Najprawdopodobniej trojany!!!

**Posty:** 16 · przez **zina181** 23 Mar 2009, 21:15

Oto log z hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:09:47, on 2009-03-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe G:\Program Files\QuickTime\qttask.exe C:\Program Files\CardDetector\ICON225\CardDetector.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\CM Data Software\CM DiskCleaner\Optimize RAM.exe C:\Documents and Settings\user\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe G:\Program Files\Orbitdownloader\orbitdm.exe G:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Kerio\Personal Firewall\persfw.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe G:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://free.grisoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - g:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - g:\Program Files\Orbitdownloader\GrabPro.dll O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CardDetectorICON225] C:\Program Files\CardDetector\ICON225\CardDetector.exe O4 - HKLM\..\Run: [BEWINTERNET-PLSessionManager] C:\Program Files\OrangeBS\BEWInternet-PL\SessionManager\SessionManager.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [Startup Cleaner] C:\Program Files\CM Data Software\CM DiskCleaner\Startup Cleaner.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKCU\..\Run: [Vista Rainbar] C:\Program Files\Vista Rainbar\launcher.exe O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe O4 - HKCU\..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe O4 - HKCU\..\Run: [ALLUpdate] "g:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Optimize RAM] C:\Program Files\CM Data Software\CM DiskCleaner\Optimize RAM.exe O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\user\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Orbit.lnk = G:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://g:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://g:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://g:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://g:\Program Files\Orbitdownloader\orbitmxt.dll/202 O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 8862 bytes

a to log z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-03-22.01 - user 2009-03-23 20:17:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1022.478 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe AV: AVG 7.5.557 *On-access scanning enabled* (Outdated) AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\user\Dane aplikacji\.# . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-23 do 2009-03-23 ))))))))))))))))))))))))))))))) . 2009-03-23 20:09 . 2009-03-23 20:09 <DIR> d-------- c:\program files\Trend Micro 2009-03-23 19:54 . 2009-03-23 20:00 <DIR> d-------- c:\program files\Anti Trojan Elite 2009-03-23 19:47 . 2009-03-23 19:47 <DIR> d-------- c:\windows\ERUNT 2009-03-23 19:47 . 2009-03-23 19:47 <DIR> d-------- C:\ERDNT 2009-03-23 19:46 . 2009-03-23 19:47 <DIR> d-------- C:\!FixIEDef 2009-03-23 19:45 . 2009-03-23 19:45 <DIR> d-------- c:\documents and settings\user\DoctorWeb 2009-03-23 16:56 . 2009-03-23 16:56 <DIR> d-------- C:\downloads 2009-03-23 16:56 . 2009-03-23 20:16 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Orbit 2009-03-23 16:56 . 2009-03-23 16:56 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\GrabPro 2009-03-19 15:36 . 2009-03-22 12:32 189,784 --a------ c:\windows\system32\PnkBstrB.xtr 2009-03-19 14:54 . 2009-03-19 14:54 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\id Software 2009-03-19 14:47 . 2009-03-19 14:48 22,328 --a------ c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys 2009-03-19 14:46 . 2009-03-19 14:46 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\id Software 2009-03-19 14:46 . 2009-03-19 14:48 2,246,144 --a------ c:\windows\system32\pbsvc.exe 2009-03-12 16:21 . 2009-03-12 16:21 45 --a------ c:\windows\system32\initdebug.nfo 2009-03-12 16:04 . 2009-03-12 16:04 <DIR> d-------- c:\program files\Avira 2009-03-12 16:04 . 2009-03-12 16:04 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Avira 2009-03-11 21:02 . 2009-03-11 21:02 <DIR> d-------- c:\documents and settings\NetworkService\Dane aplikacji\Xfire 2009-03-10 16:12 . 2009-03-10 16:12 12,317,399 --------- C:\avg7qt.dat 2009-03-08 12:23 . 2009-03-08 12:23 <DIR> d-------- c:\documents and settings\LocalService\Dane aplikacji\Xfire 2009-03-06 00:08 . 2009-03-10 16:23 <DIR> d-------- c:\windows\system32\CatRoot_bak 2009-03-06 00:06 . 2008-06-14 19:01 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2009-03-06 00:06 . 2007-03-10 02:35 100,352 -----c--- c:\windows\system32\dllcache\6to4svc.dll 2009-03-06 00:05 . 2009-02-09 14:56 1,847,680 -----c--- c:\windows\system32\dllcache\win32k.sys 2009-03-06 00:05 . 2007-04-02 07:37 546,304 -----c--- c:\windows\system32\dllcache\hhctrl.ocx 2009-03-06 00:04 . 2008-08-14 14:40 2,187,264 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2009-03-06 00:04 . 2008-08-14 14:40 2,144,256 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-03-06 00:04 . 2008-08-14 14:40 2,064,256 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-03-06 00:04 . 2008-08-14 14:40 2,022,400 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2009-03-06 00:04 . 2008-10-24 12:25 455,936 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2009-03-06 00:04 . 2008-12-11 11:24 333,184 -----c--- c:\windows\system32\dllcache\srv.sys 2009-03-06 00:04 . 2008-05-08 13:14 203,008 -----c--- c:\windows\system32\dllcache\rmcast.sys 2009-03-06 00:03 . 2008-12-21 00:03 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll 2009-03-06 00:03 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2009-03-06 00:03 . 2007-03-08 06:11 1,036,288 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2009-03-06 00:03 . 2008-04-11 19:41 683,520 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2009-03-06 00:03 . 2008-12-21 00:03 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2009-03-06 00:03 . 2008-12-21 00:03 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2009-03-06 00:03 . 2008-05-01 15:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2009-03-06 00:03 . 2008-12-21 00:03 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2009-03-06 00:03 . 2008-12-21 00:03 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2009-03-06 00:03 . 2008-12-21 00:03 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2009-03-06 00:03 . 2008-12-19 10:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2009-03-06 00:02 . 2008-09-04 17:46 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2009-03-06 00:02 . 2008-10-15 17:55 339,456 -----c--- c:\windows\system32\dllcache\netapi32.dll 2009-03-06 00:02 . 2008-10-03 11:17 247,326 -----c--- c:\windows\system32\dllcache\strmdll.dll 2009-03-05 21:27 . 2009-03-05 21:31 <DIR> d-------- c:\program files\AutoCAD 2008 2009-03-05 21:27 . 2009-03-05 21:27 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Autodesk 2009-03-05 21:27 . 2009-03-05 21:27 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Autodesk 2009-03-04 17:34 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2009-03-04 17:24 . 2009-03-05 19:41 <DIR> d-------- c:\program files\Axesstel 2009-03-04 17:24 . 2008-09-16 03:19 118,784 -ra------ c:\program files\MSP_Uninstall.exe 2009-03-04 17:24 . 2008-09-16 03:19 90,112 -ra------ c:\program files\axesstel.dll 2009-03-04 17:24 . 2008-09-16 03:18 40,064 -ra------ c:\windows\system32\drivers\Axtmvmdm.sys 2009-03-04 17:24 . 2008-09-16 03:19 38,784 -ra------ c:\windows\system32\drivers\Axtmvprt.sys 2009-03-04 17:24 . 2008-09-16 03:18 3,456 -ra------ c:\windows\system32\drivers\Axtmvflt.sys 2009-03-02 18:23 . 2009-03-02 18:23 <DIR> d-------- c:\windows\system32\Futuremark 2009-03-02 18:23 . 2009-03-02 18:23 <DIR> d-------- c:\program files\NAPI-PROJEKT 2009-03-02 18:23 . 2004-10-25 20:02 21,664 --a------ c:\windows\system32\drivers\Entech.sys 2009-03-02 18:23 . 1999-11-02 10:01 6,173 --a------ c:\windows\system32\drivers\Entech.vxd 2009-03-02 18:23 . 2004-06-22 15:44 5,632 --a------ c:\windows\system32\drivers\Entech64.sys 2009-03-02 18:23 . 2001-11-19 19:05 3,972 --a------ c:\windows\system32\drivers\PciBus.sys 2009-03-02 18:09 . 2009-03-05 15:11 <DIR> d-------- c:\windows\vbSkinner 2009-03-02 18:09 . 2009-03-02 18:09 18,944 --a------ c:\windows\system32\vbCPUInf.dll 2009-03-02 18:04 . 2009-03-02 18:04 3,888,054 --a------ c:\windows\BricoPack Wallpaper.bmp 2009-03-02 18:04 . 2009-03-02 18:04 52,901 --a------ c:\windows\BricoPackUninst.cmd 2009-03-02 18:02 . 2009-03-02 18:01 737,280 --a------ c:\windows\iun6002.exe 2009-03-02 18:01 . 2009-03-02 18:01 <DIR> d-------- c:\program files\CM Data Software 2009-03-02 18:01 . 2009-03-02 18:04 6,112 --a------ c:\windows\BricoPackFoldersDelete.cmd 2009-03-02 18:00 . 2009-03-02 18:00 <DIR> d-------- c:\windows\BricoPacks 2009-03-01 19:15 . 2009-03-01 19:15 <DIR> d-------- c:\windows\system32\VIRepair 2009-03-01 18:56 . 2009-03-01 18:56 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\ViStart 2009-03-01 18:54 . 2009-03-01 18:54 <DIR> d-------- c:\program files\WinFlip 2009-03-01 18:54 . 2009-03-01 19:32 <DIR> d-------- c:\program files\Vista Rainbar 2009-03-01 18:54 . 2009-03-01 18:54 <DIR> d-------- c:\program files\ViSplore 2009-03-01 18:54 . 2009-03-01 18:54 <DIR> d-------- c:\program files\TrueTransparency 2009-03-01 18:54 . 2009-03-01 19:15 <DIR> d-------- c:\program files\Styler 2009-03-01 18:54 . 2009-03-01 18:54 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Styler 2009-03-01 18:09 . 2009-03-01 18:11 <DIR> d-------- c:\windows\NV28682872.TMP 2009-03-01 17:52 . 2009-03-01 17:59 <DIR> d-------- c:\windows\NV40404044.TMP 2009-03-01 17:34 . 2009-03-01 19:16 <DIR> d-------- c:\windows\system32\VITrans 2009-03-01 17:34 . 2006-12-03 17:15 111,104 --a------ c:\windows\system32\Uharc.exe 2009-03-01 17:34 . 2004-11-27 19:00 94,208 --a------ c:\windows\system32\pskill.exe 2009-03-01 17:34 . 2006-12-03 17:15 19,968 --a------ c:\windows\system32\reico.exe 2009-03-01 17:34 . 2006-12-03 17:14 8,636 --a------ c:\windows\system32\modifype.exe 2009-02-26 19:46 . 2009-02-26 19:46 42,320 --a------ c:\windows\system32\xfcodec.dll 2009-02-24 19:02 . 2009-03-05 21:31 <DIR> d-------- c:\program files\Common Files\Autodesk Shared 2009-02-24 19:02 . 2009-02-24 19:02 <DIR> d-------- c:\program files\Autodesk . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-23 09:48 --------- d-----w c:\documents and settings\user\Dane aplikacji\AVG7 2009-03-22 11:33 138,944 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-03-22 11:32 189,784 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-19 14:14 75,064 ----a-w c:\windows\system32\PnkBstrA.exe 2009-03-18 16:46 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-02 17:23 86,016 ----a-w c:\windows\system32\OpenAL32.dll 2009-03-02 17:23 262,144 ----a-w c:\windows\system32\wrap_oal.dll 2009-03-02 17:04 219,648 ----a-w c:\windows\system32\uxtheme.dll 2009-03-01 16:57 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-01 16:55 --------- d-----w c:\program files\AGEIA Technologies 2009-02-28 18:05 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2009-02-18 16:25 --------- d-----w c:\documents and settings\user\Dane aplikacji\Desktopicon 2009-02-09 13:56 1,847,680 ----a-w c:\windows\system32\win32k.sys 2009-01-27 16:17 860 ----a-w c:\documents and settings\user\Dane aplikacji\wklnhst.dat 2009-01-27 16:08 --------- d-----w c:\documents and settings\Javier.DOM\Dane aplikacji\Winamp 2009-01-27 16:06 --------- d-----w c:\documents and settings\Javier.DOM\Dane aplikacji\IrfanView 2009-01-27 15:54 148 ----a-w c:\documents and settings\Javier.DOM\Dane aplikacji\wklnhst.dat 2009-01-27 15:54 --------- d-----w c:\documents and settings\Javier.DOM\Dane aplikacji\Template 2009-01-27 15:53 --------- d-----w c:\documents and settings\Javier.DOM\Dane aplikacji\AVG7 2009-01-26 15:49 --------- d-----w c:\documents and settings\Javier\Dane aplikacji\AVG7 2008-12-25 23:08 801,312 ----a-w c:\windows\system32\nvcplui.exe 2008-12-25 23:08 453,152 ----a-w c:\windows\system32\nvudisp.exe 2008-12-25 23:08 1,560,576 ----a-w c:\windows\system32\nvcuda.dll 2008-12-25 23:08 1,108,512 ----a-w c:\windows\system32\nvcpluir.dll 2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-05-10 2111176] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Vista Rainbar"="c:\program files\Vista Rainbar\launcher.exe" [2008-11-14 131778] "ALLUpdate"="g:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "Optimize RAM"="c:\program files\CM Data Software\CM DiskCleaner\Optimize RAM.exe" [2006-10-08 159744] "Google Update"="c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2009-03-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864] "36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-05-25 1953792] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-10 8429568] "AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2009-03-10 590848] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "QuickTime Task"="g:\program files\QuickTime\qttask.exe" [2008-04-12 155648] "CardDetectorICON225"="c:\program files\CardDetector\ICON225\CardDetector.exe" [2007-11-14 278528] "BEWINTERNET-PLSessionManager"="c:\program files\OrangeBS\BEWInternet-PL\SessionManager\SessionManager.exe" [2008-01-08 107248] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-10 81920] "Startup Cleaner"="c:\program files\CM Data Software\CM DiskCleaner\Startup Cleaner.exe" [2006-10-08 122880] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "nwiz"="nwiz.exe" [2007-05-10 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-12-26 219136] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2008-12-21 c:\windows\system32\advpack.dll] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] Orbit.lnk - g:\program files\Orbitdownloader\orbitdm.exe [2009-03-23 1719496] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "d:\\Program Files\\Quake III Arena\\quake3.exe"= "g:\\Program Files\\BattleField 1942\\BF1942.exe"= "c:\\Python25\\pythonw.exe"= "g:\\Program Files\\Cyanide\\Loki\\Loki.exe"= "g:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "c:\\Program Files\\OrangeBS\\BEWInternet-PL\\Connectivity\\ConnectivityManager.exe"= "g:\\Program Files\\Electronic Arts\\Need for Speed ProStreet\\nfs.exe"= "g:\\Program Files\\Spellforce 2 - Czas Mrocznych Wojen\\SpellForce2.exe"= "d:\\Program Files\\Electronic Arts\\Need for Speed Carbon\\NFSC.exe"= "g:\\Gry\\Two Worlds\\TwoWorlds.exe"= "g:\\Gry\\Two Worlds\\TwoWorlds_RADEON.exe"= "g:\\Program Files\\Electronic Arts\\Battlefield 2142 Demo\\BF2142.exe"= "c:\\Program Files\\Axesstel\\AxessManager\\AxessManager.exe"= "g:\\Program Files\\Mozilla Firefox\\firefox.exe"= "g:\\Program Files\\Kylotonn Entertainment\\Bet on Soldier\\BoS.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "g:\\Gry\\Sniper Elite\\SniperElite.exe"= "g:\\Program Files\\SpellForce\\SpellForce.exe"= "g:\\Gry\\Tactical Ops\\System\\TacticalOps.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "g:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "g:\\Program Files\\Orbitdownloader\\orbitnet.exe"= R1 fwdrv;Kerio Personal Firewall Driver;c:\windows\system32\drivers\FWDRV.SYS [2007-12-26 102912] S3 AmdTools;AMD Special Tools Driver;c:\windows\system32\DRIVERS\AmdTools.sys --> c:\windows\system32\DRIVERS\AmdTools.sys [?] S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?] S3 Axtmvflt;Axesstel USB Filter Service;c:\windows\system32\drivers\Axtmvflt.sys [2009-03-04 3456] S3 Axtmvmdm;Axesstel USB Modem;c:\windows\system32\drivers\Axtmvmdm.sys [2009-03-04 40064] S3 Axtmvprt;Axesstel Diagnostic Port;c:\windows\system32\drivers\Axtmvprt.sys [2009-03-04 38784] S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2008-12-04 95744] S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2008-12-04 51968] S3 GTPTSER;GT PT SER;c:\windows\system32\drivers\gtptser.sys [2008-12-04 8064] S3 SER120;OTI Serial port driver;c:\windows\system32\drivers\ser120.sys [2008-03-01 32782] S3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\drivers\usb2vcom.sys [2008-03-01 28864] S3 uscsc108;uscsc108;c:\windows\system32\DRIVERS\uscsc108.sys --> c:\windows\system32\DRIVERS\uscsc108.sys [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9e27cd7-c063-11dd-8e9d-b2b3199fb804}] \Shell\AutoRun\command - K:\AutoRunCardDetector.exe . Zawartość folderu 'Zaplanowane zadania' 2009-03-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-1801674531-839522115-1004.job - c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-03-08 15:56] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-PcSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe HKCU-Run-LClock - c:\program files\LClock\LClock.exe HKCU-Run-ViStart - c:\program files\ViStart\ViStart.exe HKCU-Run-ViOrb - c:\program files\ViOrb\ViOrb.exe HKCU-Run-RocketDock - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe HKLM-Run-DrvIcon - c:\program files\Vista Drive Icon\DrvIcon.exe HKLM-Run-Anti Trojan Elite - c:\program files\Anti Trojan Elite\TJEnder.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.orbitdownloader.com uInternet Connection Wizard,ShellNext = hxxp://free.grisoft.com/ IE: &Download by Orbit - g:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - g:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - g:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - g:\program files\Orbitdownloader\orbitmxt.dll/202 FF - ProfilePath - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\u8svizds.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - plugin: c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll FF - plugin: c:\documents and settings\user\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: g:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-23 20:18:51 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-515967899-1801674531-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:43,f3,04,db,62,87,01,bc,32,5a,cd,c0,a8,7e,f5,3c,15,9c,ec,8f,bc,bd,df, ea,98,2c,a7,d2,2a,a9,ea,4c,29,21,bd,20,d1,76,ef,b5,9e,37,af,cc,9a,b6,05,b4,\ "??"=hex:ee,74,77,dd,cc,50,c1,a6,bd,d7,5a,8f,26,6c,6b,2c [HKEY_USERS\S-1-5-21-515967899-1801674531-839522115-1004\Software\SecuROM\License information*] "datasecu"=hex:e3,10,2e,bb,f8,a4,fe,f6,c6,6f,eb,89,93,bf,96,1b,8f,8f,81,5e,66, f1,1e,40,c5,42,67,77,18,eb,a3,45,f1,9b,15,bf,be,3d,c3,5c,e2,65,88,ec,42,84,\ "rkeysecu"=hex:31,31,4a,62,e0,41,ff,d7,0a,6f,b2,45,66,a4,79,fd . Czas ukończenia: 2009-03-23 20:19:32 ComboFix-quarantined-files.txt 2009-03-23 19:19:30 Przed: 24 734 736 384 bajtów wolnych Po: 29,129,359,360 bajtów wolnych 267 --- E O F --- 2009-03-13 10:37:35

**Posty:** 18165 · przez **wojtas** 23 Mar 2009, 21:33

proszę opisać problem...

**Posty:** 16 · przez **zina181** 23 Mar 2009, 22:22

Komputer wolno chodzi

Dodano Dzisiaj, 21:23:
Poza tym przy włączaniu kompa wyskakuje jakieś okienko, że brakuje jakiegoś pliku czy coś takiego.

**Posty:** 18165 · przez **wojtas** 23 Mar 2009, 22:42

a jakiego pliku ? ;/

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 16 · przez **zina181** 26 Mar 2009, 22:30

brakuje pliku C:\windows\system32\scrnrdr.exe

**Posty:** 18165 · przez **wojtas** 26 Mar 2009, 22:36

wykonałes co kazalem bo nie widze raportów ?

start > uruchom > msconfig > zakladka uruchamianie poszukaj wpisu zwiazanego z plikiem scrnrdr.exe i odznacz go i reset kompa..