Dziwny pulpit, nie ma wielu funkcji

**Posty:** 16 · przez **paczek1262** 16 Paź 2008, 20:25

Witam,

Sądzę, że na pendrivie siedziało coś bardzo złego i przeszło niestety na mój komputer. Mianowicie: ni stad ni zowąd tapeta zmieniła mi się screen:

http://i37.tinypic.com/wb8gtc.jpg

Przeskanowałem komputer programem Malwarebytes' Anti-Malware, który już kiedyś mi pomógł. Ograniczyłem skanowanie tylko do dysku C. Usunąłem wszystkie zainfekowane pliki, ale niestety nie pomogło. Było tez kilka plików, ktorych program nie potrafił usunąć i poinformował mnie o tym, kaząc wejsc w zakladke Logi. To log, który mam w zakładce logi w tym programie:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.25 Wersja bazy definicji: 1062 Windows 5.1.2600 Dodatek Service Pack 2 19:56:50 2008-10-16 mbam-log-10-16-2008 (19-56-50).txt Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|F:\|G:\|H:\|) Przeskanowane obiekty: 78470 Upłynęło: 17 minute(s), 33 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 4 Zainfekowane klucze rejestru: 23 Zainfekowane wartości rejestru: 1 Zainfekowane pliki rejestru: 2 Zainfekowane foldery: 0 Zainfekowane pliki: 214 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: C:\WINDOWS\system32\iiffCUKd.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\wnbpsalf.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\eerhlbqr.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\eirzuy.dll (Trojan.Vundo.H) -> Delete on reboot. Zainfekowane klucze rejestru: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36447b47-beb3-4495-95a5-ddd7ff887ca9} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{36447b47-beb3-4495-95a5-ddd7ff887ca9} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5faa605d-89bb-4c88-9d52-473f8abca733} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{5faa605d-89bb-4c88-9d52-473f8abca733} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winjy76 (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\winjy76 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winjy76 (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\myo55 (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\myo55 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\myo55 (Rootkit.Agent) -> Delete on reboot. Zainfekowane wartości rejestru: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30b4ef34 (Trojan.Vundo.H) -> Quarantined and deleted successfully. Zainfekowane pliki rejestru: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iiffcukd -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iiffcukd -> Delete on reboot. Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\WINDOWS\system32\eirzuy.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\iiffCUKd.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\dKUCffii.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dKUCffii.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wnbpsalf.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\flaspbnw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\eerhlbqr.dll (Trojan.Vundo.H) -> Delete on reboot. C:\Documents and Settings\user\Ustawienia lokalne\Temporary Internet Files\Content.IE5\01KLMN6P\nd82m0[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Documents and Settings\user\Ustawienia lokalne\Temporary Internet Files\Content.IE5\S9UJ8HE3\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP10\A0008838.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0008893.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0008902.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0008912.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0008922.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0008960.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0009014.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0009037.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0009047.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0010057.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP12\A0010067.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010115.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010127.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010132.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010142.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010147.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010158.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010181.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010190.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010200.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP13\A0010168.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP14\A0010279.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP14\A0010231.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP14\A0010269.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP14\A0010289.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP15\A0011294.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP15\A0012306.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP15\A0012317.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP15\A0012369.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0012436.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0012465.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0012475.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0012484.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0012524.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0012535.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013535.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013545.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013558.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013567.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013577.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013620.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0013631.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0014631.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0014642.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0014648.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0014745.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015745.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015754.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015765.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015776.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015787.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015798.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015807.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015813.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0014699.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0017963.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015863.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015874.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0015887.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0016901.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0016952.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0017974.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP16\A0017985.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP17\A0018007.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP17\A0017998.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP17\A0018017.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP17\A0018027.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP17\A0018036.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP17\A0018050.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0018072.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0018125.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019181.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019243.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019249.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019288.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019348.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019359.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP18\A0019466.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019490.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019499.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019510.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019521.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019531.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019623.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019657.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019670.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019755.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019766.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP19\A0019780.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP20\A0019900.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0020033.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0020071.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0021103.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0021139.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0021176.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023373.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0021258.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0021273.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0022286.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0022294.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023294.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023310.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023320.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023331.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023341.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023352.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023362.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023383.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023389.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023406.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023441.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023453.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023459.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023494.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023505.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023515.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023526.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0023537.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0024537.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0024543.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP21\A0024554.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024634.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024643.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024653.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024737.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024773.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024727.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024812.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024846.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024857.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024894.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024929.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0024968.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025018.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025053.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025087.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025123.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025134.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025140.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025182.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP25\A0025193.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP26\A0025624.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP26\A0025634.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP26\A0025647.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP26\A0025660.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP26\A0025673.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP26\A0025712.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP27\A0025732.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP27\A0025746.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP27\A0025759.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP27\A0025768.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP27\A0026768.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001049.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001081.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001090.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0000019.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001131.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001168.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001186.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001204.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001119.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001147.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001158.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001176.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001195.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001214.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001224.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0001229.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0002239.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0002244.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP3\A0002249.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0003254.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0004262.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0004270.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0004283.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0005308.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0005298.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP4\A0005342.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP5\A0007356.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP5\A0008420.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP5\A0008435.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP5\A0008445.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP6\A0008509.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP6\A0008519.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP6\A0008555.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP6\A0008564.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP6\A0008583.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008613.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008626.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008631.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008643.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008652.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008662.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP7\A0008674.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008711.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008716.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008724.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008733.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008742.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008752.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008761.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP8\A0008770.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{E5A053CF-DF16-4C08-B252-C9CF67AF90C8}\RP9\A0008827.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\Winjy76.sys (Rootkit.Agent) -> Delete on reboot. C:\WINDOWS\system32\drivers\Myo55.sys (Rootkit.Agent) -> Delete on reboot.

Pozdrawiam i liczę na szybką pomoc

**Posty:** 8001 · przez **Okocza** 16 Paź 2008, 20:28

paczek1262,

po 1: popraw nazwę tematu

po 2: wstaw log z combofixa

po 3; wstaw log z hijacka

**Posty:** 16 · przez **paczek1262** 16 Paź 2008, 20:43

tutaj dołączam logi

Z Combofix:

Kod: Zaznacz wszystko: ComboFix 08-10-15.08 - user 2008-10-16 20:33:06.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.653 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\user\Pulpit\gta\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\Documents and Settings\All Users\Menu Start\Programy\Antivirus XP 2008.lnk C:\Documents and Settings\user\Menu Start\Programy\Autostart\ctfmon.exe C:\Program Files\akl C:\Program Files\akl\akl.dll C:\Program Files\akl\akl.exe C:\Program Files\akl\uninstall.exe C:\Program Files\akl\unsetup.exe C:\Program Files\Inet Delivery C:\Program Files\Inet Delivery\inetdl.exe C:\Program Files\Inet Delivery\intdel.exe C:\Recycled\Recycled C:\Recycled\Recycled\ctfmon.exe C:\WINDOWS\a.bat C:\WINDOWS\base64.tmp C:\WINDOWS\bdn.com C:\WINDOWS\esmf.exe C:\WINDOWS\FVProtect.exe C:\WINDOWS\grfxbanodkx.dll C:\WINDOWS\iTunesMusic.exe C:\WINDOWS\mslagent C:\WINDOWS\mslagent\2_mslagent.dll C:\WINDOWS\mslagent\mslagent.exe C:\WINDOWS\mslagent\uninstall.exe C:\WINDOWS\mssecu.exe C:\WINDOWS\ngwstxfd.dll C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\body.gif C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\capt2.gif C:\WINDOWS\privacy_danger\images\red.gif C:\WINDOWS\privacy_danger\images\text.gif C:\WINDOWS\privacy_danger\index.htm C:\WINDOWS\qrbgltos.dll C:\WINDOWS\rosqxvmn.dll C:\WINDOWS\services.exe C:\WINDOWS\system32\akttzn.exe C:\WINDOWS\system32\cenzura!.dll C:\WINDOWS\system32\awtoolb.dll C:\WINDOWS\system32\bdn.com C:\WINDOWS\system32\bsva-egihsg52.exe C:\WINDOWS\system32\cbXqpQiG.dll C:\WINDOWS\system32\dpcproxy.exe C:\WINDOWS\system32\drivers\578.exe c:\windows\system32\Drivers\Winqs53.sys C:\WINDOWS\system32\efcCuVpn.dll C:\WINDOWS\system32\emesx.dll C:\WINDOWS\system32\h@tkeysh@@k.dll C:\WINDOWS\system32\hoproxy.dll C:\WINDOWS\system32\hxiwlgpm.dat C:\WINDOWS\system32\hxiwlgpm.exe C:\WINDOWS\system32\ljJCvWoL.dll C:\WINDOWS\system32\medup012.dll C:\WINDOWS\system32\medup020.dll C:\WINDOWS\system32\msgp.exe C:\WINDOWS\system32\msnbho.dll C:\WINDOWS\system32\mssecu.exe C:\WINDOWS\system32\msvchost.exe C:\WINDOWS\system32\mtr2.exe C:\WINDOWS\system32\mwin32.exe C:\WINDOWS\system32\netode.exe C:\WINDOWS\system32\newsd32.exe C:\WINDOWS\system32\opnklMCS.dll C:\WINDOWS\system32\ps1.exe C:\WINDOWS\system32\psof1.exe C:\WINDOWS\system32\psoft1.exe C:\WINDOWS\system32\regc64.dll C:\WINDOWS\system32\regm64.dll C:\WINDOWS\system32\Rundl1.exe C:\WINDOWS\system32\smp C:\WINDOWS\system32\smp\msrc.exe C:\WINDOWS\system32\sncntr.exe C:\WINDOWS\system32\ssurf022.dll C:\WINDOWS\system32\ssvchost.com C:\WINDOWS\system32\ssvchost.exe C:\WINDOWS\system32\sysreq.exe C:\WINDOWS\system32\taack.dat C:\WINDOWS\system32\taack.exe C:\WINDOWS\system32\temp#01.exe C:\WINDOWS\system32\thun.dll C:\WINDOWS\system32\thun32.dll C:\WINDOWS\system32\VBIEWER.OCX C:\WINDOWS\system32\vbsys2.dll C:\WINDOWS\system32\vcatchpi.dll C:\WINDOWS\system32\WinCtrl32.dl_ C:\WINDOWS\system32\WinCtrl32.dll C:\WINDOWS\system32\winlogonpc.exe C:\WINDOWS\system32\winsystem.exe C:\WINDOWS\system32\WINWGPX.EXE C:\WINDOWS\userconfig9x.dll C:\WINDOWS\winsystem.exe C:\WINDOWS\zip1.tmp C:\WINDOWS\zip2.tmp C:\WINDOWS\zip3.tmp C:\WINDOWS\zipped.tmp D:\Autorun.inf E:\Autorun.inf F:\Autorun.inf G:\Autorun.inf H:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINQS53 -------\Service_Winqs53 ((((((((((((((((((((((((( Pliki utworzone od 2008-09-16 do 2008-10-16 ))))))))))))))))))))))))))))))) . 2008-10-16 19:31 . 2008-10-16 19:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\mxorqbgf 2008-10-16 19:31 . 2008-10-16 19:31 86,016 --a------ C:\WINDOWS\system32\topgfynm.exe 2008-10-16 19:31 . 2008-10-16 18:18 86,016 --a------ C:\WINDOWS\lomxeqsn.exe 2008-10-16 19:16 . 2008-10-16 19:32 46,130 --a------ C:\Autorun.exe 2008-10-16 18:46 . 2008-10-16 18:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-10 13:03 . 2008-10-10 13:03 <DIR> d-------- C:\Program Files\Audacity 2008-10-09 23:57 . 2008-10-09 23:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2008-10-09 23:54 . 2008-10-09 23:54 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-10-09 19:20 . 2008-10-09 19:20 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-10-09 19:20 . 2008-10-09 19:20 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Sony 2008-10-09 19:20 . 2002-12-17 16:23 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll 2008-10-09 19:20 . 2002-10-20 14:05 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Program Files\Vstplugins 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Program Files\Sony 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony 2008-10-09 19:11 . 2008-10-09 19:11 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Sony Setup 2008-10-09 19:10 . 2008-10-09 19:10 <DIR> d-------- C:\Program Files\Sony Setup 2008-10-06 21:12 . 2008-10-06 21:12 <DIR> d-------- C:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 18:37 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Skype 2008-10-16 17:37 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware 2008-10-09 21:55 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-15 21:33 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Mobipocket 2008-09-15 21:29 --------- d-----w C:\Program Files\Mobipocket.com 2008-09-13 16:30 --------- d-----w C:\Program Files\SopCast 2008-09-10 15:52 --------- d-----w C:\Program Files\FM Modifier 2.2 2008-08-31 20:44 --------- d-----w C:\Program Files\ESKK MemoPlus 2008-08-29 14:59 --------- d-----w C:\Program Files\eMaestro!_eng 2008-08-26 15:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\buzcdwbm 2008-08-26 15:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\wvcdovmd 2008-08-26 15:36 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Malwarebytes 2008-08-26 15:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes 2008-08-26 14:58 --------- d-----w C:\Program Files\bzkxmid 2008-08-19 16:08 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Apple Computer 2008-08-17 13:01 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-17 13:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 790528] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 486856] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 25448488] "Steam"="d:\program files\valve\steam\steam.exe" [2008-10-08 1410296] "GenAct"="C:\WINDOWS\system32\topgfynm.exe" [2008-10-16 86016] "SrvUtil"="C:\WINDOWS\system32\bmburudy.exe" [2008-10-16 86016] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-29 180269] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "8xv51J5teF"="C:\Documents and Settings\All Users\Dane aplikacji\mxorqbgf\obebadsr.exe" [2008-10-16 61440] C:\Documents and Settings\user\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-07 113664] RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-07 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=eirzuy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll schannel.dll digest.dll msnsspc.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Myo55.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winjy76.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvs64.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "G:\\Program Files\\Valve\\hl.exe"= "G:\\Program Files\\Counter-Strike\\hl.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "G:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"= "G:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "D:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\noname1908\\counter-strike\\hl.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\noname1908\\condition zero\\hl.exe"= "G:\\Program Files\\Counter-Strike\\hlds.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12418:TCP"= 12418:TCP:BitComet 12418 TCP "12418:UDP"= 12418:UDP:BitComet 12418 UDP S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e137818-45c6-11dd-bda8-0019666967c8}] \Shell\AutoRun\command - J:\autorun.exe \Shell\setup\command - J:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e137819-45c6-11dd-bda8-0019666967c8}] \Shell\AutoRun\command - K:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e13781a-45c6-11dd-bda8-0019666967c8}] \Shell\AutoRun\command - L:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73ab36d0-841e-11dd-8ba9-0019666967c8}] \Shell\AutoRun\command - N:\jdhc2x2.com \Shell\explore\Command - N:\jdhc2x2.com \Shell\open\Command - N:\jdhc2x2.com . Zawartość folderu 'Zaplanowane zadania' 2008-10-08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{083B32AD-4448-4F60-B38B-BBD1C8197630} - C:\WINDOWS\grfxbanodkx.dll BHO-{6BE4A5AD-9A67-43A8-9C3D-D2D68BA1057A} - C:\WINDOWS\system32\iiffCUKd.dll BHO-{7BFC15A1-449A-4837-B2BB-9DA6A33F099E} - C:\WINDOWS\system32\opnklMCS.dll Toolbar-{148BDBE0-051C-4B70-84B3-889274D33E60} - C:\WINDOWS\rosqxvmn.dll HKLM-Run-Cmaudio - cmicnfg.cpl ShellExecuteHooks-{7BFC15A1-449A-4837-B2BB-9DA6A33F099E} - C:\WINDOWS\system32\opnklMCS.dll SSODL-qrbgltos-{6C2CCEC5-2D81-4905-91A3-04D1886E504A} - C:\WINDOWS\qrbgltos.dll SSODL-ngwstxfd-{39BF0253-26A4-4931-AC4E-DF2376C95D01} - C:\WINDOWS\ngwstxfd.dll . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\6qqwymoq.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-16 20:37:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... C:\WINDOWS\system32\bmburudy.exe 86016 bytes executable skanowanie pomyślnie ukończone ukryte pliki: 1 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-10-16 20:40:16 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-16 18:40:07 Przed: 3 404 656 640 bajtów wolnych Po: 3,656,024,064 bajtów wolnych 281 --- E O F --- 2008-09-10 09:06:50

Z Hijackhis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:41, on 2008-10-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe C:\Documents and Settings\All Users\Dane aplikacji\mxorqbgf\obebadsr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Skype\Phone\Skype.exe D:\program files\valve\steam\steam.exe C:\WINDOWS\system32\topgfynm.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Opera\opera.exe C:\Documents and Settings\user\Pulpit\gta\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [GenAct] C:\WINDOWS\system32\topgfynm.exe O4 - HKCU\..\Run: [SrvUtil] C:\WINDOWS\system32\bmburudy.exe O4 - HKLM\..\Policies\Explorer\Run: [8xv51J5teF] C:\Documents and Settings\All Users\Dane aplikacji\mxorqbgf\obebadsr.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: eirzuy.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5699 bytes

Combofix usunął tą tapete z pulpitu, mam już normalny zegar i mogę poruszać się normalnie po menu start, ale nadal mam ikony niebieski i wyskakuje informacja taka jak przy zaporze Servie Pack 2 "Odblokuj, Blokuj nadal" tylko, ze w jezyku angielskim - pewnie z winy wirusa.

**Posty:** 8001 · przez **Okocza** 16 Paź 2008, 20:57

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\topgfynm.exe C:\WINDOWS\lomxeqsn.exe C:\Autorun.exe Folder:: C:\Documents and Settings\All Users\Dane aplikacji\mxorqbgf C:\Program Files\bzkxmid Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e137818-45c6-11dd-bda8-0019666967c8}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e137819-45c6-11dd-bda8-0019666967c8}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e13781a-45c6-11dd-bda8-0019666967c8}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73ab36d0-841e-11dd-8ba9-0019666967c8}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [GenAct] C:\WINDOWS\system32\topgfynm.exe O4 - HKCU\..\Run: [SrvUtil] C:\WINDOWS\system32\bmburudy.exe O20 - AppInit_DLLs: eirzuy.dll

to na fix w hj

**Posty:** 16 · przez **paczek1262** 16 Paź 2008, 21:10

Okocza napisał(a):
Kod: Zaznacz wszystko
O4 - HKCU\..\Run: [GenAct] C:\WINDOWS\system32\topgfynm.exe O4 - HKCU\..\Run: [SrvUtil] C:\WINDOWS\system32\bmburudy.exe O20 - AppInit_DLLs: eirzuy.dll

to na fix w hj

czyli otworzyc notatnik zapisac tak jak mówiłes i przeciągnąc na HiJack?

Tutaj log z Combofixa:

Kod: Zaznacz wszystko: ComboFix 08-10-15.08 - user 2008-10-16 21:07:40.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.589 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\user\Pulpit\gta\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\user\Pulpit\gta\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\Autorun.exe C:\WINDOWS\lomxeqsn.exe C:\WINDOWS\system32\topgfynm.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-16 do 2008-10-16 ))))))))))))))))))))))))))))))) . 2008-10-16 20:51 . 2008-10-16 20:51 77,824 --a------ C:\Setup_ver1.1779.2.exe 2008-10-16 20:38 . 2008-10-16 20:38 86,016 --a------ C:\WINDOWS\system32\bmburudy.exe 2008-10-16 18:46 . 2008-10-16 18:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-10 13:03 . 2008-10-10 13:03 <DIR> d-------- C:\Program Files\Audacity 2008-10-09 23:57 . 2008-10-09 23:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2008-10-09 23:54 . 2008-10-09 23:54 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-10-09 19:20 . 2008-10-09 19:20 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-10-09 19:20 . 2008-10-09 19:20 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Sony 2008-10-09 19:20 . 2002-12-17 16:23 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll 2008-10-09 19:20 . 2002-10-20 14:05 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Program Files\Vstplugins 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Program Files\Sony 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony 2008-10-09 19:11 . 2008-10-09 19:11 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Sony Setup 2008-10-09 19:10 . 2008-10-09 19:10 <DIR> d-------- C:\Program Files\Sony Setup 2008-10-06 21:12 . 2008-10-06 21:12 <DIR> d-------- C:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 18:50 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Skype 2008-10-16 17:37 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware 2008-10-16 16:49 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-10-09 21:55 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-15 21:33 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Mobipocket 2008-09-15 21:29 --------- d-----w C:\Program Files\Mobipocket.com 2008-09-13 16:30 --------- d-----w C:\Program Files\SopCast 2008-09-10 15:52 --------- d-----w C:\Program Files\FM Modifier 2.2 2008-08-31 20:44 --------- d-----w C:\Program Files\ESKK MemoPlus 2008-08-29 14:59 --------- d-----w C:\Program Files\eMaestro!_eng 2008-08-26 15:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\buzcdwbm 2008-08-26 15:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\wvcdovmd 2008-08-26 15:36 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Malwarebytes 2008-08-26 15:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes 2008-08-26 14:58 45,568 ----a-w C:\WINDOWS\system32\onenitgz.exe 2008-08-19 16:08 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Apple Computer 2008-08-17 13:01 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-17 13:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 790528] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 486856] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 25448488] "Steam"="d:\program files\valve\steam\steam.exe" [2008-10-08 1410296] "SrvUtil"="C:\WINDOWS\system32\bmburudy.exe" [2008-10-16 86016] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-29 180269] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] C:\Documents and Settings\user\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-07 113664] RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-07 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=eirzuy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll schannel.dll digest.dll msnsspc.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Myo55.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winjy76.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvs64.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "G:\\Program Files\\Valve\\hl.exe"= "G:\\Program Files\\Counter-Strike\\hl.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "G:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"= "G:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "D:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\noname1908\\counter-strike\\hl.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\noname1908\\condition zero\\hl.exe"= "G:\\Program Files\\Counter-Strike\\hlds.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12418:TCP"= 12418:TCP:BitComet 12418 TCP "12418:UDP"= 12418:UDP:BitComet 12418 UDP S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568] . Zawartość folderu 'Zaplanowane zadania' 2008-10-08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-16 21:08:20 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-16 21:08:53 ComboFix-quarantined-files.txt 2008-10-16 19:08:51 ComboFix2.txt 2008-10-16 19:02:43 ComboFix3.txt 2008-10-16 18:40:17 Przed: 3 615 281 152 bajtów wolnych Po: 3,605,946,368 bajtów wolnych 145 --- E O F --- 2008-09-10 09:06:50

**Posty:** 8001 · przez **Okocza** 16 Paź 2008, 21:15

paczek1262 napisał(a):czyli otworzyc notatnik zapisac tak jak mówiłes i przeciągnąc na HiJack?

hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

Kod: Zaznacz wszystko: C:\WINDOWS\system32\bmburudy.exe

użyj programu killbox i usuń ten plik - lub ręcznie.

**Posty:** 16 · przez **paczek1262** 16 Paź 2008, 21:51

Okej, zrobiłem wszystko tak jak napisałes. Prawie wszystko jest już dobrze tylko te niebieskie ikony nie dają mi spokoju

http://i35.tinypic.com/3163nrb.jpg

Wiesz jak temu zaradzić?

I bardzo dziękuję Ci za cierpliwość i za czas, który mi poświęciłes.

**Posty:** 8001 · przez **Okocza** 16 Paź 2008, 21:53

Prawy klik na Mój komputer->Własciwości->Zaawansowane->Ustawienia
(przycisk w grupie "Wydajność")->Użyj cieni dla etykiet ikon pulpitu

paczek1262 napisał(a):I bardzo dziękuję Ci za cierpliwość i za czas, który mi poświęciłes.

od tego tu jesteśmy

**Posty:** 18165 · przez **wojtas** 16 Paź 2008, 22:04

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
"appinit_dlls"=""

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem:

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Myo55.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winjy76.sys]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvs64.sys]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

te plik/i :

C:\WINDOWS\system32\onenitgz.exe

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow + nowy log z combofixa oraz Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 16 · przez **paczek1262** 16 Paź 2008, 23:07

Raport ze skanów

http://www.virustotal.com/pl/analisis/36f75ba8f3e0d65df0092db8593dce87 - dałem link. Mam nadzieje, ze wyswietli sie Wam to samo co mi.

I drugi raport (muszę skopiowac z tabeli na tamtej stronie. Nie ma zadnego "pokaz raprt"):

Kod: Zaznacz wszystko: Scan taken on 16 Oct 2008 20:43:05 (GMT) A-Squared Found nothing AntiVir Found TR/Crypt.XPACK.Gen ArcaVir Found nothing Avast Found Win32:Bravix AVG Antivirus Found SHeur.CEUP BitDefender Found Packer.Malware.Lighty.C ClamAV Found nothing CPsecure Found nothing Dr.Web Found Trojan.Packed.612 F-Prot Antivirus Found nothing F-Secure Anti-Virus Found Hoax.Win32.Renos.vawf G DATA Found Win32:Bravix Ikarus Found Hoax.Win32.Renos.vawf Kaspersky Anti-Virus Found Hoax.Win32.Renos.vawf NOD32 Found nothing Norman Virus Control Found W32/Lighty.C Panda Antivirus Found nothing Sophos Antivirus Found Mal/EncPk-EQ VirusBuster Found nothing VBA32 Found OScope.Downloader.Braviax.5

A obszar całego komputera przeskanuję jutro, dziś zajeło by mi to za duzo czasu. Jeszcze mam pytanie, czy log combofixa wykonac tym sposobem najechania tym plikiem .txt na ikonke combofixa, czy po prostu go uruchomic?

**Posty:** 18165 · przez **wojtas** 17 Paź 2008, 15:37

skasuj ten plik do kosza:

C:\WINDOWS\system32\onenitgz.exe

combofixa odpal normlanie i czekamy tez na raport ze skanu calego kompa..

**Posty:** 16 · przez **paczek1262** 17 Paź 2008, 23:03

Tutaj raport saknowania

http://paczek1262.w.interii.pl/aaaa.html

Log z Combofixa:

Kod: Zaznacz wszystko: ComboFix 08-10-15.08 - user 2008-10-17 22:53:37.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.518 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\user\Pulpit\gta\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-17 do 2008-10-17 ))))))))))))))))))))))))))))))) . 2008-10-16 22:54 . 2008-10-16 22:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-16 22:54 . 2008-10-16 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-16 20:51 . 2008-10-16 20:51 77,824 --a------ C:\Setup_ver1.1779.2.exe 2008-10-16 18:46 . 2008-10-16 18:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI 2008-10-10 13:03 . 2008-10-10 13:03 <DIR> d-------- C:\Program Files\Audacity 2008-10-09 23:57 . 2008-10-09 23:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2008-10-09 23:54 . 2008-10-09 23:54 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-10-09 19:20 . 2008-10-09 19:20 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-10-09 19:20 . 2008-10-09 19:20 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Sony 2008-10-09 19:20 . 2002-12-17 16:23 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll 2008-10-09 19:20 . 2002-10-20 14:05 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Program Files\Vstplugins 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Program Files\Sony 2008-10-09 19:19 . 2008-10-09 19:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony 2008-10-09 19:11 . 2008-10-09 19:11 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Sony Setup 2008-10-09 19:10 . 2008-10-09 19:10 <DIR> d-------- C:\Program Files\Sony Setup 2008-10-06 21:12 . 2008-10-06 21:12 <DIR> d-------- C:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-17 20:50 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Skype 2008-10-16 17:37 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware 2008-10-16 16:49 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-10-09 21:55 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-15 21:33 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Mobipocket 2008-09-15 21:29 --------- d-----w C:\Program Files\Mobipocket.com 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-13 16:30 --------- d-----w C:\Program Files\SopCast 2008-09-10 15:52 --------- d-----w C:\Program Files\FM Modifier 2.2 2008-08-31 20:44 --------- d-----w C:\Program Files\ESKK MemoPlus 2008-08-29 14:59 --------- d-----w C:\Program Files\eMaestro!_eng 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 15:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\buzcdwbm 2008-08-26 15:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\wvcdovmd 2008-08-26 15:36 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Malwarebytes 2008-08-26 15:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes 2008-08-20 05:38 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-19 16:08 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Apple Computer 2008-08-17 13:01 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-17 13:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys 2008-08-14 13:46 2,137,600 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,017,280 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((( snapshot@2008-10-16_20.39.49.39 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-20 05:34:06 1,024,000 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\browseui.dll + 2008-08-20 05:33:59 151,552 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\cdfview.dll + 2008-08-20 05:34:00 1,055,744 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\danim.dll + 2008-08-20 05:34:00 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\dxtmsft.dll + 2008-08-20 05:34:00 205,312 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\dxtrans.dll + 2008-08-20 05:34:00 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\extmgr.dll + 2008-08-19 09:38:57 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\iedw.exe + 2008-08-20 05:34:01 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\iepeers.dll + 2008-08-20 05:34:01 96,768 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\inseng.dll + 2008-08-20 05:34:05 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\jsproxy.dll + 2008-08-20 05:34:10 3,088,384 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\mshtml.dll + 2008-08-20 05:34:05 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\mshtmled.dll + 2008-08-20 05:34:01 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\msrating.dll + 2008-08-20 05:34:01 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\mstime.dll + 2008-08-20 05:34:01 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\pngfilt.dll + 2008-08-20 05:34:03 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\shdocvw.dll + 2008-08-20 05:34:05 474,112 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\shlwapi.dll + 2008-08-19 09:51:53 369,152 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\spru0415.dll + 2008-08-20 05:34:07 620,032 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\urlmon.dll + 2008-08-20 05:34:04 670,208 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\wininet.dll + 2008-08-20 05:11:06 3,088,896 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3GDR\mshtml.dll + 2008-08-20 05:11:04 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3GDR\shdocvw.dll + 2008-08-20 05:11:04 619,520 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3GDR\urlmon.dll + 2008-08-20 05:11:04 668,672 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3GDR\wininet.dll + 2008-08-20 05:07:44 3,088,896 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3QFE\mshtml.dll + 2008-08-20 05:07:42 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3QFE\shdocvw.dll + 2008-08-20 05:07:42 620,032 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3QFE\urlmon.dll + 2008-08-20 05:07:42 669,184 ----a-w C:\WINDOWS\$hf_mig$\KB956390\SP3QFE\wininet.dll + 2007-11-30 11:21:28 19,320 ----a-w C:\WINDOWS\$hf_mig$\KB956390\spmsg.dll + 2007-11-30 11:21:28 234,360 ----a-w C:\WINDOWS\$hf_mig$\KB956390\spuninst.exe + 2007-11-30 11:21:28 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB956390\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w C:\WINDOWS\$hf_mig$\KB956390\update\update.exe + 2007-11-30 12:40:47 398,200 ----a-w C:\WINDOWS\$hf_mig$\KB956390\update\updspapi.dll - 2007-02-28 16:04:45 2,137,600 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe + 2008-08-14 13:46:46 2,137,600 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe - 2007-02-28 16:04:56 2,058,880 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe + 2008-08-14 13:46:58 2,059,008 ------w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe - 2007-02-28 16:04:47 2,017,280 ------w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe + 2008-08-14 13:46:44 2,017,280 ------w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe - 2007-02-28 16:04:58 2,181,632 ------w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe + 2008-08-14 13:46:56 2,181,632 ------w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe - 2008-06-23 15:41:35 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll + 2008-08-20 05:38:45 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll - 2008-06-23 15:41:35 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll + 2008-08-20 05:38:38 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll - 2008-06-23 15:41:36 1,055,744 ----a-w C:\WINDOWS\system32\danim.dll + 2008-08-20 05:38:39 1,055,744 ----a-w C:\WINDOWS\system32\danim.dll - 2008-06-20 10:44:38 138,368 -c--a-w C:\WINDOWS\system32\dllcache\afd.sys + 2008-08-14 09:51:43 138,368 -c--a-w C:\WINDOWS\system32\dllcache\afd.sys - 2008-06-23 15:41:35 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll + 2008-08-20 05:38:45 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll - 2008-06-23 15:41:35 151,552 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll + 2008-08-20 05:38:38 151,552 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll - 2008-06-23 15:41:36 1,055,744 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll + 2008-08-20 05:38:39 1,055,744 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll - 2008-06-23 15:41:36 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-08-20 05:38:39 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2008-06-23 15:41:36 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-08-20 05:38:39 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2008-06-23 15:41:36 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-08-20 05:38:39 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2008-06-23 09:49:29 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe + 2008-08-19 09:30:39 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe - 2008-06-23 15:41:36 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll + 2008-08-20 05:38:40 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll - 2008-06-23 15:41:36 96,768 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll + 2008-08-20 05:38:40 96,768 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll - 2008-06-23 15:41:36 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-08-20 05:38:43 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2008-06-23 15:41:37 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-08-20 05:38:48 3,081,216 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll - 2008-06-23 15:41:37 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-08-20 05:38:43 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2008-06-23 15:41:37 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-08-20 05:38:40 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2008-06-23 15:41:37 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-08-20 05:38:41 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2007-02-28 16:04:45 2,137,600 -c----w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe + 2008-08-14 13:46:46 2,137,600 -c----w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe - 2007-02-28 16:04:56 2,058,880 -c----w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe + 2008-08-14 13:46:58 2,059,008 -c----w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe - 2007-02-28 16:04:47 2,017,280 -c----w C:\WINDOWS\system32\dllcache\ntkrpamp.exe + 2008-08-14 13:46:44 2,017,280 -c----w C:\WINDOWS\system32\dllcache\ntkrpamp.exe - 2007-02-28 16:04:58 2,181,632 -c----w C:\WINDOWS\system32\dllcache\ntoskrnl.exe + 2008-08-14 13:46:56 2,181,632 -c----w C:\WINDOWS\system32\dllcache\ntoskrnl.exe - 2008-06-23 15:41:37 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-08-20 05:38:41 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2008-06-23 15:41:37 1,494,528 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll + 2008-08-20 05:38:42 1,494,528 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll - 2008-06-23 15:41:37 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll + 2008-08-20 05:38:44 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll - 2006-08-14 10:34:41 332,928 -c--a-w C:\WINDOWS\system32\dllcache\srv.sys + 2008-08-28 10:04:17 333,056 -c--a-w C:\WINDOWS\system32\dllcache\srv.sys - 2008-06-23 15:41:37 616,960 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-08-20 05:38:45 616,960 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2008-03-20 08:09:45 1,845,504 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys + 2008-09-15 15:40:58 1,846,272 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys - 2008-06-23 15:41:38 662,016 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-08-20 05:38:43 662,016 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll - 2008-06-20 10:44:38 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys + 2008-08-14 09:51:43 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys - 2008-06-23 15:41:36 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-08-20 05:38:39 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2008-06-23 15:41:36 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-08-20 05:38:39 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2008-06-23 15:41:36 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-08-20 05:38:39 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll - 2008-10-10 04:59:49 116,560 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-10-17 07:27:13 116,560 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2008-06-23 15:41:36 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll + 2008-08-20 05:38:40 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll - 2008-06-23 15:41:36 96,768 ----a-w C:\WINDOWS\system32\inseng.dll + 2008-08-20 05:38:40 96,768 ----a-w C:\WINDOWS\system32\inseng.dll - 2008-06-23 15:41:36 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-08-20 05:38:43 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2005-05-24 10:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-10-21 19:40:14 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-10-21 19:40:16 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2008-06-23 15:41:37 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-08-20 05:38:48 3,081,216 ----a-w C:\WINDOWS\system32\mshtml.dll - 2008-06-23 15:41:37 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-08-20 05:38:43 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2008-06-23 15:41:37 146,432 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-08-20 05:38:40 146,432 ----a-w C:\WINDOWS\system32\msrating.dll - 2008-06-23 15:41:37 532,480 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-08-20 05:38:41 532,480 ----a-w C:\WINDOWS\system32\mstime.dll - 2008-06-23 15:41:37 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-08-20 05:38:41 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2008-06-23 15:41:37 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll + 2008-08-20 05:38:42 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll - 2008-06-23 15:41:37 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll + 2008-08-20 05:38:44 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll - 2007-11-30 12:40:46 19,320 ------w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 11:21:28 19,320 ------w C:\WINDOWS\system32\spmsg.dll - 2008-06-23 15:41:37 616,960 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-08-20 05:38:45 616,960 ----a-w C:\WINDOWS\system32\urlmon.dll - 2008-07-03 09:42:47 369,152 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2008-08-19 09:51:53 369,152 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2008-10-17 17:21:21 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_244.dat . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 790528] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-14 486856] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 25448488] "Steam"="d:\program files\valve\steam\steam.exe" [2008-10-08 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 32881] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-29 180269] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] C:\Documents and Settings\user\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-07 113664] RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-07 113664] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll schannel.dll digest.dll msnsspc.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "G:\\Program Files\\Valve\\hl.exe"= "G:\\Program Files\\Counter-Strike\\hl.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "G:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"= "G:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "D:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\noname1908\\counter-strike\\hl.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\noname1908\\condition zero\\hl.exe"= "G:\\Program Files\\Counter-Strike\\hlds.exe"= "F:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12418:TCP"= 12418:TCP:BitComet 12418 TCP "12418:UDP"= 12418:UDP:BitComet 12418 UDP S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568] . Zawartość folderu 'Zaplanowane zadania' 2008-10-08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\6qqwymoq.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-17 22:54:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-17 22:55:38 ComboFix-quarantined-files.txt 2008-10-17 20:55:36 ComboFix2.txt 2008-10-16 19:08:54 ComboFix3.txt 2008-10-16 19:02:43 ComboFix4.txt 2008-10-16 18:40:17 Przed: 3 308 257 280 bajtów wolnych Po: 3,299,319,808 bajtów wolnych 286 --- E O F --- 2008-10-17 05:20:31

**Posty:** 18165 · przez **wojtas** 18 Paź 2008, 12:19

zobacz na raport ze skanu kasprem... znalazlo bardzo duzo zainfekowanych plikow, nawet pliki .exe od gier.. wiec wszystko co skan Ci wskazał musisz usunąc.. ale wtedy gry nie beda chodzic itp,,, oraz:

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 16 · przez **paczek1262** 18 Paź 2008, 14:57

Tyle tylko, ze ta opcje mam wyłączoną.

A co do tych wszystkich zainfekowanych plikow. W ogole nie mam takiego folderu jak

C:\System Volume Information\

Nie mam go po wejsciu w dysk C. I widac ukryte foldery.

**Posty:** 54 · przez **Box** 18 Paź 2008, 16:38

Wejdź do jakiegoś folderu

Narzędzia -> Opcje folderów -> zakładka "Widok" -> odznacz opcję "Ukryj chronione pliki systemu operacyjnego (zalecane)"

**Posty:** 16 · przez **paczek1262** 18 Paź 2008, 16:54

Box rzeczywiscie pomoglo, ale nie moge ani tego folderu otworzyc, ani usnac. Ciagle wyskakuje odmowa dostepu, a kasper pokazał ze caly folder jest w wirusach.

Sorka, ze tak Wam truje dupe

**Posty:** 18165 · przez **wojtas** 18 Paź 2008, 16:55

tryb awaryjny wlacz (F8 przy starcie kompa i tam usuwaj wszytko)

**Posty:** 16 · przez **paczek1262** 18 Paź 2008, 21:44

Okej, dzieki Wam za wszystkie rady. Pomoglo.