Iexplore.exe

**Posty:** 5 · przez **mikiziom** 02 Gru 2008, 16:15

Witam.
Otoz mam nietypowy problem... Od kilku dni zaczął mi się pojawiać w menedżerze proces IEXPLORE.EXE. Korzystam z firefoxa a proces sie sam wlacza. Do tego jakis czas temu w glosnikach zaczely mowic jakies japonskie glosy... Skapnalem sie wtedy ze po wylaczenie IEXPLORE.EXE gadanie ustawalo.

**Posty:** 18165 · przez **wojtas** 02 Gru 2008, 18:47

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 5 · przez **mikiziom** 08 Gru 2008, 23:58

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-12-07.01 - Monia 2008-12-08 22:34:32.1 - NTFSx86 Running from: e:\polska kronika filmowa\Moje dokumenty\Nowy folder\Nowy folder\Pulpit\ComboFix.exe * Resident AV is active [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\mdm.exe c:\windows\system32\SkypeComm.dll D:\WinRAR.exe E:\Autorun.inf e:\polska kronika filmowa\Moje dokumenty\Nowy folder\Ulubione\Online Security Test.url . ((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 ))))))))))))))))))))))))))))))) . 2008-12-08 21:54 . 2008-12-08 21:54 <DIR> d-------- c:\windows\ERUNT 2008-12-08 21:53 . 2008-12-08 22:37 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-08 21:53 . 2005-12-29 21:36 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2008-12-08 21:53 . 2005-12-29 20:48 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-12-08 21:53 . 2005-12-29 21:36 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-12-08 21:53 . 2005-12-29 21:36 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2008-12-08 21:53 . 2005-12-29 21:36 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-12-08 21:53 . 2005-12-29 21:36 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-12-08 21:53 . 2008-12-08 21:53 <DIR> d-------- c:\documents and settings\Administrator 2008-12-08 21:40 . 2008-12-08 22:05 <DIR> d-------- C:\SDFix 2008-12-04 22:13 . 2001-08-18 06:36 8,704 --a------ c:\windows\system32\kbdjpn.dll 2008-12-04 22:13 . 2001-08-18 06:36 8,704 --a--c--- c:\windows\system32\dllcache\kbdjpn.dll 2008-12-04 22:13 . 2001-08-18 06:36 8,192 --a------ c:\windows\system32\kbdkor.dll 2008-12-04 22:13 . 2001-08-18 06:36 8,192 --a--c--- c:\windows\system32\dllcache\kbdkor.dll 2008-12-04 22:13 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd106.dll 2008-12-04 22:13 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll 2008-12-04 22:13 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll 2008-12-04 22:13 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd106.dll 2008-12-04 22:13 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101c.dll 2008-12-04 22:13 . 2001-08-17 22:55 6,144 --a--c--- c:\windows\system32\dllcache\kbd101b.dll 2008-12-04 22:13 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll 2008-12-04 22:13 . 2001-08-17 22:55 5,632 --a--c--- c:\windows\system32\dllcache\kbd103.dll 2008-12-02 15:31 . 2008-12-02 15:33 <DIR> d-------- c:\program files\SpeedFan 2008-12-02 15:31 . 2008-12-02 15:31 45 --a------ c:\windows\system32\initdebug.nfo 2008-12-02 15:13 . 2008-12-02 15:13 <DIR> d-------- c:\program files\ESET 2008-12-02 15:13 . 2008-12-02 15:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET 2008-11-30 20:16 . 2008-11-30 20:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Last.fm 2008-11-30 20:13 . 2008-11-30 20:13 <DIR> d-------- c:\program files\Last.fm 2008-11-30 13:45 . 2008-11-30 13:45 <DIR> d-------- c:\program files\Multimedia Keyboard Driver 2008-11-30 13:45 . 2003-06-20 10:16 77 --a------ c:\windows\system32\ToggleDesktop.scf . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-04 15:46 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-22 13:58 --------- d-----w c:\documents and settings\Monia\Dane aplikacji\gtk-2.0 2008-11-15 15:05 --------- d-----w c:\documents and settings\Monia\Dane aplikacji\Hamachi 2008-11-12 20:11 30 ----a-w c:\documents and settings\Monia\jagex_runescape_preferences.dat 2008-11-10 19:08 --------- d-----w c:\documents and settings\Monia\Dane aplikacji\EurekaLog 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 17:43 --------- d-----w c:\program files\Bridge Builder . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2006-06-04 200747] "WhatPulse"="d:\pliki mikołaja\avatar do traviana\whatpulse2\WhatPulse\WhatPulse.exe" [2006-08-21 665600] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416] "AQQ"="d:\aqq3\WAPSTE~1\AQQ.exe" [2008-07-10 1597936] "Gadu-Gadu"="d:\pliki mikołaja\Gadu-Gadu\gg.exe" [2006-10-10 1636040] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DVDTray"="c:\program files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 65536] "WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608] "WinampAgent"="d:\winamp\winampa.exe" [2008-07-09 36352] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WireLessKeyboard"="c:\program files\Multimedia Keyboard Driver\StartAutorun.exe" [2005-11-30 44032] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] e:\polska kronika filmowa\Moje dokumenty\Nowy folder\Nowy folder\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\startupfolder\E:^Polska Kronika Filmowa^Moje dokumenty^Nowy folder^Nowy folder^Menu Start^Programy^Autostart^hamachi.lnk] path=e:\polska kronika filmowa\Moje dokumenty\Nowy folder\Nowy folder\Menu Start\Programy\Autostart\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\E:^Polska Kronika Filmowa^Moje dokumenty^Nowy folder^Nowy folder^Menu Start^Programy^Autostart^Xfire.lnk] path=e:\polska kronika filmowa\Moje dokumenty\Nowy folder\Nowy folder\Menu Start\Programy\Autostart\Xfire.lnk backup=c:\windows\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a------ 2007-09-25 09:10 2007088 d:\flashget\flashget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2006-10-10 16:51 1636040 d:\pliki mikołaja\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray] --a--c--- 2007-05-11 02:08 2512392 c:\windows\system32\oodtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2007-10-23 01:47 360448 c:\program files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] --a--c--- 2006-12-18 17:46 25445928 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a--c--- 2007-06-19 11:44 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\GADUGADU\\Gadu-Gadu\\gg.exe"= "d:\\GADUGADU\\Gadu-Gadu\\ggphone\\ggphone.exe"= "c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"= "c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= "d:\\Pliki Mikołaja\\Gadu-Gadu\\gg.exe"= "d:\\AQQ\\AQQ.exe"= "d:\\Pliki Mikołaja\\Soldat\\soldat\\Soldat.exe"= "d:\\total comander\\totalcmd\\TOTALCMD.EXE"= "d:\\Pliki Mikołaja\\Bearshare\\BearShare.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "d:\\Pliki Mikołaja\\Soldat\\Zapasowe\\Soldat\\Soldat.exe"= "d:\\Pliki Mikołaja\\Soldat\\serwer3\\soldatserver.exe"= "d:\\Pliki Mikołaja\\Xfire\\xfire.exe"= "d:\\azureus\\Azureus\\Azureus.exe"= "e:\\Polska Kronika Filmowa\\Moje dokumenty\\Nowy folder\\Nowy folder\\Pulpit\\Programy\\Skype.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "d:\\GIERKI\\diablo\\Diablo II\\Game.exe"= "d:\\flashget\\flashget.exe"= "e:\\metin\\metin2.bin"= "e:\\CS\\CS\\CS\\hl.exe"= "e:\\aoe\\dalej\\dalej\\empires2.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\aqq3\\WapSter AQQ\\AQQ.exe"= "d:\\aqq2\\WapSter AQQ\\AQQ.exe"= "d:\\Little Fighter 2.5\\lf2.5\\lf2.5.exe"= "e:\\Warhammer 40 000 Dark Crusade\\Dawn of War - Dark Crusade\\DarkCrusade.exe"= R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\DRIVERS\bsstor.sys [2006-01-29 9344] R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\BsUDF.sys [2006-01-29 448640] R2 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2008-07-01 468224] S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824] S3 cimo;cimo;\??\c:\windows\system32\drivers\cimo.ahc [2008-05-31 23296] S3 MemStPCI;Kontroler modułów pamięci Memory Stick Sony (PCI);c:\windows\system32\DRIVERS\MemStPCI.SYS [2008-04-18 26112] S4 WinDefend;Windows Defender Service;"c:\program files\Windows Defender\MsMpEng.exe" [2006-04-03 14032] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{249bdf7a-1b2d-11dd-b0e3-000b6a1a6fee}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe84bf56-0d70-11dd-b0c1-000b6a1a6fee}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder 2008-08-27 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 17:12] 2008-12-08 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-05-10 15:22] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-Steam - d:\gierki\cs\Steam.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.entretieneteds.vze.com/ uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: &Ściągnij przy pomocy FlashGet'a - d:\flashget\jc_link.htm IE: &Ściągnij wszystko przy pomocy FlashGet'a - d:\flashget\jc_all.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 FireFox -: Profile - c:\documents and settings\Monia\Dane aplikacji\Mozilla\Firefox\Profiles\po0afw6s.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-08 22:38:02 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\cimo] "ImagePath"="\??\c:\windows\system32\drivers\cimo.ahc" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(828) c:\windows\system32\Ati2evxx.dll . Completion time: 2008-12-08 22:41:01 ComboFix-quarantined-files.txt 2008-12-08 21:39:44 Pre-Run: 560 734 208 bajtów wolnych Post-Run: 684,421,120 bajtów wolnych 195 --- E O F --- 2008-11-13 15:02:43

SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2008-12-08 at 21:57 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-08 22:01:18 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:0e596a4a "s1"=dword:9b691138 "s2"=dword:2f0d9933 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="E:\Polska Kronika Filmowa\Moje dokumenty\Nowy folder\Nowy folder (2)\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:be,29,74,cc,a3,64,3e,b4,98,b7,46,51,cf,c6,a0,87,49,e2,dc,6f,69,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a1,ba,f4,ee,1e,d1,87,de,11,d9,66,b6,bf,ab,32,67,27,.. "khjeh"=hex:c0,2c,d7,fa,0e,86,5f,43,f2,3f,0f,e8,ba,1e,f0,40,72,4c,30,b6,70,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:20,7a,6a,48,3a,8c,2c,fd,d3,f2,8e,1b,d8,63,e5,79,c7,24,ce,cc,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="E:\Polska Kronika Filmowa\Moje dokumenty\Nowy folder\Nowy folder (2)\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:be,29,74,cc,a3,64,3e,b4,98,b7,46,51,cf,c6,a0,87,49,e2,dc,6f,69,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a1,ba,f4,ee,1e,d1,87,de,11,d9,66,b6,bf,ab,32,67,27,.. "khjeh"=hex:c0,2c,d7,fa,0e,86,5f,43,f2,3f,0f,e8,ba,1e,f0,40,72,4c,30,b6,70,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:20,7a,6a,48,3a,8c,2c,fd,d3,f2,8e,1b,d8,63,e5,79,c7,24,ce,cc,cb,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] "OODEFRAG10.00.00.01WORKSTATION"="C7311FF9BCF786758D363ED712455CCEB9B255CE6A3CEECF24E546C75B096A689C74DA3EE7E759406406656C578FE3F0EFF72395E52D61D6F8217561BFED3A7068A2ECB8CC98944C05CE21444F3B5A877D9356F14B6183593884FA074CE2B9B87A6C6949E7B94C015CE709B521F068B98C262F48101CB1E0E79AD8D0E2E21D49D6E03A56A71E26868B0E0C15E97BCA747D32BEFE9C405EB9C3516954D98CAAEFFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B555BA7FD869164D67949DB7CE019D40AA5C50436231D4B4731CC2D29B78A7C437E93089EAE49F33BC6BF5F3B5B5BA578E4F85B71B482BC19500B49DEDB00B0DB93DE39B7D61F32E4F4F71FE2ADD556C59407F99D50221CD992D0986955C492EF1A5C1FC3B908BD19517D22F30CF129006CE56449C5E5995660832D360AA6FA01D853BF9DA74026C414727FB817F3A0F5C4453F9CE6168F8FAB8592FF351007D0E097347E31065729A2B2FC0AC6389D1B82975DC9E92577DE72B5925C6087082AA9B437AB3F0B778FBD0E13C91F4AEE88B4D6EF592FCA3CBD1104126A48C2C116EEE388DFA2271BA568968916833CE885AC4263385B13EB2745A550AAC1F8FAF657790DF3DB67D19AA6B1F4A39A20389BB6536E227C20B201A438B0955046E09B3EFC3335643BA1412D119CEE14755E5DB4BEC3B79C8E42BA546924063838CE88ED3F7ADEFE07BD4375A1CF0942E473E7CD54E52D35F978B0C24C6B2746BA5C241E40BD98CAF88A459661F63D7E34B5671A70FA75FA5E31F56E03D43778C68AC29280DA6804F1B734B9D52BC04FBCA97A1A71B999D408065A2C43D3C31B9F3DE3968C1E674656254F5691679C78D228B8A818FECDE551505215B42CB37CD61B97730A34FE49C03FBD2778078A4B29FE4BC2440C84B123EC518F4FB8378A4B9BC7ED15DFAA2A2924871B95A7DF00A09F35B43B33C5C258E15DFA6CD57321E7910FB6350E954281CB67667A12FD5B6163420D424B5E2420A83E647CE22799E15FB323C91FB70E29E6A17FA8899D0DEF0BFD594008A7F21A9462D734B9FB51071ED77FA6879C30E0E2AA0B0722C342DBBD6DD8169F3ABFDD9B5498CC273A15FE7F9B680D10CF064D0E0F08CFAB9265089DC2CDFB60C2E987D4FE2B4E7214FFB47546E70FEC1EA2BC21D7B536FF99F7BE359C8B5F3D3A9B36833B8D52313A05BD1D73036D30E7B25B012C890D0896F65C4F9D04E5EB08F1864279A9A1017CD753D8121FD68463F1DDF18F112546535479C8DF2B869EBA58FAC94EFF2FC5D6347B3737EB88AA527E087A7A8E8E373E8E1CF0974C8B92F886BF3863095EDFB4051D274939BB8C9F7C1D0612E6B9DF8D47537022E95AB0D257EDF2F6A789BEB181AACEC44A0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120% (Trial Version)" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\GADUGADU\\Gadu-Gadu\\gg.exe"="D:\\GADUGADU\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "D:\\GADUGADU\\Gadu-Gadu\\ggphone\\ggphone.exe"="D:\\GADUGADU\\Gadu-Gadu\\ggphone\\ggphone.exe:*:Enabled:Internetowe polaczenia telefoniczne" "C:\\Documents and Settings\\Monia\\Moje dokumenty\\Nowy folder (2)\\eMule\\emule.exe"="C:\\Documents and Settings\\Monia\\Moje dokumenty\\Nowy folder (2)\\eMule\\emule.exe:*:Enabled:eMule" "C:\\RECYCLER\\NPROTECT\\00006738.exe"="C:\\RECYCLER\\NPROTECT\\00006738.exe:*:Enabled:eMule" "E:\\eMule\\emule.exe"="E:\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail" "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail" "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail" "D:\\Pliki Mikoaja\\Gadu-Gadu\\gg.exe"="D:\\Pliki Mikoaja\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "D:\\AQQ\\AQQ.exe"="D:\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "D:\\GIERKI\\Cabal\\Cabal\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"="D:\\GIERKI\\Cabal\\Cabal\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe:*:Enabled:EST! download engine" "D:\\Pliki Mikoaja\\Soldat\\soldat\\Soldat.exe"="D:\\Pliki Mikoaja\\Soldat\\soldat\\Soldat.exe:*:Enabled:Soldat" "D:\\total comander\\totalcmd\\TOTALCMD.EXE"="D:\\total comander\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "D:\\Pliki Mikoaja\\Bearshare\\BearShare.exe"="D:\\Pliki Mikoaja\\Bearshare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "D:\\Pliki Mikoaja\\Soldat\\Serwer\\soldatserver.exe"="D:\\Pliki Mikoaja\\Soldat\\Serwer\\soldatserver.exe:*:Enabled:soldatserver" "D:\\GIERKI\\cs2\\CS-dalej\\hl.exe"="D:\\GIERKI\\cs2\\CS-dalej\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\Pliki Mikoaja\\Soldat\\Zapasowe\\Soldat\\Soldat.exe"="D:\\Pliki Mikoaja\\Soldat\\Zapasowe\\Soldat\\Soldat.exe:*:Enabled:Soldat" "E:\\Polska Kronika Filmowa\\Moje dokumenty\\Nowy folder\\Nowy folder\\Pulpit\\Skype.exe"="E:\\Polska Kronika Filmowa\\Moje dokumenty\\Nowy folder\\Nowy folder\\Pulpit\\Skype.exe:*:Enabled:Skype" "D:\\Pliki Mikoaja\\Soldat\\serwer3\\soldatserver.exe"="D:\\Pliki Mikoaja\\Soldat\\serwer3\\soldatserver.exe:*:Enabled:soldatserver" "D:\\Pliki Mikoaja\\Xfire\\xfire.exe"="D:\\Pliki Mikoaja\\Xfire\\xfire.exe:*:Enabled:Xfire" "D:\\azureus\\Azureus\\Azureus.exe"="D:\\azureus\\Azureus\\Azureus.exe:*:Enabled:Azureus" "D:\\Gierki\\CS3\\Medieval_TW.exe"="D:\\Gierki\\CS3\\Medieval_TW.exe:*:Enabled:Medieval_TW" "E:\\Polska Kronika Filmowa\\Moje dokumenty\\Nowy folder\\Nowy folder\\Pulpit\\Programy\\Skype.exe"="E:\\Polska Kronika Filmowa\\Moje dokumenty\\Nowy folder\\Nowy folder\\Pulpit\\Programy\\Skype.exe:*:Enabled:Skype" "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "D:\\GIERKI\\hom&m 3\\Heroes3.exe"="D:\\GIERKI\\hom&m 3\\Heroes3.exe:*:Enabled:Heroes of Might and MagicR III (CDP)" "D:\\Gierki\\Kal\\carom.exe"="D:\\Gierki\\Kal\\carom.exe:*:Enabled:Carom" "D:\\GIERKI\\cs4\\hl.exe"="D:\\GIERKI\\cs4\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\GIERKI\\diablo\\Diablo II\\Game.exe"="D:\\GIERKI\\diablo\\Diablo II\\Game.exe:*:Enabled:Diablo II" "D:\\flashget\\flashget.exe"="D:\\flashget\\flashget.exe:*:Enabled:Flashget" "E:\\metin\\metin2.bin"="E:\\metin\\metin2.bin:*:Enabled:metin2" "E:\\CS\\CS\\CS\\hl.exe"="E:\\CS\\CS\\CS\\hl.exe:*:Enabled:Half-Life Launcher" "E:\\aoe\\dalej\\dalej\\empires2.exe"="E:\\aoe\\dalej\\dalej\\empires2.exe:*:Enabled:Age of Empires II" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "D:\\aqq3\\WapSter AQQ\\AQQ.exe"="D:\\aqq3\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" "D:\\aqq2\\WapSter AQQ\\AQQ.exe"="D:\\aqq2\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" "D:\\Little Fighter 2.5\\lf2.5\\lf2.5.exe"="D:\\Little Fighter 2.5\\lf2.5\\lf2.5.exe:*:Enabled:lf2.5" "E:\\Warhammer 40 000 Dark Crusade\\Dawn of War - Dark Crusade\\DarkCrusade.exe"="E:\\Warhammer 40 000 Dark Crusade\\Dawn of War - Dark Crusade\\DarkCrusade.exe:*:Enabled:DarkCrusade" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Sun 12 Feb 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 12 Nov 2008 25,088 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL0003.tmp" Wed 12 Nov 2008 24,576 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL0005.tmp" Mon 18 Jun 2007 14,683,136 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL0574.tmp" Mon 18 Jun 2007 14,677,504 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL1281.tmp" Thu 15 Jun 2006 54,784 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL1767.tmp" Mon 18 Jun 2007 14,680,576 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL2159.tmp" Mon 18 Jun 2007 14,680,064 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL2288.tmp" Mon 24 Jul 2006 128,000 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL2518.tmp" Mon 18 Jun 2007 14,678,528 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL2653.tmp" Mon 18 Jun 2007 14,683,136 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL2676.tmp" Mon 18 Jun 2007 14,683,136 ...H. --- "C:\Documents and Settings\Monia\Dane aplikacji\Microsoft\Word\~WRL2815.tmp" [b]Finished![/b]

I Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:57, on 2008-12-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\oodag.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe D:\winamp\winampa.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe D:\Pliki Mikołaja\avatar do traviana\whatpulse2\WhatPulse\WhatPulse.exe C:\Program Files\Multimedia Keyboard Driver\PS2USBKbdDrv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe D:\Pliki Mikołaja\Gadu-Gadu\gg.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\INCRED~1\bin\IMApp.exe C:\WINDOWS\system32\WgaTray.exe D:\aqq2\WapSter AQQ\AQQ.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.entretieneteds.vze.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\flashget\jccatch.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Mario Forever Toolbar Helper - {A20854FD-DDB5-4931-8F76-D11EA2364D94} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\flashget\getflash.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [WinampAgent] D:\winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\Multimedia Keyboard Driver\StartAutorun.exe PS2USBKbdDrv.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c O4 - HKCU\..\Run: [WhatPulse] D:\Pliki Mikołaja\avatar do traviana\whatpulse2\WhatPulse\WhatPulse.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [AQQ] D:\aqq3\WAPSTE~1\AQQ.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Pliki Mikołaja\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - User Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\flashget\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\flashget\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\flashget\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\flashget\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- End of file - 9107 bytes

**Posty:** 18165 · przez **wojtas** 09 Gru 2008, 18:44

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{249bdf7a-1b2d-11dd-b0e3-000b6a1a6fee}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe84bf56-0d70-11dd-b0c1-000b6a1a6fee}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

te plik/i :

c:\windows\system32\drivers\cimo.ahc

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 5 · przez **mikiziom** 09 Gru 2008, 21:13

Dodane do rejestru.
Co do tych skanerow to raporty w jakim sensie?

Kod: Zaznacz wszystko: AntiVir 7.9.0.43 2008.12.09 TR/Rootkit.Gen Fortinet 3.117.0.0 2008.12.09 suspicious SecureWeb-Gateway 6.7.6 2008.12.09 Trojan.Rootkit.Gen Dodatkowe informacje File size: 23296 bytes MD5...: c7b0e8c86892e0e8eca050725b1d231e SHA1..: 5ca19ada998681eddb6bdba101a9b43753cb167a SHA256: 732c560fce6df3c27f3cd2c852b7f8a572416d7968f9809f9b14d1b033828386 SHA512: d2b9788fb12f360b9625a6591f730b05d84013240b48a2e76a26cd69dc980f77 f5ff1148159a8d01c6c796c1a274e4cb95622d6012e8ce585c67c13607d80ea3 ssdeep: 384:cz71VB7VWUGCR0qlIjecCU/CFxcKIRaFHXZ+W6zvVusZ0tsvS9+JH1l2GG:c 3LPWUZKjemsBJvCbv6A/5G PEiD..: - TrID..: File type identification Win32 Executable Generic (58.4%) Clipper DOS Executable (13.8%) Generic Win/DOS Executable (13.7%) DOS Executable Generic (13.7%) VXD Driver (0.2%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x15085 timedatestamp.....: 0x4802c23d (Mon Apr 14 02:32:29 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x480 0x4619 0x4680 6.31 ee2a696b0fb2693ee3893e0cceb82c62 .rdata 0x4b00 0x294 0x300 3.40 67d191a37d334bf1fea83cbd954a3919 .data 0x4e00 0x218 0x280 0.15 5057b95dc24fb8227107c7985001c55c INIT 0x5080 0x6b0 0x700 5.27 2a8bc11fdbc62e73686ce3727952ea7c .reloc 0x5780 0x348 0x380 5.40 ef74705fd42222ce3a4060f0df40aec1 ( 2 imports ) > ntoskrnl.exe: IoCreateSymbolicLink, IoCreateDevice, RtlInitUnicodeString, IoDeleteSymbolicLink, IofCompleteRequest, IoGetCurrentProcess, KeQueryTimeIncrement, KeTickCount, _allmul, PsGetCurrentProcessId, ZwCreateFile, ZwClose, ZwReadFile, PsSetCreateProcessNotifyRoutine, PsGetCurrentThreadId, PsSetCreateThreadNotifyRoutine, PsRemoveCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, PsRemoveLoadImageNotifyRoutine, RtlCompareMemory, KeServiceDescriptorTable, MmIsAddressValid, KeAddSystemServiceTable, RtlFreeUnicodeString, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoDeleteDevice, ExFreePoolWithTag, ExAllocatePool, ZwQuerySystemInformation, _stricmp, ProbeForRead, ProbeForWrite, memmove, memcpy, RtlFreeAnsiString, RtlUnicodeStringToAnsiString, NlsMbCodePageTag, RtlxUnicodeStringToAnsiSize, ObfDereferenceObject, ObQueryNameString, ObReferenceObjectByHandle, ObOpenObjectByName, MmUnlockPages, MmUnmapLockedPages, MmMapLockedPagesSpecifyCache, MmProbeAndLockPages, KeAttachProcess, KeDetachProcess, ExGetPreviousMode, ObOpenObjectByPointer, SeDeleteAccessState, PsLookupProcessByProcessId, SeCreateAccessState, KeBugCheckEx, KeQuerySystemTime, strrchr, memset, RtlUnwind > HAL.dll: KfAcquireSpinLock, KfReleaseSpinLock ( 0 exports )

W tym drugim tylko w AntiVir wykrylo TR/Rootkit.Gen

**Posty:** 18165 · przez **wojtas** 09 Gru 2008, 21:47

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 7 · przez **Pluma** 14 Gru 2008, 14:34

Witam

mam pewien problem też z iexplorer. Zaznaczam że jestem zielony w te sprawy. problem polega na tym, że przy starcie kompa system ładuje się bardzo powoli, potem pracuje raczej normalnie chociaż bywa, że się muli. Natomiast przy zamykaniu systemu informuje mnie że trwa zamyanie programu iexplorer.exe oraz pokazuje okienko z informacją że nie może uruchomić SUPPOR~1.exe ponieważ stacja jest właśnie zamykana i po dłuższej chwili zamyka cały komputer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:08:38, on 2008-12-14
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\xxx\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1YT3C2QS\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.is.net.pl/auto.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [16dart] C:\DOCUME~1\xxx\DANEAP~1\IDOLDO~1\Supportroad.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://217.117.128.162/activex/AxisCamControl.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.e-tarnow.pl/modules/tarnow_kamera_online/h263ctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B51DEBF-027F-49DC-89D4-EFD0A5B6A5D0}: NameServer = 217.144.192.2,217.144.192.33
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 9385 bytes
[quote][/quote]

**Posty:** 18165 · przez **wojtas** 14 Gru 2008, 14:47

Pluma, założ swoj temat... wklej loga z hijacka i combofixa w tagach.. opisz problem

Iexplore.exe

Iexplore.exe

Iexplore.exe

Re: iexplore.exe

Iexplore.exe

Re: iexplore.exe

Iexplore.exe

Iexplore.exe

Iexplore.exe

Kto jest na forum