Komputer "zamula"

**Posty:** 21 · przez **Zapodawacz** 26 Sie 2008, 16:35

Witam! Proszę o sprawdzenie logów, ponieważ od kilku dni komputer zaczął się przycinać ("zamulać"). Gdy chcę otworzyć jakiś folder to muszę poczekać kilkanaście sekund aż pojawi się skrót? do folderu na pasku zadań zanim coś innego kliknę. Troszkę to denerwujące zważywszy, że wcześniej wszystko było w porządku.

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - Kompek 2008-08-26 16:19:59.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.562 [GMT 2:00] Running from: C:\Documents and Settings\Kompek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\Config.xml C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml C:\Documents and Settings\Kompek\Dane aplikacji\ShoppingReport\cs\res2\WhiteList.dbs C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]1885CF2 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]1886CA1 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]18874CF.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]1888D78.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]188947D.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\Program Files\myglobalsearch\bar\Settings\settings.dat C:\Program Files\myglobalsearch\bar\Settings\settings.htm C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Uninst.exe C:\WINDOWS\linkinfo.dll C:\WINDOWS\system32\SkypeComm.dll C:\WINDOWS\temp\perflib_perfdata_1cc.dat . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-18 17:22 . 2008-08-22 19:46 139,600 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-18 12:57 . 2008-08-18 12:57 <DIR> d-------- C:\Program Files\JoWooD 2008-08-18 12:31 . 2008-08-18 17:21 682,280 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-08-18 12:31 . 2008-08-22 19:46 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-08-18 12:31 . 2008-08-18 17:21 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-08-18 12:31 . 2008-08-18 17:22 22,328 --a------ C:\Documents and Settings\Kompek\Dane aplikacji\PnkBstrK.sys 2008-08-16 16:46 . 2008-08-16 16:46 <DIR> d-------- C:\Program Files\Common Files\EasyInfo 2008-08-16 16:26 . 2008-08-16 16:26 <DIR> d-------- C:\Program Files\EA GAMES 2008-08-13 20:04 . 2008-08-13 20:04 <DIR> d-------- C:\WoW-2.3.0.7561-enGB 2008-08-13 14:34 . 2008-08-25 21:15 <DIR> d-------- C:\MuPvP 2008-08-11 08:44 . 2008-08-11 08:44 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-11 08:40 . 2008-08-11 08:40 <DIR> d-------- C:\WINDOWS\Dark and Light 2008-08-07 20:52 . 2008-08-07 20:52 <DIR> d-------- C:\Program Files\ACME EO 2008-08-05 17:56 . 2008-08-13 21:41 10,236 --a------ C:\WINDOWS\system32\mstmpxmlfun.xml . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-26 14:24 --------- d-----w C:\Program Files\cFosSpeed 2008-08-26 14:23 --------- d-----w C:\Documents and Settings\Kompek\Dane aplikacji\OpenOffice.org2 2008-08-16 15:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2008-08-16 14:37 --------- d-----w C:\Program Files\GameSpy Arcade 2008-08-16 14:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-16 14:23 --------- d-----w C:\Program Files\QuarkuMU 2008-08-16 11:43 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-13 19:55 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-08-07 14:39 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-06 21:12 --------- d-----w C:\Program Files\FlashGet 2008-07-28 08:14 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-27 14:00 --------- d-----w C:\Documents and Settings\Kompek\Dane aplikacji\Tibia 2008-07-27 12:22 4,000 ----a-w C:\ao.dat 2008-07-26 15:31 --------- d-----w C:\Program Files\Tibia Auto 2008-07-24 16:19 --------- d-----w C:\Program Files\Tibia 2008-07-23 06:11 --------- d-----w C:\Program Files\Asprate 2008-07-22 17:23 --------- d-----w C:\Program Files\Grupa IMAGE 2008-07-22 16:48 --------- d-----w C:\Program Files\GlobespanVirata 2008-07-06 14:24 --------- d-----w C:\Program Files\vanBasco's Karaoke Player 2008-07-03 15:20 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-04-27 22:26 20,712 ----a-w C:\Documents and Settings\Kompek\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-03-14 13:55 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 14:38 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 16:18 241664] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 07:59 57344 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\Kompek\Menu Start\Programy\Autostart\ OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 16:41:28 393216] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 23:31:38 241664] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 00:06:36 53248] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] UniSpiker-2.6.lnk - C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2007-09-21 09:05:21 86016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 17:04 3313664 C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed] -ra------ 2008-05-02 18:30 863448 C:\Program Files\cFosSpeed\cfosspeed.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a------ 2007-09-25 10:10 2007088 C:\Program Files\FlashGet\flashget.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "D:\\Program Files\\QuarkuMU\\Launcher.exe"= "C:\\Program Files\\Games-Masters.com\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\MotoGP2\\motogp2.exe"= "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "23740:TCP"= 23740:TCP:BitComet 23740 TCP "23740:UDP"= 23740:UDP:BitComet 23740 UDP R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 21:03] R3 iadusb;GlobespanVirata USB IAD LAN Modem;C:\WINDOWS\system32\DRIVERS\glauiad.sys [2004-07-02 10:20] S3 jlock101;jlock101;C:\WINDOWS\System32\jlock101.sys [2008-03-25 13:54] S3 XDva168;XDva168;C:\WINDOWS\system32\XDva168.sys [] . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 16:24:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-08-26 16:28:41 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-26 14:28:38 Pre-Run: 9,267,212,288 bajtów wolnych Post-Run: 9,414,864,896 bajt˘w wolnych 176

HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:34:43, on 2008-08-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Kompek\Pulpit\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 66.29.36.95:554 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: UniSpiker-2.6.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {2CDD22B9-FC0F-46B9-A2FA-BCCFFA7F87F3} (ActiveJoy Control) - http://www.wydglobal.com/JKeySecret/ActiveJoy3.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 7241 bytes

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 16:37

Kod: Zaznacz wszystko: O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)

to na fix w hj

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 684 · przez **djarta** 26 Sie 2008, 19:21

okocza, nie jest czysto, dokładniej sprawdzaj logi!

1)

>>Start >>> Uruchom >>> wybierz (lub wpisz) cmd>> zastosuj tę komendę (po niej wciśnij "ENTER"):

SC DELETE jlock101

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\mstmpxmlfun.xml C:\ao.dat C:\WINDOWS\System32\jlock101.sys C:\WINDOWS\system32\XDva168.sys Driver:: jlock101 XDva168

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

===================
K.

**Posty:** 21 · przez **Zapodawacz** 26 Sie 2008, 20:12

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - Kompek 2008-08-26 20:02:37.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.597 [GMT 2:00] Running from: C:\Documents and Settings\Kompek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Kompek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\ao.dat C:\WINDOWS\System32\jlock101.sys C:\WINDOWS\system32\mstmpxmlfun.xml C:\WINDOWS\system32\XDva168.sys . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\ao.dat C:\WINDOWS\System32\jlock101.sys C:\WINDOWS\system32\mstmpxmlfun.xml . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_XDVA168 -------\Service_XDva168 ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-26 19:39 . 2008-08-26 20:05 <DIR> d-------- C:\Program Files\Odkurzacz 2008-08-18 17:22 . 2008-08-22 19:46 139,600 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-08-18 12:57 . 2008-08-18 12:57 <DIR> d-------- C:\Program Files\JoWooD 2008-08-18 12:31 . 2008-08-18 17:21 682,280 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-08-18 12:31 . 2008-08-22 19:46 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-08-18 12:31 . 2008-08-18 17:21 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-08-18 12:31 . 2008-08-18 17:22 22,328 --a------ C:\Documents and Settings\Kompek\Dane aplikacji\PnkBstrK.sys 2008-08-16 16:46 . 2008-08-16 16:46 <DIR> d-------- C:\Program Files\Common Files\EasyInfo 2008-08-16 16:26 . 2008-08-16 16:26 <DIR> d-------- C:\Program Files\EA GAMES 2008-08-13 20:04 . 2008-08-13 20:04 <DIR> d-------- C:\WoW-2.3.0.7561-enGB 2008-08-13 14:34 . 2008-08-25 21:15 <DIR> d-------- C:\MuPvP 2008-08-11 08:44 . 2008-08-11 08:44 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-11 08:40 . 2008-08-11 08:40 <DIR> d-------- C:\WINDOWS\Dark and Light 2008-08-07 20:52 . 2008-08-07 20:52 <DIR> d-------- C:\Program Files\ACME EO . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-26 18:05 --------- d-----w C:\Documents and Settings\Kompek\Dane aplikacji\OpenOffice.org2 2008-08-26 18:04 --------- d-----w C:\Program Files\cFosSpeed 2008-08-26 17:51 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-08-26 17:51 --------- d-----w C:\Program Files\FlashGet 2008-08-26 17:51 --------- d-----w C:\Program Files\Codec Pack - All In 1 2008-08-26 17:51 --------- d-----w C:\Program Files\BitComet 2008-08-16 15:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2008-08-16 14:37 --------- d-----w C:\Program Files\GameSpy Arcade 2008-08-16 14:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-16 14:23 --------- d-----w C:\Program Files\QuarkuMU 2008-08-16 11:43 --------- d-----w C:\Program Files\Gadu-Gadu 2008-07-28 08:14 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-27 14:00 --------- d-----w C:\Documents and Settings\Kompek\Dane aplikacji\Tibia 2008-07-26 15:31 --------- d-----w C:\Program Files\Tibia Auto 2008-07-24 16:19 --------- d-----w C:\Program Files\Tibia 2008-07-23 06:11 --------- d-----w C:\Program Files\Asprate 2008-07-22 17:23 --------- d-----w C:\Program Files\Grupa IMAGE 2008-07-22 16:48 --------- d-----w C:\Program Files\GlobespanVirata 2008-07-06 14:24 --------- d-----w C:\Program Files\vanBasco's Karaoke Player 2008-07-03 15:20 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-04-27 22:26 20,712 ----a-w C:\Documents and Settings\Kompek\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-03-14 13:55 486856] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-08-16 16:01 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 14:38 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 16:18 241664] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SoundMan"="SOUNDMAN.EXE" [2003-08-05 07:59 57344 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\Kompek\Menu Start\Programy\Autostart\ OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 16:41:28 393216] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 23:31:38 241664] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 00:06:36 53248] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] UniSpiker-2.6.lnk - C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2007-09-21 09:05:21 86016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 17:04 3313664 C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed] -ra------ 2008-05-02 18:30 863448 C:\Program Files\cFosSpeed\cfosspeed.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a------ 2007-09-25 10:10 2007088 C:\Program Files\FlashGet\flashget.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "D:\\Program Files\\QuarkuMU\\Launcher.exe"= "C:\\Program Files\\Games-Masters.com\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\MotoGP2\\motogp2.exe"= "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "23740:TCP"= 23740:TCP:BitComet 23740 TCP "23740:UDP"= 23740:UDP:BitComet 23740 UDP R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 21:03] R3 iadusb;GlobespanVirata USB IAD LAN Modem;C:\WINDOWS\system32\DRIVERS\glauiad.sys [2004-07-02 10:20] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 20:05:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-08-26 20:09:52 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-26 18:09:48 Pre-Run: 9,391,435,776 bajtów wolnych Post-Run: 9,323,474,944 bajt˘w wolnych 152

FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.5.6050 * * * ******************************************************************************** Created at 20:11:31 on Tuesday, August 26, 2008 Time Zone : Logged On User : Kompek Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) XP 2500+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 1048048 KB Free Physical Memory : 617636 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2014860 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\Program Files\Codec Pack - All In 1\DivXconfig.exe C:\Program Files\Codec Pack - All In 1\ac3filter.ico C:\Program Files\Codec Pack - All In 1\DivXSetup.ico C:\Program Files\Codec Pack - All In 1\dvobsub.ico C:\Program Files\Codec Pack - All In 1\ffdshow.ico C:\Program Files\Codec Pack - All In 1\g400.ico C:\Program Files\Codec Pack - All In 1\ie.ico C:\Program Files\Codec Pack - All In 1\irunin.bmp C:\Program Files\Codec Pack - All In 1\irunin.dat C:\Program Files\Codec Pack - All In 1\irunin.ini C:\Program Files\Codec Pack - All In 1\irunin.lng C:\Program Files\Codec Pack - All In 1\verze.txt C:\Program Files\Codec Pack - All In 1\xvid.ico -------------------------------------------------------------------------------- !!! Directories that have been removed !!! C:\Program Files\Codec Pack - All In 1 -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:12:39, on 2008-08-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Odkurzacz\odk_mcd.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Kompek\Pulpit\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 66.29.36.95:554 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: UniSpiker-2.6.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {2CDD22B9-FC0F-46B9-A2FA-BCCFFA7F87F3} (ActiveJoy Control) - http://www.wydglobal.com/JKeySecret/ActiveJoy3.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 7208 bytes

A wiecie może jak wyłączyć, żebym nie musiał klikać na ikonkę przy starcie, aby system się załadował?

**Posty:** 684 · przez **djarta** 26 Sie 2008, 20:16

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

Na koniec scan tym ---> http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

==================
K.

**Posty:** 21 · przez **Zapodawacz** 27 Sie 2008, 11:10

Kod: Zaznacz wszystko: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 27 sierpień 2008 11:08:04 System operacyjny: Microsoft Windows XP Home Edition, Dodatek Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.1 Ostatnia aktualizacja Kaspersky Anti-Virus27/08/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus1150236 ------------------------------------------------------------------------------- Ustawienia skanowania: Skanowanie przy użyciu następujących baz danych: rozszerzone Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ G:\ Statystyki skanowania: Liczba skanowanych obiektów: 181464 Liczba wykrytych wirusów: 9 Liczba zainfekowanych obiektów: 15 Liczba podejrzanych obiektów: 0 Czas trwania skanowania: 02:26:20 Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie C:\Documents and Settings\Kompek\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\cert8.db Object is locked pominięty C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\history.dat Object is locked pominięty C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\key3.db Object is locked pominięty C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\parent.lock Object is locked pominięty C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\search.sqlite Object is locked pominięty C:\Documents and Settings\Kompek\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\urlclassifier2.sqlite Object is locked pominięty C:\Documents and Settings\Kompek\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\Kompek\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\Kompek\Pulpit\MUZA NOWA\jaarta.mp3 Zainfekowanych: Trojan-Downloader.WMA.Wimad.n pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\albumTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\albumTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\EXIFTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\EXIFTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\imageTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\imageTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\imageTable.fpt Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\keywordTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\keywordTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\pathnameTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\pathnameTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\ROFTable.cdx Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\HP\Digital Imaging\db\ROFTable.dbf Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\Cache\_CACHE_001_ Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\Cache\_CACHE_002_ Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\Cache\_CACHE_003_ Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\pav9tpe0.default\Cache\_CACHE_MAP_ Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Historia\History.IE5\MSHist012008082720080828\index.dat Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Temp\hpodvd09.log Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Temp\~DFC163.tmp Object is locked pominięty C:\Documents and Settings\Kompek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\MuPvP\MuPvP\mu.dll Zainfekowanych: Backdoor.Win32.Rbot.fco pominięty C:\My Downloads\jaarta-desine.mp3 Zainfekowanych: Trojan-Downloader.WMA.Wimad.n pominięty C:\My Downloads\trzy ofiary.mp3 Zainfekowanych: Trojan-Downloader.WMA.Wimad.n pominięty C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked pominięty C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll Zainfekowanych: not-a-virus:AdTool.Win32.MyWebSearch.i pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040854.DLL Zainfekowanych: not-a-virus:WebToolbar.Win32.MyWebSearch.dh pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040855.DLL Zainfekowanych: not-a-virus:AdTool.Win32.MyWebSearch.i pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040859.dll Zainfekowanych: Trojan-Spy.Win32.BHO.j pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040860.dll Zainfekowanych: not-a-virus:AdWare.Win32.Shopper.v pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\A0042103.dll Zainfekowanych: not-a-virus:RiskTool.Win32.Squnsh.a pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\A0042105.exe Zainfekowanych: Trojan-Dropper.Win32.Agent.qtz pominięty C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\change.log Object is locked pominięty C:\Tatko-muza\geburstag u mojej cioci.mp3 Zainfekowanych: Trojan-Downloader.WMA.Wimad.n pominięty C:\Tatko-muza\jola mu do.mp3 Zainfekowanych: Trojan-Downloader.WMA.Wimad.n pominięty C:\Tatko-muza\życzenie dla ciebie.mp3 Zainfekowanych: Trojan-Downloader.WMA.Wimad.n pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\SchedLgU.Txt Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\Sti_Trace.log Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\default Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\software Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\system Object is locked pominięty C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\drivers\sptd.sys Object is locked pominięty C:\WINDOWS\system32\h323log.txt Object is locked pominięty C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty C:\WINDOWS\system32\xmldis.dll Zainfekowanych: Trojan.Win32.b pominięty C:\WINDOWS\wiadebug.log Object is locked pominięty C:\WINDOWS\wiaservc.log Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty Proces skanowania został zakończony.

**Posty:** 684 · przez **djarta** 27 Sie 2008, 11:16

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: C:\Documents and Settings\Kompek\Pulpit\MUZA NOWA\jaarta.mp3 C:\MuPvP\MuPvP\mu.dll C:\My Downloads\jaarta-desine.mp3 C:\My Downloads\trzy ofiary.mp3 C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040855.DLL C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040859.dll C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040860.dll C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\A0042103.dll C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\A0042105.exe C:\Tatko-muza\geburstag u mojej cioci.mp3 C:\Tatko-muza\jola mu do.mp3 C:\Tatko-muza\życzenie dla ciebie.mp3 C:\WINDOWS\system32\xmldis.dll

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

=================
K.

**Posty:** 21 · przez **Zapodawacz** 27 Sie 2008, 14:15

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\Documents and Settings\Kompek\Pulpit\MUZA NOWA\jaarta.mp3" deleted successfully. File "C:\MuPvP\MuPvP\mu.dll" deleted successfully. File "C:\My Downloads\jaarta-desine.mp3" deleted successfully. File "C:\My Downloads\trzy ofiary.mp3" deleted successfully. File "C:\Program Files\Mozilla Firefox\plugins\NPMyGlSh.dll" deleted successfully. File "C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040855.DLL" deleted successfully. File "C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040859.dll" deleted successfully. File "C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP110\A0040860.dll" deleted successfully. File "C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\A0042103.dll" deleted successfully. File "C:\System Volume Information\_restore{69CA5539-3655-41DF-B746-F34852DE1EB3}\RP112\A0042105.exe" deleted successfully. File "C:\Tatko-muza\geburstag u mojej cioci.mp3" deleted successfully. File "C:\Tatko-muza\jola mu do.mp3" deleted successfully. Completed script processing. ******************* Finished! Terminate.

**Posty:** 684 · przez **djarta** 27 Sie 2008, 14:23

Wszystko ładnie się usunęło, możesz zrobić następny scan kasperskym dla pewnośći

====================
K.

**Posty:** 21 · przez **Zapodawacz** 27 Sie 2008, 14:35

Może jutro ;p Troszkę to długo się robi xD Dzięki za pomoc

**Posty:** 684 · przez **djarta** 27 Sie 2008, 14:36

To przeskanuj tylko partycje "C"

===============
K.

Komputer "zamula"

Komputer "zamula"

Komputer "zamula"

Komputer "zamula"

Re: komputer "zamula"

Komputer "zamula"

Re: komputer "zamula"

Komputer "zamula"

Re: komputer "zamula"

Komputer "zamula"

Re: komputer "zamula"

Komputer "zamula"

Kto jest na forum