Net zwolnił, podejrzane wpisy

**Posty:** 1861 · przez **skowrona** 26 Lut 2009, 12:54

Internet mi strasznie muli podejrzewam że może to być wirus
Najbardziej niepokoją mnie te dwa wpisy
O4 - HKLM\..\Run: [GEST] m‘|\ü
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll,wbsys.dll
Od dawien dawna używałam Kasperskiego i nigdy czegoś takiego nie widziałem

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:32:55, on 2009-02-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20583) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\LClock\lclock.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [GEST] m‘|\ü O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll,wbsys.dll O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6344 bytes

Kod: Zaznacz wszystko: ComboFix 09-02-25.02 - Administrator 2009-02-26 11:46:18.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2046.1570 [GMT 1:00] Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-26 do 2009-02-26 ))))))))))))))))))))))))))))))) . 2009-02-26 11:49 . 2009-02-26 11:49 <DIR> d-------- c:\windows\system32\xircom 2009-02-26 11:49 . 2009-02-26 11:49 <DIR> d-------- c:\windows\system32\oobe 2009-02-26 11:49 . 2009-02-26 11:49 <DIR> d-------- c:\windows\srchasst 2009-02-26 11:49 . 2009-02-26 11:49 <DIR> d-------- c:\windows\msagent 2009-02-26 11:49 . 2009-02-26 11:49 <DIR> d-------- c:\program files\microsoft frontpage 2009-02-26 11:32 . 2009-02-26 11:32 <DIR> d-------- c:\program files\Trend Micro 2009-02-25 10:44 . 2009-02-26 11:30 <DIR> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2 2009-02-24 20:36 . 2009-02-24 20:36 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS 2009-02-24 20:36 . 1997-03-24 16:42 314,368 --a------ c:\windows\IsUninst.exe 2009-02-24 11:39 . 2009-02-24 11:40 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-24 11:39 . 2009-02-24 11:39 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-24 11:38 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2009-02-24 11:37 . 2009-02-24 11:37 <DIR> d-------- c:\program files\MSXML 6.0 2009-02-23 19:40 . 2009-02-24 20:36 165 --a------ c:\windows\SNOW.INI 2009-02-23 19:38 . 2009-02-23 19:38 675 --a------ c:\windows\HAMMER.INI 2009-02-23 17:43 . 2009-02-23 17:43 <DIR> d-------- c:\windows\system32\LogFiles 2009-02-23 17:43 . 2004-08-03 23:08 25,600 --a------ c:\windows\system32\drivers\usbser.sys 2009-02-23 17:43 . 2008-03-21 13:57 14,640 --------- c:\windows\system32\spmsgXP_2k3.dll 2009-02-23 17:43 . 2009-02-23 17:43 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-02-23 17:43 . 2009-02-23 17:43 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-02-23 17:42 . 2009-02-23 17:43 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Suite 2009-02-23 17:42 . 2009-02-23 17:43 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\PC Suite 2009-02-23 17:42 . 2009-02-23 17:43 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\Nokia 2009-02-23 17:41 . 2009-02-23 17:41 <DIR> d-------- c:\program files\PC Connectivity Solution 2009-02-23 17:41 . 2009-02-23 17:41 <DIR> d-------- c:\program files\Nokia 2009-02-23 17:41 . 2009-02-23 17:41 <DIR> d-------- c:\program files\DIFX 2009-02-23 17:41 . 2009-02-23 17:41 <DIR> d-------- c:\program files\Common Files\PCSuite 2009-02-23 17:41 . 2009-02-23 17:41 <DIR> d-------- c:\program files\Common Files\Nokia 2009-02-23 17:41 . 2008-09-15 07:29 1,112,288 --a------ c:\windows\system32\wdfcoinstaller01007.dll 2009-02-23 17:41 . 2008-09-15 07:56 659,968 --a------ c:\windows\system32\nmwcdcocls.dll 2009-02-23 17:41 . 2008-09-15 07:56 91,136 --a------ c:\windows\system32\nmwcdcls.dll 2009-02-23 17:41 . 2008-09-15 07:56 22,016 --a------ c:\windows\system32\drivers\ccdcmbo.sys 2009-02-23 17:41 . 2008-08-26 09:26 18,816 --a------ c:\windows\system32\drivers\pccsmcfd.sys 2009-02-23 17:41 . 2008-09-15 07:56 17,664 --a------ c:\windows\system32\drivers\ccdcmb.sys 2009-02-23 17:41 . 2008-09-15 07:56 8,064 --a------ c:\windows\system32\drivers\usbser_lowerfltj.sys 2009-02-23 17:41 . 2008-09-15 07:56 8,064 --a------ c:\windows\system32\drivers\usbser_lowerflt.sys 2009-02-23 17:40 . 2009-02-23 17:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Installations 2009-02-23 16:11 . 2009-02-23 16:11 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\Media Player Classic 2009-02-23 13:15 . 2004-08-04 00:44 159,232 --a------ c:\windows\system32\ptpusd.dll 2009-02-23 13:15 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2009-02-23 13:15 . 2001-10-26 17:29 5,632 --a------ c:\windows\system32\ptpusb.dll 2009-02-23 11:58 . 2009-02-23 11:58 <DIR> d-------- c:\windows\Sun 2009-02-21 18:07 . 2009-02-21 18:07 <DIR> d-------- c:\program files\Grupa IMAGE 2009-02-20 14:17 . 2009-02-22 16:11 <DIR> d-------- c:\program files\Vista Rainbar 2009-02-20 09:30 . 2009-02-20 09:41 <DIR> d-------- C:\ikonki 2009-02-19 21:16 . 2009-02-19 21:27 <DIR> d-------- c:\program files\Thoosje Vista Sidebar 2009-02-19 20:49 . 2009-02-19 20:49 <DIR> d-------- c:\program files\RocketDock 2009-02-19 17:58 . 2009-02-19 17:58 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\FLEXnet 2009-02-19 17:54 . 2009-02-19 17:54 <DIR> d-------- c:\program files\Bonjour 2009-02-19 17:48 . 2009-02-19 17:48 <DIR> d-------- c:\program files\Common Files\Macrovision Shared 2009-02-19 17:47 . 2009-02-19 17:54 <DIR> d-------- c:\program files\Common Files\Adobe 2009-02-19 17:21 . 2009-02-19 17:21 <DIR> d-------- c:\program files\LClock 2009-02-19 17:14 . 2006-09-06 01:46 666,624 --a------ C:\Hyalo-Calendar Gadget by adni18.exe 2009-02-19 17:13 . 2005-11-26 11:37 578,048 --a------ C:\Glassy Clock II gadget.exe 2009-02-19 16:55 . 2009-02-19 16:55 2,560 --a------ c:\windows\_MSRSTRT.EXE 2009-02-19 16:44 . 2009-02-19 16:44 0 --------- c:\windows\WB.ini 2009-02-19 16:41 . 2009-02-19 16:45 868 --a------ c:\windows\langorig.ini 2009-02-19 16:40 . 2005-01-22 19:05 20,480 --------- c:\windows\system32\wbload.dll 2009-02-19 15:44 . 2009-02-19 15:44 <DIR> d-------- c:\program files\DAEMON Tools Pro 2009-02-19 15:44 . 2009-02-19 15:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro 2009-02-19 15:44 . 2009-02-19 15:44 717,296 --a------ c:\windows\system32\drivers\sptd.sys 2009-02-19 15:43 . 2009-02-19 15:43 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\DAEMON Tools Pro 2009-02-19 15:41 . 2009-02-19 15:41 <DIR> d-------- c:\program files\Stardock 2009-02-19 15:41 . 2008-04-26 16:14 42,672 --a------ c:\windows\system32\wbsys.dll 2009-02-19 14:43 . 2009-02-19 14:43 <DIR> d-------- c:\program files\Ashampoo 2009-02-19 14:43 . 2009-02-19 14:43 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ashampoo 2009-02-19 14:43 . 2009-02-19 14:43 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\Ashampoo 2009-02-19 14:43 . 2009-02-19 14:43 54,156 --ah----- c:\windows\QTFont.qfn 2009-02-19 14:43 . 2009-02-19 14:43 1,409 --a------ c:\windows\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-26 10:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-26 10:48 401,440 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-02-26 10:48 4,548 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-02-26 10:48 3,358,240 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-02-26 10:48 29,412 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-02-24 08:47 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-23 19:21 --------- d-----w c:\program files\Common Files\InstallShield 2009-02-22 18:39 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\foobar2000 2009-02-21 12:26 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\uTorrent 2009-02-18 15:47 89,601 ----a-w c:\windows\system32\drivers\klick.dat 2009-02-18 15:47 33,808 ----a-w c:\windows\system32\drivers\klbg.sys 2009-02-18 15:47 101,287 ----a-w c:\windows\system32\drivers\klin.dat 2009-02-18 15:36 --------- d-----w c:\program files\NAPI-PROJEKT 2009-02-18 15:36 --------- d-----w c:\program files\K-Lite Codec Pack 2009-02-18 15:34 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\BESTplayer 2009-02-18 15:31 --------- d-----w c:\program files\foobar2000 2009-02-18 15:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2009-02-18 15:25 --------- d-----w c:\program files\MSBuild 2009-02-18 15:25 --------- d-----w c:\program files\Microsoft.NET 2009-02-18 15:25 --------- d-----w c:\program files\Microsoft Works 2009-02-18 15:13 --------- d-----w c:\program files\Kaspersky Lab 2009-02-18 15:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-02-18 15:01 16,608 ----a-w c:\windows\gdrv.sys 2009-02-18 14:57 --------- d-----w c:\program files\uTorrent 2009-02-18 14:48 --------- d-----w c:\program files\WapSter 2009-02-18 14:48 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Ubisoft 2009-02-18 14:48 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Tlen.pl 2009-02-18 14:48 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Sports Interactive 2009-02-18 14:39 --------- d-----w c:\program files\Realtek 2009-02-18 14:39 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\InstallShield 2009-02-18 14:37 315,392 ----a-w c:\windows\HideWin.exe 2009-02-18 14:34 --------- d-----w c:\program files\Intel 2009-02-18 14:29 --------- d-----w c:\program files\Real Alternative 2009-02-18 14:29 --------- d-----w c:\program files\QuickTime Alternative 2009-02-18 14:29 --------- d-----w c:\program files\Java 2009-02-18 14:29 --------- d-----w c:\program files\Common Files\Java 2009-02-18 14:29 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-02-18 14:25 --------- d-----w c:\program files\Windows Media Connect 2 2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll 2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll . ------- Sigcheck ------- 2007-07-10 14:06 642560 ce594e18fe0d0af804f1f3694921ce62 c:\windows\system32\user32.dll 2007-07-13 23:56 814592 ce7193c5f7c01b19768e066087c1c919 c:\windows\system32\wininet.dll 2007-07-28 02:15 360576 0fb6743e937c7bb248b2530a5a77abc6 c:\windows\system32\drivers\tcpip.sys 2007-07-26 18:30 2145792 316acc3ac43fc855204ce5e775f66b91 c:\windows\system32\ntoskrnl.exe 2007-07-13 23:42 974848 32f67215c57df2c401bf93b7ee65987f c:\windows\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "LClock"="c:\program files\LClock\lclock.exe" [2004-09-19 65536] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="m‘|\ü" [X] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8523776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-18 206088] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "nwiz"="nwiz.exe" [2007-11-07 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2007-07-27 c:\windows\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] 2009-02-19 16:58 210168 c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592] . . ------- Skan uzupełniający ------- . uStart Page = about:blank uInternet Settings,ProxyOverride = *.local IE: Dodaj do listy blokowanych banerów - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq53ywxv.default\ FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npnul32.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPOFF12.DLL ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-26 11:49:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(864) c:\windows\system32\cscui.dll c:\program files\Stardock\Object Desktop\WindowBlinds\WBSrv.dll - - - - - - - > 'explorer.exe'(364) c:\windows\system32\SHDOCVW.dll c:\program files\RocketDock\RocketDock.dll c:\windows\system32\ntshrui.dll c:\windows\system32\msi.dll c:\windows\system32\SETUPAPI.dll c:\program files\LClock\LC.dll c:\program files\Stardock\Object Desktop\WindowBlinds\tray.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\rundll32.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\nvsvc32.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-02-26 11:51:12 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-02-26 10:51:04 Przed: 9 462 697 984 bajtów wolnych Po: 9,424,666,624 bajtów wolnych 245

**Posty:** 18165 · przez **wojtas** 26 Lut 2009, 17:19

skasuj:

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [GEST] m‘|\ü

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.