nie mogę wypakować exe, win32/virtus.at

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 19:37

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-10 18:31:00.9 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.131 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\iwbcba.exe C:\WINDOWS\system32\jcezogo.exe C:\WINDOWS\system32\nugfkc.exe C:\WINDOWS\system32\pwtvnj.exe C:\WINDOWS\system32\zkfyk.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\iwbcba.exe C:\WINDOWS\system32\jcezogo.exe C:\WINDOWS\system32\nugfkc.exe C:\WINDOWS\system32\pwtvnj.exe C:\WINDOWS\system32\zkfyk.exe . ((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 ))))))))))))))))))))))))))))))) . 2008-03-10 17:08 . 2008-03-10 17:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-10 17:08 . 2008-03-10 17:08 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-09 21:07 . 2008-03-09 21:07 <DIR> d-------- C:\Deckard 2008-03-09 20:43 . 2008-03-08 19:40 <DIR> d-------- C:\SDFix 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-0

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 19:42

log urwany

daj nowego loga calego oraz log nowy log z dssa

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 19:53

Taki się pokazał po skończeniu skanowanie przez Combo... To jeszcze raz włączyć Combo z tym CFScriptem czy bez??
http://www.wklej.org/id/9703808aea

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 19:59

juz bez ale daj 2 logi

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 20:04

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-10 19:00:43.10 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.104 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\bbeeg.ini C:\WINDOWS\system32\bbeeg.ini2 C:\WINDOWS\system32\cafratrn.ini C:\WINDOWS\system32\ceoltucn.ini C:\WINDOWS\system32\fkqafixf.ini C:\WINDOWS\system32\fmjtbqdj.ini C:\WINDOWS\system32\hchmjopo.ini C:\WINDOWS\system32\ifaccyvo.ini C:\WINDOWS\system32\iqapagom.ini C:\WINDOWS\system32\jdwdnnce.ini C:\WINDOWS\system32\jqoafjbo.ini C:\WINDOWS\system32\jvlpkxde.ini C:\WINDOWS\system32\ksseeewo.ini C:\WINDOWS\system32\lhwecxfd.ini C:\WINDOWS\system32\lsepganj.ini C:\WINDOWS\system32\lsqcwwod.ini C:\WINDOWS\system32\nhokwomq.ini C:\WINDOWS\system32\qufbebww.ini C:\WINDOWS\system32\siclilkd.ini C:\WINDOWS\system32\skatmiac.ini C:\WINDOWS\system32\trqgncqm.ini C:\WINDOWS\system32\urroxvjr.ini C:\WINDOWS\system32\vgevgfpw.ini C:\WINDOWS\system32\wbppmhjy.ini C:\WINDOWS\system32\xtqihfnm.ini C:\WINDOWS\system32\ycjgbfpk.ini C:\WINDOWS\system32\yrggurvg.ini . ((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 ))))))))))))))))))))))))))))))) . 2008-03-10 17:08 . 2008-03-10 17:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-10 17:08 . 2008-03-10 17:08 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-09 21:07 . 2008-03-09 21:07 <DIR> d-------- C:\Deckard 2008-03-09 20:43 . 2008-03-08 19:40 <DIR> d-------- C:\SDFix 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-25 13:23 1,033,728 ------w C:\WINDOWS\explorer.exe 2008-02-22 20:08 99,840 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe 2008-02-22 20:08 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe 2008-02-22 20:08 35,328 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe 2008-02-22 20:08 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe 2008-02-22 20:08 159,744 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe 2008-02-22 20:08 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe 2008-02-22 20:03 99,840 ----a-w C:\WINDOWS\system32\dllcache\helphost.exe 2008-02-22 19:59 9,216 ----a-w C:\WINDOWS\system32\scrnsave.scr 2008-02-22 19:59 708,608 ----a-w C:\WINDOWS\system32\ss3dfo.scr 2008-02-22 19:59 679,936 ----a-w C:\WINDOWS\system32\sstext3d.scr 2008-02-22 19:59 610,304 ----a-w C:\WINDOWS\system32\sspipes.scr 2008-02-22 19:59 47,104 ----a-w C:\WINDOWS\system32\ssmypics.scr 2008-02-22 19:59 393,216 ----a-w C:\WINDOWS\system32\ssflwbox.scr 2008-02-22 19:59 20,992 ----a-w C:\WINDOWS\system32\ssmarque.scr 2008-02-22 19:59 19,968 ----a-w C:\WINDOWS\system32\ssbezier.scr 2008-02-22 19:59 14,848 ----a-w C:\WINDOWS\system32\ssstars.scr 2008-02-22 09:03 62,464 ----a-w C:\WINDOWS\system32\dllcache\rdpclip.exe 2008-02-22 09:01 18,944 ----a-w C:\WINDOWS\system32\ssmyst.scr 2008-02-22 08:34 98,304 ----a-w C:\WINDOWS\system32\scardsvr.exe 2008-02-22 08:33 86,016 ----a-w C:\WINDOWS\unvise32qt.exe 2008-02-22 08:32 4,096 ----a-w C:\WINDOWS\system32\unlodctr.exe 2008-02-22 08:32 4,096 ----a-w C:\WINDOWS\system32\nddeapir.exe 2008-02-22 08:32 4,096 ----a-w C:\WINDOWS\system32\actmovie.exe 2008-02-22 08:32 30,208 ----a-w C:\WINDOWS\system32\dplaysvr.exe 2008-02-22 08:32 30,208 ----a-w C:\WINDOWS\system32\asr_fmt.exe 2008-02-22 08:31 15,360 ----a-w C:\WINDOWS\TASKMAN.EXE 2008-02-22 08:22 220,672 ----a-w C:\WINDOWS\system32\logon.scr 2008-02-21 16:58 114,688 ----a-w C:\WINDOWS\system32\wscript.exe 2008-02-21 07:08 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe 2008-02-21 07:08 285,696 ----a-w C:\WINDOWS\winhlp32.exe 2008-02-21 07:08 14,336 ----a-w C:\WINDOWS\system32\runonce.exe 2008-02-21 07:07 82,432 ----a-w C:\WINDOWS\system32\dfrgfat.exe 2008-02-21 07:07 515,072 ----a-w C:\WINDOWS\system32\LOGONUI.EXE 2008-02-21 07:07 420,352 ----a-w C:\WINDOWS\system32\ntvdm.exe 2008-02-21 07:07 25,088 ----a-w C:\WINDOWS\system32\userinit.exe 2008-02-21 07:07 25,088 ----a-w C:\WINDOWS\system32\defrag.exe 2008-02-21 07:07 155,648 ----a-w C:\WINDOWS\system32\NeroCheck.exe 2008-02-21 06:47 78,848 ----a-w C:\WINDOWS\system32\msiexec.exe 2008-02-21 06:47 57,344 ----a-w C:\WINDOWS\system32\sol.exe 2008-02-21 06:47 55,808 ----a-w C:\WINDOWS\system32\freecell.exe 2008-02-21 06:47 539,136 ----a-w C:\WINDOWS\system32\spider.exe 2008-02-21 06:47 5,632 ----a-w C:\WINDOWS\system32\write.exe 2008-02-21 06:47 32,768 ----a-w C:\WINDOWS\system32\odbcad32.exe 2008-02-21 06:47 128,000 ----a-w C:\WINDOWS\system32\mshearts.exe 2008-02-21 06:47 119,808 ----a-w C:\WINDOWS\system32\winmine.exe 2008-02-21 06:45 80,896 ----a-w C:\WINDOWS\system32\charmap.exe 2008-02-21 06:45 65,024 ----a-w C:\WINDOWS\system32\cleanmgr.exe 2008-02-21 06:45 408,576 ----a-w C:\WINDOWS\system32\mstsc.exe 2008-02-21 06:45 345,088 ----a-w C:\WINDOWS\system32\mspaint.exe 2008-02-21 06:45 187,904 ----a-w C:\WINDOWS\system32\accwiz.exe 2008-02-21 06:45 139,264 ----a-w C:\WINDOWS\system32\sndvol32.exe 2008-02-21 06:45 132,608 ----a-w C:\WINDOWS\system32\sndrec32.exe 2008-02-21 06:45 115,200 ----a-w C:\WINDOWS\system32\calc.exe 2008-02-21 06:45 1,221,632 ----a-w C:\WINDOWS\system32\ntbackup.exe 2008-02-21 06:44 47,104 ----a-w C:\WINDOWS\system32\cmdl32.exe 2008-02-21 06:43 73,216 ----a-w C:\WINDOWS\system32\magnify.exe 2008-02-21 06:43 70,144 ----a-w C:\WINDOWS\system32\notepad.exe 2008-02-21 06:43 50,176 ----a-w C:\WINDOWS\system32\utilman.exe 2008-02-21 06:43 44,544 ----a-w C:\WINDOWS\system32\alg.exe 2008-02-21 06:43 395,776 ------w C:\WINDOWS\system32\cmd.exe 2008-02-21 06:43 347,136 ----a-w C:\WINDOWS\system32\tourstart.exe 2008-02-21 06:43 216,064 ----a-w C:\WINDOWS\system32\osk.exe 2008-02-21 06:43 150,016 ----a-w C:\WINDOWS\system32\imapi.exe 2008-02-21 06:43 143,872 ----a-w C:\WINDOWS\system32\mobsync.exe 2008-02-21 06:43 112,128 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-02-21 06:43 11,776 ----a-w C:\WINDOWS\system32\rasautou.exe 2008-02-21 06:43 10,752 ----a-w C:\WINDOWS\hh.exe 2008-02-21 06:42 35,840 ----a-w C:\WINDOWS\system32\rcimlby.exe 2008-02-21 06:42 18,944 ----a-w C:\WINDOWS\system32\libusbd-nt.exe 2008-02-21 06:42 18,944 ----a-w C:\WINDOWS\system32\libusbd-nt(2).exe 2008-02-21 06:42 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe 2008-02-21 06:41 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-02-21 06:41 33,280 ----a-w C:\WINDOWS\system32\rundll32.exe 2008-02-21 06:34 47,104 ------w C:\WINDOWS\system32\drwtsn32.exe 2008-02-21 06:34 180,224 ----a-w C:\WINDOWS\system32\dwwin.exe 2008-02-21 06:34 10,752 ----a-w C:\WINDOWS\system32\dumprep.exe 2008-02-21 06:26 3,584 ----a-w C:\WINDOWS\system32\regedt32.exe 2008-02-21 06:26 149,504 ----a-w C:\WINDOWS\regedit.exe 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-18 19:20 69,696 ----a-w C:\WINDOWS\system32\ygrbwios.dll 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-12-27 10:02 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- 2008-02-25 14:23 1033728 d093703d1c9253c2dcf6265b73b5d825 C:\WINDOWS\explorer.exe 2008-02-22 21:03 1033728 d093703d1c9253c2dcf6265b73b5d825 C:\WINDOWS\system32\dllcache\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "ISTray"="D:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-10 19:03:11 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-10 19:03:53 ComboFix-quarantined-files.txt 2008-03-10 18:03:52 ComboFix5.txt 2008-03-09 19:02:42 ComboFix4.txt 2008-03-09 20:17:48 ComboFix3.txt 2008-03-10 15:00:08 ComboFix2.txt 2008-03-10 17:35:28

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 20:10

zainstaluj:

http://www.programosy.pl/program,kerio-personal-firewall.html

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\ftbrpfwv.ini
C:\WINDOWS\system32\bffpuxx.exe
C:\WINDOWS\system32\fznbby.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 20:44

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-10 19:41:55.11 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.141 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\bffpuxx.exe C:\WINDOWS\system32\ftbrpfwv.ini C:\WINDOWS\system32\fznbby.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\bffpuxx.exe C:\WINDOWS\system32\ftbrpfwv.ini C:\WINDOWS\system32\fznbby.exe . ((((((((((((((((((((((((( Files Created from 2008-02-10 to 2008-03-10 ))))))))))))))))))))))))))))))) . 2008-03-10 17:08 . 2008-03-10 17:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-10 17:08 . 2008-03-10 17:08 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-09 21:07 . 2008-03-09 21:07 <DIR> d-------- C:\Deckard 2008-03-09 20:43 . 2008-03-08 19:40 <DIR> d-------- C:\SDFix 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-25 13:23 1,033,728 ------w C:\WINDOWS\explorer.exe 2008-02-22 20:08 99,840 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe 2008-02-22 20:08 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe 2008-02-22 20:08 35,328 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe 2008-02-22 20:08 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe 2008-02-22 20:08 159,744 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe 2008-02-22 20:08 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe 2008-02-22 20:03 99,840 ----a-w C:\WINDOWS\system32\dllcache\helphost.exe 2008-02-22 19:59 9,216 ----a-w C:\WINDOWS\system32\scrnsave.scr 2008-02-22 19:59 708,608 ----a-w C:\WINDOWS\system32\ss3dfo.scr 2008-02-22 19:59 679,936 ----a-w C:\WINDOWS\system32\sstext3d.scr 2008-02-22 19:59 610,304 ----a-w C:\WINDOWS\system32\sspipes.scr 2008-02-22 19:59 47,104 ----a-w C:\WINDOWS\system32\ssmypics.scr 2008-02-22 19:59 393,216 ----a-w C:\WINDOWS\system32\ssflwbox.scr 2008-02-22 19:59 20,992 ----a-w C:\WINDOWS\system32\ssmarque.scr 2008-02-22 19:59 19,968 ----a-w C:\WINDOWS\system32\ssbezier.scr 2008-02-22 19:59 14,848 ----a-w C:\WINDOWS\system32\ssstars.scr 2008-02-22 09:03 62,464 ----a-w C:\WINDOWS\system32\dllcache\rdpclip.exe 2008-02-22 09:01 18,944 ----a-w C:\WINDOWS\system32\ssmyst.scr 2008-02-22 08:34 98,304 ----a-w C:\WINDOWS\system32\scardsvr.exe 2008-02-22 08:33 86,016 ----a-w C:\WINDOWS\unvise32qt.exe 2008-02-22 08:32 4,096 ----a-w C:\WINDOWS\system32\unlodctr.exe 2008-02-22 08:32 4,096 ----a-w C:\WINDOWS\system32\nddeapir.exe 2008-02-22 08:32 4,096 ----a-w C:\WINDOWS\system32\actmovie.exe 2008-02-22 08:32 30,208 ----a-w C:\WINDOWS\system32\dplaysvr.exe 2008-02-22 08:32 30,208 ----a-w C:\WINDOWS\system32\asr_fmt.exe 2008-02-22 08:31 15,360 ----a-w C:\WINDOWS\TASKMAN.EXE 2008-02-22 08:22 220,672 ----a-w C:\WINDOWS\system32\logon.scr 2008-02-21 16:58 114,688 ----a-w C:\WINDOWS\system32\wscript.exe 2008-02-21 07:08 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe 2008-02-21 07:08 285,696 ----a-w C:\WINDOWS\winhlp32.exe 2008-02-21 07:08 14,336 ----a-w C:\WINDOWS\system32\runonce.exe 2008-02-21 07:07 82,432 ----a-w C:\WINDOWS\system32\dfrgfat.exe 2008-02-21 07:07 515,072 ----a-w C:\WINDOWS\system32\LOGONUI.EXE 2008-02-21 07:07 420,352 ----a-w C:\WINDOWS\system32\ntvdm.exe 2008-02-21 07:07 25,088 ----a-w C:\WINDOWS\system32\userinit.exe 2008-02-21 07:07 25,088 ----a-w C:\WINDOWS\system32\defrag.exe 2008-02-21 07:07 155,648 ----a-w C:\WINDOWS\system32\NeroCheck.exe 2008-02-21 06:47 78,848 ----a-w C:\WINDOWS\system32\msiexec.exe 2008-02-21 06:47 57,344 ----a-w C:\WINDOWS\system32\sol.exe 2008-02-21 06:47 55,808 ----a-w C:\WINDOWS\system32\freecell.exe 2008-02-21 06:47 539,136 ----a-w C:\WINDOWS\system32\spider.exe 2008-02-21 06:47 5,632 ----a-w C:\WINDOWS\system32\write.exe 2008-02-21 06:47 32,768 ----a-w C:\WINDOWS\system32\odbcad32.exe 2008-02-21 06:47 128,000 ----a-w C:\WINDOWS\system32\mshearts.exe 2008-02-21 06:47 119,808 ----a-w C:\WINDOWS\system32\winmine.exe 2008-02-21 06:45 80,896 ----a-w C:\WINDOWS\system32\charmap.exe 2008-02-21 06:45 65,024 ----a-w C:\WINDOWS\system32\cleanmgr.exe 2008-02-21 06:45 408,576 ----a-w C:\WINDOWS\system32\mstsc.exe 2008-02-21 06:45 345,088 ----a-w C:\WINDOWS\system32\mspaint.exe 2008-02-21 06:45 187,904 ----a-w C:\WINDOWS\system32\accwiz.exe 2008-02-21 06:45 139,264 ----a-w C:\WINDOWS\system32\sndvol32.exe 2008-02-21 06:45 132,608 ----a-w C:\WINDOWS\system32\sndrec32.exe 2008-02-21 06:45 115,200 ----a-w C:\WINDOWS\system32\calc.exe 2008-02-21 06:45 1,221,632 ----a-w C:\WINDOWS\system32\ntbackup.exe 2008-02-21 06:44 47,104 ----a-w C:\WINDOWS\system32\cmdl32.exe 2008-02-21 06:43 73,216 ----a-w C:\WINDOWS\system32\magnify.exe 2008-02-21 06:43 70,144 ----a-w C:\WINDOWS\system32\notepad.exe 2008-02-21 06:43 50,176 ----a-w C:\WINDOWS\system32\utilman.exe 2008-02-21 06:43 44,544 ----a-w C:\WINDOWS\system32\alg.exe 2008-02-21 06:43 395,776 ------w C:\WINDOWS\system32\cmd.exe 2008-02-21 06:43 347,136 ----a-w C:\WINDOWS\system32\tourstart.exe 2008-02-21 06:43 216,064 ----a-w C:\WINDOWS\system32\osk.exe 2008-02-21 06:43 150,016 ----a-w C:\WINDOWS\system32\imapi.exe 2008-02-21 06:43 143,872 ----a-w C:\WINDOWS\system32\mobsync.exe 2008-02-21 06:43 112,128 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-02-21 06:43 11,776 ----a-w C:\WINDOWS\system32\rasautou.exe 2008-02-21 06:43 10,752 ----a-w C:\WINDOWS\hh.exe 2008-02-21 06:42 35,840 ----a-w C:\WINDOWS\system32\rcimlby.exe 2008-02-21 06:42 18,944 ----a-w C:\WINDOWS\system32\libusbd-nt.exe 2008-02-21 06:42 18,944 ----a-w C:\WINDOWS\system32\libusbd-nt(2).exe 2008-02-21 06:42 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe 2008-02-21 06:41 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-02-21 06:41 33,280 ----a-w C:\WINDOWS\system32\rundll32.exe 2008-02-21 06:34 47,104 ------w C:\WINDOWS\system32\drwtsn32.exe 2008-02-21 06:34 180,224 ----a-w C:\WINDOWS\system32\dwwin.exe 2008-02-21 06:34 10,752 ----a-w C:\WINDOWS\system32\dumprep.exe 2008-02-21 06:26 3,584 ----a-w C:\WINDOWS\system32\regedt32.exe 2008-02-21 06:26 149,504 ----a-w C:\WINDOWS\regedit.exe 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-18 19:20 69,696 ----a-w C:\WINDOWS\system32\ygrbwios.dll 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-12-27 10:02 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- 2008-02-25 14:23 1033728 d093703d1c9253c2dcf6265b73b5d825 C:\WINDOWS\explorer.exe 2008-02-22 21:03 1033728 d093703d1c9253c2dcf6265b73b5d825 C:\WINDOWS\system32\dllcache\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "ISTray"="D:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S2 SPF4;Sunbelt Personal Firewall 4;"D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-10 19:43:32 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-10 19:44:05 ComboFix-quarantined-files.txt 2008-03-10 18:44:04 ComboFix5.txt 2008-03-09 20:17:48 ComboFix4.txt 2008-03-10 15:00:08 ComboFix3.txt 2008-03-10 17:35:28 ComboFix2.txt 2008-03-10 18:03:56

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 21:58

czysto

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 22:11

Ej, ale jak potem kompa zrestartowałem to mi się restartował przy starcie systemu i jak go wziąłem na awaryjny i przywróciłem system do poprzedniego skanu Combo Fixa to działało, więc może coś z tymi skryptami nie tak?

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 22:24

skrypty byly na usuwanie wirusów

poprawne byly a masz teraz jakis jeszcze problem z kompem?

**Posty:** 302 · przez **pilif25** 11 Mar 2008, 22:14

To może przez tego Firewalla, bo jak zainstalowałem drugi raz to też się restartował

**Posty:** 3854 · przez **Dzi@dek** 11 Mar 2008, 22:33

Jak długo masz zainstalowany system :?:

**Posty:** 302 · przez **pilif25** 11 Mar 2008, 22:48

A da się to jakoś sprawdzi, bo nie wiem, gubię się, bo już miałem tyle formatów...??

**Posty:** 18165 · przez **wojtas** 12 Mar 2008, 13:17

sprawdz i podaj temperatury i napiecia z everesta ( znajdziesz go w googlach)

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 08:53

A gdzie są te temperatury, bo znaleźć nie mogę?

**Posty:** 18165 · przez **wojtas** 16 Mar 2008, 10:54

tam poszukaj opcji czujnik i powinne byc

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 12:14

Jak instaluje Everesta i chcę go włączyć to pokazuje się tai błąd:

I w folderze nie ma pliku exe

**Posty:** 18165 · przez **wojtas** 16 Mar 2008, 18:42

a moze tym:

http://www.programosy.pl/program,speedfan.html

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 20:33

Też nie ma exe w folderze

**Posty:** 18165 · przez **wojtas** 16 Mar 2008, 20:59

to w biosie poszukaj bo nie wiem czemu Ci nie działaja

nie mogę wypakować exe, win32/virtus.at

Kto jest na forum