nie mogę wypakować exe, win32/virtus.at

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 21:10

Ja zakładam, że to przez tego wira co wcześnej...

**Posty:** 18165 · przez **wojtas** 16 Mar 2008, 21:12

to daj nowe logi jeszcze raz

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 22:26

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-16 21:13:23.10 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.160 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-16 to 2008-03-16 ))))))))))))))))))))))))))))))) . 2008-03-16 19:32 . 2008-03-16 19:32 45 --a------ C:\WINDOWS\system32\initdebug.nfo 2008-03-10 19:51 . 2008-03-11 18:38 330 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-03-09 21:07 . 2008-03-09 21:07 <DIR> d-------- C:\Deckard 2008-03-09 20:43 . 2008-03-08 19:40 <DIR> d-------- C:\SDFix 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:17 . 2008-02-25 14:25 1,014 ---hs---- C:\WINDOWS\system32\ftbrpfwv.ini 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-22 22:16 . 2008-02-22 22:16 <DIR> d-------- C:\Program Files\Crawler 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 17:21 --------- d-----w C:\Program Files\ZyDAS Technology Corporation 2008-02-14 17:10 --------- d-----w C:\Program Files\Common Files\Java 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-02-14 16:26 --------- d-----w C:\Program Files\SAGEM 2008-02-11 14:15 --------- d-----w C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7AD050E-E638-4B0F-BB8F-ED0BCCB23750}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "ISTray"="D:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\WINDOWS\\system32\\fznbby.exe"= "C:\\WINDOWS\\system32\\bffpuxx.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] *Newly Created Service* - GIVEIO *Newly Created Service* - SPEEDFAN . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-16 21:15:14 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-16 21:19:22 ComboFix-quarantined-files.txt 2008-03-16 20:19:18 ComboFix5.txt 2008-03-10 17:35:28 ComboFix4.txt 2008-03-10 18:03:56 ComboFix3.txt 2008-03-10 18:44:08 ComboFix2.txt 2008-03-16 07:20:16

**Posty:** 18165 · przez **wojtas** 16 Mar 2008, 22:38

ten plik:

C:\Documents and Settings\Admin\jogl.dll

przeskanuj na tych stronach :

http://virusscan.jotti.org/
http://www.virustotal.com/

i zapisz sobie raporty gdzies

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\ftbrpfwv.ini
C:\\WINDOWS\\system32\\fznbby.exe
C:\\WINDOWS\\system32\\bffpuxx.exe

Folder::
C:\Program Files\Crawler

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpnlj]
[HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\fznbby.exe"=-
"C:\\WINDOWS\\system32\\bffpuxx.exe"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum oraz raporty

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 23:08

Kod: Zaznacz wszystko: ComboFix 08-03-08.2 - Admin 2008-03-16 22:03:57.11 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.152 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\\WINDOWS\\system32\\bffpuxx.exe C:\\WINDOWS\\system32\\fznbby.exe C:\WINDOWS\system32\ftbrpfwv.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\\WINDOWS\\system32\\bffpuxx.exe C:\\WINDOWS\\system32\\fznbby.exe C:\Program Files\Crawler C:\Program Files\Crawler\adrkeys.dat C:\Program Files\Crawler\COMMON_FF.dat C:\Program Files\Crawler\confirm.dat C:\Program Files\Crawler\ctbcomm.dll C:\Program Files\Crawler\CTConf.dat C:\Program Files\Crawler\CTipsDef.dll C:\Program Files\Crawler\CToolbar.exe C:\Program Files\Crawler\firefox\chrome.manifest C:\Program Files\Crawler\firefox\chrome\crawlertbr.jar C:\Program Files\Crawler\firefox\components\xshared.dll C:\Program Files\Crawler\firefox\components\xshared.xpt C:\Program Files\Crawler\firefox\components\xsupport.dll C:\Program Files\Crawler\firefox\components\xsupport.xpt C:\Program Files\Crawler\firefox\components\xwsg.dll C:\Program Files\Crawler\firefox\components\xwsg.xpt C:\Program Files\Crawler\firefox\install.ini C:\Program Files\Crawler\firefox\install.rdf C:\Program Files\Crawler\firefox\stwsg_ff.ini C:\Program Files\Crawler\Languages\STWSG_CS.cab C:\Program Files\Crawler\Languages\STWSG_DE.cab C:\Program Files\Crawler\Languages\STWSG_EN.cab C:\Program Files\Crawler\Languages\STWSG_ES.cab C:\Program Files\Crawler\Languages\STWSG_IT.cab C:\Program Files\Crawler\Languages\STWSG_PT-BR.cab C:\Program Files\Crawler\Languages\STWSG_PT.cab C:\Program Files\Crawler\Languages\TBR5_CS.cab C:\Program Files\Crawler\Languages\TBR5_DE.cab C:\Program Files\Crawler\Languages\TBR5_EN.cab C:\Program Files\Crawler\Languages\TBR5_ES.cab C:\Program Files\Crawler\Languages\TBR5_IT.cab C:\Program Files\Crawler\Languages\TBR5_PT-BR.cab C:\Program Files\Crawler\Languages\TBR5_PT.cab C:\Program Files\Crawler\stwsg_ff.dat C:\Program Files\Crawler\STWSGLanguageAct\info.ini C:\Program Files\Crawler\STWSGLanguageAct\language.ini C:\Program Files\Crawler\svc_set.dat C:\Program Files\Crawler\TBR5LanguageAct\info.ini C:\Program Files\Crawler\TBR5LanguageAct\language.ini C:\Program Files\Crawler\Update\domains.cab C:\Program Files\Crawler\WebSecurityGuard.dll C:\Program Files\Crawler\WSGData\domains\domains_000.dat C:\Program Files\Crawler\WSGData\domains\domains_000_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_001.dat C:\Program Files\Crawler\WSGData\domains\domains_001_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_002.dat C:\Program Files\Crawler\WSGData\domains\domains_002_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_003.dat C:\Program Files\Crawler\WSGData\domains\domains_003_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_004.dat C:\Program Files\Crawler\WSGData\domains\domains_004_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_005.dat C:\Program Files\Crawler\WSGData\domains\domains_005_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_006.dat C:\Program Files\Crawler\WSGData\domains\domains_006_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_007.dat C:\Program Files\Crawler\WSGData\domains\domains_007_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_008.dat C:\Program Files\Crawler\WSGData\domains\domains_008_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_009.dat C:\Program Files\Crawler\WSGData\domains\domains_009_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_010.dat C:\Program Files\Crawler\WSGData\domains\domains_010_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_011.dat C:\Program Files\Crawler\WSGData\domains\domains_011_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_012.dat C:\Program Files\Crawler\WSGData\domains\domains_012_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_013.dat C:\Program Files\Crawler\WSGData\domains\domains_013_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_014.dat C:\Program Files\Crawler\WSGData\domains\domains_014_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_015.dat C:\Program Files\Crawler\WSGData\domains\domains_015_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_016.dat C:\Program Files\Crawler\WSGData\domains\domains_016_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_017.dat C:\Program Files\Crawler\WSGData\domains\domains_017_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_018.dat C:\Program Files\Crawler\WSGData\domains\domains_018_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_019.dat C:\Program Files\Crawler\WSGData\domains\domains_019_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_020.dat C:\Program Files\Crawler\WSGData\domains\domains_020_diff.dat C:\Program Files\Crawler\WSGData\domains\domains_021.dat C:\Program Files\Crawler\WSGData\domains\domains_021_diff.dat C:\Program Files\Crawler\WSGData\domains\index.dat C:\Program Files\Crawler\WSGData\userData_S-1-5-21-57989841-1454471165-725345543-1003.dat C:\Program Files\Crawler\WSGData\wfilter.dat C:\WINDOWS\system32\ftbrpfwv.ini . ((((((((((((((((((((((((( Files Created from 2008-02-16 to 2008-03-16 ))))))))))))))))))))))))))))))) . 2008-03-16 19:32 . 2008-03-16 19:32 45 --a------ C:\WINDOWS\system32\initdebug.nfo 2008-03-10 19:51 . 2008-03-11 18:38 330 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-03-09 21:07 . 2008-03-09 21:07 <DIR> d-------- C:\Deckard 2008-03-09 20:43 . 2008-03-08 19:40 <DIR> d-------- C:\SDFix 2008-03-08 13:13 . 2008-03-08 13:13 <DIR> d-------- C:\Program Files\GIF Movie Gear 2008-03-08 12:13 . 2008-03-08 12:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Jasc 2008-03-06 21:48 . 2008-03-06 21:48 <DIR> d-------- C:\Program Files\MoorHunt 2008-03-06 18:13 . 2008-03-06 18:13 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-03-06 18:13 . 2007-10-24 01:47 282,112 --a------ C:\WINDOWS\system32\MSCOREE.DLL 2008-03-06 18:13 . 2007-10-24 01:47 96,760 --a------ C:\WINDOWS\system32\dfshim.dll 2008-03-03 21:02 . 2008-03-03 21:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thinstall 2008-02-25 14:09 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-25 14:09 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-25 14:09 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-25 14:09 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Tools 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spyware Terminator 2008-02-21 01:34 . 2008-02-21 01:34 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2020-12-14 22:42 --------- d-----w C:\Program Files\ESET 2008-02-14 17:21 --------- d-----w C:\Program Files\ZyDAS Technology Corporation 2008-02-14 17:10 --------- d-----w C:\Program Files\Common Files\Java 2008-02-14 16:26 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-02-14 16:26 --------- d-----w C:\Program Files\SAGEM 2008-02-11 14:15 --------- d-----w C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2008-01-17 20:31 --------- d-----w C:\Program Files\Common Files\DVDVideoSoft 2008-01-16 21:02 --------- d-----w C:\Program Files\Virtools 2008-01-16 06:54 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InstallShield 2007-11-01 17:34 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-05-20 09:05 397,312 ----a-w C:\Documents and Settings\Admin\jogl.dll 2006-02-04 04:04 8 --sha-r C:\WINDOWS\neoqaz2.dll 2006-05-03 11:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 12:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-02-21 07:41 1667584] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-02-21 07:42 90112] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 15:57 1289000] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2008-02-21 07:42 1961984] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-21 07:42 15360] "SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2008-02-21 08:07 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-02-21 17:55 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 08:07 98304] "PCSuiteTrayApplication"="D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2008-02-21 17:56 222208] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 14:24 185896] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-21 17:56 921600] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "ISTray"="D:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-21 08:08 2957824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-02-21 07:43 1634304] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-26 20:48:12 113664] Phone Connection Monitor.lnk - D:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe [2007-09-09 21:19:57 754176] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-14 17:26:28 962560] ZDWLan Utility.lnk - C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-02-14 18:21:47 487424] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Shareaza\\Shareaza.exe"= "D:\\Program Files\\TVAnts\\Tvants.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "D:\\Program Files\\FlashFXP\\FlashFXP.exe"= "D:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "D:\\Program Files\\Sony Ericsson\\Mobile\\DXP SyncML.exe"= "D:\\Program Files\\The All-Seeing Eye\\eye.exe"= "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "D:\\Quake 4\\QuakeIIIArena 1.32 + OSP\\quake3.exe"= "D:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "18230:TCP"= 18230:TCP:ProStreet "18235:TCP"= 18235:TCP:ProStreet "13505:TCP"= 13505:TCP:ProStreet R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-21 01:34] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 20:50] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 18:44] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27] S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-04-14 05:07] S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 13:44] *Newly Created Service* - GIVEIO *Newly Created Service* - SPEEDFAN . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-16 22:06:08 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-16 22:06:42 ComboFix-quarantined-files.txt 2008-03-16 21:06:42 ComboFix5.txt 2008-03-10 18:03:56 ComboFix4.txt 2008-03-10 18:44:08 ComboFix3.txt 2008-03-16 07:20:16 ComboFix2.txt 2008-03-16 20:19:26

Ten jogl.dll jest czysty.

**Posty:** 18165 · przez **wojtas** 16 Mar 2008, 23:11

czysto w takim razie

**Posty:** 302 · przez **pilif25** 16 Mar 2008, 23:41

Jak próbuje uruchomić aplikację (udało się zainstalować) to wyskakuje takie coś:

Co zrobić??

**Posty:** 18165 · przez **wojtas** 17 Mar 2008, 20:28

mozesz powiekszyc screena?

**Posty:** 302 · przez **pilif25** 20 Mar 2008, 08:07

nie mogę wypakować exe, win32/virtus.at

Kto jest na forum