Explorer.exe zakończenie procesu

**Posty:** 388 · przez **banior** 30 Lis 2008, 18:34

Witam!

Od kilku dni mam następujący problem. Podczas przeglądania zawartości dysku gdy wchodzę pod katalogi wyskakują mi następujące komunikaty, które raz, że mnie denerwują, a dwa, że często zmuszają mnie do restartu systemu. Dodam, że u brata na kompie dzieje się to samo.

Dodatkowo często w parze z explorer.exe pojawia sie komunikat o zamknięciu procesu drwtsn32.exe

Jak temu zaradzić?

**Posty:** 8001 · przez **Okocza** 30 Lis 2008, 18:35

banior, log z combofixa i hijacka wstaw

**Posty:** 388 · przez **banior** 30 Lis 2008, 18:53

combofix

Kod: Zaznacz wszystko: ComboFix 08-11-12.02 - Banek 2008-11-30 17:48:03.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2269 [GMT 1:00] Uruchomiony z: c:\documents and settings\Banek\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . - TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI - . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-28 do 2008-11-30 ))))))))))))))))))))))))))))))) . 2008-11-30 09:05 . 2008-11-30 09:05 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-30 08:50 . 2008-11-30 08:50 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-30 08:50 . 2008-11-30 08:50 <DIR> d-------- c:\program files\AVG 2008-11-30 08:50 . 2008-11-30 08:50 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\avg8 2008-11-30 08:50 . 2008-11-30 08:50 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-30 08:50 . 2008-11-30 08:50 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-30 08:50 . 2008-11-30 08:50 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-30 08:33 . 2008-11-30 08:33 <DIR> d--hs---- C:\FOUND.007 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-11-29 19:37 . 2008-11-29 19:37 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2008-11-29 19:37 . 2008-11-29 19:37 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-11-29 18:42 . 2008-11-29 18:42 <DIR> d-------- c:\program files\Blue Byte 2008-11-29 18:26 . 2008-11-29 18:26 <DIR> d-------- c:\program files\DOSBox-0.72 2008-11-29 09:15 . 2008-11-29 09:15 68,296 --a------ c:\windows\system32\drivers\GRD.sys 2008-11-29 09:13 . 2008-11-29 09:13 <DIR> d-------- c:\program files\Common Files\G DATA 2008-11-29 09:13 . 2008-11-29 09:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\G DATA 2008-11-29 09:13 . 2008-11-29 09:13 50,888 --a------ c:\windows\system32\drivers\MiniIcpt.sys 2008-11-29 09:13 . 2008-11-29 09:13 50,888 --a------ c:\windows\system32\drivers\GDTdiIcpt.sys 2008-11-29 08:27 . 2008-11-29 08:27 <DIR> d-------- c:\program files\Lucky18 Casino 2008-11-28 20:25 . 2008-11-28 20:25 <DIR> d-------- C:\profiles 2008-11-28 20:25 . 2008-11-28 20:25 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\BITS 2008-11-27 18:03 . 2008-11-27 18:03 <DIR> d--hs---- C:\FOUND.006 2008-11-27 11:06 . 2008-11-27 11:06 <DIR> d--hs---- C:\FOUND.005 2008-11-27 10:27 . 2008-11-27 10:27 <DIR> d--hs---- C:\FOUND.004 2008-11-27 10:01 . 2008-11-27 10:01 <DIR> d--hs---- C:\FOUND.003 2008-11-26 19:07 . 2008-11-26 19:07 <DIR> d-------- c:\windows\ServicePackFiles 2008-11-26 19:07 . 2008-04-14 22:51 294,912 --------- c:\windows\system32\dllcache\dlimport.exe 2008-11-26 18:57 . 2008-11-26 18:57 <DIR> d-------- C:\BLUEBYTE 2008-11-25 18:25 . 2008-11-25 18:25 <DIR> d-------- C:\nfs 2008-11-24 15:45 . 2008-11-24 15:45 <DIR> d-------- C:\office sharepoint2007 2008-11-23 20:59 . 2008-11-23 20:59 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Dev-Cpp 2008-11-22 21:13 . 2008-11-22 21:13 <DIR> d---s---- c:\documents and settings\Banek\UserData 2008-11-21 19:58 . 2008-11-21 19:58 <DIR> dr-h----- c:\documents and settings\Banek\Dane aplikacji\SecuROM 2008-11-21 19:58 . 2008-11-21 19:58 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-11-21 19:54 . 2008-11-21 19:54 <DIR> d-------- c:\program files\Common Files\Adobe 2008-11-21 19:46 . 2008-11-21 19:46 <DIR> d-------- c:\program files\Atari 2008-11-21 19:25 . 2008-11-21 19:25 <DIR> d-------- c:\program files\UltraISO 2008-11-21 19:25 . 2008-11-21 19:25 <DIR> d-------- c:\program files\Common Files\EZB Systems 2008-11-20 18:38 . 2008-11-20 18:38 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\OpenOffice.org2 2008-11-19 19:14 . 2008-11-19 19:14 <DIR> d-------- C:\Downloads 2008-11-19 19:13 . 2008-11-19 19:13 <DIR> d-------- c:\program files\BitComet 2008-11-19 11:48 . 2008-11-19 11:49 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\BESTplayer 2008-11-18 20:54 . 2008-11-18 20:54 626,065,408 --a------ C:\WinLite.iso 2008-11-18 20:27 . 2008-11-18 20:27 <DIR> d-------- c:\program files\nLite 2008-11-18 20:09 . 2008-11-18 20:09 <DIR> d-------- c:\program files\Intel 2008-11-18 20:09 . 2008-11-18 20:09 <DIR> d-------- C:\Intel 2008-11-18 08:00 . 2008-11-18 08:00 <DIR> d--hs---- C:\FOUND.002 2008-11-17 22:32 . 86,750 c:\windows\system32\drivers\7631126c.sys 2008-11-17 22:32 . 2008-11-17 22:32 29 --a------ c:\windows\system32\qeefaooi.tmp 2008-11-17 17:56 . 2008-11-17 17:56 <DIR> d-------- c:\program files\VSO 2008-11-17 17:56 . 2008-11-17 17:56 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Vso 2008-11-17 17:56 . 2008-11-17 17:56 94,208 --a------ c:\windows\system32\drivers\ezplay.sys 2008-11-17 17:56 . 2008-11-17 17:56 94,208 --a------ c:\documents and settings\Banek\Dane aplikacji\ezplay.sys 2008-11-17 17:56 . 2008-11-17 17:56 87,608 --a------ c:\documents and settings\Banek\Dane aplikacji\inst.exe 2008-11-17 17:56 . 2008-11-17 17:56 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys 2008-11-17 17:56 . 2008-11-17 17:56 47,360 --a------ c:\documents and settings\Banek\Dane aplikacji\pcouffin.sys 2008-11-16 15:32 . 2002-01-12 16:30 3,567 --a------ c:\windows\system32\drivers\PortTalk.sys 2008-11-16 13:33 . 2008-11-16 13:33 <DIR> d-------- c:\windows\Sun 2008-11-16 08:10 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll 2008-11-15 19:04 . 2008-11-15 19:04 <DIR> d-------- C:\Mortal Kombat PL 2008-11-15 19:03 . 2008-11-30 17:19 69 --a------ c:\windows\NeroDigital.ini 2008-11-15 18:57 . 2008-11-15 18:57 <DIR> d-------- c:\program files\MSXML 4.0 2008-11-15 16:09 . 2008-11-15 16:09 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Ahead 2008-11-15 16:09 . 2008-11-15 16:09 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ahead 2008-11-15 16:06 . 2008-11-15 16:06 <DIR> d-------- c:\program files\Nero 2008-11-15 16:06 . 2008-11-15 16:06 <DIR> d-------- c:\program files\Common Files\Ahead 2008-11-15 16:06 . 2008-11-15 16:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-11-14 20:10 . 2008-11-14 20:10 <DIR> d-------- c:\program files\TVAnts 2008-11-14 19:38 . 2006-12-10 22:32 499,712 --a------ c:\windows\system32\msvcp71.dll 2008-11-14 19:38 . 2006-12-10 22:32 348,160 --a------ c:\windows\system32\msvcr71.dll 2008-11-14 19:38 . 2008-06-08 22:58 60,273 --a------ c:\windows\system32\pthreadGC2.dll 2008-11-14 19:38 . 2008-11-02 15:02 7,680 --a------ c:\windows\system32\ff_vfw.dll 2008-11-14 19:38 . 2008-11-02 15:02 6,144 --a------ c:\windows\system32\ff_acm.acm 2008-11-14 19:38 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest 2008-11-14 19:22 . 2008-11-14 19:22 <DIR> d-------- c:\program files\ffdshow 2008-11-14 19:22 . 2008-11-14 19:22 <DIR> d-------- c:\program files\DirectShow Pack 2008-11-14 19:19 . 2008-11-14 19:19 <DIR> d-------- c:\program files\Java 2008-11-14 19:19 . 2008-11-14 19:19 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-14 19:19 . 2008-11-14 19:19 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-14 17:52 . 2008-11-14 17:52 <DIR> d-------- c:\program files\SAGEM 2008-11-14 17:35 . 2008-11-14 17:35 <DIR> d-------- c:\program files\SopCast 2008-11-13 19:47 . 2008-11-13 19:47 <DIR> d-------- C:\SportsKeeping 2008-11-13 19:06 . 2008-11-13 19:06 <DIR> d-------- c:\program files\ATI 2008-11-13 19:04 . 2008-11-13 19:04 <DIR> d-------- c:\program files\ATI Technologies 2008-11-13 19:04 . 2008-11-13 19:04 <DIR> d-------- C:\ATI 2008-11-13 17:59 . 2008-09-15 16:27 1,846,656 --------- c:\windows\system32\dllcache\win32k.sys 2008-11-13 17:51 . 2008-05-07 06:12 1,291,776 --------- c:\windows\system32\dllcache\quartz.dll 2008-11-13 17:51 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-11-13 17:51 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\dllcache\bthport.sys 2008-11-13 17:50 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys 2008-11-13 17:50 . 2008-08-14 11:04 138,496 --------- c:\windows\system32\dllcache\afd.sys 2008-11-13 17:27 . 2008-08-14 14:26 2,190,464 --------- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-13 17:27 . 2008-08-14 14:26 2,146,816 --------- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-13 17:27 . 2008-08-14 14:26 2,067,328 --------- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-13 17:27 . 2008-08-14 14:26 2,025,472 --------- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-13 17:27 . 2008-04-11 20:06 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll 2008-11-13 17:25 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-13 17:25 . 2008-05-08 15:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys 2008-11-13 15:28 . 2008-11-13 15:28 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-11-13 08:02 . 2008-10-15 17:36 337,408 --------- c:\windows\system32\dllcache\netapi32.dll 2008-11-12 21:01 . 2008-11-12 21:01 <DIR> d-------- C:\my shared folder 2008-11-12 21:01 . 2008-11-12 21:01 <DIR> d-------- C:\eMule 2008-11-12 20:56 . 2008-11-12 20:56 <DIR> d-------- C:\stery 2008-11-11 16:27 . 2008-11-11 16:27 <DIR> d-------- c:\program files\eMule 2008-11-11 14:33 . 2008-11-11 14:33 <DIR> d-------- c:\program files\Kings Bounty 2008-11-11 14:27 . 2008-11-11 14:27 54 --a------ c:\windows\VplayerINI.vpl 2008-11-11 13:50 . 2008-11-11 13:50 <DIR> d-------- c:\program files\Lavalys 2008-11-11 13:17 . 2008-11-11 14:27 868 --a------ c:\windows\VPlayer.INI 2008-11-11 13:13 . 2008-11-11 13:13 <DIR> d--h----- c:\windows\PIF 2008-11-11 12:38 . 2008-11-11 12:38 <DIR> d-------- c:\program files\Winamp 2008-11-11 12:38 . 2008-11-11 12:38 <DIR> d-------- c:\program files\Codec 2008-11-11 12:38 . 2008-11-30 17:09 95 --a------ c:\windows\winamp.ini 2008-11-11 12:37 . 2008-11-11 12:37 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Talkback 2008-11-11 12:37 . 2008-11-11 12:53 3,450 --a------ c:\windows\mozver.dat 2008-11-11 12:37 . 2008-11-11 12:37 0 --a------ c:\windows\nsreg.dat 2008-11-11 12:10 . 2008-11-11 12:10 0 --a------ c:\windows\ativpsrm.bin 2008-11-11 12:09 . 2008-10-28 21:05 593,920 --------- c:\windows\system32\ati2sgag.exe 2008-11-11 11:32 . 2008-11-11 11:32 262,144 --a------ c:\windows\system32\wrap_oal.dll 2008-11-11 11:32 . 2008-11-11 11:32 86,016 --a------ c:\windows\system32\OpenAL32.dll 2008-11-11 11:31 . 2008-11-11 11:31 <DIR> d-------- c:\windows\system32\Futuremark 2008-11-11 11:31 . 2004-10-25 20:02 21,664 --a------ c:\windows\system32\drivers\Entech.sys 2008-11-11 11:31 . 1999-11-02 10:01 6,173 --a------ c:\windows\system32\drivers\Entech.vxd . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-25 14:29 94,208 ----a-w c:\windows\DUMP6b7b.tmp 2008-11-20 18:14 2,560 ----a-w c:\windows\system32\BitCometRes.dll 2008-11-14 17:01 94,208 ----a-w c:\windows\DUMP25a8.tmp 2008-11-11 09:50 --------- d-----w c:\program files\AMD 2008-11-11 09:48 315,392 ----a-w c:\windows\HideWin.exe 2008-11-11 09:48 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-11 09:48 --------- d-----w c:\program files\Realtek 2008-11-11 09:47 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-11 09:46 --------- d-----w c:\documents and settings\Banek\Dane aplikacji\InstallShield 2008-11-11 09:38 --------- d-----w c:\program files\microsoft frontpage 2008-11-11 09:36 --------- d-----w c:\program files\Usługi online 2008-10-29 03:11 3,341,824 ----a-w c:\windows\system32\drivers\ati2mtag.sys 2008-10-29 03:11 3,341,824 ----a-w c:\windows\system32\dllcache\ati2mtag.sys 2008-10-29 02:23 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll 2008-10-29 02:22 314,880 ----a-w c:\windows\system32\ati2dvag.dll 2008-10-29 02:11 43,520 ----a-w c:\windows\system32\ati2edxx.dll 2008-10-29 02:11 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe 2008-10-29 02:11 188,416 ----a-w c:\windows\system32\atipdlxx.dll 2008-10-29 02:11 147,456 ----a-w c:\windows\system32\Oemdspif.dll 2008-10-29 02:11 10,973,184 ----a-w c:\windows\system32\atioglxx.dll 2008-10-29 02:10 143,360 ----a-w c:\windows\system32\ati2evxx.dll 2008-10-29 02:09 585,728 ----a-w c:\windows\system32\ati2evxx.exe 2008-10-29 02:07 53,248 ----a-w c:\windows\system32\ATIDDC.DLL 2008-10-29 01:58 4,041,472 ----a-w c:\windows\system32\ati3duag.dll 2008-10-29 01:49 307,200 ----a-w c:\windows\system32\atiiiexx.dll 2008-10-29 01:41 2,472,832 ----a-w c:\windows\system32\ativvaxx.dll 2008-10-29 01:25 48,640 ----a-w c:\windows\system32\amdpcom32.dll 2008-10-29 01:21 389,120 ----a-w c:\windows\system32\atikvmag.dll 2008-10-29 01:19 44,032 ----a-w c:\windows\system32\atiadlxx.dll 2008-10-29 01:19 17,408 ----a-w c:\windows\system32\atitvo32.dll 2008-10-29 01:18 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll 2008-10-29 01:18 253,952 ----a-w c:\windows\system32\atiok3x2.dll 2008-10-29 01:12 577,536 ----a-w c:\windows\system32\ati2cqag.dll 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll 2008-09-05 22:31 267,816 ------w c:\windows\system32\dllcache\wgaLogon.dll 2008-09-05 22:30 952,872 ------w c:\windows\system32\dllcache\WgaTray.exe 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\dllcache\msxml3.dll 2008-08-21 02:18 314,880 ----a-w c:\windows\system32\dllcache\ati2dvag.dll 2008-08-21 01:55 4,094,560 ----a-w c:\windows\system32\dllcache\ati3duag.dll 2008-08-21 01:38 2,377,856 ----a-w c:\windows\system32\dllcache\ativvaxx.dll 2008-08-21 01:11 561,152 ----a-w c:\windows\system32\dllcache\ati2cqag.dll 2008-08-20 05:11 668,672 ----a-w c:\windows\system32\wininet.dll 2008-08-20 05:11 668,672 ------w c:\windows\system32\dllcache\wininet.dll 2008-08-20 05:11 619,520 ------w c:\windows\system32\dllcache\urlmon.dll 2008-08-20 05:11 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll 2008-08-20 05:11 1,499,136 ------w c:\windows\system32\dllcache\shdocvw.dll 2008-08-14 13:26 2,146,816 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w c:\windows\system32\ntkrnlpa.exe . [code]<pre> ------w 1,084,053 2004-02-13 18:26:12 c:\filmy\Do filmów\Kodeki\ALLPlayer 2.0 .exe </pre>[/code] ((((((((((((((((((((((((((((( snapshot_2008-11-29_19.29.34,17 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-30 07:50:40 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys + 2008-11-30 07:38:10 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_6e0.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016] "WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-14 136600] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "abjlpdwl"="c:\windows\abjlpdwl.exe" [N/A] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-30 1234712] "nwiz"="nwiz.exe" [2006-10-31 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-11-22 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] --a------ 2008-08-29 16:11 61440 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "e:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\TVAnts\\Tvants.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "22412:TCP"= 22412:TCP:BitComet 22412 TCP "22412:UDP"= 22412:UDP:BitComet 22412 UDP R0 nvgts;nvgts;c:\windows\system32\DRIVERS\nvgts.sys [2007-08-09 102400] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-30 97928] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-30 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-30 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-30 76040] S2 rsstrqro;rsstrqro;c:\windows\system32\drivers\rsstrqro.sys [ ] S3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [2002-01-12 3567] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c5a31c0-afda-11dd-b6a1-806d6172696f}] \Shell\AutoRun\command - D:\livebox_tp.EXE *Newly Created Service* - appmgmt *Newly Created Service* - avg8emc *Newly Created Service* - avg8wd *Newly Created Service* - avgldx86 *Newly Created Service* - avgmfx86 *Newly Created Service* - avgtdix . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Banek\Dane aplikacji\Mozilla\Firefox\Profiles\dpsixy02.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-30 17:48:12 Windows 5.1.2600 Dodatek Service Pack 3 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\controlset003\Services\7631126c] "ImagePath"="\SystemRoot\System32\drivers\7631126c.sys" . Czas ukończenia: 2008-11-30 17:48:45 ComboFix-quarantined-files.txt 2008-11-30 16:48:44 ComboFix3.txt 2008-11-14 18:46:56 ComboFix2.txt 2008-11-29 18:30:34 Przed: 1 476 722 688 bajtów wolnych Po: 1,464,041,472 bajtów wolnych 298 --- E O F --- 2008-11-28 08:19:41

HiJack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:45:08, on 2008-11-30 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Winamp\Winampa.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\eMule\emule.exe E:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\Program Files\Winamp\Winamp.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\dwwin.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Downloads n\Programy\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget2 urlcatch - {1f364306-aa45-47b5-9f9d-39a8b94e7ef1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (file missing) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [abjlpdwl] %systemroot%\abjlpdwl.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &download all by flashget - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: &download by flashget - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193c772a-87be-4b19-a7bb-445b226fe9a1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 30 Lis 2008, 22:26

skasuj:

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

te plik/i :

c:\windows\system32\drivers\7631126c.sys
c:\windows\system32\qeefaooi.tmp

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 388 · przez **banior** 01 Gru 2008, 21:03

Wpis usunięty!

c:\windows\system32\qeefaooi.tmp
Tego pliku nie odnajduje..

c:\windows\system32\drivers\7631126c.sys
przy próbie skanowania tego pliku wywala komunikat

Kod: Zaznacz wszystko: The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

lub

Kod: Zaznacz wszystko: 0 bytes size received / Se ha recibido un archivo vacio

Dodam, że Plik waży 84KB i jego data modyfikacji wzrasta z minuty na minute. Jest równa bieżącemu czasowi.

**Posty:** 18165 · przez **wojtas** 01 Gru 2008, 23:08

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

c:\windows\system32\qeefaooi.tmp

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem to samo robisz z:

c:\windows\system32\drivers\7631126c.sys