Nieznany program/usługa przy uruchamianiu

**Posty:** 1519 · przez **michal_michael** 28 Sie 2008, 16:20

Witam

Mam pewien problem. Otóż ostatnio w moim autostarcie pojawiło się coś nieznajomego mi (zaznaczone na czerwono)

Kiedy to wyłączę i nawet skasuje wpis, to i tak po ponownym uruchomieniu komputera znowu się pojawia.
Dodam jeszcze, że przy starcie windowsa, po wpisaniu hasła na chwilkę robi się czarny ekran, a wcześniej tego nie było.

Jak myślicie, co to jest i jak się tego pozbyć ? Może będą potrzebne logi do sprawdzenia?

**Posty:** 99 · przez **alamakota** 28 Sie 2008, 16:22

Witaj,
koniecznie trzeba będzie wkleić logi.
Hjt oraz Combofix.

**Posty:** 1519 · przez **michal_michael** 28 Sie 2008, 16:41

alamakota napisał(a):koniecznie trzeba będzie wkleić logi.
Hjt oraz Combofix.

Proszę bardzo:

Kod: Zaznacz wszystko: ComboFix 08-08-27.06 - JUREK 2008-08-28 16:38:47.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1612 [GMT 2:00] Running from: D:\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\JUREK\Dane aplikacji\macromedia\Flash Player\#SharedObjects\R58Q4ZXJ\bin.clearspring.com C:\Documents and Settings\JUREK\Dane aplikacji\macromedia\Flash Player\#SharedObjects\R58Q4ZXJ\bin.clearspring.com\clearspring.sol C:\Documents and Settings\JUREK\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com C:\Documents and Settings\JUREK\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 ))))))))))))))))))))))))))))))) . 2008-08-28 08:49 . 2008-08-28 08:49 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\fltk.org 2008-08-27 16:10 . 2008-08-28 16:34 258,549 --a------ C:\WINDOWS\svhosI 2008-08-27 16:08 . 2008-08-27 16:08 48,641 --a------ C:\WINDOWS\system32\Output.exe 2008-08-27 16:08 . 2008-08-27 16:08 48,641 --a------ C:\WINDOWS\svhosI.exe 2008-08-27 12:12 . 2008-08-28 08:55 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Hamachi 2008-08-27 12:12 . 2008-08-27 12:12 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-08-24 19:07 . 2008-08-24 19:07 754 --a------ C:\WINDOWS\WORDPAD.INI 2008-08-23 15:09 . 2008-08-23 15:09 <DIR> dr------- C:\Documents and Settings\JUREK\Dane aplikacji\Brother 2008-08-21 15:07 . 2008-08-21 15:07 <DIR> d-------- C:\WINDOWS\usgwmt 2008-08-20 22:31 . 2008-08-20 22:31 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Thinstall 2008-08-20 17:11 . 2008-08-20 17:11 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-20 17:11 . 2008-08-20 17:11 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-20 17:11 . 2007-09-07 14:55 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd 2008-08-19 16:53 . 2007-09-07 14:55 12,744 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2008-08-19 16:13 . 2008-08-19 16:13 <DIR> d-------- C:\Program Files\Common Files\Futuremark Shared 2008-08-19 16:12 . 2008-08-19 16:12 <DIR> d-------- C:\WINDOWS\Sun 2008-08-18 11:54 . 2008-08-18 11:54 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-08-18 11:54 . 2008-08-18 11:54 298 --a------ C:\WINDOWS\game.ini 2008-08-17 22:37 . 2008-08-17 22:39 <DIR> d-------- C:\Documents and Settings\JUREK\.VirtualBox 2008-08-17 22:37 . 2008-07-29 21:24 54,896 --a------ C:\WINDOWS\system32\drivers\VBoxDrv.sys 2008-08-17 22:37 . 2008-07-29 21:24 41,616 --a------ C:\WINDOWS\system32\drivers\VBoxUSBMon.sys 2008-08-17 22:37 . 2008-07-29 21:24 31,696 --a------ C:\WINDOWS\system32\drivers\VBoxUSB.sys 2008-08-17 14:12 . 2008-08-17 14:12 <DIR> d-------- C:\WINDOWS\system32\xlive 2008-08-16 17:48 . 2008-08-16 17:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2008-08-16 17:38 . 2008-08-16 17:38 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-08-16 17:38 . 2008-08-16 17:38 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-16 17:31 . 2008-08-16 17:31 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-08-16 17:31 . 2008-08-16 17:31 <DIR> d-------- C:\Program Files\Microsoft Works 2008-08-16 17:31 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll 2008-08-16 17:30 . 2008-08-16 17:30 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-08-16 17:29 . 2008-08-16 17:29 <DIR> dr-h----- C:\MSOCache 2008-08-16 17:29 . 2008-08-17 12:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-08-16 17:25 . 2008-08-16 17:25 <DIR> d-------- C:\Program Files\Techland 2008-08-15 15:26 . 2008-08-15 15:26 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-15 15:23 . 2008-08-15 15:23 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2008-08-15 14:31 . 2008-08-15 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ATI 2008-08-15 14:30 . 2008-08-15 14:30 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-15 14:30 . 2008-07-03 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2008-08-15 14:26 . 2008-08-15 14:26 10 --a------ C:\WINDOWS\WININIT.INI 2008-08-15 14:03 . 2008-08-15 14:03 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\ESET 2008-08-15 14:03 . 2008-08-15 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-15 13:36 . 2008-08-15 13:36 <DIR> d-------- C:\WINDOWS\system32\Futuremark 2008-08-15 13:36 . 2007-08-20 10:05 27,672 -ra------ C:\WINDOWS\system32\drivers\Entech.sys 2008-08-15 13:36 . 2001-11-19 20:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2008-08-14 23:21 . 2008-08-14 23:21 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Gadu-Gadu 2008-08-14 23:14 . 2006-01-10 10:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll 2008-08-14 23:14 . 2007-12-17 11:14 12,400 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys 2008-08-14 23:12 . 2008-08-17 16:16 34,122 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-14 23:12 . 2007-12-28 17:22 10,296 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-14 22:58 . 2008-01-21 11:45 8,192 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys 2008-08-14 22:52 . 2008-04-14 22:51 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-14 22:51 . 2008-08-14 22:51 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-14 22:51 . 2008-05-01 16:37 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-14 22:49 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 22:47 . 2008-08-14 22:47 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Ashampoo 2008-08-14 22:46 . 2008-08-14 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-08-14 22:46 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-14 22:46 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-14 22:45 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-08-14 22:43 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-08-14 22:43 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-08-14 22:43 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-08-14 22:43 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-08-14 22:43 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-08-14 22:27 . 2008-08-28 15:47 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\MyPhoneExplorer 2008-08-14 22:25 . 2006-05-15 15:35 18,704 -ra------ C:\WINDOWS\system32\drivers\se27nd5.sys 2008-08-14 22:24 . 2006-05-15 15:35 90,800 -ra------ C:\WINDOWS\system32\drivers\se27unic.sys 2008-08-14 22:24 . 2006-05-15 15:35 88,688 -ra------ C:\WINDOWS\system32\drivers\SE27mgmt.sys 2008-08-14 22:24 . 2006-05-15 15:35 86,560 -ra------ C:\WINDOWS\system32\drivers\SE27obex.sys 2008-08-14 22:24 . 2006-05-15 15:35 4,128 -ra------ C:\WINDOWS\system32\drivers\se27cr.sys 2008-08-14 22:23 . 2006-05-15 15:35 97,184 -ra------ C:\WINDOWS\system32\drivers\SE27mdm.sys 2008-08-14 22:23 . 2006-05-15 15:35 61,600 -ra------ C:\WINDOWS\system32\drivers\SE27bus.sys 2008-08-14 22:23 . 2006-05-15 15:35 9,360 -ra------ C:\WINDOWS\system32\drivers\SE27mdfl.sys 2008-08-14 22:23 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cmnt.sys 2008-08-14 22:23 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cm.sys 2008-08-14 22:23 . 2006-05-15 15:36 5,872 -ra------ C:\WINDOWS\system32\drivers\SE27whnt.sys 2008-08-14 22:23 . 2006-05-15 15:36 5,872 -ra------ C:\WINDOWS\system32\drivers\se27wh.sys 2008-08-14 21:06 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-14 20:23 . 2008-08-14 20:23 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-14 20:04 . 2008-08-14 20:04 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\ACD Systems 2008-08-14 20:02 . 2008-08-14 20:02 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-08-14 20:02 . 2008-08-14 20:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-08-14 18:59 . 2008-08-14 18:59 <DIR> d-------- C:\Program Files\ScanSoft 2008-08-14 18:59 . 2008-08-14 18:59 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared 2008-08-14 18:59 . 2008-08-14 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft 2008-08-14 18:58 . 2008-08-14 18:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Brother . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-27 17:19 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\uTorrent 2008-08-20 15:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-15 19:23 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-08-15 19:23 361,600 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-08-14 17:30 306,432 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe 2008-08-14 17:30 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\TuneUp Software 2008-08-14 17:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software 2008-08-14 17:29 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-14 17:27 --------- d-----w C:\Program Files\Real Alternative 2008-08-14 17:27 --------- d-----w C:\Program Files\QuickTime Alternative 2008-08-14 17:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-08-14 17:26 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-08-14 17:26 --------- d-----w C:\Program Files\Java 2008-08-14 17:26 --------- d-----w C:\Program Files\Common Files\Java 2008-08-14 17:13 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\ATI 2008-08-14 17:11 --------- d-----w C:\Program Files\Reference Assemblies 2008-08-14 17:11 --------- d-----w C:\Program Files\MSBuild 2008-08-14 17:05 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-14 17:00 --------- d-----w C:\Program Files\Nuance 2008-08-14 17:00 --------- d-----w C:\Program Files\Brother 2008-08-14 17:00 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\InstallShield 2008-08-14 17:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-08-14 15:36 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-14 15:36 --------- d-----w C:\Program Files\Realtek 2008-08-14 15:34 --------- d-----w C:\Program Files\Intel 2008-08-14 15:22 --------- d-----w C:\Program Files\Usługi online 2008-08-14 15:20 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:29 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-07-04 06:33 3,230,720 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-07-04 03:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-07-04 03:25 421,888 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-07-04 03:23 309,248 ------w C:\WINDOWS\system32\ati2dvag.dll 2008-07-04 03:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-07-04 03:14 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-07-04 03:14 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-07-04 03:13 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-07-04 03:13 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-07-04 03:12 561,152 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-07-04 03:10 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-07-04 03:06 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-07-04 03:00 3,786,144 ------w C:\WINDOWS\system32\ati3duag.dll 2008-07-04 02:55 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-07-04 02:49 2,140,672 ------w C:\WINDOWS\system32\ativvaxx.dll 2008-07-04 02:34 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-07-04 02:30 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-07-04 02:29 32,768 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-07-04 02:28 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-07-04 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-07-04 02:22 565,248 ------w C:\WINDOWS\system32\ati2cqag.dll 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:46 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-24 08:42 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-23 09:23 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:23 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:48 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:48 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-06-04 12:55 53,248 ----a-w C:\WINDOWS\system32\CSVer.dll 2008-05-30 12:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll 2008-05-30 12:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll 2008-05-30 12:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll 2008-05-30 12:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll 2008-05-30 12:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll 2008-05-30 12:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll 2008-05-30 12:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll 2006-06-24 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . ------- Sigcheck ------- 2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2008-08-14 19:38 361344 b0870dc4ae8a0a40c45ec66bcde3e523 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys 2008-08-15 21:23 361600 eec9730f9cc03819111d90e6caa2dcc9 C:\WINDOWS\system32\dllcache\tcpip.sys 2008-08-15 21:23 361600 eec9730f9cc03819111d90e6caa2dcc9 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Programy\ESET Smart Security\egui.exe" [2008-06-10 18:52 1447168] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440] "NodLogin"="C:\Programy\ESET Smart Security\nodlogin.exe" [2008-08-27 16:08 359203] "svhosI"="C:\WINDOWS\svhosI.exe" [2008-08-27 16:08 48641] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NodLogin"=C:\Programy\ESET Smart Security\nodlogin.exe "svhosI"=C:\WINDOWS\svhosI.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Programy\\uTorrent\\uTorrent.exe"= "D:\\Gry\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3478:UDP"= 3478:UDP:stun "3479:UDP"= 3479:UDP:stun 2 "6112:UDP"= 6112:UDP:stun 3 "5730:UDP"= 5730:UDP:game "5739:UDP"= 5739:UDP:game 1 "9001:TCP"= 9001:TCP:game 2 "11881:TCP"= 11881:TCP:game 3 R1 VBoxDrv;VirtualBox Service;C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [2008-07-29 21:24] R1 VBoxUSBMon;VirtualBox USB Monitor Driver;C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [2008-07-29 21:24] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 22:51] R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-05-21 01:53] R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-02-03 07:54] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-08-14 19:30] S3 VBoxUSB;VirtualBox USB;C:\WINDOWS\system32\Drivers\VBoxUSB.sys [2008-07-29 21:24] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B19E6D8-E150-813E-6E91-30BBE6127823}] C:\WINDOWS\svhosI.exe . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\JUREK\Dane aplikacji\Mozilla\Firefox\Profiles\ewi5qhrc.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank FF -: plugin - C:\Programy\Mozilla Firefox\plugins\np-mswmp.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\np32dsw.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-28 16:39:25 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run svhosI = C:\WINDOWS\svhosI.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-28 16:39:39 ComboFix-quarantined-files.txt 2008-08-28 14:39:38 Pre-Run: 10,172,063,744 bajtów wolnych Post-Run: 10,160,160,768 bajtów wolnych 261

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:34:37, on 2008-08-28 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programy\ESET Smart Security\ekrn.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Programy\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Programy\ESET Smart Security\egui.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\System32\svchost.exe D:\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [egui] "C:\Programy\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [NodLogin] C:\Programy\ESET Smart Security\nodlogin.exe O4 - HKLM\..\Run: [svhosI] C:\WINDOWS\svhosI.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218746562984 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218967213703 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Programy\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Programy\ESET Smart Security\ekrn.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programy\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 4711 bytes

**Posty:** 18165 · przez **wojtas** 28 Sie 2008, 17:05

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\svhosI
C:\WINDOWS\system32\Output.exe
C:\WINDOWS\svhosI.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B19E6D8-E150-813E-6E91-30BBE6127823}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"svhosI"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"svhosI"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

Autor postu otrzymał pochwałę

**Posty:** 1519 · przez **michal_michael** 28 Sie 2008, 17:16

Zrobione, tutaj log:

Kod: Zaznacz wszystko: ComboFix 08-08-27.06 - JUREK 2008-08-28 17:14:56.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1596 [GMT 2:00] Running from: D:\ComboFix.exe Command switches used :: D:\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\svhosI C:\WINDOWS\svhosI.exe C:\WINDOWS\system32\Output.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\svhosI C:\WINDOWS\svhosI.exe C:\WINDOWS\system32\Output.exe . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 ))))))))))))))))))))))))))))))) . 2008-08-28 08:49 . 2008-08-28 08:49 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\fltk.org 2008-08-27 12:12 . 2008-08-28 08:55 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Hamachi 2008-08-27 12:12 . 2008-08-27 12:12 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-08-24 19:07 . 2008-08-24 19:07 754 --a------ C:\WINDOWS\WORDPAD.INI 2008-08-23 15:09 . 2008-08-23 15:09 <DIR> dr------- C:\Documents and Settings\JUREK\Dane aplikacji\Brother 2008-08-21 15:07 . 2008-08-21 15:07 <DIR> d-------- C:\WINDOWS\usgwmt 2008-08-20 22:31 . 2008-08-20 22:31 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Thinstall 2008-08-20 17:11 . 2008-08-20 17:11 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-08-20 17:11 . 2008-08-20 17:11 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-08-20 17:11 . 2007-09-07 14:55 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd 2008-08-19 16:53 . 2007-09-07 14:55 12,744 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2008-08-19 16:13 . 2008-08-19 16:13 <DIR> d-------- C:\Program Files\Common Files\Futuremark Shared 2008-08-19 16:12 . 2008-08-19 16:12 <DIR> d-------- C:\WINDOWS\Sun 2008-08-18 11:54 . 2008-08-18 11:54 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-08-18 11:54 . 2008-08-18 11:54 298 --a------ C:\WINDOWS\game.ini 2008-08-17 22:37 . 2008-08-17 22:39 <DIR> d-------- C:\Documents and Settings\JUREK\.VirtualBox 2008-08-17 22:37 . 2008-07-29 21:24 54,896 --a------ C:\WINDOWS\system32\drivers\VBoxDrv.sys 2008-08-17 22:37 . 2008-07-29 21:24 41,616 --a------ C:\WINDOWS\system32\drivers\VBoxUSBMon.sys 2008-08-17 22:37 . 2008-07-29 21:24 31,696 --a------ C:\WINDOWS\system32\drivers\VBoxUSB.sys 2008-08-17 14:12 . 2008-08-17 14:12 <DIR> d-------- C:\WINDOWS\system32\xlive 2008-08-16 17:48 . 2008-08-16 17:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2008-08-16 17:38 . 2008-08-16 17:38 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-08-16 17:38 . 2008-08-16 17:38 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-16 17:31 . 2008-08-16 17:31 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-08-16 17:31 . 2008-08-16 17:31 <DIR> d-------- C:\Program Files\Microsoft Works 2008-08-16 17:31 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll 2008-08-16 17:30 . 2008-08-16 17:30 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-08-16 17:29 . 2008-08-16 17:29 <DIR> dr-h----- C:\MSOCache 2008-08-16 17:29 . 2008-08-17 12:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-08-16 17:25 . 2008-08-16 17:25 <DIR> d-------- C:\Program Files\Techland 2008-08-15 15:26 . 2008-08-15 15:26 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-15 15:23 . 2008-08-15 15:23 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe 2008-08-15 14:31 . 2008-08-15 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ATI 2008-08-15 14:30 . 2008-08-15 14:30 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-15 14:30 . 2008-07-03 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe 2008-08-15 14:26 . 2008-08-15 14:26 10 --a------ C:\WINDOWS\WININIT.INI 2008-08-15 14:03 . 2008-08-15 14:03 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\ESET 2008-08-15 14:03 . 2008-08-15 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-15 13:36 . 2008-08-15 13:36 <DIR> d-------- C:\WINDOWS\system32\Futuremark 2008-08-15 13:36 . 2007-08-20 10:05 27,672 -ra------ C:\WINDOWS\system32\drivers\Entech.sys 2008-08-15 13:36 . 2001-11-19 20:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2008-08-14 23:21 . 2008-08-14 23:21 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Gadu-Gadu 2008-08-14 23:14 . 2006-01-10 10:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll 2008-08-14 23:14 . 2007-12-17 11:14 12,400 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys 2008-08-14 23:12 . 2008-08-17 16:16 34,122 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-14 23:12 . 2007-12-28 17:22 10,296 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-14 22:58 . 2008-01-21 11:45 8,192 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys 2008-08-14 22:52 . 2008-04-14 22:51 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-14 22:51 . 2008-08-14 22:51 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-14 22:51 . 2008-05-01 16:37 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-14 22:49 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 22:47 . 2008-08-14 22:47 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\Ashampoo 2008-08-14 22:46 . 2008-08-14 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-08-14 22:46 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-14 22:46 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-14 22:45 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-08-14 22:43 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-08-14 22:43 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-08-14 22:43 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-08-14 22:43 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-08-14 22:43 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-08-14 22:27 . 2008-08-28 15:47 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\MyPhoneExplorer 2008-08-14 22:25 . 2006-05-15 15:35 18,704 -ra------ C:\WINDOWS\system32\drivers\se27nd5.sys 2008-08-14 22:24 . 2006-05-15 15:35 90,800 -ra------ C:\WINDOWS\system32\drivers\se27unic.sys 2008-08-14 22:24 . 2006-05-15 15:35 88,688 -ra------ C:\WINDOWS\system32\drivers\SE27mgmt.sys 2008-08-14 22:24 . 2006-05-15 15:35 86,560 -ra------ C:\WINDOWS\system32\drivers\SE27obex.sys 2008-08-14 22:24 . 2006-05-15 15:35 4,128 -ra------ C:\WINDOWS\system32\drivers\se27cr.sys 2008-08-14 22:23 . 2006-05-15 15:35 97,184 -ra------ C:\WINDOWS\system32\drivers\SE27mdm.sys 2008-08-14 22:23 . 2006-05-15 15:35 61,600 -ra------ C:\WINDOWS\system32\drivers\SE27bus.sys 2008-08-14 22:23 . 2006-05-15 15:35 9,360 -ra------ C:\WINDOWS\system32\drivers\SE27mdfl.sys 2008-08-14 22:23 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cmnt.sys 2008-08-14 22:23 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cm.sys 2008-08-14 22:23 . 2006-05-15 15:36 5,872 -ra------ C:\WINDOWS\system32\drivers\SE27whnt.sys 2008-08-14 22:23 . 2006-05-15 15:36 5,872 -ra------ C:\WINDOWS\system32\drivers\se27wh.sys 2008-08-14 21:06 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg 2008-08-14 20:23 . 2008-08-14 20:23 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-14 20:04 . 2008-08-14 20:04 <DIR> d-------- C:\Documents and Settings\JUREK\Dane aplikacji\ACD Systems 2008-08-14 20:02 . 2008-08-14 20:02 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-08-14 20:02 . 2008-08-14 20:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-08-14 18:59 . 2008-08-14 18:59 <DIR> d-------- C:\Program Files\ScanSoft 2008-08-14 18:59 . 2008-08-14 18:59 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared 2008-08-14 18:59 . 2008-08-14 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft 2008-08-14 18:58 . 2008-08-14 18:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Brother . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-27 17:19 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\uTorrent 2008-08-20 15:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-15 19:23 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-08-15 19:23 361,600 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-08-14 17:30 306,432 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe 2008-08-14 17:30 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\TuneUp Software 2008-08-14 17:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software 2008-08-14 17:29 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-14 17:27 --------- d-----w C:\Program Files\Real Alternative 2008-08-14 17:27 --------- d-----w C:\Program Files\QuickTime Alternative 2008-08-14 17:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-08-14 17:26 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-08-14 17:26 --------- d-----w C:\Program Files\Java 2008-08-14 17:26 --------- d-----w C:\Program Files\Common Files\Java 2008-08-14 17:13 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\ATI 2008-08-14 17:11 --------- d-----w C:\Program Files\Reference Assemblies 2008-08-14 17:11 --------- d-----w C:\Program Files\MSBuild 2008-08-14 17:05 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-14 17:00 --------- d-----w C:\Program Files\Nuance 2008-08-14 17:00 --------- d-----w C:\Program Files\Brother 2008-08-14 17:00 --------- d-----w C:\Documents and Settings\JUREK\Dane aplikacji\InstallShield 2008-08-14 17:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-08-14 15:36 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-08-14 15:36 --------- d-----w C:\Program Files\Realtek 2008-08-14 15:34 --------- d-----w C:\Program Files\Intel 2008-08-14 15:22 --------- d-----w C:\Program Files\Usługi online 2008-08-14 15:20 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:29 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-07-04 06:33 3,230,720 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-07-04 03:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-07-04 03:25 421,888 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-07-04 03:23 309,248 ------w C:\WINDOWS\system32\ati2dvag.dll 2008-07-04 03:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-07-04 03:14 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-07-04 03:14 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-07-04 03:13 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-07-04 03:13 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-07-04 03:12 561,152 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-07-04 03:10 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-07-04 03:06 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-07-04 03:00 3,786,144 ------w C:\WINDOWS\system32\ati3duag.dll 2008-07-04 02:55 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-07-04 02:49 2,140,672 ------w C:\WINDOWS\system32\ativvaxx.dll 2008-07-04 02:34 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-07-04 02:30 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-07-04 02:29 32,768 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-07-04 02:28 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-07-04 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-07-04 02:22 565,248 ------w C:\WINDOWS\system32\ati2cqag.dll 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:46 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-24 08:42 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-23 09:23 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:23 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:48 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:48 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-06-04 12:55 53,248 ----a-w C:\WINDOWS\system32\CSVer.dll 2008-05-30 12:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll 2008-05-30 12:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll 2008-05-30 12:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll 2008-05-30 12:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll 2008-05-30 12:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll 2008-05-30 12:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll 2008-05-30 12:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll 2006-06-24 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . ------- Sigcheck ------- 2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2008-08-14 19:38 361344 b0870dc4ae8a0a40c45ec66bcde3e523 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys 2008-08-15 21:23 361600 eec9730f9cc03819111d90e6caa2dcc9 C:\WINDOWS\system32\dllcache\tcpip.sys 2008-08-15 21:23 361600 eec9730f9cc03819111d90e6caa2dcc9 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Programy\ESET Smart Security\egui.exe" [2008-06-10 18:52 1447168] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440] "NodLogin"="C:\Programy\ESET Smart Security\nodlogin.exe" [2008-08-27 16:08 359203] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NodLogin"=C:\Programy\ESET Smart Security\nodlogin.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Programy\\uTorrent\\uTorrent.exe"= R1 VBoxDrv;VirtualBox Service;C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [2008-07-29 21:24] R1 VBoxUSBMon;VirtualBox USB Monitor Driver;C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [2008-07-29 21:24] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 22:51] R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-05-21 01:53] R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-02-03 07:54] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-08-14 19:30] S3 VBoxUSB;VirtualBox USB;C:\WINDOWS\system32\Drivers\VBoxUSB.sys [2008-07-29 21:24] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-28 17:15:21 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-28 17:15:33 ComboFix-quarantined-files.txt 2008-08-28 15:15:32 ComboFix2.txt 2008-08-28 14:39:40 Pre-Run: 10,147,692,544 bajtów wolnych Post-Run: 10,136,498,176 bajtów wolnych 236

**Posty:** 18165 · przez **wojtas** 28 Sie 2008, 17:27

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 1519 · przez **michal_michael** 28 Sie 2008, 17:48

wojtas napisał(a):Czysto

Super - już jest dobrze, wielkie dzięki za pomoc

Chciałbym się jeszcze dowiedzieć co to było, jakiś wirus czy co ??

Aha, korzystając z okazji zapytam się - jak się pozbyć tego okienka:

Wyskakuje mi przy otwieraniu dowolnego pliku *.exe i mimo odznaczenia tej opcji u dołu okna - nadal wyskakuje. Można się tego jakoś pozbyć ?

**Posty:** 591 · przez **Gazprom** 29 Sie 2008, 15:57

Start -> Uruchom -> gpedit.msc

Konfiguracja użytkownika -> Szablony administracyjne -> Składniki systemu Windows -> Menedżer załączników -> Lista dołączana do plików niskiego ryzyka -> Włącz tę opcję i wpisz rozszerzenie .exe

Autor postu otrzymał pochwałę

**Posty:** 1519 · przez **michal_michael** 29 Sie 2008, 17:28

Gazprom

działa, dzięki

Kto jest na forum