nie mogę wypakować exe, win32/virtus.at

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 11:38

Witam!
Mam problem. Gdy chcę wypakować exe to klikam wypakuj tutaj i plik exe się nie pojawia, to samo przy instalacji programów, nie ma pliku exe w folderze. NOD32 co chwilę informuje mnie, że znalazł wirusa i jest to spoolsv.exe-Win32/Virtus.AT. Co mam z tym zrobić, bo przez to żadnych programów ani nic nie mogę instalować??

**Posty:** 3854 · przez **Dzi@dek** 09 Mar 2008, 12:45

Daj logi z Combofix oraz Hijackthis.

w/g tego opisu - pamiętaj o tagach :
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 14:03

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-09 10:49:05.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.310 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pskt.ini . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-08 10:14 . 2008-03-08 10:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 10:14 . 2008-03-08 10:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 20:26 . 2008-02-25 20:26 <DIR> d--hs---- C:\FOUND.016 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-23 22:51 . 2008-02-23 22:51 1,033,728 --a------ C:\WINDOWS\explorer.exe.002 2008-02-23 22:51 . 2008-02-23 22:51 57,856 --a------ C:\WINDOWS\system32\spoolsv.exe.003 2008-02-23 16:07 . 2008-02-23 16:07 57,856 --a------ C:\WINDOWS\system32\spoolsv.exe.002 2008-02-23 14:10 . 2008-02-23 14:11 1,033,728 --a------ C:\WINDOWS\explorer.exe.000 2008-02-23 13:53 . 2008-02-23 13:53 57,856 --a------ C:\WINDOWS\system32\spoolsv.exe.000 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 07:24 . 2008-02-25 16:56 164,968 --ahs---- C:\WINDOWS\system32\oqstv.ini2 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-20 17:46 . 2008-02-20 17:46 <DIR> d--hs---- C:\FOUND.015 2008-02-20 07:12 . 2008-02-22 09:21 1,074 ---hs---- C:\WINDOWS\system32\ooubhlca.ini 2008-02-19 19:58 . 2008-02-20 07:10 414 ---hs---- C:\WINDOWS\system32\vpyfcogf.ini 2008-02-18 21:51 . 2008-02-18 21:51 <DIR> d--hs---- C:\FOUND.014 2008-02-17 13:41 . 2008-02-18 18:42 1,207,847 ---hs---- C:\WINDOWS\system32\peeadlpg.ini 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-12 21:15 . 2008-02-17 13:23 1,207,487 ---hs---- C:\WINDOWS\system32\llchcgxo.ini 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2008-02-11 13:49 . 2008-02-12 16:57 1,206,227 ---hs---- C:\WINDOWS\system32\ucuvmyyo.ini 2008-02-10 13:26 . 2008-02-11 13:49 1,205,987 ---hs---- C:\WINDOWS\system32\ebryrecb.ini 2008-02-09 13:27 . 2008-02-10 10:21 1,205,780 ---hs---- C:\WINDOWS\system32\rongnqdk.ini 2008-02-09 11:50 . 2008-02-09 11:50 <DIR> d--hs---- C:\FOUND.013 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] rqrpnlj.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 10:50:35 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-09 10:51:10 ComboFix-quarantined-files.txt 2008-03-09 09:51:10 ComboFix2.txt 2008-02-25 19:28:58

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:01:57, on 2008-03-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Microsoft ActiveSync\Wcescomm.exe C:\WINDOWS\system32\libusbd-nt.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MICROS~4\rapimgr.exe D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe d:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Spyware Terminator\sp_rsser.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe D:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Admin\Pulpit\hijackthis.com C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Phone Connection Monitor.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: Crawler Search - tbr:iemenu O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll O20 - Winlogon Notify: rqrpnlj - rqrpnlj.dll (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 9418 bytes

**Posty:** 3854 · przez **Dzi@dek** 09 Mar 2008, 14:30

Wklej do notatika:

File::
C:\WINDOWS\explorer.exe.002
C:\WINDOWS\system32\spoolsv.exe.003
C:\WINDOWS\system32\spoolsv.exe.002
C:\WINDOWS\explorer.exe.000
C:\WINDOWS\system32\spoolsv.exe.000
C:\WINDOWS\system32\oqstv.ini2
C:\WINDOWS\system32\ooubhlca.ini
C:\WINDOWS\system32\peeadlpg.ini

Folder::
C:\FOUND.013
C:\FOUND.014
C:\FOUND.015
C:\FOUND.016

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

A w hijackthis usuń wpisy:

O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file)
O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file)
O20 - Winlogon Notify: rqrpnlj - rqrpnlj.dll (file missing)

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 15:25

Ale jak upuszczam ten CFScript na Combo Fixa, to mi się włącza ten Combo Fix, a kompek się nie restartuje...

**Posty:** 3854 · przez **Dzi@dek** 09 Mar 2008, 16:28

pilif25 napisał(a):Ale jak upuszczam ten CFScript na Combo Fixa, to mi się włącza ten Combo Fix, a kompek się nie restartuje...

To daj log z Combo po tym zabiegu oraz z HJ.

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 17:27

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-09 14:39:40.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.217 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\explorer.exe.000 C:\WINDOWS\explorer.exe.002 C:\WINDOWS\system32\ooubhlca.ini C:\WINDOWS\system32\oqstv.ini2 C:\WINDOWS\system32\peeadlpg.ini C:\WINDOWS\system32\spoolsv.exe.000 C:\WINDOWS\system32\spoolsv.exe.002 C:\WINDOWS\system32\spoolsv.exe.003 . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-08 10:14 . 2008-03-08 10:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 10:14 . 2008-03-08 10:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-19 19:58 . 2008-02-20 07:10 414 ---hs---- C:\WINDOWS\system32\vpyfcogf.ini 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-12 21:15 . 2008-02-17 13:23 1,207,487 ---hs---- C:\WINDOWS\system32\llchcgxo.ini 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2008-02-11 13:49 . 2008-02-12 16:57 1,206,227 ---hs---- C:\WINDOWS\system32\ucuvmyyo.ini 2008-02-10 13:26 . 2008-02-11 13:49 1,205,987 ---hs---- C:\WINDOWS\system32\ebryrecb.ini 2008-02-09 13:27 . 2008-02-10 10:21 1,205,780 ---hs---- C:\WINDOWS\system32\rongnqdk.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 14:40:57 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-09 14:42:07 ComboFix-quarantined-files.txt 2008-03-09 13:42:04 ComboFix5.txt 2008-02-25 19:28:58 ComboFix4.txt 2008-03-09 09:51:12 ComboFix3.txt 2008-03-09 12:52:48 ComboFix2.txt 2008-03-09 13:02:00

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:37:07, on 2008-03-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Microsoft ActiveSync\Wcescomm.exe C:\WINDOWS\system32\libusbd-nt.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MICROS~4\rapimgr.exe D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe d:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Spyware Terminator\sp_rsser.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe D:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Documents and Settings\Admin\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll (file missing) O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Phone Connection Monitor.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: Crawler Search - tbr:iemenu O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 9220 bytes

**Posty:** 18165 · przez **wojtas** 09 Mar 2008, 17:37

skasuj:

O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file)
O2 - BHO: O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)

wklej do notatnika:

File::
C:\WINDOWS\system32\vpyfcogf.ini
C:\WINDOWS\system32\ucuvmyyo.ini
C:\WINDOWS\system32\ebryrecb.ini
C:\WINDOWS\system32\rongnqdk.ini

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 19:08

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-09 17:54:53.5 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.210 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\ebryrecb.ini C:\WINDOWS\system32\rongnqdk.ini C:\WINDOWS\system32\ucuvmyyo.ini C:\WINDOWS\system32\vpyfcogf.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ebryrecb.ini C:\WINDOWS\system32\rongnqdk.ini C:\WINDOWS\system32\ucuvmyyo.ini C:\WINDOWS\system32\vpyfcogf.ini . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-08 10:14 . 2008-03-08 10:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 10:14 . 2008-03-08 10:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-12 21:15 . 2008-02-17 13:23 1,207,487 ---hs---- C:\WINDOWS\system32\llchcgxo.ini 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 17:56:19 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-09 17:56:43 ComboFix-quarantined-files.txt 2008-03-09 16:56:42 ComboFix5.txt 2008-03-09 09:51:12 ComboFix4.txt 2008-03-09 12:52:48 ComboFix3.txt 2008-03-09 13:02:00 ComboFix2.txt 2008-03-09 13:42:10

**Posty:** 18165 · przez **wojtas** 09 Mar 2008, 20:53

wklej do notatnika:

File::
C:\WINDOWS\system32\llchcgxo.ini

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 21:07

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-09 20:00:54.6 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.205 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\llchcgxo.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\llchcgxo.ini . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-08 10:14 . 2008-03-08 10:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 10:14 . 2008-03-08 10:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . [color=red]C:\WINDOWS\system32\svchost.exe ... Infected -- Win32.Qhost !![/color] ----a-w 14,336 2004-08-03 21:44:28 C:\WINDOWS\system32\svchost.exe ----a-w 14,336 2008-02-22 20:04:36 C:\WINDOWS\system32\dllcache\svchost.exe ----a-w 16,980 2008-03-05 07:14:56 C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf Entries: 3 (3) Directories: 0 Files: 3 Bytes: 45,652 Blocks: 90 ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 20:02:17 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-09 20:02:39 ComboFix-quarantined-files.txt 2008-03-09 19:02:38 ComboFix5.txt 2008-03-09 12:52:48 ComboFix4.txt 2008-03-09 13:02:00 ComboFix3.txt 2008-03-09 13:42:10 ComboFix2.txt 2008-03-09 16:56:46

Aha i jeszcze jak pojawia się log to mi wyskakuje błąd, że system nie może znaleźć pliku Nircmd.exe i mam go znaleźć wyszukiwarką.

**Posty:** 18165 · przez **wojtas** 09 Mar 2008, 21:18

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z dss'a

jesli sie nie zmieszcza wrzuc na jakis serwer

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 22:19

Tego Report.txt nie mogę znaleźć.

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-09 21:15:58.7 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.251 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-09 21:07 . 2008-03-09 21:07 <DIR> d-------- C:\Deckard 2008-03-09 20:43 . 2008-03-08 19:40 <DIR> d-------- C:\SDFix 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-08 10:14 . 2008-03-08 10:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 10:14 . 2008-03-08 10:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-02-14 18:21 . 2008-02-14 18:21 <DIR> d-------- C:\Program Files\ZyDAS Technology Corporation 2008-02-14 18:21 . 2006-08-24 13:44 477,696 --a------ C:\WINDOWS\system32\drivers\ZD1211BU.sys 2008-02-14 18:21 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.DLL 2008-02-14 18:21 . 2005-03-18 15:35 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2008-02-14 18:21 . 2005-06-08 18:44 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2008-02-14 18:21 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll 2008-02-14 18:21 . 2008-02-22 09:33 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe 2008-02-14 18:21 . 2005-06-08 18:44 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2008-02-14 18:21 . 2004-10-25 13:40 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2008-02-14 18:21 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS 2008-02-14 18:21 . 2005-07-12 14:44 15,872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL 2008-02-14 18:10 . 2008-02-14 18:10 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-14 17:26 . 2008-02-14 17:26 <DIR> d-------- C:\Program Files\SAGEM 2008-02-11 15:15 . 2008-02-11 15:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 21:17:11 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-09 21:17:46 ComboFix-quarantined-files.txt 2008-03-09 20:17:46 ComboFix5.txt 2008-03-09 13:02:00 ComboFix4.txt 2008-03-09 13:42:10 ComboFix3.txt 2008-03-09 16:56:46 ComboFix2.txt 2008-03-09 19:02:42

A ten z DSS to ma się nazywać main czy extra??

**Posty:** 18165 · przez **wojtas** 09 Mar 2008, 22:35

main

poszukaj ten raport tu C:\SDFix

**Posty:** 302 · przez **pilif25** 09 Mar 2008, 23:34

Nie ma tego Report.txt w tym folderze...

[code]Deckard's System Scanner v20071014.68
Run by Admin on 2008-03-09 21:07:23
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
7: 2008-03-09 20:07:31 UTC - RP436 - Deckard's System Scanner Restore Point
6: 2008-03-09 19:00:41 UTC - RP435 - ComboFix created restore point
5: 2008-03-09 16:54:39 UTC - RP434 - ComboFix created restore point
4: 2008-03-09 13:39:28 UTC - RP433 - ComboFix created restore point
3: 2008-03-09 12:57:01 UTC - RP432 - ComboFix created restore point

-- First Restore Point --
1: 2008-03-09 09:48:52 UTC - RP430 - ComboFix created restore point

Backed up registry hives.
Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-03-09 21:08:27
Platform: Windows XP Dodatek Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Microsoft ActiveSync\rapimgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\libusbd-nt.exe
D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ESET\nod32krn.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
D:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Sony Ericsson\Mobile\Connectivity Pack\ConnMngMntBox.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Admin\Pulpit\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\Program Files\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: ZDWLan Utility.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: rqrpnlj - C:\WINDOWS\system32\
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\ESET\nod32krn.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 9844 bytes

-- HijackThis Fixed Entries (C:\Documents and Settings\Admin\Pulpit\backups\) --

backup-20080309-134838-965 O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file)
backup-20080309-134838-945 O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file)
backup-20080309-134838-724 O20 - Winlogon Notify: rqrpnlj - rqrpnlj.dll (file missing)
backup-20080309-143658-874 O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
backup-20080309-143658-414 O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file)
backup-20080309-143658-194 O20 - Winlogon Notify: rqrpnlj - C:\WINDOWS\
backup-20080309-175301-558 O2 - BHO: (no name) - {B7AD050E-E638-4B0F-BB8F-ED0BCCB23750} - (no file)
backup-20080309-175301-350 O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
backup-20080309-175301-130 O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)

-- File Associations -----------------------------------------------------------

[COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR]
[COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR]

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System>
R1 ATITool (ATITool Overclocking Utility) - c:\windows\system32\drivers\atitool.sys <Not Verified; ; Low-Level Driver>
R1 sp_rsdrv2 (Spyware Terminator Driver 2) - c:\windows\system32\drivers\sp_rsdrv2.sys
R2 AMON - c:\windows\system32\drivers\amon.sys <Not Verified; Eset; NOD32 Antivirus System>
R3 libusb0 (LibUsb-Win32 - Kernel Driver, Version 0.1.10.1) - c:\windows\system32\drivers\libusb0.sys
R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
R3 ZDPSp50 (ZDPSp50 NDIS Protocol Driver) - c:\windows\system32\drivers\zdpsp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>

S3 ASPI (Advanced SCSI Programming Interface Driver) - c:\windows\system32\drivers\aspi32.sys <Not Verified; Adaptec; Adaptec's ASPI Layer>
S3 BRGSp50 (BRGSp50 NDIS Protocol Driver) - c:\windows\system32\drivers\brgsp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
S3 RivaTuner32 - d:\program files\rivatuner v2.04\rivatuner32.sys

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 libusbd (LibUsb-Win32 - Daemon, Version 0.1.10.1) - system32\libusbd-nt.exe <Not Verified; http://libusb-win32.sourceforge.net; LibUsb-Win32>
R2 sp_rssrv (Spyware Terminator Realtime Shield Service) - "c:\program files\spyware terminator\sp_rsser.exe" <Not Verified; Crawler.com; Crawler Spyware Terminator>
R2 StarWindServiceAE (StarWind AE Service) - d:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition>
R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Files created between 2008-02-09 and 2008-03-09 -----------------------------

2008-03-08 13:13:26 0 d-------- C:\Program Files\GIF Movie Gear
2008-03-06 21:48:09 0 d-------- C:\Program Files\MoorHunt
2008-03-06 18:13:29 0 d-------- C:\WINDOWS\SxsCaPendDel
2008-02-22 22:16:28 0 d-------- C:\Program Files\Crawler
2008-02-21 01:34:17 138752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-02-21 01:34:09 0 d-------- C:\Program Files\Spyware Terminator
2008-02-14 18:21:49 17151 --a------ C:\WINDOWS\system32\ZDPNDIS5.SYS <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-14 18:21:49 81920 --a------ C:\WINDOWS\system32\ZDPN50.DLL <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-14 18:21:49 31744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-14 18:21:49 17664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-14 18:21:49 29184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-14 18:21:49 20608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2008-02-14 18:21:47 24576 --a------ C:\WINDOWS\system32\ZyDelReg.exe <Not Verified; ; ZyDelReg Application>
2008-02-14 18:21:47 15872 --a------ C:\WINDOWS\system32\InsDrvZD64.DLL <Not Verified; ; InsDrvZD Dynamic Link Library>
2008-02-14 18:21:47 28672 --a------ C:\WINDOWS\system32\InsDrvZD.dll <Not Verified; ; InsDrvZD Dynamic Link Library>
2008-02-14 18:21:47 0 d-------- C:\Program Files\ZyDAS Technology Corporation
2008-02-14 18:10:55 0 d-------- C:\Program Files\Common Files\Java
2008-02-14 17:26:30 1531904 --a------ C:\WINDOWS\adiras.exe <Not Verified; ; adiras Application>
2008-02-14 17:26:29 127456 --a------ C:\WINDOWS\system32\ipdetect.exe <Not Verified; ; IPDETECT>
2008-02-14 17:26:28 135168 --a------ C:\WINDOWS\system32\unaddrv.exe <Not Verified; Analog Devices.; UnADdrv>
2008-02-14 17:26:28 126976 --a------ C:\WINDOWS\system32\coclassfast.dll
2008-02-14 17:26:28 46892 --a------ C:\WINDOWS\system32\adadix16.dll
2008-02-14 17:26:27 143360 --a------ C:\WINDOWS\autoclk.exe <Not Verified; ; autoclk Application>
2008-02-14 17:26:19 0 d-------- C:\Program Files\SAGEM

-- Find3M Report ---------------------------------------------------------------

2008-03-08 12:13:14 0 d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc
2008-03-06 21:27:10 392284 --a------ C:\WINDOWS\system32\perfh015.dat
2008-03-06 21:27:10 67872 --a------ C:\WINDOWS\system32\perfc015.dat
2008-03-03 21:02:30 0 d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall
2008-02-25 14:23:00 1033728 -----n--- C:\WINDOWS\explorer.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-25 14:08:36 0 d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools
2008-02-22 20:59:52 679936 --a------ C:\WINDOWS\system32\sstext3d.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:52 14848 --a------ C:\WINDOWS\system32\ssstars.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:52 610304 --a------ C:\WINDOWS\system32\sspipes.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:52 47104 --a------ C:\WINDOWS\system32\ssmypics.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:52 20992 --a------ C:\WINDOWS\system32\ssmarque.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:52 393216 --a------ C:\WINDOWS\system32\ssflwbox.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:52 19968 --a------ C:\WINDOWS\system32\ssbezier.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:50 708608 --a------ C:\WINDOWS\system32\ss3dfo.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 20:59:50 9216 --a------ C:\WINDOWS\system32\scrnsave.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 10:01:54 18944 --a------ C:\WINDOWS\system32\ssmyst.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:52 131072 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2008-02-22 09:35:44 70144 -----n--- C:\WINDOWS\system32\iwbcba.exe
2008-02-22 09:35:34 293376 --a------ C:\WINDOWS\system32\WISPTIS.EXE <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:35:34 264704 --a------ C:\WINDOWS\system32\MaggiUninstall60.exe <Not Verified; medianet Ltd.; Maggi>
2008-02-22 09:35:34 70144 -----n--- C:\WINDOWS\system32\jcezogo.exe
2008-02-22 09:35:34 49152 --a------ C:\WINDOWS\system32\DSndUp.exe <Not Verified; Analog Devices Inc.; adi DSndUp>
2008-02-22 09:35:34 45056 --a------ C:\WINDOWS\system32\CleanUp.exe <Not Verified; adi; adi CleanUp>
2008-02-22 09:35:26 70144 -----n--- C:\WINDOWS\system32\zkfyk.exe
2008-02-22 09:35:14 70144 -----n--- C:\WINDOWS\system32\nugfkc.exe
2008-02-22 09:35:06 16384 --a------ C:\WINDOWS\system32\tskill.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:06 70144 -----n--- C:\WINDOWS\system32\pwtvnj.exe
2008-02-22 09:35:04 17920 --a------ C:\WINDOWS\system32\tsshutdn.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 15360 --a------ C:\WINDOWS\system32\tsdiscon.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 15360 --a------ C:\WINDOWS\system32\tscon.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 15360 --a------ C:\WINDOWS\system32\shadow.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 16384 --a------ C:\WINDOWS\system32\rwinsta.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 13824 --a------ C:\WINDOWS\system32\rdsaddin.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:35:04 17408 --a------ C:\WINDOWS\system32\qappsrv.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 124928 --a------ C:\WINDOWS\system32\mplay32.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 15872 --a------ C:\WINDOWS\system32\logoff.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:04 39424 --a------ C:\WINDOWS\system32\JETCOMP.exe <Not Verified; Microsoft Corporation; Microsoft® Database Compact Utility>
2008-02-22 09:35:04 103424 --a------ C:\WINDOWS\system32\clipbrd.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:02 44544 --a------ C:\WINDOWS\system32\tscupgrd.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:02 141824 --a------ C:\WINDOWS\system32\sessmgr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:35:02 67072 --a------ C:\WINDOWS\system32\rdshost.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:35:02 415744 -ra------ C:\WINDOWS\system32\ftdiunin.exe <Not Verified; FTDI Ltd.; FTDI Uninstall Program>
2008-02-22 09:35:00 168960 --a------ C:\WINDOWS\system32\wuauclt1.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:58 13824 --a------ C:\WINDOWS\system32\wscntfy.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:58 435712 --a------ C:\WINDOWS\system32\wiaacmgr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:58 66048 --a------ C:\WINDOWS\system32\wextract.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:58 291840 --a------ C:\WINDOWS\system32\vssvc.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:58 18432 --a------ C:\WINDOWS\system32\ups.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:58 11776 --a------ C:\WINDOWS\system32\spnpinst.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:58 103936 --a------ C:\WINDOWS\system32\logagent.exe <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2008-02-22 09:34:58 71680 --a------ C:\WINDOWS\system32\blastcln.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:56 16896 --a------ C:\WINDOWS\system32\upnpcont.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:56 12800 --a------ C:\WINDOWS\system32\tracert.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 260096 --a------ C:\WINDOWS\system32\tracerpt.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 75264 --a------ C:\WINDOWS\system32\tlntsvr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 80384 --a------ C:\WINDOWS\system32\tlntsess.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 63488 --a------ C:\WINDOWS\system32\tlntadmn.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 77312 --a------ C:\WINDOWS\system32\telnet.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 139776 --a------ C:\WINDOWS\system32\taskmgr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 107008 --a------ C:\WINDOWS\system32\sysocmgr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 14848 --a------ C:\WINDOWS\system32\stimon.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 12800 --a------ C:\WINDOWS\system32\spiisupd.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:56 91136 --a------ C:\WINDOWS\system32\smlogsvc.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 70656 --a------ C:\WINDOWS\system32\sigverif.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:56 78336 --a------ C:\WINDOWS\system32\shrpubw.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 42496 --a------ C:\WINDOWS\system32\shmgrate.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:54 18944 --a------ C:\WINDOWS\system32\secedit.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 77824 --a------ C:\WINDOWS\system32\sdbinst.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 128000 --a------ C:\WINDOWS\system32\schtasks.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 98304 --a------ C:\WINDOWS\system32\scardsvr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 13824 --a------ C:\WINDOWS\system32\savedump.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 77824 --a------ C:\WINDOWS\system32\rtcshare.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 15360 --a------ C:\WINDOWS\system32\rsh.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 14336 --a------ C:\WINDOWS\system32\rexec.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 53248 --a------ C:\WINDOWS\system32\reg.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 56832 --a------ C:\WINDOWS\system32\rasphone.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 50688 --a------ C:\WINDOWS\system32\proquota.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 109568 --a------ C:\WINDOWS\system32\progman.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:54 49152 --a------ C:\WINDOWS\system32\powercfg.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:54 18944 --a------ C:\WINDOWS\system32\ping.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 15872 --a------ C:\WINDOWS\system32\perfmon.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:52 70144 --a------ C:\WINDOWS\system32\openfiles.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 79872 --a------ C:\WINDOWS\system32\nslookup.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 38400 --a------ C:\WINDOWS\system32\netstat.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 87040 --a------ C:\WINDOWS\system32\netsh.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 114688 --a------ C:\WINDOWS\system32\netdde.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 55296 --a------ C:\WINDOWS\system32\narrator.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 12288 --a------ C:\WINDOWS\system32\mstinit.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:52 117248 --a------ C:\WINDOWS\system32\mqtgsvc.exe <Not Verified; Microsoft Corporation; Microsoft Message Queue>
2008-02-22 09:34:52 815616 --a------ C:\WINDOWS\system32\mmc.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 335872 --a------ C:\WINDOWS\system32\netsetup.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 85504 --a------ C:\WINDOWS\system32\makecab.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:50 60928 --a------ C:\WINDOWS\system32\logman.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 75264 --a------ C:\WINDOWS\system32\locator.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:50 53760 --a------ C:\WINDOWS\system32\ipv6.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 114688 --a------ C:\WINDOWS\system32\iexpress.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:50 39424 --a------ C:\WINDOWS\system32\grpconv.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 122880 --a------ C:\WINDOWS\system32\gpresult.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 44544 --a------ C:\WINDOWS\system32\ftp.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:50 193024 --a------ C:\WINDOWS\system32\fsquirt.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:48 45568 --a------ C:\WINDOWS\system32\extrac32.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:48 52224 --a------ C:\WINDOWS\system32\eventcreate.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:48 194048 --a------ C:\WINDOWS\system32\eudcedit.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:48 1298432 --a------ C:\WINDOWS\system32\dxdiag.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:48 17920 --a------ C:\WINDOWS\system32\dvdupgrd.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:48 83456 --a------ C:\WINDOWS\system32\dpvsetup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:48 18432 --a------ C:\WINDOWS\system32\dpnsvr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:48 15872 --a------ C:\WINDOWS\system32\dmremote.exe <Not Verified; Microsoft Corp.; Logical Disk Manager for Windows NT>
2008-02-22 09:34:48 225280 --a------ C:\WINDOWS\system32\dmadmin.exe <Not Verified; Microsoft Corp., Veritas Software; Menedżer dysków logicznych dla systemu Windows NT>
2008-02-22 09:34:48 164864 --a------ C:\WINDOWS\system32\diskpart.exe <Not Verified; Microsoft Corporation; Aplikacja Diskpart firmy Microsoft Corporation>
2008-02-22 09:34:46 124928 --a------ C:\WINDOWS\system32\net1.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:46 85504 --a------ C:\WINDOWS\system32\diantz.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:46 98304 --a------ C:\WINDOWS\system32\cscript.exe <Not Verified; Microsoft Corporation; Microsoft (r) Windows Script Host>
2008-02-22 09:34:46 64512 --a------ C:\WINDOWS\system32\cmstp.exe <Not Verified; Microsoft Corporation; Menedżer połączeń firmy Microsoft(R)>
2008-02-22 09:34:46 39424 --a------ C:\WINDOWS\system32\cmmon32.exe <Not Verified; Microsoft Corporation; Menedżer połączeń firmy Microsoft(R)>
2008-02-22 09:34:46 56320 --a------ C:\WINDOWS\system32\cipher.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:46 14336 --a------ C:\WINDOWS\system32\auditusr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:46 11264 --a------ C:\WINDOWS\system32\atmadm.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:44 69632 --a------ C:\WINDOWS\system32\usrshuta.exe <Not Verified; U.S. Robotics Corporation; U.S. Robotics Modem Driver>
2008-02-22 09:34:44 61440 --a------ C:\WINDOWS\system32\usrprbda.exe <Not Verified; U.S. Robotics Corporation; U.S. Robotics modem>
2008-02-22 09:34:44 77824 --a------ C:\WINDOWS\system32\usrmlnka.exe <Not Verified; U.S. Robotics Corporation; U.S. Robotics Modem Driver>
2008-02-22 09:34:44 12288 --a------ C:\WINDOWS\system32\regsvr32.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:44 15360 --a------ C:\WINDOWS\system32\pentnt.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:44 41472 --a------ C:\WINDOWS\system32\osuninst.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:44 42496 --a------ C:\WINDOWS\system32\net.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:44 52224 --a------ C:\WINDOWS\system32\migpwd.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:44 57344 --a------ C:\WINDOWS\system32\ipconfig.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:44 98304 --a------ C:\WINDOWS\system32\ahui.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 11776 --a------ C:\WINDOWS\system32\winmsd.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 51200 --a------ C:\WINDOWS\system32\w32tm.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 102400 --a------ C:\WINDOWS\system32\verifier.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 36864 --a------ C:\WINDOWS\system32\typeperf.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 16896 --a------ C:\WINDOWS\system32\tftp.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 13312 --a------ C:\WINDOWS\system32\tcmsetup.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 15360 --a------ C:\WINDOWS\system32\taskman.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 73728 --a------ C:\WINDOWS\system32\tasklist.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 74752 --a------ C:\WINDOWS\system32\taskkill.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 70144 --a------ C:\WINDOWS\system32\systeminfo.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 37376 --a------ C:\WINDOWS\system32\syskey.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:42 51200 --a------ C:\WINDOWS\system32\syncapp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:42 16896 --a------ C:\WINDOWS\system32\runas.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 132608 --a------ C:\WINDOWS\system32\rsvp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:40 62976 --a------ C:\WINDOWS\system32\rsopprov.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 49152 --a------ C:\WINDOWS\system32\rsmui.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows Whistler®>
2008-02-22 09:34:40 54272 --a------ C:\WINDOWS\system32\rsm.exe <Not Verified; Microsoft Corp; System operacyjny Microsoft(R) Windows (R) 2000>
2008-02-22 09:34:40 12800 --a------ C:\WINDOWS\system32\replace.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:40 128512 --a------ C:\WINDOWS\system32\nwscript.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 13824 --a------ C:\WINDOWS\system32\mrinfo.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 45056 --a------ C:\WINDOWS\system32\ipsec6.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 14848 --a------ C:\WINDOWS\system32\help.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 58368 --a------ C:\WINDOWS\system32\gpupdate.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 56832 --a------ C:\WINDOWS\system32\getmac.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:40 62976 --a------ C:\WINDOWS\system32\fsutil.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 11776 --a------ C:\WINDOWS\system32\rasdial.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 14848 --a------ C:\WINDOWS\system32\fc.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:38 16384 --a------ C:\WINDOWS\system32\expand.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 80896 --a------ C:\WINDOWS\system32\eventtriggers.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 39424 --a------ C:\WINDOWS\system32\esentutl.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:38 57856 --a------ C:\WINDOWS\system32\dvdplay.exe <Not Verified; ; Aplikacja dvdplay>
2008-02-22 09:34:38 60416 --a------ C:\WINDOWS\system32\driverquery.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 10752 --a------ C:\WINDOWS\system32\doskey.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:38 18432 --a------ C:\WINDOWS\system32\diskperf.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 13824 --a------ C:\WINDOWS\system32\convert.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:38 17920 --a------ C:\WINDOWS\system32\compact.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:38 15872 --a------ C:\WINDOWS\system32\comp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:38 11264 --a------ C:\WINDOWS\system32\chkntfs.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:38 11776 --a------ C:\WINDOWS\system32\chkdsk.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:36 148480 --a------ C:\WINDOWS\system32\bootcfg.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:36 11264 --a------ C:\WINDOWS\system32\attrib.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:08 9216 --a------ C:\WINDOWS\system32\subst.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:08 9728 --a------ C:\WINDOWS\system32\sfc.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:08 9728 --a------ C:\WINDOWS\system32\reset.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:08 9728 --a------ C:\WINDOWS\system32\proxycfg.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:08 9216 --a------ C:\WINDOWS\system32\print.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:06 5632 --a------ C:\WINDOWS\system32\winver.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:06 8192 --a------ C:\WINDOWS\system32\smbinst.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:06 6144 --a------ C:\WINDOWS\system32\msdtc.exe <Not Verified; Microsoft Corporation; Microsoft Distributed Transaction Coordinator>
2008-02-22 09:34:06 4608 --a------ C:\WINDOWS\system32\mqsvc.exe <Not Verified; Microsoft Corporation; Microsoft Message Queue>
2008-02-22 09:34:06 9728 --a------ C:\WINDOWS\system32\label.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:06 9728 --a------ C:\WINDOWS\system32\finger.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:06 9216 --a------ C:\WINDOWS\system32\find.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:06 9216 --a------ C:\WINDOWS\system32\eventvwr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:06 5120 --a------ C:\WINDOWS\system32\dcomcnfg.exe <Not Verified; Microsoft Corporation; COM Services>
2008-02-22 09:34:06 5632 --a------ C:\WINDOWS\system32\cisvc.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:04 8192 --a------ C:\WINDOWS\system32\winhlp32.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 3072 --a------ C:\WINDOWS\system32\systray.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:04 4608 --a------ C:\WINDOWS\system32\regwiz.exe <Not Verified; Microsoft; RegWizExe>
2008-02-22 09:34:04 7168 --a------ C:\WINDOWS\system32\recover.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:04 6656 --a------ C:\WINDOWS\system32\msswchx.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 8192 --a------ C:\WINDOWS\system32\mountvol.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 8192 --a------ C:\WINDOWS\system32\lpr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 6144 --a------ C:\WINDOWS\system32\lpq.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 5120 --a------ C:\WINDOWS\system32\lodctr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:04 8192 --a------ C:\WINDOWS\system32\hostname.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 7168 --a------ C:\WINDOWS\system32\forcedos.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 3072 --a------ C:\WINDOWS\system32\fixmapi.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:04 4608 --a------ C:\WINDOWS\system32\dllhst3g.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:04 8192 --a------ C:\WINDOWS\system32\control.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:04 7680 --a------ C:\WINDOWS\system32\ckcnv.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:02 32256 --a------ C:\WINDOWS\system32\wupdmgr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:02 32768 --a------ C:\WINDOWS\system32\wpnpinst.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:02 32256 --a------ C:\WINDOWS\system32\wpabaln.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:02 33792 --a------ C:\WINDOWS\system32\vssadmin.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:02 32256 --a------ C:\WINDOWS\system32\tracert6.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:02 32768 --a------ C:\WINDOWS\system32\sethc.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:02 33792 --a------ C:\WINDOWS\system32\regini.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:02 32768 --a------ C:\WINDOWS\system32\mnmsrvc.exe <Not Verified; Microsoft Corporation; Windows® NetMeeting®>
2008-02-22 09:34:02 33280 --a------ C:\WINDOWS\system32\clipsrv.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:02 8192 --a------ C:\WINDOWS\system32\cidaemon.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:02 5120 --a------ C:\WINDOWS\system32\bootvrfy.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:02 4608 --a------ C:\WINDOWS\system32\bootok.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:02 32768 --a------ C:\WINDOWS\system32\asr_pfu.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:00 33792 --a------ C:\WINDOWS\system32\relog.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:00 33792 --a------ C:\WINDOWS\system32\ping6.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:34:00 31744 --a------ C:\WINDOWS\system32\ntsd.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:34:00 33792 --a------ C:\WINDOWS\system32\asr_ldm.exe <Not Verified; Microsoft Corp.; Menedżer dysków logicznych dla systemu Windows NT>
2008-02-22 09:33:56 59392 --a------ C:\WINDOWS\system32\packager.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:52 25600 --a------ C:\WINDOWS\system32\routemon.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:52 25600 --a------ C:\WINDOWS\system32\at.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:50 30720 --a------ C:\WINDOWS\system32\xcopy.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:50 26112 --a------ C:\WINDOWS\system32\skeys.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:50 29184 --a------ C:\WINDOWS\system32\mshta.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:50 30720 --a------ C:\WINDOWS\system32\ddeshare.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:50 27648 --a------ C:\WINDOWS\system32\conime.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:50 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe <Not Verified; ATI Technologies, Inc.; ATI Default Resolution Update>
2008-02-22 09:33:48 31232 --a------ C:\WINDOWS\system32\sc.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:48 22528 --a------ C:\WINDOWS\system32\qwinsta.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:48 22528 --a------ C:\WINDOWS\system32\msg.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:48 26624 --a------ C:\WINDOWS\system32\lnkstub.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:48 29696 --a------ C:\WINDOWS\system32\lights.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:48 19456 --a------ C:\WINDOWS\system32\libusbd-9x.exe <Not Verified; http://libusb-win32.sourceforge.net; LibUsb-Win32>
2008-02-22 09:33:48 28160 --a------ C:\WINDOWS\system32\findstr.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 19456 --a------ C:\WINDOWS\system32\tcpsvcs.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:46 20480 --a------ C:\WINDOWS\system32\shutdown.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 23040 --a------ C:\WINDOWS\system32\setup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:46 24576 --a------ C:\WINDOWS\system32\rsmsink.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows Whistler®>
2008-02-22 09:33:46 20480 --a------ C:\WINDOWS\system32\route.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 22016 --a------ C:\WINDOWS\system32\rcp.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 20992 --a------ C:\WINDOWS\system32\qprocess.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 22528 --a------ C:\WINDOWS\system32\pathping.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 19968 --a------ C:\WINDOWS\system32\mqbkup.exe <Not Verified; Microsoft Corporation; Microsoft Message Queue>
2008-02-22 09:33:46 21504 --a------ C:\WINDOWS\system32\fontview.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:46 22528 --a------ C:\WINDOWS\system32\fltMc.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:44 23552 --a------ C:\WINDOWS\system32\sort.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:44 21504 --a------ C:\WINDOWS\system32\nbtstat.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:44 22016 --a------ C:\WINDOWS\system32\mpnotify.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:44 19456 --a------ C:\WINDOWS\system32\cacls.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:44 19968 --a------ C:\WINDOWS\system32\arp.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:40 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-02-22 09:33:38 86016 --a------ C:\WINDOWS\unvise32qt.exe <Not Verified; MindVision; Installer VISE 2.8.3>
2008-02-22 09:33:38 41984 -----n--- C:\WINDOWS\Ctregrun.exe <Not Verified; Creative Technology Ltd; Creative On-line Registration System>
2008-02-22 09:33:36 73216 -----n--- C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-02-22 09:33:36 286720 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2008-02-22 09:33:36 70144 --a------ C:\WINDOWS\NOTEPAD.EXE <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:33:36 70144 --a------ C:\WINDOWS\MOTA113.exe
2008-02-22 09:33:36 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-02-22 09:33:32 25600 --a------ C:\WINDOWS\twunk_32.exe <Not Verified; Twain Working Group; Twain Thunker>
2008-02-22 09:33:32 62464 --a------ C:\WINDOWS\system32\rdpclip.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:33:18 107520 --a------ C:\WINDOWS\system32\rsnotify.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:32:54 4096 --a------ C:\WINDOWS\system32\unlodctr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:32:54 4096 --a------ C:\WINDOWS\system32\nddeapir.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:32:54 30208 --a------ C:\WINDOWS\system32\dplaysvr.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-02-22 09:32:54 30208 --a------ C:\WINDOWS\system32\asr_fmt.exe <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:32:54 4096 --a------ C:\WINDOWS\system32\actmovie.exe <Not Verified; Microsoft Corporation; DirectShow>
2008-02-22 09:31:52 15360 --a------ C:\WINDOWS\TASKMAN.EXE <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-22 09:22:50 220672 --a------ C:\WINDOWS\system32\logon.scr <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®>
2008-02-21 17:58:10 114688 --a------ C:\WINDOWS\system32\wscript.exe <Not Verified; Microsoft Corporation; Microsoft (r) Windows Script

**Posty:** 18165 · przez **wojtas** 09 Mar 2008, 23:38

log wklej na jakis serwer bo sie nie miesci np na www.wklej.org

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 00:11

http://www.wklej.org/id/288ab53e66

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 16:38

wklej do notatnika:

File::
C:\WINDOWS\system32\ygrbwios.dll
C:\WINDOWS\system32\bbeeg.ini2

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu )

ten plik przesaknuj:

C:\WINDOWS\system32\jcezogo.exe

na tych stronach i daj raporty;

http://virusscan.jotti.org/
http://www.virustotal.com/

**Posty:** 302 · przez **pilif25** 10 Mar 2008, 17:41

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.3.4.0 2008.03.10 Win-Trojan/Agent.66048.S AntiVir 7.6.0.73 2008.03.10 TR/Vundo.Gen Authentium 4.93.8 2008.03.07 - Avast 4.7.1098.0 2008.03.09 Win32:Agent-PUU AVG 7.5.0.516 2008.03.10 SHeur.AEEU BitDefender 7.2 2008.03.10 Trojan.Vundo.DRP CAT-QuickHeal 9.50 2008.03.08 TrojanDownloader.Agent.fnz ClamAV 0.92.1 2008.03.10 Trojan.Downloader-19899 DrWeb 4.44.0.09170 2008.03.10 Trojan.Virtumod.246 eSafe 7.0.15.0 2008.03.09 - eTrust-Vet 31.3.5597 2008.03.07 - Ewido 4.0 2008.03.10 - FileAdvisor 1 2008.03.10 - Fortinet 3.14.0.0 2008.03.10 - F-Prot 4.4.2.54 2008.03.09 W32/Virtumonde.OE F-Secure 6.70.13260.0 2008.03.10 Suspicious:W32/Malware!Gemini Ikarus T3.1.1.20 2008.03.10 Trojan-Downloader.Win32.Agent.fnw Kaspersky 7.0.0.125 2008.03.10 not-a-virus:AdWare.Win32.Virtumonde.gen McAfee 5247 2008.03.07 - Microsoft 1.3301 2008.03.10 Trojan:Win32/Vundo.Z NOD32v2 2935 2008.03.10 - Norman 5.80.02 2008.03.07 - Panda 9.0.0.4 2008.03.09 - Prevx1 V2 2008.03.10 - Rising 20.35.02.00 2008.03.10 Trojan.DL.Win32.Agent.fog Sophos 4.27.0 2008.03.10 Troj/Virtum-Gen Sunbelt 3.0.930.0 2008.03.05 - Symantec 10 2008.03.10 - TheHacker 6.2.92.239 2008.03.09 - VBA32 3.12.6.2 2008.03.05 suspected of Embedded.Trojan-Downloader.Win32.Agent.fnw VirusBuster 4.3.26:9 2008.03.09 Adware.Vundo.V.Gen Webwasher-Gateway 6.6.2 2008.03.10 Trojan.Vundo.Gen Dodatkowe informacje File size: 70144 bytes MD5: 242325e22d8207bd18eaa5762f6fa9c8 SHA1: fcf383ab6869bdf0ad498a8d4a5472b7aaffee03 PEiD: -

Kod: Zaznacz wszystko: Scan taken on 10 Mar 2008 16:05:30 (GMT) A-Squared Found Trojan-Downloader.Win32.Agent.fnw AntiVir Found TR/Vundo.Gen ArcaVir Found Trojan.Downloader.Agent.Fnw Avast Found Win32:Agent-PUU AVG Antivirus Found SHeur.AEEU BitDefender Found Trojan.Vundo.DRP ClamAV Found Trojan.Downloader-19899 CPsecure Found Troj.Downloader.W32.Agent.fnw Dr.Web Found Trojan.Virtumod.246 F-Prot Antivirus Found nothing F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.Virtumonde.gen (4, 1, 400) Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.Virtumonde.gen NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found Trojan.DL.Win32.Agent.fog Sophos Antivirus Found Troj/Virtum-Gen VirusBuster Found nothing VBA32 Found Embedded.Trojan-Downloader.Win32.Agent.fnw (probable variant)

**Posty:** 18165 · przez **wojtas** 10 Mar 2008, 19:20

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\iwbcba.exe
C:\WINDOWS\system32\jcezogo.exe
C:\WINDOWS\system32\zkfyk.exe
C:\WINDOWS\system32\nugfkc.exe
C:\WINDOWS\system32\pwtvnj.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum.

nie mogę wypakować exe, win32/virtus.at

Nie mogę wypakować exe, Win32/Virtus.AT

Kto jest na forum