis 2008, 15:07

Daj logi z HiJackThis i Combofix do działu Bezpieczeństwo.

**Posty:** 188 · przez **czesieK** 26 Lis 2008, 15:25

Dodam jeszcze, że Avast informował mnie o znalezieniu wirusów po instalacji Daemon Tools i sterowników drukarki.
Gazprom, jesteśmy w tym dziale

ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-11-26.03 - user 2008-11-26 14:20:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.552 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\windows\system32\gasretyw0.dll c:\windows\system32\mpg4c32.dll D:\Autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-26 do 2008-11-26 ))))))))))))))))))))))))))))))) . 2008-11-26 13:47 . 2008-11-26 13:47 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\ATI 2008-11-26 13:47 . 2008-11-26 13:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ATI 2008-11-26 13:45 . 2008-11-26 13:45 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\6500 Series 2008-11-25 23:14 . 2008-11-25 23:14 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Lexmark Productivity Studio 2008-11-25 23:13 . 2008-11-25 23:16 <DIR> d-------- c:\documents and settings\All Users\Lx_cats 2008-11-25 23:11 . 2008-11-25 23:11 <DIR> d-------- C:\logs 2008-11-25 23:11 . 2007-05-04 04:50 348,160 --a------ c:\windows\system32\lxdfcoin.dll 2008-11-25 23:11 . 2001-10-26 17:29 87,040 --a------ c:\windows\system32\wiafbdrv.dll 2008-11-25 23:11 . 2001-10-26 17:29 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-25 23:11 . 2006-08-01 14:53 40,960 --a------ c:\windows\system32\lxdfvs.dll 2008-11-25 23:11 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-25 23:11 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-11-25 23:10 . 2008-11-25 23:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\6500 Series 2008-11-25 23:10 . 2007-05-25 05:24 692,224 --a------ c:\windows\system32\lxdfdrs.dll 2008-11-25 23:10 . 2006-06-03 06:12 339,968 --a------ c:\windows\system32\IMGMAN32.DLL 2008-11-25 23:10 . 2006-06-03 06:12 98,345 --a------ c:\windows\system32\IMHOST32.DLL 2008-11-25 23:10 . 2006-06-03 06:12 98,304 --a------ c:\windows\system32\IM31XPNG.DEL 2008-11-25 23:10 . 2007-04-09 23:59 69,632 --a------ c:\windows\system32\lxdfoem.dll 2008-11-25 23:10 . 2007-04-17 23:17 69,632 --a------ c:\windows\system32\lxdfcnv4.dll 2008-11-25 23:10 . 2006-06-03 06:12 69,632 --a------ c:\windows\system32\IM31XTIF.DEL 2008-11-25 23:10 . 2007-05-22 23:09 65,536 --a------ c:\windows\system32\lxdfcaps.dll 2008-11-25 23:10 . 2006-06-03 06:12 49,152 --a------ c:\windows\system32\IM31IMG.DIL 2008-11-25 23:10 . 2007-05-24 20:41 45,056 --a------ c:\windows\system32\LXDFPMON.DLL 2008-11-25 23:10 . 2007-05-24 20:41 32,768 --a------ c:\windows\system32\LXDFFXPU.DLL 2008-11-25 23:09 . 2008-11-25 23:09 <DIR> d-------- c:\program files\Abbyy FineReader 6.0 Sprint 2008-11-25 23:07 . 2008-11-25 23:10 <DIR> d-------- c:\program files\Lexmark 6500 Series 2008-11-25 20:39 . 2008-11-25 20:41 <DIR> d-------- c:\program files\uTorrent 2008-11-25 18:39 . 2008-11-25 18:39 85,504 -r-hs---- c:\windows\system32\gasretyw1.dll 2008-11-25 18:07 . 2008-11-25 18:07 <DIR> d-------- c:\windows\Sun 2008-11-25 18:07 . 2008-11-25 18:07 <DIR> d-------- c:\program files\Java 2008-11-25 18:07 . 2008-11-25 18:07 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-25 18:07 . 2008-11-25 18:07 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-25 14:34 . 2008-11-25 14:42 <DIR> d-------- c:\windows\system32\CatRoot_bak 2008-11-25 14:33 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-25 08:32 . 2008-11-25 14:46 <DIR> d--h----- c:\windows\$hf_mig$ 2008-11-25 08:32 . 2005-06-28 10:21 22,752 --a------ c:\windows\system32\spupdsvc.exe 2008-11-24 17:43 . 2006-10-26 19:56 32,592 --a------ c:\windows\system32\msonpmon.dll 2008-11-24 17:42 . 2008-11-24 17:42 <DIR> d-------- c:\program files\MSBuild 2008-11-24 17:42 . 2008-11-24 17:42 <DIR> d-------- c:\program files\Microsoft Works 2008-11-24 17:39 . 2008-11-24 17:42 <DIR> d-------- c:\windows\SHELLNEW 2008-11-24 17:39 . 2008-11-24 17:43 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-11-24 17:38 . 2008-11-24 17:38 <DIR> dr-h----- C:\MSOCache 2008-11-24 15:56 . 2008-08-14 14:46 2,181,632 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-24 15:56 . 2008-08-14 14:46 2,137,600 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-24 15:56 . 2008-08-14 14:46 2,059,008 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-24 15:56 . 2008-08-14 14:46 2,017,280 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-24 15:26 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-11-24 15:26 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2008-11-24 15:26 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-11-24 15:26 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-11-24 15:26 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2008-11-24 15:26 . 2001-08-17 22:02 9,600 --a------ c:\windows\system32\drivers\hidusb.sys 2008-11-24 15:26 . 2001-08-17 22:02 9,600 --a--c--- c:\windows\system32\dllcache\hidusb.sys 2008-11-24 14:28 . 2008-06-14 19:01 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-11-24 14:28 . 2008-06-14 19:01 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-23 22:48 . 2008-11-23 22:48 0 --a------ c:\windows\ativpsrm.bin 2008-11-23 17:42 . 2008-11-23 17:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-11-23 17:37 . 2006-12-08 12:02 251,672 --a------ c:\windows\system32\xactengine2_5.dll 2008-11-23 17:36 . 2008-11-23 17:36 <DIR> d-------- c:\program files\KONAMI 2008-11-23 16:19 . 2008-11-23 16:19 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Gadu-Gadu 2008-11-23 16:18 . 2008-11-25 22:33 <DIR> d-------- c:\program files\Gadu-Gadu 2008-11-23 16:18 . 2008-11-23 20:51 <DIR> d-------- c:\documents and settings\user\Gadu-Gadu 2008-11-23 16:13 . 2008-11-26 14:06 <DIR> d-------- c:\program files\DAEMON Tools 2008-11-23 16:13 . 2008-11-23 16:13 223,128 --a------ c:\windows\system32\drivers\dtscsi.sys 2008-11-23 16:11 . 2008-11-23 20:37 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Skype 2008-11-23 16:09 . 2008-11-23 16:17 <DIR> d-------- c:\program files\Winamp 2008-11-23 16:09 . 2008-11-26 14:20 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\uTorrent 2008-11-23 16:09 . 2006-05-19 22:16 2,560 --------- c:\windows\system32\drivers\cdralw2k.sys 2008-11-23 16:09 . 2006-05-19 22:16 2,432 --------- c:\windows\system32\drivers\cdr4_xp.sys 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\SopCast 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\Skype 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\Mozilla Thunderbird 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2008-11-23 16:08 . 2001-08-17 22:59 3,072 --a------ c:\windows\system32\drivers\audstub.sys 2008-11-23 16:07 . 2008-11-23 16:29 <DIR> d-------- c:\program files\RivChat2 2008-11-23 16:06 . 2008-11-25 23:09 <DIR> d--hs---- c:\windows\Installer 2008-11-23 16:05 . 2008-11-23 20:30 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Apple Computer 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> dr-h----- c:\documents and settings\Default User\Ustawienia lokalne 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\Default User\Ulubione 2008-11-23 16:05 . 2008-11-23 15:10 <DIR> d--h----- c:\documents and settings\Default User\Szablony 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\Default User\Pulpit 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\Default User\Moje dokumenty 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> dr------- c:\documents and settings\Default User\Menu Start 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\All Users\Ulubione 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d--h----- c:\documents and settings\All Users\Szablony 2008-11-23 16:05 . 2008-11-25 23:13 <DIR> d-------- c:\documents and settings\All Users\Pulpit 2008-11-23 16:05 . 2008-11-23 15:16 <DIR> dr------- c:\documents and settings\All Users\Menu Start 2008-11-23 16:05 . 2008-11-23 15:11 <DIR> dr------- c:\documents and settings\All Users\Dokumenty 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\windows\Downloaded Installations 2008-11-23 16:04 . 2008-11-23 16:05 <DIR> d-------- c:\program files\QuickTime 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\program files\iTunes 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\program files\iPod 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-11-23 16:03 . 2008-11-26 14:02 <DIR> d-------- c:\windows\system32\CatRoot2 2008-11-23 16:03 . 2008-11-25 14:44 <DIR> d-------- c:\windows\system32\CatRoot 2008-11-23 16:03 . 2008-11-23 21:43 <DIR> d-------- c:\program files\Google 2008-11-23 16:03 . 2008-11-23 16:05 <DIR> dr-h----- c:\documents and settings\Default User\Dane aplikacji 2008-11-23 16:03 . 2008-11-23 15:19 <DIR> d--h----- c:\documents and settings\Default User 2008-11-23 16:03 . 2008-11-26 13:47 <DIR> dr-h----- c:\documents and settings\All Users\Dane aplikacji 2008-11-23 16:03 . 2008-11-25 23:16 <DIR> d-------- c:\documents and settings\All Users 2008-11-23 16:03 . 2008-11-23 15:19 <DIR> d-------- C:\Documents and Settings 2008-11-23 16:02 . 2008-11-23 16:02 <DIR> d-------- c:\program files\Lavalys 2008-11-23 16:02 . 2008-11-23 15:16 261 --a------ c:\windows\system32\$winnt$.inf 2008-11-23 16:01 . 2008-11-23 16:01 <DIR> d-------- c:\program files\DivX 2008-11-23 16:00 . 2008-11-23 16:00 <DIR> d-------- c:\program files\Common Files\AVSMedia 2008-11-23 16:00 . 2008-11-23 16:00 <DIR> d-------- c:\program files\AVSMedia 2008-11-23 16:00 . 2003-05-21 23:50 1,700,352 --a------ c:\windows\system32\GdiPlus.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-25 16:21 --------- d-----w c:\program files\Common Files\Adobe 2008-11-25 16:19 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-24 20:06 --------- d-----w c:\program files\DC++ 2008-11-23 21:45 --------- d-----w c:\program files\ATI Technologies 2008-11-23 15:07 155,995 ----a-w c:\windows\java\Packages\4ONLVPNF.ZIP 2008-11-23 15:03 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-23 15:01 96,256 ----a-w c:\windows\system32\drivers\sptd0509.sys 2008-11-23 15:01 642,560 ----a-w c:\windows\system32\drivers\sptd.sys 2008-11-23 14:58 --------- d-----w c:\program files\MarBit 2008-11-23 14:22 --------- d-----w c:\program files\Alwil Software 2008-11-23 14:14 --------- d-----w c:\program files\microsoft frontpage 2008-11-23 14:12 --------- d-----w c:\program files\Usługi online 2008-10-29 03:10 3,341,824 ----a-w c:\windows\system32\drivers\ati2mtag.sys 2008-10-29 02:23 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll 2008-10-29 02:22 314,880 ----a-w c:\windows\system32\ati2dvag.dll 2008-10-29 02:11 43,520 ----a-w c:\windows\system32\ati2edxx.dll 2008-10-29 02:11 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe 2008-10-29 02:11 188,416 ----a-w c:\windows\system32\atipdlxx.dll 2008-10-29 02:11 147,456 ----a-w c:\windows\system32\Oemdspif.dll 2008-10-29 02:10 143,360 ----a-w c:\windows\system32\ati2evxx.dll 2008-10-29 02:10 10,973,184 ----a-w c:\windows\system32\atioglxx.dll 2008-10-29 02:09 585,728 ----a-w c:\windows\system32\ati2evxx.exe 2008-10-29 02:07 53,248 ----a-w c:\windows\system32\ATIDDC.DLL 2008-10-29 01:57 4,041,472 ----a-w c:\windows\system32\ati3duag.dll 2008-10-29 01:49 307,200 ----a-w c:\windows\system32\atiiiexx.dll 2008-10-29 01:41 2,472,832 ----a-w c:\windows\system32\ativvaxx.dll 2008-10-29 01:25 48,640 ----a-w c:\windows\system32\amdpcom32.dll 2008-10-29 01:21 389,120 ----a-w c:\windows\system32\atikvmag.dll 2008-10-29 01:19 44,032 ----a-w c:\windows\system32\atiadlxx.dll 2008-10-29 01:19 17,408 ----a-w c:\windows\system32\atitvo32.dll 2008-10-29 01:18 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll 2008-10-29 01:18 253,952 ----a-w c:\windows\system32\atiok3x2.dll 2008-10-29 01:12 577,536 ----a-w c:\windows\system32\ati2cqag.dll 2008-10-28 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:46 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-25 2101248] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-06-14 278528] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-23 282624] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2006-06-09 35328] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-25 136600] "lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-12 455600] "lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480] "Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-12 308144] "SoundMan"="SOUNDMAN.EXE" [2005-01-10 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-25 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\RivChat2\\RivChat.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\Instalki\\Internetowe\\utorrent.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\lxdfcoms.exe"= "c:\\Program Files\\Lexmark 6500 Series\\lxdfamon.exe"= "c:\\Program Files\\Lexmark 6500 Series\\frun.exe"= "c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"= "c:\\Program Files\\Lexmark 6500 Series\\LXDFFax.exe"= "c:\\Program Files\\Lexmark 6500 Series\\lxdfmon.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfpswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdftime.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfjswx.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-23 110160] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-23 20560] R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service [] S2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdfserv.exe [2008-11-25 99248] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cce2c45e-b96e-11dd-b884-806d6172696f}] \Shell\AutoRun\command - ij.bat \Shell\explore\Command - ij.bat \Shell\open\Command - ij.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cce2c45f-b96e-11dd-b884-806d6172696f}] \Shell\AutoRun\command - ij.bat \Shell\explore\Command - ij.bat \Shell\open\Command - ij.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36dce72-bb15-11dd-8bc3-00304f245418}] \Shell\AutoRun\command - G:\abk.bat \Shell\explore\Command - G:\abk.bat \Shell\open\Command - G:\abk.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36dce73-bb15-11dd-8bc3-00304f245418}] \Shell\AutoRun\command - H:\abk.bat \Shell\explore\Command - H:\abk.bat \Shell\open\Command - H:\abk.bat *Newly Created Service* - PROCEXP90 . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\cb55a8gw.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.onet.pl . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-26 14:21:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(584) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-11-26 14:22:24 ComboFix-quarantined-files.txt 2008-11-26 13:22:08 Przed: 49 320 787 968 bajtów wolnych Po: 49,381,498,880 bajtów wolnych 272 --- E O F --- 2008-11-25 13:46:34

HiJack this:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:12:01, on 2008-11-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Lexmark 6500 Series\lxdfmon.exe C:\Program Files\Lexmark 6500 Series\lxdfamon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lxdfcoms.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\user\Pulpit\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe" O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe" O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\kamsoft.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing) O23 - Service: lxdfCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdfserv.exe O23 - Service: lxdf_device - - C:\WINDOWS\system32\lxdfcoms.exe

**Posty:** 8001 · przez **Okocza** 26 Lis 2008, 15:53

Gazprom napisał(a):Skąd ściągałeś program

to nie ma znaczenia, Avast często wykrywa w programach wirusy itp nawet jeśli nie ma w nich żadnego szkodliwego oprogramowania.

czesieK, masz wirusa PATRON

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 591 · przez **Gazprom** 26 Lis 2008, 17:09

Okocza zgodzę się z tobą ale nie w całości, gdyż mogłoby to mieć znaczenie. Ściąganie poprzez terrenty nie zawsze jest w całości bezpieczne, ale mimo wszystko się z tobą zgadzam.

**Posty:** 8001 · przez **Okocza** 26 Lis 2008, 17:10

Gazprom, od kiedy Avasta pobiera się przez torrenty :?:

to jest DARMOWY program...

sry za OT

**Posty:** 18165 · przez **wojtas** 26 Lis 2008, 17:34

skasuj:

O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\kamsoft.exe

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\gasretyw1.dll

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cce2c45e-b96e-11dd-b884-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cce2c45f-b96e-11dd-b884-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36dce72-bb15-11dd-8bc3-00304f245418}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f36dce73-bb15-11dd-8bc3-00304f245418}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 591 · przez **Gazprom** 26 Lis 2008, 17:44

Chodziło mi o Daemona.

**Posty:** 188 · przez **czesieK** 26 Lis 2008, 22:49

Gazprom - program ściągnąłem jak się nie mylę ze strony programs.pl

Tutaj log po skorzystaniu z tego CFScript (nie wiem czy wszystko dobrze zrobiłem)

Kod: Zaznacz wszystko: ComboFix 08-11-26.03 - user 2008-11-26 21:44:41.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.576 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\user\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: c:\windows\system32\gasretyw1.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\gasretyw1.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-26 do 2008-11-26 ))))))))))))))))))))))))))))))) . 2008-11-26 19:43 . 2008-11-26 19:43 <DIR> d-------- c:\program files\Common Files\Nero 2008-11-26 19:42 . 2008-11-26 19:42 <DIR> d-------- c:\program files\Common Files\LightScribe 2008-11-26 19:41 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll 2008-11-26 19:40 . 2008-11-26 19:40 <DIR> d-------- c:\program files\Common Files\Ahead 2008-11-26 19:40 . 2008-11-26 19:41 <DIR> d-------- c:\program files\Ahead 2008-11-26 19:40 . 2004-07-26 17:16 1,568,768 --------- c:\windows\system32\ImagX7.dll 2008-11-26 19:40 . 2004-07-26 17:16 476,320 --------- c:\windows\system32\ImagXpr7.dll 2008-11-26 19:40 . 2004-07-26 17:16 471,040 --------- c:\windows\system32\ImagXRA7.dll 2008-11-26 19:40 . 2004-07-26 17:16 262,144 --------- c:\windows\system32\ImagXR7.dll 2008-11-26 19:40 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe 2008-11-26 16:20 . 2008-11-26 16:21 <DIR> d-------- c:\program files\Trojan Remover 2008-11-26 16:20 . 2008-11-26 16:20 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Simply Super Software 2008-11-26 16:20 . 2008-11-26 16:20 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-11-26 16:20 . 2008-11-26 16:20 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Simply Super Software 2008-11-26 16:20 . 2006-05-25 15:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll 2008-11-26 16:20 . 2003-02-02 20:06 153,088 --a------ c:\windows\system32\UNRAR3.dll 2008-11-26 16:20 . 2005-08-26 01:50 77,312 --a------ c:\windows\system32\ztvunace26.dll 2008-11-26 16:20 . 2002-03-06 01:00 75,264 --a------ c:\windows\system32\unacev2.dll 2008-11-26 16:20 . 2006-06-19 13:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll 2008-11-26 14:27 . 2008-11-26 14:27 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Thunderbird 2008-11-26 13:47 . 2008-11-26 13:47 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\ATI 2008-11-26 13:47 . 2008-11-26 13:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ATI 2008-11-26 13:45 . 2008-11-26 13:45 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\6500 Series 2008-11-25 23:14 . 2008-11-25 23:14 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Lexmark Productivity Studio 2008-11-25 23:13 . 2008-11-25 23:16 <DIR> d-------- c:\documents and settings\All Users\Lx_cats 2008-11-25 23:11 . 2008-11-25 23:11 <DIR> d-------- C:\logs 2008-11-25 23:11 . 2007-05-04 04:50 348,160 --a------ c:\windows\system32\lxdfcoin.dll 2008-11-25 23:11 . 2001-10-26 17:29 87,040 --a------ c:\windows\system32\wiafbdrv.dll 2008-11-25 23:11 . 2001-10-26 17:29 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll 2008-11-25 23:11 . 2006-08-01 14:53 40,960 --a------ c:\windows\system32\lxdfvs.dll 2008-11-25 23:11 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-25 23:11 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-11-25 23:10 . 2008-11-25 23:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\6500 Series 2008-11-25 23:10 . 2007-05-25 05:24 692,224 --a------ c:\windows\system32\lxdfdrs.dll 2008-11-25 23:10 . 2006-06-03 06:12 339,968 --a------ c:\windows\system32\IMGMAN32.DLL 2008-11-25 23:10 . 2006-06-03 06:12 98,345 --a------ c:\windows\system32\IMHOST32.DLL 2008-11-25 23:10 . 2006-06-03 06:12 98,304 --a------ c:\windows\system32\IM31XPNG.DEL 2008-11-25 23:10 . 2007-04-09 23:59 69,632 --a------ c:\windows\system32\lxdfoem.dll 2008-11-25 23:10 . 2007-04-17 23:17 69,632 --a------ c:\windows\system32\lxdfcnv4.dll 2008-11-25 23:10 . 2006-06-03 06:12 69,632 --a------ c:\windows\system32\IM31XTIF.DEL 2008-11-25 23:10 . 2007-05-22 23:09 65,536 --a------ c:\windows\system32\lxdfcaps.dll 2008-11-25 23:10 . 2006-06-03 06:12 49,152 --a------ c:\windows\system32\IM31IMG.DIL 2008-11-25 23:10 . 2007-05-24 20:41 45,056 --a------ c:\windows\system32\LXDFPMON.DLL 2008-11-25 23:10 . 2007-05-24 20:41 32,768 --a------ c:\windows\system32\LXDFFXPU.DLL 2008-11-25 23:09 . 2008-11-25 23:09 <DIR> d-------- c:\program files\Abbyy FineReader 6.0 Sprint 2008-11-25 23:07 . 2008-11-25 23:10 <DIR> d-------- c:\program files\Lexmark 6500 Series 2008-11-25 20:39 . 2008-11-25 20:41 <DIR> d-------- c:\program files\uTorrent 2008-11-25 18:07 . 2008-11-25 18:07 <DIR> d-------- c:\windows\Sun 2008-11-25 18:07 . 2008-11-25 18:07 <DIR> d-------- c:\program files\Java 2008-11-25 18:07 . 2008-11-25 18:07 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-25 18:07 . 2008-11-25 18:07 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-25 14:34 . 2008-11-25 14:42 <DIR> d-------- c:\windows\system32\CatRoot_bak 2008-11-25 14:33 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-25 08:32 . 2008-11-25 14:46 <DIR> d--h----- c:\windows\$hf_mig$ 2008-11-25 08:32 . 2005-06-28 10:21 22,752 --a------ c:\windows\system32\spupdsvc.exe 2008-11-24 17:43 . 2006-10-26 19:56 32,592 --a------ c:\windows\system32\msonpmon.dll 2008-11-24 17:42 . 2008-11-24 17:42 <DIR> d-------- c:\program files\MSBuild 2008-11-24 17:42 . 2008-11-24 17:42 <DIR> d-------- c:\program files\Microsoft Works 2008-11-24 17:39 . 2008-11-24 17:42 <DIR> d-------- c:\windows\SHELLNEW 2008-11-24 17:39 . 2008-11-24 17:43 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-11-24 17:38 . 2008-11-24 17:38 <DIR> dr-h----- C:\MSOCache 2008-11-24 15:56 . 2008-08-14 14:46 2,181,632 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-24 15:56 . 2008-08-14 14:46 2,137,600 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-24 15:56 . 2008-08-14 14:46 2,059,008 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-24 15:56 . 2008-08-14 14:46 2,017,280 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-24 15:26 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-11-24 15:26 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2008-11-24 15:26 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-11-24 15:26 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-11-24 15:26 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2008-11-24 15:26 . 2001-08-17 22:02 9,600 --a------ c:\windows\system32\drivers\hidusb.sys 2008-11-24 15:26 . 2001-08-17 22:02 9,600 --a--c--- c:\windows\system32\dllcache\hidusb.sys 2008-11-24 14:28 . 2008-06-14 19:01 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-11-24 14:28 . 2008-06-14 19:01 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-23 22:48 . 2008-11-23 22:48 0 --a------ c:\windows\ativpsrm.bin 2008-11-23 17:42 . 2008-11-23 17:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-11-23 17:37 . 2006-12-08 12:02 251,672 --a------ c:\windows\system32\xactengine2_5.dll 2008-11-23 17:36 . 2008-11-23 17:36 <DIR> d-------- c:\program files\KONAMI 2008-11-23 16:19 . 2008-11-23 16:19 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Gadu-Gadu 2008-11-23 16:18 . 2008-11-25 22:33 <DIR> d-------- c:\program files\Gadu-Gadu 2008-11-23 16:18 . 2008-11-23 20:51 <DIR> d-------- c:\documents and settings\user\Gadu-Gadu 2008-11-23 16:13 . 2008-11-26 14:06 <DIR> d-------- c:\program files\DAEMON Tools 2008-11-23 16:13 . 2008-11-23 16:13 223,128 --a------ c:\windows\system32\drivers\dtscsi.sys.vir 2008-11-23 16:11 . 2008-11-23 20:37 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Skype 2008-11-23 16:09 . 2008-11-23 16:17 <DIR> d-------- c:\program files\Winamp 2008-11-23 16:09 . 2008-11-26 21:45 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\uTorrent 2008-11-23 16:09 . 2006-05-19 22:16 2,560 --------- c:\windows\system32\drivers\cdralw2k.sys 2008-11-23 16:09 . 2006-05-19 22:16 2,432 --------- c:\windows\system32\drivers\cdr4_xp.sys 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\SopCast 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\Skype 2008-11-23 16:08 . 2008-11-26 14:27 <DIR> d-------- c:\program files\Mozilla Thunderbird 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-23 16:08 . 2008-11-23 16:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2008-11-23 16:08 . 2001-08-17 22:59 3,072 --a------ c:\windows\system32\drivers\audstub.sys 2008-11-23 16:07 . 2008-11-23 16:29 <DIR> d-------- c:\program files\RivChat2 2008-11-23 16:06 . 2008-11-26 19:43 <DIR> d--hs---- c:\windows\Installer 2008-11-23 16:05 . 2008-11-23 20:30 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Apple Computer 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> dr-h----- c:\documents and settings\Default User\Ustawienia lokalne 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\Default User\Ulubione 2008-11-23 16:05 . 2008-11-23 15:10 <DIR> d--h----- c:\documents and settings\Default User\Szablony 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\Default User\Pulpit 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\Default User\Moje dokumenty 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> dr------- c:\documents and settings\Default User\Menu Start 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d-------- c:\documents and settings\All Users\Ulubione 2008-11-23 16:05 . 2008-11-23 16:05 <DIR> d--h----- c:\documents and settings\All Users\Szablony 2008-11-23 16:05 . 2008-11-26 19:43 <DIR> d-------- c:\documents and settings\All Users\Pulpit 2008-11-23 16:05 . 2008-11-23 15:16 <DIR> dr------- c:\documents and settings\All Users\Menu Start 2008-11-23 16:05 . 2008-11-23 15:11 <DIR> dr------- c:\documents and settings\All Users\Dokumenty 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\windows\Downloaded Installations 2008-11-23 16:04 . 2008-11-23 16:05 <DIR> d-------- c:\program files\QuickTime 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\program files\iTunes 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\program files\iPod 2008-11-23 16:04 . 2008-11-23 16:04 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-11-23 16:03 . 2008-11-26 14:02 <DIR> d-------- c:\windows\system32\CatRoot2 2008-11-23 16:03 . 2008-11-25 14:44 <DIR> d-------- c:\windows\system32\CatRoot 2008-11-23 16:03 . 2008-11-23 21:43 <DIR> d-------- c:\program files\Google 2008-11-23 16:03 . 2008-11-23 16:05 <DIR> dr-h----- c:\documents and settings\Default User\Dane aplikacji 2008-11-23 16:03 . 2008-11-26 14:22 <DIR> d--h----- c:\documents and settings\Default User 2008-11-23 16:03 . 2008-11-26 16:20 <DIR> dr-h----- c:\documents and settings\All Users\Dane aplikacji 2008-11-23 16:03 . 2008-11-25 23:16 <DIR> d-------- c:\documents and settings\All Users 2008-11-23 16:03 . 2008-11-23 15:19 <DIR> d-------- C:\Documents and Settings 2008-11-23 16:02 . 2008-11-23 16:02 <DIR> d-------- c:\program files\Lavalys 2008-11-23 16:02 . 2008-11-23 15:16 261 --a------ c:\windows\system32\$winnt$.inf 2008-11-23 16:01 . 2008-11-23 16:01 <DIR> d-------- c:\program files\DivX 2008-11-23 16:00 . 2008-11-23 16:00 <DIR> d-------- c:\program files\Common Files\AVSMedia . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-25 16:21 --------- d-----w c:\program files\Common Files\Adobe 2008-11-25 16:19 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-24 20:06 --------- d-----w c:\program files\DC++ 2008-11-23 21:45 --------- d-----w c:\program files\ATI Technologies 2008-11-23 15:07 155,995 ----a-w c:\windows\java\Packages\4ONLVPNF.ZIP 2008-11-23 15:03 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-23 15:01 96,256 ----a-w c:\windows\system32\drivers\sptd0509.sys 2008-11-23 15:01 642,560 ----a-w c:\windows\system32\drivers\sptd.sys 2008-11-23 14:58 --------- d-----w c:\program files\MarBit 2008-11-23 14:22 --------- d-----w c:\program files\Alwil Software 2008-11-23 14:14 --------- d-----w c:\program files\microsoft frontpage 2008-11-23 14:12 --------- d-----w c:\program files\Usługi online 2008-10-29 03:10 3,341,824 ----a-w c:\windows\system32\drivers\ati2mtag.sys 2008-10-29 02:23 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll 2008-10-29 02:22 314,880 ----a-w c:\windows\system32\ati2dvag.dll 2008-10-29 02:11 43,520 ----a-w c:\windows\system32\ati2edxx.dll 2008-10-29 02:11 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe 2008-10-29 02:11 188,416 ----a-w c:\windows\system32\atipdlxx.dll 2008-10-29 02:11 147,456 ----a-w c:\windows\system32\Oemdspif.dll 2008-10-29 02:10 143,360 ----a-w c:\windows\system32\ati2evxx.dll 2008-10-29 02:10 10,973,184 ----a-w c:\windows\system32\atioglxx.dll 2008-10-29 02:09 585,728 ----a-w c:\windows\system32\ati2evxx.exe 2008-10-29 02:07 53,248 ----a-w c:\windows\system32\ATIDDC.DLL 2008-10-29 01:57 4,041,472 ----a-w c:\windows\system32\ati3duag.dll 2008-10-29 01:49 307,200 ----a-w c:\windows\system32\atiiiexx.dll 2008-10-29 01:41 2,472,832 ----a-w c:\windows\system32\ativvaxx.dll 2008-10-29 01:25 48,640 ----a-w c:\windows\system32\amdpcom32.dll 2008-10-29 01:21 389,120 ----a-w c:\windows\system32\atikvmag.dll 2008-10-29 01:19 44,032 ----a-w c:\windows\system32\atiadlxx.dll 2008-10-29 01:19 17,408 ----a-w c:\windows\system32\atitvo32.dll 2008-10-29 01:18 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll 2008-10-29 01:18 253,952 ----a-w c:\windows\system32\atiok3x2.dll 2008-10-29 01:12 577,536 ----a-w c:\windows\system32\ati2cqag.dll 2008-10-28 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:46 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-26_14.21.54,00 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-26 13:50:43 26,624 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\39b0f7b41d5db948a00f027675e33cb9\Accessibility.ni.dll + 2008-11-26 13:50:45 860,160 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\29d3b1bd7610ff4f8d353071747a5473\AspNetMMCExt.ni.dll + 2008-11-26 13:50:46 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e8c6aedc6698d4469a43e4fa4ae3f4cc\CustomMarshalers.ni.dll + 2008-11-26 13:50:46 15,360 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\ae38494430a5ac4980c7cced60febcdf\dfsvc.ni.exe + 2008-11-26 13:50:48 880,640 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\dd709a042de2d54e9651e68fe5e4ab18\Microsoft.Build.Engine.ni.dll + 2008-11-26 13:50:48 81,920 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\bdb11a05aaf53442abcf42b3b00c35c8\Microsoft.Build.Framework.ni.dll + 2008-11-26 13:50:51 1,691,648 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\[u]0[/u]3831a7348f2074aa76b6cbef3e3fc9e\Microsoft.Build.Tasks.ni.dll + 2008-11-26 13:50:52 163,840 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\a5840e0c85d29a4fbd3628e3f730d82f\Microsoft.Build.Utilities.ni.dll + 2008-11-26 13:50:55 1,724,416 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5487076234d2924b9517da34ed367e03\Microsoft.VisualBasic.ni.dll + 2008-11-26 13:50:56 962,560 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\1a4b5b295594704db85631b9ca299ecd\System.Configuration.ni.dll + 2008-11-26 13:50:58 1,712,128 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\b72c80abcfe3ae42af83f3e9f1e1eed0\System.Deployment.ni.dll + 2008-11-26 13:50:59 1,220,608 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\7b2dc1cef1343c4bb86feada485a5ccd\System.DirectoryServices.ni.dll + 2008-11-26 13:51:00 512,000 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\9c5a476d01d39940920be493ca2c7093\System.DirectoryServices.Protocols.ni.dll + 2008-11-26 13:51:01 659,456 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ae5bf0addb970141bb712cda774ff7ef\System.EnterpriseServices.ni.dll + 2008-11-26 13:51:01 294,912 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ae5bf0addb970141bb712cda774ff7ef\System.EnterpriseServices.Wrapper.dll + 2008-11-26 13:51:03 729,088 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\e2cf5f74f060d049937d1d20eb9b92ce\System.Security.ni.dll + 2008-11-26 13:51:04 684,032 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\7e9f9c7a7bcdb34ba3152eb077e109db\System.Transactions.ni.dll + 2008-11-26 13:51:24 2,310,144 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\51c3e93f0c0fc2469f02e86eec1f0880\System.Web.Mobile.ni.dll + 2008-11-26 13:51:24 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\13e7e4bc4e1f4d4195876c92035b247c\System.Web.RegularExpressions.ni.dll + 2008-11-26 13:51:27 1,945,600 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\456a216ddf51964bb1772b642230126c\System.Web.Services.ni.dll + 2008-11-26 13:51:19 11,808,768 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5512a78529565f40843bd409faad73f2\System.Web.ni.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-25 2101248] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-06-14 278528] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-23 282624] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2006-06-09 35328] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-25 136600] "lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-12 455600] "lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480] "Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-12 308144] "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-09-20 922192] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SoundMan"="SOUNDMAN.EXE" [2005-01-10 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-25 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\RivChat2\\RivChat.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\Instalki\\Internetowe\\utorrent.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\lxdfcoms.exe"= "c:\\Program Files\\Lexmark 6500 Series\\lxdfamon.exe"= "c:\\Program Files\\Lexmark 6500 Series\\frun.exe"= "c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"= "c:\\Program Files\\Lexmark 6500 Series\\LXDFFax.exe"= "c:\\Program Files\\Lexmark 6500 Series\\lxdfmon.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfpswx.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdftime.exe"= "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdfjswx.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-23 110160] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-23 20560] R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfcoms.exe -service [] S2 lxdfCATSCustConnectService;lxdfCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdfserv.exe [2008-11-25 99248] *Newly Created Service* - CATCHME *Newly Created Service* - LIGHTSCRIBESERVICE *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-26 21:45:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(584) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-11-26 21:46:30 ComboFix-quarantined-files.txt 2008-11-26 20:46:21 ComboFix2.txt 2008-11-26 13:22:25 Przed: 46 562 594 816 bajtów wolnych Po: 46,435,000,320 bajtów wolnych 296 --- E O F --- 2008-11-25 13:46:34

**Posty:** 18165 · przez **wojtas** 26 Lis 2008, 23:10

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Kto jest na forum