F:\nie jest prawidłową aplikacją win32

**Posty:** 4 · przez **boniu** 16 Lut 2009, 19:18

Witam, mam następujący problem:
Po włożeniu płyty do napędu nie uruchamia sie autostart, i pokazuje komunikat F:\nie jest prawidłową aplikacją win32, a w przypadku ręcznego uruchamiania zacina sie komputer i pomaga tylko wyjęcie płyty z napędu.
Żadna płyta nie działa, ale np. gra która wymaga cd w napędzie uruchamia się normalnie, więc problem nie leży chyba w napędzie.
Oto logi:
Combofix

Kod: Zaznacz wszystko: ComboFix 09-02-15.01 - Boniu 2009-02-16 18:01:36.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.33 [GMT 1:00] Running from: c:\documents and settings\Boniu\Moje dokumenty\Downloads\Programs\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090216-0] *On-access scanning disabled* (Updated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Boniu\Dane aplikacji\.# c:\documents and settings\Boniu\Dane aplikacji\.#\MBX@220@3C3270.### c:\documents and settings\Boniu\Dane aplikacji\.#\MBX@220@3C3280.### . ((((((((((((((((((((((((( Files Created from 2009-01-16 to 2009-02-16 ))))))))))))))))))))))))))))))) . 2009-02-16 17:41 . 2009-02-16 17:41 <DIR> d-------- c:\program files\Trend Micro 2009-02-16 17:25 . 2009-02-16 17:34 <DIR> d-------- c:\program files\Spyware Doctor 2009-02-16 17:25 . 2009-02-16 17:25 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\PC Tools 2009-02-16 17:25 . 2009-02-16 18:01 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-02-16 17:25 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys 2009-02-16 17:25 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys 2009-02-16 17:25 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys 2009-02-16 17:25 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys 2009-02-11 19:39 . 2009-02-11 19:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Last.fm 2009-02-11 19:38 . 2009-02-11 19:38 <DIR> d-------- c:\program files\Last.fm 2009-02-11 14:27 . 2009-02-11 14:28 <DIR> d-------- c:\program files\Nowe Gadu-Gadu 2009-02-11 13:48 . 2009-02-11 13:48 <DIR> d-------- c:\program files\JRE 2009-02-11 13:47 . 2009-02-11 14:08 <DIR> d-------- c:\windows\SxsCaPendDel 2009-02-11 13:42 . 2009-02-11 13:42 <DIR> d-------- c:\program files\Common Files\Java 2009-02-09 15:45 . 2009-02-09 15:45 <DIR> d-------- c:\program files\Common Files\Corel 2009-02-06 16:00 . 2009-02-06 16:00 <DIR> d--hs---- C:\found.000 2009-02-05 17:30 . 2009-02-05 17:30 394 --a------ c:\windows\capture.ini 2009-02-05 12:48 . 2009-02-16 17:00 23 --a------ c:\windows\BlendSettings.ini 2009-02-04 16:52 . 2009-02-04 16:53 <DIR> d-------- c:\program files\4Musics WMA to MP3 Converter 2009-02-04 16:52 . 2007-11-01 18:53 42,880 --a------ c:\windows\system32\drivers\vacs2xkd.sys 2009-02-04 16:52 . 2001-03-17 22:34 22,528 --a------ c:\windows\system32\WNASPI32.DLL 2009-02-04 16:52 . 2002-07-17 09:05 16,512 --a------ c:\windows\system32\drivers\ASPI32.SYS 2009-02-03 14:57 . 2009-02-03 14:57 <DIR> d-------- c:\windows\system32\AGEIA 2009-02-03 14:57 . 2009-02-03 14:57 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2009-02-03 14:57 . 2009-02-03 14:58 <DIR> d-------- c:\program files\AGEIA Technologies 2009-02-02 08:38 . 2009-02-02 08:38 <DIR> d-------- c:\program files\Morrowind 2009-02-01 16:14 . 2009-02-01 16:14 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\fltk.org 2009-01-31 16:50 . 2009-01-31 16:50 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\Corel 2009-01-31 16:48 . 2009-01-31 16:48 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\InstallShield 2009-01-26 18:40 . 2009-01-26 18:41 284 --a------ c:\windows\gfscore.ini 2009-01-26 13:42 . 2009-01-26 14:05 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\SecondLife 2009-01-26 10:02 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll 2009-01-26 10:02 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll 2009-01-26 09:58 . 2009-01-26 09:58 <DIR> d-------- c:\windows\Logs 2009-01-24 18:05 . 2009-01-24 18:05 0 --a------ c:\windows\nsreg.dat 2009-01-19 10:48 . 2009-01-19 10:48 <DIR> d-------- c:\program files\Chainer 2009-01-19 10:48 . 2009-01-19 10:48 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\Xlutop 2009-01-19 10:47 . 2006-01-12 10:18 22,752 --a------ c:\windows\system32\drivers\bumxmidi.sys 2009-01-19 10:41 . 2004-08-03 23:07 59,264 --a------ c:\windows\system32\drivers\USBAUDIO.sys 2009-01-19 10:41 . 2004-08-03 23:07 59,264 --a--c--- c:\windows\system32\dllcache\usbaudio.sys 2009-01-18 19:47 . 2009-01-18 19:47 <DIR> d-------- c:\windows\system32\IOSUBSYS . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-16 17:04 --------- d-----w c:\documents and settings\Boniu\Dane aplikacji\DMCache 2009-02-16 16:06 --------- d-----w c:\program files\Internet Download Manager 2009-02-11 12:48 --------- d-----w c:\program files\OpenOffice.org 3 2009-02-11 12:43 --------- d-----w c:\program files\Java 2009-02-05 11:20 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-31 15:44 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-18 18:47 --------- d-----w c:\program files\Google 2009-01-17 23:46 --------- d-----w c:\program files\IDoser v4 2009-01-13 13:53 --------- d-----w c:\documents and settings\Boniu\Dane aplikacji\IDM 2009-01-08 18:14 --------- d-----w c:\program files\Pineapple Works 2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr 2009-01-02 11:32 --------- d-----w c:\program files\BrainWave Generator 2009-01-01 11:52 --------- d-----w c:\program files\VIA 2008-12-29 16:20 --------- d-----w c:\program files\Common Files\LightScribe 2008-12-29 16:20 --------- d-----w c:\documents and settings\Boniu\Dane aplikacji\Ahead 2008-12-29 16:17 --------- d-----w c:\program files\Common Files\Ahead 2008-12-29 16:12 --------- d-----w c:\program files\Nero 2008-12-29 16:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-29 16:04 --------- d-----w c:\program files\Ahead 2008-12-27 17:07 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Total Gameplay 2008-12-25 19:26 --------- d-----w c:\program files\Intel Desktop Board 2008-12-21 14:50 --------- d-----w c:\program files\Opera 2008-12-19 18:22 --------- d-----w c:\program files\Exact Audio Copy . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-11-18 12:58 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-11-05 2607616] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 344064] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-12-18 307200] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "CorelDRAW Graphics Suite 11b"="e:\programy\Corel Draw\Languages\PL\Programs\Registration.exe" [2004-06-23 733184] "SoundMan"="SOUNDMAN.EXE" [2004-07-01 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-01-01 585728] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "e:\\Gry\\Tactical ops\\System\\TacticalOps.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10189:TCP"= 10189:TCP:BitCometLite 10189 TCP "10189:UDP"= 10189:UDP:BitCometLite 10189 UDP R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-24 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-11-24 20560] R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-11-25 33792] R3 EuMusDesignVirtualAudioCableWdm_s2x;Sound2x Audio Cable (WDM);c:\windows\system32\drivers\vacs2xkd.sys [2009-02-04 42880] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2009-02-04 16512] S3 BCUMXMIDI;BCUMXMIDI;c:\windows\system32\drivers\bumxmidi.sys [2009-01-19 22752] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-16 356920] --- Other Services/Drivers In Memory --- *NewlyCreated* - IKFILESEC *NewlyCreated* - IKSYSFLT *NewlyCreated* - IKSYSSEC *NewlyCreated* - MCHINJDRV *NewlyCreated* - SDAUXSERVICE *NewlyCreated* - SDCORESERVICE *Deregistered* - mchInjDrv . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.daemon-search.com/startpage IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Ściągnij przez IDM - c:\program files\Internet Download Manager\IEExt.htm IE: Ściągnij wszystkie linki przez IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Ściągnij zawartość wideo FLV przez IDM - c:\program files\Internet Download Manager\IEGetVL.htm LSP: c:\windows\system32\idmmbc.dll TCP: {FB28A2A4-7231-46E9-BB32-9783D7371BD0} = 213.172.186.4,195.136.250.200 FF - ProfilePath - c:\documents and settings\Boniu\Dane aplikacji\Mozilla\Firefox\Profiles\ynu7um87.default\ FF - prefs.js: browser.startup.homepage - hxxp://portal.opera.com FF - component: c:\documents and settings\Boniu\Dane aplikacji\IDM\idmmzcc2\components\idmmzcc.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-16 18:04:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{6ad96eed-4303-43ef-bfdd-af576101fef9}] @Denied: (Full) (Everyone) "Model"=dword:0000001f "Therad"=dword:0000000f "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):a9,c1,34,ac,d3,dd,b3,cf,78,3d,a3,45,fa,6a,88,d1,2c,65,11,98,f7, 81,8f,a4,cb,80,e3,56,45,2c,22,73,c2,7e,b2,a2,bf,1c,d4,d4,00,00,00,00,00,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(696) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(760) c:\windows\system32\idmmbc.dll . Completion time: 2009-02-16 18:06:12 ComboFix-quarantined-files.txt 2009-02-16 17:05:55 Pre-Run: 1,053,519,872 bajtów wolnych Post-Run: 2,131,664,896 bajtów wolnych 209

Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:18:00, on 2009-02-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\explorer.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] E:\Programy\Corel Draw\Languages\PL\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=022409 serial=DR12CNC-8322248-NFT lang=PL O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Ściągnij przez IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Ściągnij zawartość wideo FLV przez IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{FB28A2A4-7231-46E9-BB32-9783D7371BD0}: NameServer = 213.172.186.4,195.136.250.200 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 8700 bytes

Z góry dziękuje za wszelką możliwą pomoc.

**Posty:** 18165 · przez **wojtas** 16 Lut 2009, 19:33

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 4 · przez **boniu** 17 Lut 2009, 20:27

Kaspersky nic nie wykrył, ale dalej nie działa, choć już się nie zacina. Po otworzeniu F:/ pojawia sie tylko autorun, a reszty plików nie widać.

**Posty:** 300 · przez **sgsman** 17 Lut 2009, 20:55

A czy wykonałeś skan uzywając Dr. CureIt oraz FixIEDef?

**Posty:** 4 · przez **boniu** 17 Lut 2009, 21:07

tak, dr. curelt wykrył jednego trojana. usunelem.

**Posty:** 18165 · przez **wojtas** 19 Lut 2009, 00:21

daj jeszcze nowego loga z combofixa

**Posty:** 4 · przez **boniu** 19 Lut 2009, 16:40

Kod: Zaznacz wszystko: ComboFix 09-02-18.01 - Boniu 2009-02-19 15:25:56.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.259 [GMT 1:00] Running from: c:\documents and settings\Boniu\Moje dokumenty\Downloads\Programs\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090218-0] *On-access scanning disabled* (Updated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2009-01-19 to 2009-02-19 ))))))))))))))))))))))))))))))) . 2009-02-18 19:00 . 2009-02-18 19:00 <DIR> d-------- c:\windows\system32\pl-PL 2009-02-18 18:54 . 2009-02-18 19:00 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-18 18:54 . 2009-02-18 18:54 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-18 18:54 . 2009-02-18 18:54 <DIR> d-------- c:\program files\MSBuild 2009-02-18 18:53 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2009-02-18 18:45 . 2009-02-18 18:45 <DIR> d-------- c:\program files\MSXML 6.0 2009-02-18 18:22 . 2009-02-19 10:32 <DIR> d-------- c:\program files\Prec 2009-02-17 19:22 . 2009-02-17 19:22 <DIR> d-------- c:\windows\ERUNT 2009-02-17 19:22 . 2009-02-17 19:22 <DIR> d-------- C:\ERDNT 2009-02-17 19:21 . 2009-02-17 19:21 <DIR> d-------- C:\!FixIEDef 2009-02-17 17:14 . 2009-02-17 17:44 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\Nowe Gadu-Gadu 2009-02-17 15:52 . 2009-02-17 15:52 <DIR> d-------- c:\windows\Sun 2009-02-16 19:38 . 2009-02-16 19:53 <DIR> d-------- c:\documents and settings\Boniu\DoctorWeb 2009-02-16 17:41 . 2009-02-16 17:41 <DIR> d-------- c:\program files\Trend Micro 2009-02-16 17:25 . 2009-02-16 17:34 <DIR> d-------- c:\program files\Spyware Doctor 2009-02-16 17:25 . 2009-02-16 17:25 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\PC Tools 2009-02-16 17:25 . 2009-02-16 18:01 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-02-16 17:25 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys 2009-02-16 17:25 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys 2009-02-16 17:25 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys 2009-02-16 17:25 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys 2009-02-11 19:39 . 2009-02-11 19:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Last.fm 2009-02-11 19:38 . 2009-02-11 19:38 <DIR> d-------- c:\program files\Last.fm 2009-02-11 14:27 . 2009-02-11 14:28 <DIR> d-------- c:\program files\Nowe Gadu-Gadu 2009-02-11 13:48 . 2009-02-11 13:48 <DIR> d-------- c:\program files\JRE 2009-02-11 13:47 . 2009-02-11 14:08 <DIR> d-------- c:\windows\SxsCaPendDel 2009-02-11 13:42 . 2009-02-11 13:42 <DIR> d-------- c:\program files\Common Files\Java 2009-02-09 15:45 . 2009-02-09 15:45 <DIR> d-------- c:\program files\Common Files\Corel 2009-02-06 16:00 . 2009-02-06 16:00 <DIR> d--hs---- C:\found.000 2009-02-05 17:30 . 2009-02-05 17:30 394 --a------ c:\windows\capture.ini 2009-02-05 12:48 . 2009-02-18 10:25 23 --a------ c:\windows\BlendSettings.ini 2009-02-04 16:52 . 2009-02-04 16:53 <DIR> d-------- c:\program files\4Musics WMA to MP3 Converter 2009-02-04 16:52 . 2007-11-01 18:53 42,880 --a------ c:\windows\system32\drivers\vacs2xkd.sys 2009-02-04 16:52 . 2001-03-17 22:34 22,528 --a------ c:\windows\system32\WNASPI32.DLL 2009-02-04 16:52 . 2002-07-17 09:05 16,512 --a------ c:\windows\system32\drivers\ASPI32.SYS 2009-02-03 14:57 . 2009-02-03 14:57 <DIR> d-------- c:\windows\system32\AGEIA 2009-02-03 14:57 . 2009-02-03 14:57 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2009-02-03 14:57 . 2009-02-03 14:58 <DIR> d-------- c:\program files\AGEIA Technologies 2009-02-02 08:38 . 2009-02-02 08:38 <DIR> d-------- c:\program files\Morrowind 2009-02-01 16:14 . 2009-02-01 16:14 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\fltk.org 2009-01-31 16:50 . 2009-01-31 16:50 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\Corel 2009-01-31 16:48 . 2009-01-31 16:48 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\InstallShield 2009-01-26 18:40 . 2009-01-26 18:41 284 --a------ c:\windows\gfscore.ini 2009-01-26 13:42 . 2009-01-26 14:05 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\SecondLife 2009-01-26 10:02 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll 2009-01-26 10:02 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll 2009-01-26 09:58 . 2009-01-26 09:58 <DIR> d-------- c:\windows\Logs 2009-01-24 18:05 . 2009-01-24 18:05 0 --a------ c:\windows\nsreg.dat 2009-01-19 10:48 . 2009-01-19 10:48 <DIR> d-------- c:\program files\Chainer 2009-01-19 10:48 . 2009-01-19 10:48 <DIR> d-------- c:\documents and settings\Boniu\Dane aplikacji\Xlutop 2009-01-19 10:47 . 2006-01-12 10:18 22,752 --a------ c:\windows\system32\drivers\bumxmidi.sys 2009-01-19 10:41 . 2004-08-03 23:07 59,264 --a------ c:\windows\system32\drivers\USBAUDIO.sys 2009-01-19 10:41 . 2004-08-03 23:07 59,264 --a--c--- c:\windows\system32\dllcache\usbaudio.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-19 14:25 --------- d-----w c:\documents and settings\Boniu\Dane aplikacji\DMCache 2009-02-18 19:05 --------- d-----w c:\documents and settings\Boniu\Dane aplikacji\IDM 2009-02-17 14:52 --------- d-----w c:\program files\AskBarDis 2009-02-16 16:06 --------- d-----w c:\program files\Internet Download Manager 2009-02-11 12:48 --------- d-----w c:\program files\OpenOffice.org 3 2009-02-11 12:43 --------- d-----w c:\program files\Java 2009-02-05 11:20 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-31 15:44 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-18 18:47 --------- d-----w c:\program files\Google 2009-01-17 23:46 --------- d-----w c:\program files\IDoser v4 2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr 2009-01-02 11:32 --------- d-----w c:\program files\BrainWave Generator 2009-01-01 11:52 --------- d-----w c:\program files\VIA 2008-12-29 16:20 --------- d-----w c:\program files\Common Files\LightScribe 2008-12-29 16:20 --------- d-----w c:\documents and settings\Boniu\Dane aplikacji\Ahead 2008-12-29 16:17 --------- d-----w c:\program files\Common Files\Ahead 2008-12-29 16:12 --------- d-----w c:\program files\Nero 2008-12-29 16:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-29 16:04 --------- d-----w c:\program files\Ahead 2008-12-27 17:07 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Total Gameplay 2008-12-25 19:26 --------- d-----w c:\program files\Intel Desktop Board 2008-12-21 14:50 --------- d-----w c:\program files\Opera 2008-12-19 18:22 --------- d-----w c:\program files\Exact Audio Copy . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-11-18 12:58 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-11-05 2607616] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360] "Prec"="c:\program files\Prec\PrecStarter.exe" [2009-01-25 508014] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 344064] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-12-18 307200] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "CorelDRAW Graphics Suite 11b"="e:\programy\Corel Draw\Languages\PL\Programs\Registration.exe" [2004-06-23 733184] "SoundMan"="SOUNDMAN.EXE" [2004-07-01 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-01-01 585728] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 16:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-08-04 00:02 36352 c:\program files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "e:\\Gry\\Tactical ops\\System\\TacticalOps.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10189:TCP"= 10189:TCP:BitCometLite 10189 TCP "10189:UDP"= 10189:UDP:BitCometLite 10189 UDP R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-24 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-11-24 20560] R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-11-25 33792] R3 EuMusDesignVirtualAudioCableWdm_s2x;Sound2x Audio Cable (WDM);c:\windows\system32\drivers\vacs2xkd.sys [2009-02-04 42880] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2009-02-04 16512] S3 BCUMXMIDI;BCUMXMIDI;c:\windows\system32\drivers\bumxmidi.sys [2009-01-19 22752] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-16 356920] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.daemon-search.com/startpage IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Ściągnij przez IDM - c:\program files\Internet Download Manager\IEExt.htm IE: Ściągnij wszystkie linki przez IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Ściągnij zawartość wideo FLV przez IDM - c:\program files\Internet Download Manager\IEGetVL.htm LSP: c:\windows\system32\idmmbc.dll TCP: {FB28A2A4-7231-46E9-BB32-9783D7371BD0} = 213.172.186.4,195.136.250.200 FF - ProfilePath - c:\documents and settings\Boniu\Dane aplikacji\Mozilla\Firefox\Profiles\ynu7um87.default\ FF - prefs.js: browser.startup.homepage - hxxp://portal.opera.com FF - component: c:\documents and settings\Boniu\Dane aplikacji\IDM\idmmzcc2\components\idmmzcc.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-19 15:28:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{6ad96eed-4303-43ef-bfdd-af576101fef9}] @Denied: (Full) (Everyone) "Model"=dword:0000001f "Therad"=dword:0000000f "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):a9,c1,34,ac,d3,dd,b3,cf,78,3d,a3,45,fa,6a,88,d1,2c,65,11,98,f7, 81,8f,a4,cb,80,e3,56,45,2c,22,73,c2,7e,b2,a2,bf,1c,d4,d4,00,00,00,00,00,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(700) c:\windows\system32\Ati2evxx.dll c:\windows\system32\CLBCATQ.DLL - - - - - - - > 'lsass.exe'(756) c:\windows\system32\idmmbc.dll . Completion time: 2009-02-19 15:29:33 ComboFix-quarantined-files.txt 2009-02-19 14:29:16 Pre-Run: 5 686 824 960 bajtów wolnych Post-Run: 5,671,841,792 bajtów wolnych 212

**Posty:** 18165 · przez **wojtas** 19 Lut 2009, 17:13

ja tu nic nie widzę złego...

Kto jest na forum