Dziwne okienka, i spowolniona praca pc

**Posty:** 2691 · przez **Z@K** 05 Sie 2008, 21:08

Witam. Od pewnego czasu pojawia mi sie na pasku na dole, jakies okienko na sekunde i zamyka sie, nie zdazam nawet zobaczyc co to jest, a komputer spowolnił swoją pracę. Proszę o sprawdzenie loga, i ewentualne wskazówki co do usunięcia szkodników, o ile takie są.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:07:39, on 2008-08-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\RTHDCPL.EXE F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe F:\Program Files\Winamp\winampa.exe F:\Documents and Settings\User\service2.exe F:\Program Files\RocketDock\RocketDock.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Bonjour\mDNSResponder.exe F:\Program Files\Common Files\LightScribe\LSSrvc.exe F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE F:\WINDOWS\system32\nvsvc32.exe F:\Program Files\Common Files\Protexis\License Service\PSIService.exe F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wscntfy.exe F:\Program Files\Tlen.pl\tlen.exe F:\Program Files\Skype\Phone\Skype.exe F:\Program Files\Skype\Plugin Manager\skypePM.exe F:\Program Files\Winamp\winamp.exe F:\Program Files\Last.fm\LastFM.exe F:\Program Files\Opera\Opera.exe F:\Program Files\Common Files\InstallShield\UpdateService\agent.exe F:\Documents and Settings\User\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.srtest.com/referrer/srtest R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - F:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - F:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] F:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=010508 serial=DR12WEX-1504397-KTY lang=EN O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKLM\..\Run: [ISUSPM Startup] F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM] "F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Advanced DHTML Enable] F:\Documents and Settings\User\service2.exe O4 - HKCU\..\Run: [RocketDock] "F:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - Startup: Sidebar.lnk = F:\Documents and Settings\User\Moje dokumenty\Clear Sidebar.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Winamp Search - F:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: f:\program files\bonjour\mdnsnsp.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38BD57F4-72B6-4D7E-81DF-0C65D342AE5B}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - F:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - F:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 8001 · przez **Okocza** 05 Sie 2008, 21:08

Z@K, popraw logi, wstaw w code i daj od razu log z combofixa

**Posty:** 2691 · przez **Z@K** 07 Sie 2008, 15:25

log poprawiony, z HJ jest przed Combofixem, a tutaj daje Log z Combo oraz jeszcze jeden z HJ juz po CF

Kod: Zaznacz wszystko: ComboFix 08-08-06.02 - User 2008-08-07 15:13:38.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1660 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) . 2008-08-07 14:56 . 2008-08-07 14:56 3,899 --a------ F:\Documents and Settings\User\planet.exe 2008-08-05 20:48 . 2008-08-05 21:04 20,480 --a------ F:\Documents and Settings\User\symant.exe 2008-08-05 14:06 . 2008-08-05 14:06 23,040 --a------ F:\Documents and Settings\User\service2.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-05 20:53 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-04 17:38 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-01 21:27 --------- d-----w F:\Program Files\RocketDock 2008-06-26 21:05 --------- d-----w F:\Program Files\MD4DC++ 2008-06-21 14:37 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Atari 2008-06-21 14:33 --------- d-----w F:\Program Files\Common Files\PocketSoft 2008-06-21 14:31 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{01f8fef8-415c-11dd-ab93-0019dbcbfa4d}] \Shell\Auto\command - I:\activexdebugger32.exe f \Shell\AutoRun\command - F:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - I:\activexdebugger32.exe f \Shell\open\Command - I:\activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5499b532-3e35-11dd-ab76-0019dbcbfa4d}] \Shell\Auto\command - I:\activexdebugger32.exe f \Shell\AutoRun\command - F:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - I:\activexdebugger32.exe f \Shell\open\Command - I:\activexdebugger32.exe f [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}] C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\avi32.exe . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . - - - - ORPHANS REMOVED - - - - HKLM-Run-CorelDRAW Graphics Suite 11b - F:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe HKLM-Run-SunJavaUpdateSched - F:\Program Files\Java\jre1.5.0_05\bin\jusched.exe Notify-AtiExtEvent - (no file) MSConfigStartUp-Gainward - F:\Program Files\VDOTool\TBPanel.exe MSConfigStartUp-Glass2k - F:\Program Files\Glass2k\Glass2k.exe MSConfigStartUp-LClock - F:\Program Files\LClock\LClock.exe . ------- Supplementary Scan ------- . FireFox -: Profile - F:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\af7dq1jo.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-07 15:15:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-07 15:16:23 ComboFix-quarantined-files.txt 2008-08-07 13:16:20 Pre-Run: 7,951,208,448 bajtów wolnych Post-Run: 7,940,251,648 bajtów wolnych 141

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:25:00, on 2008-08-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\RTHDCPL.EXE F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe F:\Program Files\Winamp\winampa.exe F:\Documents and Settings\User\service2.exe F:\Program Files\RocketDock\RocketDock.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Bonjour\mDNSResponder.exe F:\Program Files\Common Files\LightScribe\LSSrvc.exe F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE F:\WINDOWS\system32\nvsvc32.exe F:\Program Files\Common Files\Protexis\License Service\PSIService.exe F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wscntfy.exe F:\WINDOWS\system32\notepad.exe F:\WINDOWS\explorer.exe F:\Program Files\Tlen.pl\tlen.exe F:\Program Files\Opera\Opera.exe F:\Documents and Settings\User\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.srtest.com/referrer/srtest R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - F:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - F:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM] "F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [RocketDock] "F:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - Startup: Sidebar.lnk = F:\Documents and Settings\User\Moje dokumenty\Clear Sidebar.exe O8 - Extra context menu item: &Winamp Search - F:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: f:\program files\bonjour\mdnsnsp.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38BD57F4-72B6-4D7E-81DF-0C65D342AE5B}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - F:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - F:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 684 · przez **djarta** 07 Sie 2008, 15:32

1)

O8 - Extra context menu item: &Winamp Search - F:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: F:\Documents and Settings\User\service2.exe Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{01f8fef8-415c-11dd-ab93-0019dbcbfa4d}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5499b532-3e35-11dd-ab76-0019dbcbfa4d}] [-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log). Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

3)

F:\Documents and Settings\User\planet.exe
F:\Documents and Settings\User\symant.exe
F:\WINDOWS\system32\1EB16A5616.sys

Sprawdź je na --> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

Autor postu otrzymał pochwałę

**Posty:** 2691 · przez **Z@K** 07 Sie 2008, 20:29

Kod: Zaznacz wszystko: ComboFix 08-08-06.02 - User 2008-08-07 20:25:34.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1569 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe Command switches used :: F:\Documents and Settings\User\Moje dokumenty\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: F:\Documents and Settings\User\service2.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Documents and Settings\User\service2.exe . ((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) . 2008-08-07 14:56 . 2008-08-07 15:15 6,656 --a------ F:\Documents and Settings\User\planet.exe 2008-08-05 20:48 . 2008-08-05 21:04 20,480 --a------ F:\Documents and Settings\User\symant.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-07 14:05 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-04 17:38 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-01 21:27 --------- d-----w F:\Program Files\RocketDock 2008-06-26 21:05 --------- d-----w F:\Program Files\MD4DC++ 2008-06-21 14:37 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Atari 2008-06-21 14:33 --------- d-----w F:\Program Files\Common Files\PocketSoft 2008-06-21 14:31 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-07 20:27:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-07 20:28:28 ComboFix-quarantined-files.txt 2008-08-07 18:28:21 ComboFix2.txt 2008-08-07 13:16:24 Pre-Run: 7,922,159,616 bajtów wolnych Post-Run: 7,912,615,936 bajtów wolnych 124

teraz moge usunac ten plik C:\Qoobox. ??

a co z tymi

F:\Documents and Settings\User\planet.exe
F:\Documents and Settings\User\symant.exe
F:\WINDOWS\system32\1EB16A5616.sys

??

**Posty:** 18165 · przez **wojtas** 07 Sie 2008, 20:31

Z@K napisał(a):a co z tymi

miałes przeskanować je na tamtych stronach i dac raport

**Posty:** 2691 · przez **Z@K** 07 Sie 2008, 21:12

F:\Documents and Settings\User\planet.exe :

A-Squared Found nothing
AntiVir Found HEUR/Crypted
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Packer.Krunchy.B
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Mailfinder.Win32.Agent.pb
Fortinet Found nothing
Ikarus Found Trojan-Mailfinder.Win32.Agent.pb
Kaspersky Anti-Virus Found Trojan-Mailfinder.Win32.Agent.pb
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

F:\Documents and Settings\User\symant.exe:

A-Squared Found nothing
AntiVir Found TR/Drop.A.BAT.20480
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found Trojan-Dropper.A.BAT.20480
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

F:\WINDOWS\system32\1EB16A5616.sys:

Found nothing

czekam na dalsze instrukcje. pozdrawiam

**Posty:** 684 · przez **djarta** 07 Sie 2008, 21:15

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: F:\Documents and Settings\User\planet.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

Drugiego pliku nie usuwamy,2/20. :wink:

**Posty:** 8001 · przez **Okocza** 07 Sie 2008, 21:18

na koniec:

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 2691 · przez **Z@K** 07 Sie 2008, 21:53

Kod: Zaznacz wszystko: ComboFix 08-08-06.02 - User 2008-08-07 21:51:40.9 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1488 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe Command switches used :: F:\Documents and Settings\User\Moje dokumenty\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: F:\Documents and Settings\User\planet.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Documents and Settings\User\planet.exe . ((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) . 2008-08-05 20:48 . 2008-08-05 21:04 20,480 --a------ F:\Documents and Settings\User\symant.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-07 14:05 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-04 17:38 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-01 21:27 --------- d-----w F:\Program Files\RocketDock 2008-06-26 21:05 --------- d-----w F:\Program Files\MD4DC++ 2008-06-21 14:37 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Atari 2008-06-21 14:33 --------- d-----w F:\Program Files\Common Files\PocketSoft 2008-06-21 14:31 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-07 21:52:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-07 21:52:57 ComboFix-quarantined-files.txt 2008-08-07 19:52:54 ComboFix2.txt 2008-08-07 18:28:29 ComboFix3.txt 2008-08-07 13:16:24 Pre-Run: 7,891,009,536 bajtów wolnych Post-Run: 7,881,560,064 bajtów wolnych 124

**Posty:** 8001 · przez **Okocza** 07 Sie 2008, 21:56

czysto - wykonaj to co w moim poprzednim poscie zaleciłem

**Posty:** 2691 · przez **Z@K** 14 Sie 2008, 11:58

nadal coś siedzi w kompie, bo mi dostawca napisal ze wykryli wysylanie spamu odemnie;/
daje log z ComboFixa,

Kod: Zaznacz wszystko: ComboFix 08-08-06.02 - User 2008-08-14 11:17:38.10 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1593 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\WINDOWS\system32\pskill.exe . ((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 ))))))))))))))))))))))))))))))) . 2008-08-12 18:13 . 2008-08-12 18:13 <DIR> d-------- F:\WINDOWS\system32\VIRepair 2008-08-12 18:08 . 2008-08-12 18:14 <DIR> d-------- F:\WINDOWS\system32\VITrans 2008-08-12 18:08 . 2008-08-12 18:09 <DIR> d-------- F:\VTPFiles 2008-08-12 18:08 . 2008-08-12 18:08 <DIR> d-------- F:\Documents and Settings\User\Dane aplikacji\Styler 2008-08-12 18:08 . 2006-12-03 17:15 69,632 --a------ F:\WINDOWS\system32\moveex.exe 2008-08-12 18:08 . 2006-12-03 17:14 8,636 --a------ F:\WINDOWS\system32\modifype.exe 2008-08-12 16:31 . 2008-08-12 16:31 22,016 --a------ F:\Documents and Settings\User\service2.exe 2008-08-11 15:15 . 2008-08-12 09:19 6,144 --a------ F:\Documents and Settings\User\systems.exe 2008-08-10 16:22 . 2008-08-10 16:22 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-08-10 16:22 . 2008-08-10 16:22 1,409 --a------ F:\WINDOWS\QTFont.for 2008-08-05 20:48 . 2008-08-05 21:04 20,480 --a------ F:\Documents and Settings\User\symant.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 06:18 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-12 07:45 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-12 07:34 --------- d-----w F:\Program Files\DkZ Studio 2008-08-11 21:04 --------- d-----w F:\Program Files\MD4DC++ 2008-08-01 21:27 --------- d-----w F:\Program Files\RocketDock 2008-06-21 14:37 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Atari 2008-06-21 14:33 --------- d-----w F:\Program Files\Common Files\PocketSoft 2008-06-21 14:31 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . - - - - ORPHANS REMOVED - - - - HKCU-Run-LClock - F:\Program Files\LClock\LClock.exe HKCU-Run-Vista Sidebar - F:\Program Files\Vista Sidebar\sidebar.exe HKCU-Run-ViStart - F:\Program Files\ViStart\ViStart.exe HKCU-Run-ViOrb - F:\Program Files\ViOrb\ViOrb.exe . ------- Supplementary Scan ------- . FireFox -: Profile - F:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\af7dq1jo.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-14 11:19:46 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-14 11:20:26 ComboFix-quarantined-files.txt 2008-08-14 09:20:23 ComboFix2.txt 2008-08-07 19:52:57 Pre-Run: 7,265,800,192 bajtów wolnych Post-Run: 7,265,837,056 bajtów wolnych 140

**Posty:** 684 · przez **djarta** 14 Sie 2008, 12:05

Wklej do Notatnika:

Kod: Zaznacz wszystko: DirLook:: F:\WINDOWS\system32\VIRepair F:\WINDOWS\system32\VITrans F:\Documents and Settings\User\Dane aplikacji\Styler

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

Potem:

F:\WINDOWS\system32\moveex.exe
F:\WINDOWS\system32\modifype.exe

Sprawdź je na --> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

**Posty:** 2691 · przez **Z@K** 14 Sie 2008, 12:17

Kod: Zaznacz wszystko: ComboFix 08-08-06.02 - User 2008-08-14 12:14:57.11 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1445 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe Command switches used :: F:\Documents and Settings\User\Moje dokumenty\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . I:\autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 ))))))))))))))))))))))))))))))) . 2008-08-12 18:13 . 2008-08-12 18:13 <DIR> d-------- F:\WINDOWS\system32\VIRepair 2008-08-12 18:08 . 2008-08-12 18:14 <DIR> d-------- F:\WINDOWS\system32\VITrans 2008-08-12 18:08 . 2008-08-12 18:09 <DIR> d-------- F:\VTPFiles 2008-08-12 18:08 . 2008-08-12 18:08 <DIR> d-------- F:\Documents and Settings\User\Dane aplikacji\Styler 2008-08-12 18:08 . 2006-12-03 17:15 69,632 --a------ F:\WINDOWS\system32\moveex.exe 2008-08-12 18:08 . 2006-12-03 17:14 8,636 --a------ F:\WINDOWS\system32\modifype.exe 2008-08-12 16:31 . 2008-08-12 16:31 22,016 --a------ F:\Documents and Settings\User\service2.exe 2008-08-11 15:15 . 2008-08-12 09:19 6,144 --a------ F:\Documents and Settings\User\systems.exe 2008-08-10 16:22 . 2008-08-10 16:22 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-08-10 16:22 . 2008-08-10 16:22 1,409 --a------ F:\WINDOWS\QTFont.for 2008-08-05 20:48 . 2008-08-05 21:04 20,480 --a------ F:\Documents and Settings\User\symant.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-14 10:13 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-13 06:18 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-12 07:34 --------- d-----w F:\Program Files\DkZ Studio 2008-08-11 21:04 --------- d-----w F:\Program Files\MD4DC++ 2008-08-01 21:27 --------- d-----w F:\Program Files\RocketDock 2008-06-21 14:37 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Atari 2008-06-21 14:33 --------- d-----w F:\Program Files\Common Files\PocketSoft 2008-06-21 14:31 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of F:\Documents and Settings\User\Dane aplikacji\Styler ---- 2008-08-12 18:08 52 --a------ F:\Documents and Settings\User\Dane aplikacji\Styler\Styler\Data\Styler.ini ---- Directory of F:\WINDOWS\system32\VIRepair ---- 2007-08-21 05:03 2079 --a------ F:\WINDOWS\system32\VIRepair\vi.sif ---- Directory of F:\WINDOWS\system32\VITrans ---- 2007-08-21 05:03 2079 --a------ F:\WINDOWS\system32\VITrans\vi.sif ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}] C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\avi32.exe . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-14 12:16:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-14 12:16:40 ComboFix-quarantined-files.txt 2008-08-14 10:16:28 ComboFix2.txt 2008-08-14 09:20:26 Pre-Run: 7,543,222,272 bajtów wolnych Post-Run: 7,534,260,224 bajtów wolnych 142

log z CF

Dodano 14.08.2008 11:21:08:

djarta napisał(a):F:\WINDOWS\system32\moveex.exeF:\WINDOWS\system32\modifype.exe

nic nie znalazło

**Posty:** 684 · przez **djarta** 14 Sie 2008, 12:23

W takim razie jest czysto.

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

===========================
K .

**Posty:** 2691 · przez **Z@K** 14 Sie 2008, 14:37

raport ze skanowania kasperskim:

Kod: Zaznacz wszystko: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 14 sierpień 2008 14:36:53 System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.1 Ostatnia aktualizacja Kaspersky Anti-Virus14/08/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus1092839 ------------------------------------------------------------------------------- Ustawienia skanowania: Skanowanie przy użyciu następujących baz danych: rozszerzone Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: C:\ D:\ E:\ F:\ G:\ H:\ J:\ Statystyki skanowania: Liczba skanowanych obiektów: 104687 Liczba wykrytych wirusów: 11 Liczba zainfekowanych obiektów: 18 Liczba podejrzanych obiektów: 0 Czas trwania skanowania: 01:13:32 Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\avi32.exe Zainfekowanych: Trojan.Win32.KillAV.adr pominięty C:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP4\A0000507.exe Zainfekowanych: Trojan.Win32.KillAV.adr pominięty C:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP8\A0000911.exe Zainfekowanych: Trojan.Win32.KillAV.adr pominięty C:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP9\change.log Object is locked pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty D:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP9\change.log Object is locked pominięty E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty E:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP9\change.log Object is locked pominięty F:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty F:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty F:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty F:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty F:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty F:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty F:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty F:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty F:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty F:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty F:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty F:\Documents and Settings\User\Cookies\index.dat Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Opera\Opera\mail\indexer\indexer.dat Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Opera\Opera\mail\lexicon\lexicon.dat Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Opera\Opera\mail\mailbase.dat Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\call256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\callmember256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\chat512.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\chat8192.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\chatmember256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\chatmsg1024.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\chatmsg256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\chatmsg512.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\contactgroup256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\dyncontent\bundle.dat Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\index2.dat Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\profile16384.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\sms256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\transfer256.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\transfer512.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\user1024.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\user16384.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\user4096.dbb Object is locked pominięty F:\Documents and Settings\User\Dane aplikacji\Skype\nice_boy_4\voicemail256.dbb Object is locked pominięty F:\Documents and Settings\User\NTUSER.DAT Object is locked pominięty F:\Documents and Settings\User\ntuser.dat.LOG Object is locked pominięty F:\Documents and Settings\User\service2.exe Zainfekowanych: Trojan-Proxy.Win32.Small.ux pominięty F:\Documents and Settings\User\symant.exe Zainfekowanych: Trojan.Win32.Disabler.aq pominięty F:\Documents and Settings\User\systems.exe Zainfekowanych: Trojan.Win32.Disabler.ar pominięty F:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Last.fm\Client\Last.fm.log Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Last.fm\Client\WinampPlugin.log Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Last.fm\collection.db Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Historia\History.IE5\MSHist012008081420080815\index.dat Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\temp\etilqs_QY8QaM4EeZYb5zV Object is locked pominięty F:\Documents and Settings\User\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\sw_ae-20080814-080415.log Object is locked pominięty F:\Program Files\Common Files\Microsoft Shared\Database Replication\WZCNFLCT.EXE Zainfekowanych: Virus.Win32.Virut.a pominięty F:\Program Files\Tlen.pl\plugins\DozaKultury.tpl Zainfekowanych: not-a-virus:AdWare.Win32.Doza.a pominięty F:\Program Files\Tlen.pl\Profiles\lyzi\DataBase\chats.dat Object is locked pominięty F:\Program Files\Tlen.pl\Profiles\lyzi\DataBase\chats.idx Object is locked pominięty F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty F:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP3\A0000089.exe Zainfekowanych: Backdoor.Win32.IRCBot.dsb pominięty F:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP4\A0000146.exe Zainfekowanych: Trojan-Mailfinder.Win32.Agent.pb pominięty F:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP4\A0000522.exe Zainfekowanych: Trojan.Win32.Disabler.ar pominięty F:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP4\A0000547.exe Zainfekowanych: Trojan.Win32.Disabler.ar pominięty F:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP4\A0000574.exe Zainfekowanych: Trojan.Win32.Disabler.ar pominięty F:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP9\change.log Object is locked pominięty F:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty F:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty F:\WINDOWS\Sti_Trace.log Object is locked pominięty F:\WINDOWS\system32\CatRoot2\edb.log Object is locked pominięty F:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked pominięty F:\WINDOWS\system32\closeapp.exe Zainfekowanych: not-a-virus:RiskTool.Win32.CloseApp.a pominięty F:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty F:\WINDOWS\system32\config\default Object is locked pominięty F:\WINDOWS\system32\config\default.LOG Object is locked pominięty F:\WINDOWS\system32\config\SAM Object is locked pominięty F:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty F:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty F:\WINDOWS\system32\config\SECURITY Object is locked pominięty F:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty F:\WINDOWS\system32\config\software Object is locked pominięty F:\WINDOWS\system32\config\software.LOG Object is locked pominięty F:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty F:\WINDOWS\system32\config\system Object is locked pominięty F:\WINDOWS\system32\config\system.LOG Object is locked pominięty F:\WINDOWS\system32\drivers\sptd.sys Object is locked pominięty F:\WINDOWS\system32\h323log.txt Object is locked pominięty F:\WINDOWS\system32\KMON.OCX Zainfekowanych: not-a-virus:Monitor.Win32.KeyLogger.o pominięty F:\WINDOWS\system32\KTKBDHK3.DLL Zainfekowanych: not-a-virus:Monitor.Win32.KeyLogger.o pominięty F:\WINDOWS\system32\PAC.EXE Zainfekowanych: Trojan.Win32.VB.bcg pominięty F:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty F:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty F:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty F:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty F:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty F:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty F:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty F:\WINDOWS\system32\WISPTIS.EXE Zainfekowanych: Virus.Win32.Virut.a pominięty F:\WINDOWS\wiadebug.log Object is locked pominięty F:\WINDOWS\wiaservc.log Object is locked pominięty F:\WINDOWS\WindowsUpdate.log Object is locked pominięty G:\System Volume Information\_restore{0E59A5F8-5988-4228-AC98-8217E5C2F809}\RP9\change.log Object is locked pominięty Proces skanowania został zakończony.

**Posty:** 684 · przez **djarta** 14 Sie 2008, 14:53

1)

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\avi32.exe F:\Documents and Settings\User\service2.exe F:\Documents and Settings\User\symant.exe F:\Documents and Settings\User\systems.exe F:\Program Files\Common Files\Microsoft Shared\Database Replication\WZCNFLCT.EXE F:\Program Files\Tlen.pl\plugins\DozaKultury.tpl F:\WINDOWS\system32\closeapp.exe F:\WINDOWS\system32\KMON.OCX F:\WINDOWS\system32\KTKBDHK3.DLL F:\WINDOWS\system32\PAC.EXE F:\WINDOWS\system32\WISPTIS.EXE

Kopiujesz - klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

2)

Z folderu "System Volume Information" usuniesz poprzez chwilowe wyłączenie "Przywracania Systemu":
>Panel Sterowania>System>Przywracanie Systemu>>zaznacz w okienku przy "Wyłącz przywracanie na wszystkich dyskach">Zastosuj>OK.
Potem możesz powrócić do poprzedniego ustawienia (czyli usunąć zaznaczenie z okienka).

**Posty:** 2691 · przez **Z@K** 14 Sie 2008, 20:09

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at F:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "F:\Documents and Settings\User\service2.exe" deleted successfully. File "F:\Documents and Settings\User\symant.exe" deleted successfully. File "F:\Documents and Settings\User\systems.exe" deleted successfully. File "F:\Program Files\Common Files\Microsoft Shared\Database Replication\WZCNFLCT.EXE" deleted successfully. File "F:\Program Files\Tlen.pl\plugins\DozaKultury.tpl" deleted successfully. File "F:\WINDOWS\system32\closeapp.exe" deleted successfully. File "F:\WINDOWS\system32\KMON.OCX" deleted successfully. File "F:\WINDOWS\system32\KTKBDHK3.DLL" deleted successfully. File "F:\WINDOWS\system32\PAC.EXE" deleted successfully. File "F:\WINDOWS\system32\WISPTIS.EXE" deleted successfully. File "C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\avi32.exe" deleted successfully. Completed script processing. ******************* Finished! Terminate.

2) też wykonane

**Posty:** 684 · przez **djarta** 14 Sie 2008, 20:17

To wszystko z mojej strony.

===========================
K .

**Posty:** 2691 · przez **Z@K** 15 Sie 2008, 10:14

kurde, niby wszystko czyste, a mi znowu informacja wyskakuje ze wykryto ruchy z mojego kompa bla bla ;/

co ja mam zrobic zeby tego nie było albo jak to sprawdzic?:/

Kto jest na forum