folder winfile

**Posty:** 688 · przez **freestyler** 23 Wrz 2007, 10:34

pojawil sie dzisiaj na kazdej partycji... kiedys juz mialem z nim przeboje skonczylo sie wykasowaniem wszystkich plikow exe mam nadzieje ze teraz tak sie nie stanie

logi:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:26, on 2007-09-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\Mstray.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Zdalne sterowanie\X10srvs.exe
C:\Program Files\Zdalne sterowanie\X10clns.exe
C:\Documents and Settings\Freestyler\Menu Start\Programy\Autostart\ctfmon.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Freestyler\Pulpit\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RavTimeXP] C:\WINDOWS\Mstray.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [Zdalne sterowanie - serwer] C:\Program Files\Zdalne sterowanie\X10srvs.exe -port 10000 -password X10
O4 - HKCU\..\Run: [Zdalne sterowanie] C:\Program Files\Zdalne sterowanie\X10clns.exe -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ctfmon.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 5698 bytes

combofix

ComboFix 07-09-21.2 - "Freestyler" 2007-09-23 10:25:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.475 [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\mstray.exe
C:\WINDOWS\system32\plugin1.dat
C:\WINDOWS\system32\scvhost.exe
D:\Autorun.inf
E:\Autorun.inf
I:\Autorun.inf
J:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-08-23 to 2007-09-23 )))))))))))))))))))))))))))))))
.

2007-09-18 19:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\NVIDIA
2007-09-18 19:41 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-09-18 19:40 <DIR> d-------- C:\NVIDIA
2007-09-15 22:35 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-15 22:35 22,328 --a------ C:\DOCUME~1\FREEST~1\DANEAP~1\PnkBstrK.sys
2007-09-15 22:34 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-09-15 22:33 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-09-08 12:07 <DIR> d-------- C:\DOCUME~1\FREEST~1\SystemRequirementsLab
2007-09-05 22:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\X10 Commander
2007-09-05 21:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\X10 Settings
2007-09-05 21:07 18,560 --a------ C:\WINDOWS\system32\drivers\x10ufx2.sys
2007-09-05 21:07 127,184 --a------ C:\WINDOWS\Unwise.exe
2007-09-05 21:07 <DIR> d-------- C:\Program Files\Zdalne sterowanie
2007-09-05 21:07 <DIR> d-------- C:\Program Files\Common Files\X10
2007-09-05 21:07 <DIR> d-------- C:\Program Files\AHSDK
2007-09-05 21:07 <DIR> d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\PSq
2007-09-05 19:47 <DIR> d-------- C:\Program Files\GameSpy Arcade
2007-09-05 19:46 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-09-05 19:46 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll
2007-08-29 17:47 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-08-25 15:49 <DIR> d-------- C:\Program Files\FreeCommander
2007-08-25 15:49 <DIR> d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\FreeCommander
2007-08-24 07:36 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-08-24 07:36 <DIR> d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\Real
2007-08-24 07:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-23 10:28 --------- d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\uTorrent
2007-09-23 09:57 --------- d-------- C:\Program Files\MSN Messenger
2007-09-20 19:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-20 17:30 --------- d-------- C:\Program Files\Mozilla Thunderbird
2007-09-18 20:16 --------- d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP
2007-09-13 22:04 2350 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-05 21:11 --------- d-------- C:\Program Files\Winamp
2007-08-22 17:12 2251776 --a------ C:\WINDOWS\system32\kernel1.exe
2007-08-18 08:33 --------- d-------- C:\Program Files\uTorrent
2007-08-17 15:53 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help
2007-08-15 20:33 --------- d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\ATI
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-29 17:51 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-07-28 22:37 --------- d-a------ C:\Program Files\XnView
2007-07-28 15:14 --------- d-------- C:\Program Files\Futuremark
2007-07-27 21:15 --------- d-------- C:\Program Files\Fraps
2007-07-27 19:15 --------- d-------- C:\Program Files\Gigabyte
2007-07-25 15:24 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-07-14 12:41 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-12 09:12 81920 --a------ C:\WINDOWS\system32\frapsvid.dll
2007-07-05 17:14 126976 --a------ C:\WINDOWS\War3Unin.exe
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvusmb.exe
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvugart.exe
2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin
2007-06-27 13:01 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-04-09 16:08 53765 ---h----- C:\Program Files\Program Files.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 17:56 C:\WINDOWS\system32\CTHELPER.EXE]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 23:33]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 17:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 20:31]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-06-28 17:00]
"Zdalne sterowanie - serwer"="C:\Program Files\Zdalne sterowanie\X10srvs.exe" [2006-02-23 00:29]
"Zdalne sterowanie"="C:\Program Files\Zdalne sterowanie\X10clns.exe" [2006-02-23 17:52]

C:\DOCUME~1\FREEST~1\MENUST~1\Programy\AUTOST~1\
ctfmon.exe [2006-09-14 08:21:48]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Freestyler^Menu Start^Programy^Autostart^ctfmon.exe]
path=C:\Documents and Settings\Freestyler\Menu Start\Programy\Autostart\ctfmon.exe
backup=C:\windows\pss\ctfmon.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
R3 XUIF;X10 USB Wireless Transceiver;C:\WINDOWS\system32\Drivers\x10ufx2.sys
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- E:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
AutoRun\command- C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- I:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
AutoRun\command- C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- J:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8a204fd5-4ffb-11dc-ae7b-000feaff31b3}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- K:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d25c44c-1b01-11dc-adea-000feaff31b3}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- J:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f133be4-1910-11dc-94ee-806d6172696f}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- I:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f133be5-1910-11dc-94ee-806d6172696f}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- J:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9c8f036-19e2-11dc-ade8-000feaff31b3}]
AutoRun\command- C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f85671b9-1db8-11dc-adef-000feaff31b3}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- Recycled\ctfmon.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-23 10:28:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [644] 0x846D4438

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-23 10:29:42
C:\ComboFix-quarantined-files.txt ... 2007-09-23 10:29
.
--- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Wrz 2007, 10:42

skasuj:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - Startup: ctfmon.exe << bedzie w autostarcie

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8a204fd5-4ffb-11dc-ae7b-000feaff31b3}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f133be4-1910-11dc-94ee-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f133be5-1910-11dc-94ee-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9c8f036-19e2-11dc-ade8-000feaff31b3}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f85671b9-1db8-11dc-adef-000feaff31b3}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje
Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt

potem kasujesz foldery WINFILE i dajesz nowe logi

Autor postu otrzymał pochwałę

**Posty:** 688 · przez **freestyler** 23 Wrz 2007, 11:17

wydaje se ze jest ok logi:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:07:24, on 2007-09-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Zdalne sterowanie\X10srvs.exe
C:\Program Files\Zdalne sterowanie\X10clns.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Freestyler\Pulpit\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [Zdalne sterowanie - serwer] C:\Program Files\Zdalne sterowanie\X10srvs.exe -port 10000 -password X10
O4 - HKCU\..\Run: [Zdalne sterowanie] C:\Program Files\Zdalne sterowanie\X10clns.exe -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 5431 bytes

ComboFix 07-09-21.2 - "Freestyler" 2007-09-23 11:08:09.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.633 [GMT 2:00]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf
E:\Autorun.inf
I:\Autorun.inf
J:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-08-23 to 2007-09-23 )))))))))))))))))))))))))))))))
.

2007-09-23 11:00 <DIR> d-------- C:\WINDOWS\ERUNT
2007-09-18 19:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\NVIDIA
2007-09-18 19:41 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-09-18 19:40 <DIR> d-------- C:\NVIDIA
2007-09-15 22:35 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-15 22:35 22,328 --a------ C:\DOCUME~1\FREEST~1\DANEAP~1\PnkBstrK.sys
2007-09-15 22:34 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-09-15 22:33 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-09-08 12:07 <DIR> d-------- C:\DOCUME~1\FREEST~1\SystemRequirementsLab
2007-09-05 22:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\X10 Commander
2007-09-05 21:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\X10 Settings
2007-09-05 21:07 18,560 --a------ C:\WINDOWS\system32\drivers\x10ufx2.sys
2007-09-05 21:07 127,184 --a------ C:\WINDOWS\Unwise.exe
2007-09-05 21:07 <DIR> d-------- C:\Program Files\Zdalne sterowanie
2007-09-05 21:07 <DIR> d-------- C:\Program Files\Common Files\X10
2007-09-05 21:07 <DIR> d-------- C:\Program Files\AHSDK
2007-09-05 21:07 <DIR> d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\PSq
2007-09-05 19:47 <DIR> d-------- C:\Program Files\GameSpy Arcade
2007-09-05 19:46 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-09-05 19:46 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll
2007-08-29 17:47 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-08-25 15:49 <DIR> d-------- C:\Program Files\FreeCommander
2007-08-25 15:49 <DIR> d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\FreeCommander
2007-08-24 07:36 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-08-24 07:36 <DIR> d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\Real
2007-08-24 07:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-23 10:37 --------- d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\uTorrent
2007-09-23 09:57 --------- d-------- C:\Program Files\MSN Messenger
2007-09-20 19:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-20 17:30 --------- d-------- C:\Program Files\Mozilla Thunderbird
2007-09-18 20:16 --------- d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP
2007-09-13 22:04 2350 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-05 21:11 --------- d-------- C:\Program Files\Winamp
2007-08-22 17:12 2251776 --a------ C:\WINDOWS\system32\kernel1.exe
2007-08-18 08:33 --------- d-------- C:\Program Files\uTorrent
2007-08-17 15:53 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help
2007-08-15 20:33 --------- d-------- C:\DOCUME~1\FREEST~1\DANEAP~1\ATI
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-29 17:51 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-07-28 22:37 --------- d-a------ C:\Program Files\XnView
2007-07-28 15:14 --------- d-------- C:\Program Files\Futuremark
2007-07-27 21:15 --------- d-------- C:\Program Files\Fraps
2007-07-27 19:15 --------- d-------- C:\Program Files\Gigabyte
2007-07-25 15:24 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-07-14 12:41 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-12 09:12 81920 --a------ C:\WINDOWS\system32\frapsvid.dll
2007-07-05 17:14 126976 --a------ C:\WINDOWS\War3Unin.exe
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvusmb.exe
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-06-29 01:54 356352 --a------ C:\WINDOWS\system32\nvugart.exe
2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin
2007-06-27 13:01 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-04-09 16:08 53765 ---h----- C:\Program Files\Program Files.exe
.

((((((((((((((((((((((((((((( snapshot_2007-09-23_102857,21 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 163,328 2007-09-23 06:52:19 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
----a-w 4,390,912 2007-09-23 09:00:19 C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
----a-w 159,744 2007-09-23 09:00:19 C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
----a-w 163,328 2007-09-23 06:52:19 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
----a-w 4,390,912 2007-09-23 09:00:18 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
----a-w 159,744 2007-09-23 09:00:18 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 17:56 C:\WINDOWS\system32\CTHELPER.EXE]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 23:33]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 17:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 20:31]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-06-28 17:00]
"Zdalne sterowanie - serwer"="C:\Program Files\Zdalne sterowanie\X10srvs.exe" [2006-02-23 00:29]
"Zdalne sterowanie"="C:\Program Files\Zdalne sterowanie\X10clns.exe" [2006-02-23 17:52]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Freestyler^Menu Start^Programy^Autostart^ctfmon.exe]
path=C:\Documents and Settings\Freestyler\Menu Start\Programy\Autostart\ctfmon.exe
backup=C:\windows\pss\ctfmon.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);C:\WINDOWS\system32\drivers\pe3ah4nc.sys
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);C:\WINDOWS\system32\drivers\ps6ah4nc.sys
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
R3 XUIF;X10 USB Wireless Transceiver;C:\WINDOWS\system32\Drivers\x10ufx2.sys
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);C:\WINDOWS\system32\pr2ah4nc.exe svc
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d25c44c-1b01-11dc-adea-000feaff31b3}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command- J:\Recycled\ctfmon.exe

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-23 11:10:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [2996] 0x84A3AB30

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-23 11:12:17
C:\ComboFix-quarantined-files.txt ... 2007-09-23 11:12
C:\ComboFix2.txt ... 2007-09-23 10:29
.
--- E O F ---

SDFix: Version 1.107

Run by Freestyler on 2007-09-23 at 11:00

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing SharedAccess Service

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe:*:Disabled:Sunbelt Firewall GUI"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

Files with Hidden Attributes:

Mon 9 Apr 2007 53,765 ...H. --- "C:\Program Files\Program Files.exe"
Thu 14 Sep 2006 20,480 ..SHR --- "C:\Recycled\ctfmon.exe"
Tue 24 May 2005 503,808 A..H. --- "C:\Program Files\Konnekt\konnekt.exe"
Mon 9 Apr 2007 53,765 ...H. --- "C:\Program Files\MSN Messenger\MSN Messenger.exe"
Thu 14 Sep 2006 20,480 ..SHR --- "C:\Recycled\Recycled\ctfmon.exe"
Sun 23 Sep 2007 120 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Thu 13 Sep 2007 1,745 ...HR --- "C:\Documents and Settings\Freestyler\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

Finished!

**Posty:** 237 · przez **Kuba1** 23 Wrz 2007, 12:44

Pobierz i uruchom narzędzie Killbox
zaznacz opcje Delete on Reboot i w polu Full patch of file to delete wklej

C:\Program Files\Program Files.exe

Klikasz X reset kompa.

Otwórz notatnik i wklej w nim

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d25c44c-1b01-11dc-adea-000feaff31b3}]

Plik>>Zapisz jako>>zmień rozszerzenie z txt na wszystkie pliki i zapisz pod nazwą FIX.REG klikasz na powstały plik i dodajesz go do rejestru.

Sformatuj Pen Drive'a , po każdym podłączeniu infekcja będzie wracała.

Opróznij kosz.

Daj nowe logi.

folder winfile

folder WINFILE

Kto jest na forum