Olhrwef.exe , e.exe

**Posty:** 13 · przez **FoReST333** 18 Lip 2009, 15:48

witam. mam taką spawę, że po włączeniu kompa wyskakuje mi takie okienko:
http://img145.imageshack.us/img145/3996/blad1.jpg
nie wiem co to, ale juz mnie to denerwuje ;p
jest jeszcze inny błąd, kiedy chce otworzyc dysk przez 'mój komputer'
http://img149.imageshack.us/img149/7201/blad2.jpg
do tego przestał mi działać 'podglądacz obrazów systemu windows'

aa i bym zapomniał. chcialem zrobic skana SDfix'em, ale trzeba włączyć tryb awaryjny.
próbowałem i mi sie wyświetlił taki niebieski ekran i że musze ponownie uruchomic komputer

cos tam pisało zeby uruchomic chkdsk /f ale nie wiem co to ;p
dodam loga z OTL'a ;p

http://wklej.org/id/122738/

proszę o pomoc

**Posty:** 18165 · przez **wojtas** 18 Lip 2009, 16:17

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NWEReboot] File not found
O4 - HKCU..\Run: [cdoosoft] C:\Documents and Settings\User\Ustawienia lokalne\Temp\olhrwef.exe ()
O32 - AutoRun File - [2009-07-11 12:02:55 | 00,000,049 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-07-11 12:02:55 | 00,000,049 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-07-11 12:02:55 | 00,000,049 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-07-11 12:02:55 | 00,000,049 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{e8ccb2ad-6d70-11de-9f21-000ce5e69f47}\Shell\AutoRun\command - "" = H:\icxpa.cmd -- File not found
O33 - MountPoints2\{e8ccb2ad-6d70-11de-9f21-000ce5e69f47}\Shell\open\Command - "" = H:\icxpa.cmd -- File not found
O33 - MountPoints2\{fd5b35c1-6f7a-11de-9f28-000ce5e69f47}\Shell\AutoRun\command - "" = H:\metdgv.bat -- File not found
O33 - MountPoints2\{fd5b35c1-6f7a-11de-9f28-000ce5e69f47}\Shell\open\Command - "" = H:\metdgv.bat -- File not found
O33 - MountPoints2\{fd5b35c2-6f7a-11de-9f28-000ce5e69f47}\Shell\AutoRun\command - "" = I:\metdgv.bat -- File not found
O33 - MountPoints2\{fd5b35c2-6f7a-11de-9f28-000ce5e69f47}\Shell\open\Command - "" = I:\metdgv.bat -- File not found

:Files
C:\WINDOWS\System32\sk461543.dll
C:\WINDOWS\System32\sk461543.dl_
C:\Documents and Settings\User\Ustawienia lokalne\Temp\olhrwef.exe
C:\autorun.inf
D:\autorun.inf
E:\autorun.inf
F:\autorun.inf
C:\WINDOWS\System32\oo461543.dll
C:\WINDOWS\System32\oo461543.dl_
C:\WINDOWS\System32\no461543.dll
C:\WINDOWS\System32\no461543.dl_
C:\WINDOWS\System32\kj461543.dll
C:\WINDOWS\System32\kj461543.dl_
C:\WINDOWS\AhnRpta.exe
C:\aieh8r.bat
D:\aieh8r.bat
E:\aieh8r.bat
F:\aieh8r.bat
C:\icxpa.cmd
D:\icxpa.cmd
E:\icxpa.cmd
F:\icxpa.cmd
C:\WINDOWS\System32\ik461543.dll
C:\WINDOWS\System32\ik461543.dl_
C:\WINDOWS\System32\olhrwef.exe
C:\WINDOWS\System32\nmdfgds0.dll
C:\p.exe
d:\p.exe
e:\p.exe
f:\p.exe
C:\WINDOWS\System32\kl461543.dll
C:\WINDOWS\System32\kl461543.dl_
C:\WINDOWS\System32\rk461543.dll
C:\WINDOWS\System32\rk461543.dl_
C:\WINDOWS\System32\ij461543.dll
C:\WINDOWS\System32\ij461543.dl_
C:\WINDOWS\System32\jl416823.dll
C:\WINDOWS\System32\jl416823.dl_
C:\WINDOWS\System32\k~252703.dll
C:\WINDOWS\System32\k~252703.dl_
C:\WINDOWS\System32\og252703.dll
C:\WINDOWS\System32\og252703.dl_
C:\WINDOWS\System32\jj461543.dll
C:\WINDOWS\System32\jj461543.dl_
C:\WINDOWS\System32\ti461543.dll
C:\WINDOWS\System32\ti461543.dl_
C:\WINDOWS\System32\si461543.dll
C:\WINDOWS\System32\si461543.dl_

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 13 · przez **FoReST333** 18 Lip 2009, 16:18

a jak zrobic ten raport? ;p
czy to nie jest czasem to co sie otworzylo po resecie w notatniku? ;p
jesli tak to prosze ;p

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NWEReboot deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cdoosoft deleted successfully. C:\Documents and Settings\User\Ustawienia lokalne\Temp\olhrwef.exe moved successfully. C:\autorun.inf moved successfully. D:\autorun.inf moved successfully. E:\autorun.inf moved successfully. F:\autorun.inf moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8ccb2ad-6d70-11de-9f21-000ce5e69f47}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8ccb2ad-6d70-11de-9f21-000ce5e69f47}\ not found. File H:\icxpa.cmd not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8ccb2ad-6d70-11de-9f21-000ce5e69f47}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8ccb2ad-6d70-11de-9f21-000ce5e69f47}\ not found. File H:\icxpa.cmd not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd5b35c1-6f7a-11de-9f28-000ce5e69f47}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd5b35c1-6f7a-11de-9f28-000ce5e69f47}\ not found. File H:\metdgv.bat not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd5b35c1-6f7a-11de-9f28-000ce5e69f47}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd5b35c1-6f7a-11de-9f28-000ce5e69f47}\ not found. File H:\metdgv.bat not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd5b35c2-6f7a-11de-9f28-000ce5e69f47}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd5b35c2-6f7a-11de-9f28-000ce5e69f47}\ not found. File I:\metdgv.bat not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd5b35c2-6f7a-11de-9f28-000ce5e69f47}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd5b35c2-6f7a-11de-9f28-000ce5e69f47}\ not found. File I:\metdgv.bat not found. ========== FILES ========== DllUnregisterServer procedure not found in C:\WINDOWS\System32\sk461543.dll C:\WINDOWS\System32\sk461543.dll NOT unregistered. C:\WINDOWS\System32\sk461543.dll moved successfully. C:\WINDOWS\System32\sk461543.dl_ moved successfully. File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\olhrwef.exe not found. File\Folder C:\autorun.inf not found. File\Folder D:\autorun.inf not found. File\Folder E:\autorun.inf not found. File\Folder F:\autorun.inf not found. DllUnregisterServer procedure not found in C:\WINDOWS\System32\oo461543.dll C:\WINDOWS\System32\oo461543.dll NOT unregistered. C:\WINDOWS\System32\oo461543.dll moved successfully. C:\WINDOWS\System32\oo461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\no461543.dll C:\WINDOWS\System32\no461543.dll NOT unregistered. C:\WINDOWS\System32\no461543.dll moved successfully. C:\WINDOWS\System32\no461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\kj461543.dll C:\WINDOWS\System32\kj461543.dll NOT unregistered. C:\WINDOWS\System32\kj461543.dll moved successfully. C:\WINDOWS\System32\kj461543.dl_ moved successfully. C:\WINDOWS\AhnRpta.exe moved successfully. C:\aieh8r.bat moved successfully. D:\aieh8r.bat moved successfully. E:\aieh8r.bat moved successfully. F:\aieh8r.bat moved successfully. C:\icxpa.cmd moved successfully. D:\icxpa.cmd moved successfully. E:\icxpa.cmd moved successfully. F:\icxpa.cmd moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\ik461543.dll C:\WINDOWS\System32\ik461543.dll NOT unregistered. C:\WINDOWS\System32\ik461543.dll moved successfully. C:\WINDOWS\System32\ik461543.dl_ moved successfully. C:\WINDOWS\System32\olhrwef.exe moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\nmdfgds0.dll C:\WINDOWS\System32\nmdfgds0.dll NOT unregistered. C:\WINDOWS\System32\nmdfgds0.dll moved successfully. C:\p.exe moved successfully. d:\p.exe moved successfully. e:\p.exe moved successfully. f:\p.exe moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\kl461543.dll C:\WINDOWS\System32\kl461543.dll NOT unregistered. C:\WINDOWS\System32\kl461543.dll moved successfully. C:\WINDOWS\System32\kl461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\rk461543.dll C:\WINDOWS\System32\rk461543.dll NOT unregistered. C:\WINDOWS\System32\rk461543.dll moved successfully. C:\WINDOWS\System32\rk461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\ij461543.dll C:\WINDOWS\System32\ij461543.dll NOT unregistered. C:\WINDOWS\System32\ij461543.dll moved successfully. C:\WINDOWS\System32\ij461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\jl416823.dll C:\WINDOWS\System32\jl416823.dll NOT unregistered. C:\WINDOWS\System32\jl416823.dll moved successfully. C:\WINDOWS\System32\jl416823.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\k~252703.dll C:\WINDOWS\System32\k~252703.dll NOT unregistered. C:\WINDOWS\System32\k~252703.dll moved successfully. C:\WINDOWS\System32\k~252703.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\og252703.dll C:\WINDOWS\System32\og252703.dll NOT unregistered. C:\WINDOWS\System32\og252703.dll moved successfully. C:\WINDOWS\System32\og252703.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\jj461543.dll C:\WINDOWS\System32\jj461543.dll NOT unregistered. C:\WINDOWS\System32\jj461543.dll moved successfully. C:\WINDOWS\System32\jj461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\ti461543.dll C:\WINDOWS\System32\ti461543.dll NOT unregistered. C:\WINDOWS\System32\ti461543.dll moved successfully. C:\WINDOWS\System32\ti461543.dl_ moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\si461543.dll C:\WINDOWS\System32\si461543.dll NOT unregistered. C:\WINDOWS\System32\si461543.dll moved successfully. C:\WINDOWS\System32\si461543.dl_ moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: User File delete failed. C:\Documents and Settings\User\Ustawienia lokalne\Temp\~1fd32fa.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\User\Ustawienia lokalne\Temp\~1fd3378.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\User\Ustawienia lokalne\Temp\~1fd3396.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\User\Ustawienia lokalne\Temp\~6f634fd.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\User\Ustawienia lokalne\Temp\~8f364d5.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\User\Ustawienia lokalne\Temp\~8f3670c.tmp scheduled to be deleted on reboot. ->Temp folder emptied: 33863691 bytes ->Temporary Internet Files folder emptied: 19761600 bytes ->FireFox cache emptied: 87168340 bytes ->Google Chrome cache emptied: 6432531 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2352022 bytes %systemroot%\System32 .tmp files removed: 2596 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 142,68 mb OTL by OldTimer - Version 3.0.9.1 log created on 07182009_161922 Files\Folders moved on Reboot... File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\~1fd32fa.tmp not found! File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\~1fd3378.tmp not found! File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\~1fd3396.tmp not found! File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\~6f634fd.tmp not found! File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\~8f364d5.tmp not found! File\Folder C:\Documents and Settings\User\Ustawienia lokalne\Temp\~8f3670c.tmp not found! Registry entries deleted on Reboot...

tu daje nowego loga
http://wklej.org/id/122751/

**Posty:** 18165 · przez **wojtas** 19 Lip 2009, 16:14

Wykonaj to co jest podane w tym temacie

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 13 · przez **FoReST333** 19 Lip 2009, 16:44

log z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-07-19.01 - User 2009-07-19 16:22.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1580 [GMT 2:00] Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\User\Pulpit\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\AhnRpta.exe c:\windows\system32\e8main0.dll c:\windows\system32\msconfig.exe D:\060ptrm.com D:\0bcobed.exe D:\0xuc.com D:\1f.bat D:\1gk8ha.bat D:\1mteolu9.com D:\1ogf.exe D:\1utbfd.bat D:\2.bat D:\28b6ry9r.exe D:\2a.exe D:\2fiy.bat D:\2nuk.com D:\2u.com D:\3.cmd D:\3j2h0tf.bat D:\3rl3lqbq.bat D:\6fnlpetp.exe D:\6phx.com D:\8.bat D:\8.exe D:\86l2qw.bat D:\8gig0ofk.com D:\8paf1d.com D:\9dlvtiil.exe D:\a1agmur.cmd D:\a2h2.com D:\b.com D:\be2trf.bat D:\boyedt.com D:\cahpcg.cmd D:\cb.exe D:\cj1m.com D:\cqxj.exe D:\cv22.cmd D:\d9c.bat D:\dbrxubcw.com D:\e.cmd D:\e2.cmd D:\ej10fkdo.bat D:\em8tqm.cmd D:\eyt.exe D:\fbak.exe D:\fsaht.cmd D:\g1.bat D:\g1ljsm.com D:\gbm6n.exe D:\gclwpivc.cmd D:\gi2ky.exe D:\gkc6.com D:\gpcdt.cmd D:\gy.exe D:\gyn.cmd D:\h3.bat D:\hkn6k.bat D:\hl80c6b1.com D:\husyu8n.exe D:\hyetn1i.exe D:\i.bat D:\i.cmd D:\i.com D:\i6g6x.cmd D:\iky.bat D:\iqe68o.bat D:\ix8bmwx.bat D:\j.cmd D:\jeorels.cmd D:\jm3cx96.bat D:\lc.exe D:\luk1ylq.com D:\m.com D:\m0vnonh.bat D:\m9ma.exe D:\metdgv.bat D:\minm.cmd D:\ml.com D:\mt.bat D:\n0euybx.exe D:\n68mqcra.exe D:\ncyrf.bat D:\npee.com D:\nu.cmd D:\o.exe D:\o1.com D:\o3n9k.com D:\opgde.exe D:\p1y2.cmd D:\pook.com D:\q0dhfjf.exe D:\q1alx.exe D:\q9.cmd D:\qkjxl.exe D:\qphdin.com D:\qwtb.com D:\qxty9be.cmd D:\rcukd.cmd D:\rwj0.cmd D:\s.exe D:\sm.exe D:\ste8.bat D:\sv8c2bjw.bat D:\u.com D:\ukvr.bat D:\uo10sn.cmd D:\upw.bat D:\upx.bat D:\ur0.com D:\uvsqfgwd.cmd D:\uxkl0apt.bat D:\vwewav8.com D:\w.com D:\w2.com D:\w98.com D:\wx8o0bt1.com D:\xbvv6o.com D:\xdglur.bat D:\xdw.com D:\xh319r9b.bat D:\xhah66s.cmd D:\xmcckw.bat D:\xsia.bat D:\y6yol.exe D:\yh.cmd D:\yhh.bat D:\ymxf2.exe D:\ysep1.exe E:\0bcobed.exe E:\0xuc.com E:\1f.bat E:\1gk8ha.bat E:\1ogf.exe E:\1utbfd.bat E:\2.bat E:\2a.exe E:\2fiy.bat E:\3.cmd E:\3j2h0tf.bat E:\3rl3lqbq.bat E:\6fnlpetp.exe E:\8.bat E:\8.exe E:\86l2qw.bat E:\9dlvtiil.exe E:\a1agmur.cmd E:\a2h2.com E:\b.com E:\be2trf.bat E:\boyedt.com E:\cahpcg.cmd E:\cb.exe E:\cqxj.exe E:\cv22.cmd E:\d9c.bat E:\dbrxubcw.com E:\e.cmd E:\e2.cmd E:\ej10fkdo.bat E:\em8tqm.cmd E:\eyt.exe E:\fbak.exe E:\fsaht.cmd E:\g1.bat E:\g1ljsm.com E:\gbm6n.exe E:\gclwpivc.cmd E:\gi2ky.exe E:\gpcdt.cmd E:\gyn.cmd E:\h3.bat E:\hkn6k.bat E:\husyu8n.exe E:\hyetn1i.exe E:\i.bat E:\i.cmd E:\i.com E:\i6g6x.cmd E:\iky.bat E:\iqe68o.bat E:\ix8bmwx.bat E:\j.cmd E:\jeorels.cmd E:\jm3cx96.bat E:\lc.exe E:\luk1ylq.com E:\m.com E:\m0vnonh.bat E:\m9ma.exe E:\metdgv.bat E:\minm.cmd E:\mt.bat E:\n68mqcra.exe E:\ncyrf.bat E:\npee.com E:\nu.cmd E:\o3n9k.com E:\opgde.exe E:\p1y2.cmd E:\pook.com E:\q0dhfjf.exe E:\q9.cmd E:\qphdin.com E:\qwtb.com E:\qxty9be.cmd E:\rcukd.cmd E:\rwj0.cmd E:\sm.exe E:\ste8.bat E:\sv8c2bjw.bat E:\u.com E:\ukvr.bat E:\uo10sn.cmd E:\upw.bat E:\upx.bat E:\uvsqfgwd.cmd E:\uxkl0apt.bat E:\vwewav8.com E:\w.com E:\w2.com E:\w98.com E:\wx8o0bt1.com E:\xdglur.bat E:\xdw.com E:\xh319r9b.bat E:\xhah66s.cmd E:\xmcckw.bat E:\xsia.bat E:\y6yol.exe E:\yh.cmd E:\yhh.bat E:\ymxf2.exe E:\ysep1.exe F:\060ptrm.com F:\0bcobed.exe F:\0xuc.com F:\1f.bat F:\1gk8ha.bat F:\1mteolu9.com F:\1ogf.exe F:\1utbfd.bat F:\2.bat F:\28b6ry9r.exe F:\2a.exe F:\2fiy.bat F:\2nuk.com F:\2u.com F:\3.cmd F:\3j2h0tf.bat F:\3rl3lqbq.bat F:\6fnlpetp.exe F:\6phx.com F:\8.bat F:\8.exe F:\86l2qw.bat F:\8gig0ofk.com F:\8paf1d.com F:\9dlvtiil.exe F:\a1agmur.cmd F:\a2h2.com F:\b.com F:\be2trf.bat F:\boyedt.com F:\cahpcg.cmd F:\cb.exe F:\cj1m.com F:\cqxj.exe F:\cv22.cmd F:\d9c.bat F:\dbrxubcw.com F:\e.cmd F:\e2.cmd F:\ej10fkdo.bat F:\em8tqm.cmd F:\eyt.exe F:\fbak.exe F:\fsaht.cmd F:\g1.bat F:\g1ljsm.com F:\gbm6n.exe F:\gclwpivc.cmd F:\gi2ky.exe F:\gkc6.com F:\gpcdt.cmd F:\gy.exe F:\gyn.cmd F:\h3.bat F:\hkn6k.bat F:\hl80c6b1.com F:\husyu8n.exe F:\hyetn1i.exe F:\i.bat F:\i.cmd F:\i.com F:\i6g6x.cmd F:\iky.bat F:\iqe68o.bat F:\ix8bmwx.bat F:\j.cmd F:\jeorels.cmd F:\jm3cx96.bat F:\lc.exe F:\luk1ylq.com F:\m.com F:\m0vnonh.bat F:\m9ma.exe F:\metdgv.bat F:\minm.cmd F:\ml.com F:\mt.bat F:\n0euybx.exe F:\n68mqcra.exe F:\ncyrf.bat F:\npee.com F:\nu.cmd F:\o.exe F:\o1.com F:\o3n9k.com F:\opgde.exe F:\p1y2.cmd F:\pook.com F:\q0dhfjf.exe F:\q1alx.exe F:\q9.cmd F:\qkjxl.exe F:\qphdin.com F:\qwtb.com F:\qxty9be.cmd F:\rcukd.cmd F:\rwj0.cmd F:\s.exe F:\sm.exe F:\ste8.bat F:\sv8c2bjw.bat F:\u.com F:\ukvr.bat F:\uo10sn.cmd F:\upw.bat F:\upx.bat F:\ur0.com F:\uvsqfgwd.cmd F:\uxkl0apt.bat F:\vwewav8.com F:\w.com F:\w2.com F:\w98.com F:\wx8o0bt1.com F:\xbvv6o.com F:\xdglur.bat F:\xdw.com F:\xh319r9b.bat F:\xhah66s.cmd F:\xmcckw.bat F:\xsia.bat F:\y6yol.exe F:\yh.cmd F:\yhh.bat F:\ymxf2.exe F:\ysep1.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_AVPsys ((((((((((((((((((((((((( Pliki utworzone od 2009-06-19 do 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\xircom 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\oobe 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\srchasst 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\msagent 2009-07-19 13:06 . 2009-07-19 14:30 81920 ----a-w- c:\windows\system32\nt461543.dll 2009-07-19 11:36 . 2009-07-19 11:36 81920 ----a-w- c:\windows\system32\si252703.dll 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\windows\USB Vibration 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\program files\USB Vibration 2009-07-19 08:23 . 2009-07-19 09:30 81920 ----a-w- c:\windows\system32\no461543.dll 2009-07-19 08:23 . 2009-07-19 14:30 81920 ----a-w- c:\windows\system32\sk461543.dll 2009-07-19 08:03 . 2009-07-19 08:03 81920 ----a-w- c:\windows\system32\rk461543.dll 2009-07-18 18:43 . 2009-07-19 10:30 81920 ----a-w- c:\windows\system32\kj461543.dll 2009-07-18 18:39 . 2009-07-19 10:48 81920 ----a-w- c:\windows\system32\q}416823.dll 2009-07-18 18:39 . 2009-07-19 10:48 81920 ----a-w- c:\windows\system32\r}416823.dll 2009-07-18 14:25 . 2009-07-19 11:39 81920 ----a-w- c:\windows\system32\jj461543.dll 2009-07-18 14:21 . 2009-07-19 14:31 81920 ----a-w- c:\windows\system32\oo461543.dll 2009-07-18 14:21 . 2009-07-19 14:31 81920 ----a-w- c:\windows\system32\si461543.dll 2009-07-18 14:21 . 2009-07-19 14:30 81920 ----a-w- c:\windows\system32\ij461543.dll 2009-07-18 14:21 . 2009-07-19 14:32 81920 ----a-w- c:\windows\system32\ti461543.dll 2009-07-18 14:20 . 2009-07-19 14:30 81920 ----a-w- c:\windows\system32\qs461543.dll 2009-07-18 14:19 . 2009-07-18 14:19 -------- d-----w- C:\_OTL 2009-07-18 14:18 . 2009-07-18 14:23 81920 ----a-w- c:\windows\system32\ps461543.dll 2009-07-18 09:41 . 2008-06-16 13:28 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll 2009-07-18 09:21 . 2009-07-18 13:29 -------- d-----w- c:\program files\trend micro 2009-07-18 09:21 . 2009-07-18 09:21 -------- d-----w- C:\rsit 2009-07-18 09:17 . 2009-07-18 09:23 -------- d-----w- C:\SDFix 2009-07-16 12:44 . 2009-07-16 13:10 81920 ----a-w- c:\windows\system32\pv249656.dll 2009-07-16 09:07 . 2009-07-16 09:07 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Identities 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200whnt.sys 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200wh.sys 2009-07-13 07:11 . 2006-11-07 08:42 61504 ----a-r- c:\windows\system32\drivers\w200bus.sys 2009-07-11 08:12 . 2009-07-11 08:12 -------- d-----w- C:\Python24 2009-07-10 16:41 . 2009-07-10 16:41 -------- d-----w- c:\windows\Logs 2009-07-09 15:54 . 2009-07-09 15:54 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Adobe 2009-07-09 12:37 . 2009-07-09 12:46 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ventrilo 2009-07-09 12:04 . 2009-07-09 12:05 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Tibia 2009-07-09 10:09 . 2009-07-09 10:09 -------- d-----w- c:\program files\uTorrent 2009-07-09 10:09 . 2009-07-19 12:02 -------- d-----w- c:\documents and settings\User\Dane aplikacji\uTorrent 2009-07-09 08:28 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-07-09 08:28 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-07-09 08:28 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll 2009-07-09 07:06 . 2009-07-09 07:06 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 2009-07-09 07:05 . 2009-07-10 15:23 -------- d-----w- c:\documents and settings\User\Gadu-Gadu 2009-07-09 07:05 . 2009-07-09 07:05 -------- d-----w- c:\program files\Gadu-Gadu 2009-07-08 17:15 . 2009-07-08 17:15 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Media Player Classic . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 14:30 . 2009-07-19 14:21 81920 ----a-w- c:\windows\system32\qt461543.dll 2009-07-19 14:30 . 2009-07-08 16:27 5077 ----a-w- c:\windows\system32\drivers\njklmn.sys 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\program files\microsoft frontpage 2009-07-19 11:15 . 2009-07-08 14:50 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-16 07:14 . 2009-07-08 14:34 557056 ----a-w- c:\windows\system32\mspaint.exe 2009-07-09 10:26 . 2009-07-08 16:19 -------- d-----w- c:\program files\Winamp 2009-07-08 16:31 . 2009-07-08 16:30 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-07-08 16:27 . 2009-07-08 16:27 81920 ----a-w- c:\windows\system32\kl416823.dll 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\xing shared 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\Real 2009-07-08 16:24 . 2009-07-08 16:24 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-07-08 16:24 . 2009-07-08 16:24 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Real 2009-07-08 16:23 . 2009-07-08 16:22 -------- d-----w- c:\program files\Google 2009-07-08 16:21 . 2009-07-08 16:21 -------- d-----w- c:\program files\Common Files\Adobe 2009-07-08 15:19 . 2009-07-08 15:19 0 ----a-w- c:\windows\nsreg.dat 2009-07-08 15:08 . 2009-07-08 15:05 -------- d-----w- c:\program files\Common Files\Ahead 2009-07-08 15:08 . 2009-07-08 15:08 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ahead 2009-07-08 15:05 . 2009-07-08 15:05 -------- d-----w- c:\program files\Nero 2009-07-08 15:04 . 2009-07-08 15:04 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Logitech 2009-07-08 15:03 . 2009-07-08 15:03 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Leadertech 2009-07-08 15:03 . 2009-07-08 15:03 10134 ----a-r- c:\documents and settings\User\Dane aplikacji\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe 2009-07-08 15:03 . 2009-07-08 15:01 -------- d-----w- c:\program files\Common Files\Logishrd 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\program files\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\User\Dane aplikacji\InstallShield 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-07-08 14:50 . 2009-07-08 14:46 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-08 14:45 . 2009-07-08 14:45 -------- d-----w- c:\program files\VDOTool 2009-07-08 14:42 . 2008-06-16 13:28 47898 ----a-w- c:\windows\system32\perfc015.dat 2009-07-08 14:42 . 2008-06-16 13:28 352770 ----a-w- c:\windows\system32\perfh015.dat 2009-07-08 14:37 . 2009-07-08 14:37 -------- d-----w- c:\program files\Usługi online 2009-07-08 14:35 . 2009-07-08 14:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-08 14:34 . 2009-07-08 14:34 -------- d-----w- c:\program files\Windows Media Connect 2 2009-06-02 16:11 . 2009-07-08 16:30 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-29 21:37 . 2009-07-08 16:30 205824 ----a-w- c:\windows\system32\xvidvfw.dll 2009-05-29 21:31 . 2009-07-08 16:30 881664 ----a-w- c:\windows\system32\xvidcore.dll 2009-05-01 21:02 . 2009-07-08 16:30 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-07-08 16:30 685056 ----a-w- c:\windows\system32\divx.dll 2009-04-28 20:20 . 2009-07-08 16:19 44944 ------w- c:\windows\system32\drivers\pxhelp20.sys 2009-07-10 11:35 . 2009-07-08 15:12 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 151552] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 212992] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-07-23 1683456] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-11-29 55824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-16 124928] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-8 846352] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-01-09 10:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [COLOR=RED] Klucz Trybu Awaryjnego wymaga naprawy. Komputer nie może wejść w Tryb Awaryjny. [/COLOR] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "f:\\PES 2009\\pes2009.exe"= S2 gupdate1c9ffe8612be232;Usługa Google Update (gupdate1c9ffe8612be232);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 133104] S2 MCIDRV_2600_6_0;MCIDRV_2600_6_0;c:\windows\system32\drivers\njklmn.sys [2009-07-08 5077] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - HELPSVC . Zawartość folderu 'Zaplanowane zadania' 2009-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] 2009-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\idg199yp.default\ FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 16:31 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\sfc_os.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll c:\windows\system32\cscui.dll - - - - - - - > 'lsass.exe'(676) c:\windows\system32\scecli.dll - - - - - - - > 'explorer.exe'(3864) c:\windows\system32\SHDOCVW.dll c:\windows\system32\qs461543.dll c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\msi.dll c:\windows\system32\LINKINFO.dll c:\windows\system32\ntshrui.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe . ************************************************************************** . Czas ukończenia: 2009-07-19 16:34 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-07-19 14:34 Przed: 4 791 357 440 bajtów wolnych Po: 5 046 198 272 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 602 --- E O F --- 2009-07-14 12:59

dalej nie dziala podglądacz obrazów.
jak klikam 2 razy na obrazek to nic sie nie robi, ale jak dalem 'uruchom za pomocą' to mi wyskakuje okienko ktore daje na screenie:
http://img520.imageshack.us/img520/1757/blad3.jpg

**Posty:** 18165 · przez **wojtas** 19 Lip 2009, 18:22

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\nt461543.dll
c:\windows\system32\si252703.dll
c:\windows\system32\no461543.dll
c:\windows\system32\sk461543.dll
c:\windows\system32\rk461543.dll
c:\windows\system32\kj461543.dll
c:\windows\system32\q}416823.dll
c:\windows\system32\r}416823.dll
c:\windows\system32\jj461543.dll
c:\windows\system32\oo461543.dll
c:\windows\system32\si461543.dll
c:\windows\system32\ij461543.dll
c:\windows\system32\ti461543.dll
c:\windows\system32\qs461543.dll
c:\windows\system32\ps461543.dll
c:\windows\system32\pv249656.dll
c:\windows\system32\qt461543.dll
c:\windows\system32\kl416823.dll
c:\windows\system32\drivers\njklmn.sys

Driver::
MCIDRV_2600_6_0

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

**Posty:** 13 · przez **FoReST333** 19 Lip 2009, 18:42

drugi log:

Kod: Zaznacz wszystko: ComboFix 09-07-19.01 - User 2009-07-19 18:28.2.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1592 [GMT 2:00] Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\User\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: "c:\windows\system32\drivers\njklmn.sys" "c:\windows\system32\ij461543.dll" "c:\windows\system32\jj461543.dll" "c:\windows\system32\kj461543.dll" "c:\windows\system32\kl416823.dll" "c:\windows\system32\no461543.dll" "c:\windows\system32\nt461543.dll" "c:\windows\system32\oo461543.dll" "c:\windows\system32\ps461543.dll" "c:\windows\system32\pv249656.dll" "c:\windows\system32\q}416823.dll" "c:\windows\system32\qs461543.dll" "c:\windows\system32\qt461543.dll" "c:\windows\system32\r}416823.dll" "c:\windows\system32\rk461543.dll" "c:\windows\system32\si252703.dll" "c:\windows\system32\si461543.dll" "c:\windows\system32\sk461543.dll" "c:\windows\system32\ti461543.dll" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\njklmn.sys c:\windows\system32\ij461543.dll c:\windows\system32\jj461543.dll c:\windows\system32\kj461543.dll c:\windows\system32\kl416823.dll c:\windows\system32\no461543.dll c:\windows\system32\nt461543.dll c:\windows\system32\oo461543.dll c:\windows\system32\ps461543.dll c:\windows\system32\pv249656.dll c:\windows\system32\q}416823.dll c:\windows\system32\qs461543.dll c:\windows\system32\qt461543.dll c:\windows\system32\r}416823.dll c:\windows\system32\rk461543.dll c:\windows\system32\si252703.dll c:\windows\system32\si461543.dll c:\windows\system32\sk461543.dll c:\windows\system32\ti461543.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_MCIDRV_2600_6_0 ((((((((((((((((((((((((( Pliki utworzone od 2009-06-19 do 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-19 16:28 . 2009-07-19 16:33 81920 ----a-w- c:\windows\system32\st461543.dll 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\xircom 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\oobe 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\srchasst 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\msagent 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\program files\microsoft frontpage 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\windows\USB Vibration 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\program files\USB Vibration 2009-07-19 08:23 . 2009-07-19 16:34 81920 ----a-w- c:\windows\system32\sk461543.dll 2009-07-18 14:21 . 2009-07-19 16:35 81920 ----a-w- c:\windows\system32\ti461543.dll 2009-07-18 14:19 . 2009-07-18 14:19 -------- d-----w- C:\_OTL 2009-07-18 09:41 . 2008-06-16 13:28 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll 2009-07-18 09:21 . 2009-07-18 13:29 -------- d-----w- c:\program files\trend micro 2009-07-18 09:21 . 2009-07-18 09:21 -------- d-----w- C:\rsit 2009-07-18 09:17 . 2009-07-18 09:23 -------- d-----w- C:\SDFix 2009-07-16 09:07 . 2009-07-16 09:07 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Identities 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200whnt.sys 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200wh.sys 2009-07-13 07:11 . 2006-11-07 08:42 61504 ----a-r- c:\windows\system32\drivers\w200bus.sys 2009-07-11 08:12 . 2009-07-11 08:12 -------- d-----w- C:\Python24 2009-07-10 16:41 . 2009-07-10 16:41 -------- d-----w- c:\windows\Logs 2009-07-09 15:54 . 2009-07-09 15:54 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Adobe 2009-07-09 12:37 . 2009-07-09 12:46 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ventrilo 2009-07-09 12:04 . 2009-07-09 12:05 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Tibia 2009-07-09 10:09 . 2009-07-09 10:09 -------- d-----w- c:\program files\uTorrent 2009-07-09 10:09 . 2009-07-19 12:02 -------- d-----w- c:\documents and settings\User\Dane aplikacji\uTorrent 2009-07-09 08:28 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-07-09 08:28 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-07-09 08:28 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll 2009-07-09 07:06 . 2009-07-09 07:06 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 2009-07-09 07:05 . 2009-07-10 15:23 -------- d-----w- c:\documents and settings\User\Gadu-Gadu 2009-07-09 07:05 . 2009-07-09 07:05 -------- d-----w- c:\program files\Gadu-Gadu 2009-07-08 17:15 . 2009-07-08 17:15 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Media Player Classic . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 11:15 . 2009-07-08 14:50 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-16 07:14 . 2009-07-08 14:34 557056 ----a-w- c:\windows\system32\mspaint.exe 2009-07-09 10:26 . 2009-07-08 16:19 -------- d-----w- c:\program files\Winamp 2009-07-08 16:31 . 2009-07-08 16:30 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\xing shared 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\Real 2009-07-08 16:24 . 2009-07-08 16:24 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-07-08 16:24 . 2009-07-08 16:24 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Real 2009-07-08 16:23 . 2009-07-08 16:22 -------- d-----w- c:\program files\Google 2009-07-08 16:21 . 2009-07-08 16:21 -------- d-----w- c:\program files\Common Files\Adobe 2009-07-08 15:19 . 2009-07-08 15:19 0 ----a-w- c:\windows\nsreg.dat 2009-07-08 15:08 . 2009-07-08 15:05 -------- d-----w- c:\program files\Common Files\Ahead 2009-07-08 15:08 . 2009-07-08 15:08 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ahead 2009-07-08 15:05 . 2009-07-08 15:05 -------- d-----w- c:\program files\Nero 2009-07-08 15:04 . 2009-07-08 15:04 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Logitech 2009-07-08 15:03 . 2009-07-08 15:03 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Leadertech 2009-07-08 15:03 . 2009-07-08 15:03 10134 ----a-r- c:\documents and settings\User\Dane aplikacji\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe 2009-07-08 15:03 . 2009-07-08 15:01 -------- d-----w- c:\program files\Common Files\Logishrd 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\program files\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\User\Dane aplikacji\InstallShield 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-07-08 14:50 . 2009-07-08 14:46 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-08 14:45 . 2009-07-08 14:45 -------- d-----w- c:\program files\VDOTool 2009-07-08 14:42 . 2008-06-16 13:28 47898 ----a-w- c:\windows\system32\perfc015.dat 2009-07-08 14:42 . 2008-06-16 13:28 352770 ----a-w- c:\windows\system32\perfh015.dat 2009-07-08 14:37 . 2009-07-08 14:37 -------- d-----w- c:\program files\Usługi online 2009-07-08 14:35 . 2009-07-08 14:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-08 14:34 . 2009-07-08 14:34 -------- d-----w- c:\program files\Windows Media Connect 2 2009-06-02 16:11 . 2009-07-08 16:30 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-29 21:37 . 2009-07-08 16:30 205824 ----a-w- c:\windows\system32\xvidvfw.dll 2009-05-29 21:31 . 2009-07-08 16:30 881664 ----a-w- c:\windows\system32\xvidcore.dll 2009-05-01 21:02 . 2009-07-08 16:30 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-07-08 16:30 685056 ----a-w- c:\windows\system32\divx.dll 2009-04-28 20:20 . 2009-07-08 16:19 44944 ------w- c:\windows\system32\drivers\pxhelp20.sys 2009-07-10 11:35 . 2009-07-08 15:12 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 151552] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 212992] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-07-23 1683456] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-11-29 55824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-16 124928] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-8 846352] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-01-09 10:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [COLOR=RED] Klucz Trybu Awaryjnego wymaga naprawy. Komputer nie może wejść w Tryb Awaryjny. [/COLOR] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "f:\\PES 2009\\pes2009.exe"= S2 gupdate1c9ffe8612be232;Usługa Google Update (gupdate1c9ffe8612be232);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 133104] . Zawartość folderu 'Zaplanowane zadania' 2009-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] 2009-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\idg199yp.default\ FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 18:33 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\sfc_os.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll c:\windows\system32\cscui.dll - - - - - - - > 'lsass.exe'(676) c:\windows\system32\scecli.dll - - - - - - - > 'explorer.exe'(884) c:\windows\system32\SHDOCVW.dll c:\windows\system32\qs461543.dll c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\msi.dll c:\windows\system32\LINKINFO.dll c:\windows\system32\ntshrui.dll c:\windows\system32\msimtf.dll c:\windows\system32\MSCTF.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe . ************************************************************************** . Czas ukończenia: 2009-07-19 18:37 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-07-19 16:37 ComboFix2.txt 2009-07-19 14:34 Przed: 5 074 792 448 bajtów wolnych Po: 5 069 410 304 bajtów wolnych 257 --- E O F --- 2009-07-14 12:59

dalej nie dziala ten podglądacz ;p

**Posty:** 18165 · przez **wojtas** 19 Lip 2009, 18:54

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\st461543.dll
c:\windows\system32\sk461543.dll
c:\windows\system32\ti461543.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

zrób skan Malwarebytes Anti-Malware

**Posty:** 13 · przez **FoReST333** 19 Lip 2009, 22:11

log combofixa

Kod: Zaznacz wszystko: ComboFix 09-07-19.01 - User 2009-07-19 19:03.3.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1685 [GMT 2:00] Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\User\Pulpit\CFScript.txt FILE :: "c:\windows\system32\sk461543.dll" "c:\windows\system32\st461543.dll" "c:\windows\system32\ti461543.dll" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\sk461543.dll c:\windows\system32\st461543.dll c:\windows\system32\ti461543.dll . ((((((((((((((((((((((((( Pliki utworzone od 2009-06-19 do 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-19 17:07 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\tt461543.dll 2009-07-19 13:06 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\nt461543.dll 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\windows\USB Vibration 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\program files\USB Vibration 2009-07-19 08:23 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\sk461543.dll 2009-07-18 18:43 . 2009-07-19 16:40 81920 ----a-w- c:\windows\system32\kj461543.dll 2009-07-18 14:25 . 2009-07-19 16:58 81920 ----a-w- c:\windows\system32\jj461543.dll 2009-07-18 14:21 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\oo461543.dll 2009-07-18 14:21 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\si461543.dll 2009-07-18 14:21 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\ij461543.dll 2009-07-18 14:21 . 2009-07-19 17:09 81920 ----a-w- c:\windows\system32\ti461543.dll 2009-07-18 14:20 . 2009-07-19 17:08 81920 ----a-w- c:\windows\system32\qs461543.dll 2009-07-18 14:19 . 2009-07-18 14:19 -------- d-----w- C:\_OTL 2009-07-18 09:41 . 2008-06-16 13:28 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll 2009-07-18 09:21 . 2009-07-18 13:29 -------- d-----w- c:\program files\trend micro 2009-07-18 09:21 . 2009-07-18 09:21 -------- d-----w- C:\rsit 2009-07-18 09:17 . 2009-07-18 09:23 -------- d-----w- C:\SDFix 2009-07-16 09:07 . 2009-07-16 09:07 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Identities 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200whnt.sys 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200wh.sys 2009-07-13 07:11 . 2006-11-07 08:42 61504 ----a-r- c:\windows\system32\drivers\w200bus.sys 2009-07-11 08:12 . 2009-07-11 08:12 -------- d-----w- C:\Python24 2009-07-10 16:41 . 2009-07-10 16:41 -------- d-----w- c:\windows\Logs 2009-07-09 15:54 . 2009-07-09 15:54 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Adobe 2009-07-09 12:37 . 2009-07-09 12:46 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ventrilo 2009-07-09 12:04 . 2009-07-09 12:05 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Tibia 2009-07-09 10:09 . 2009-07-09 10:09 -------- d-----w- c:\program files\uTorrent 2009-07-09 10:09 . 2009-07-19 12:02 -------- d-----w- c:\documents and settings\User\Dane aplikacji\uTorrent 2009-07-09 08:28 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-07-09 08:28 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-07-09 08:28 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll 2009-07-09 07:06 . 2009-07-09 07:06 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 2009-07-09 07:05 . 2009-07-10 15:23 -------- d-----w- c:\documents and settings\User\Gadu-Gadu 2009-07-09 07:05 . 2009-07-09 07:05 -------- d-----w- c:\program files\Gadu-Gadu 2009-07-08 17:15 . 2009-07-08 17:15 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Media Player Classic . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 17:09 . 2009-07-19 16:37 5077 ----a-w- c:\windows\system32\drivers\njklmn.sys 2009-07-19 17:03 . 2009-07-19 14:21 81920 ----a-w- c:\windows\system32\qt461543.dll 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\program files\microsoft frontpage 2009-07-19 11:15 . 2009-07-08 14:50 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-16 07:14 . 2009-07-08 14:34 557056 ----a-w- c:\windows\system32\mspaint.exe 2009-07-09 10:26 . 2009-07-08 16:19 -------- d-----w- c:\program files\Winamp 2009-07-08 16:31 . 2009-07-08 16:30 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\xing shared 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\Real 2009-07-08 16:24 . 2009-07-08 16:24 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-07-08 16:24 . 2009-07-08 16:24 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Real 2009-07-08 16:23 . 2009-07-08 16:22 -------- d-----w- c:\program files\Google 2009-07-08 16:21 . 2009-07-08 16:21 -------- d-----w- c:\program files\Common Files\Adobe 2009-07-08 15:19 . 2009-07-08 15:19 0 ----a-w- c:\windows\nsreg.dat 2009-07-08 15:08 . 2009-07-08 15:05 -------- d-----w- c:\program files\Common Files\Ahead 2009-07-08 15:08 . 2009-07-08 15:08 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ahead 2009-07-08 15:05 . 2009-07-08 15:05 -------- d-----w- c:\program files\Nero 2009-07-08 15:04 . 2009-07-08 15:04 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Logitech 2009-07-08 15:03 . 2009-07-08 15:03 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Leadertech 2009-07-08 15:03 . 2009-07-08 15:03 10134 ----a-r- c:\documents and settings\User\Dane aplikacji\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe 2009-07-08 15:03 . 2009-07-08 15:01 -------- d-----w- c:\program files\Common Files\Logishrd 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\program files\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\User\Dane aplikacji\InstallShield 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-07-08 14:50 . 2009-07-08 14:46 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-08 14:45 . 2009-07-08 14:45 -------- d-----w- c:\program files\VDOTool 2009-07-08 14:42 . 2008-06-16 13:28 47898 ----a-w- c:\windows\system32\perfc015.dat 2009-07-08 14:42 . 2008-06-16 13:28 352770 ----a-w- c:\windows\system32\perfh015.dat 2009-07-08 14:37 . 2009-07-08 14:37 -------- d-----w- c:\program files\Usługi online 2009-07-08 14:35 . 2009-07-08 14:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-08 14:34 . 2009-07-08 14:34 -------- d-----w- c:\program files\Windows Media Connect 2 2009-06-02 16:11 . 2009-07-08 16:30 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-29 21:37 . 2009-07-08 16:30 205824 ----a-w- c:\windows\system32\xvidvfw.dll 2009-05-29 21:31 . 2009-07-08 16:30 881664 ----a-w- c:\windows\system32\xvidcore.dll 2009-05-01 21:02 . 2009-07-08 16:30 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-07-08 16:30 685056 ----a-w- c:\windows\system32\divx.dll 2009-04-28 20:20 . 2009-07-08 16:19 44944 ------w- c:\windows\system32\drivers\pxhelp20.sys 2009-07-10 11:35 . 2009-07-08 15:12 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ------- Sigcheck ------- [-] 2007-07-11 05:06 642560 CE594E18FE0D0AF804F1F3694921CE62 c:\windows\system32\user32.dll [-] 2008-06-16 13:28 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:\windows\system32\drivers\tcpip.sys [-] 2008-06-16 13:28 549888 335813EACD16E84F3047A3326F6E5473 c:\windows\system32\winlogon.exe [-] 2008-07-19 00:33 2074240 0DBF1939DF18AC8F8C1E4BD63D7D4B0F c:\windows\system32\ntkrnlpa.exe [-] 2008-07-07 09:44 2197376 37D5DAAEDA594B9BEE00C82F185CC549 c:\windows\system32\ntoskrnl.exe [-] 2008-06-27 15:36 1482240 12B143C653DFA3F953EDA4534B1AAEA8 c:\windows\explorer.exe [-] 2008-06-16 13:28 1420800 4678172D19476FA7D539682FCA42C942 c:\windows\system32\comres.dll [-] 2008-06-16 13:28 724992 7F059A93D251284A8BC758327ECD3D69 c:\windows\system32\comctl32.dll [7] 2008-06-16 13:28 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [7] 2008-06-16 13:28 1054208 737739FACEAD60683AA8D7FF7602FD14 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll [-] 2008-06-16 13:28 1571840 C8BDAD4065118558B3DC360FC96D81DB c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 151552] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 212992] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-07-23 1683456] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-11-29 55824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-16 124928] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-8 846352] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-01-09 10:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [COLOR=RED] Klucz Trybu Awaryjnego wymaga naprawy. Komputer nie może wejść w Tryb Awaryjny. [/COLOR] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "f:\\PES 2009\\pes2009.exe"= S2 gupdate1c9ffe8612be232;Usługa Google Update (gupdate1c9ffe8612be232);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 133104] S2 MCIDRV_2600_6_0;MCIDRV_2600_6_0;c:\windows\system32\drivers\njklmn.sys [2009-07-19 5077] . Zawartość folderu 'Zaplanowane zadania' 2009-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] 2009-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\idg199yp.default\ FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(620) c:\windows\system32\sfc_os.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll c:\windows\system32\cscui.dll - - - - - - - > 'lsass.exe'(676) c:\windows\system32\scecli.dll - - - - - - - > 'explorer.exe'(1704) c:\windows\system32\SHDOCVW.dll c:\windows\system32\qs461543.dll c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\msi.dll c:\windows\system32\LINKINFO.dll c:\windows\system32\ntshrui.dll c:\windows\system32\si461543.dll c:\windows\system32\msimtf.dll c:\windows\system32\MSCTF.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe . ************************************************************************** . Czas ukończenia: 2009-07-19 19:11 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-07-19 17:11 ComboFix2.txt 2009-07-19 16:37 ComboFix3.txt 2009-07-19 14:34 Przed: 5 073 637 376 bajtów wolnych Po: 5 062 455 296 bajtów wolnych 238 --- E O F --- 2009-07-14 12:59

log tego skana

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.39 Wersja bazy definicji: 2421 Windows 5.1.2600 Dodatek Service Pack 3 2009-07-19 22:05:38 mbam-log-2009-07-19 (22-05-38).txt Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|F:\|) Przeskanowane obiekty: 139176 Upłynęło: 1 hour(s), 1 minute(s), 43 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 2 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 1 Zainfekowane foldery: 0 Zainfekowane pliki: 176 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: C:\WINDOWS\system32\si461543.dll (Virus.Sality) -> Delete on reboot. C:\WINDOWS\system32\qs461543.dll (Virus.Sality) -> Delete on reboot. Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\WINDOWS\system32\si461543.dll (Virus.Sality) -> Delete on reboot. C:\WINDOWS\system32\qs461543.dll (Virus.Sality) -> Delete on reboot. c:\Qoobox\quarantine\C\WINDOWS\system32\ij461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\nt461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\oo461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\qs461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\si461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\sk461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\ti461543.dll.vir (Virus.Sality) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\WINDOWS\system32\drivers\njklmn.sys.vir (Trojan.KillAV) -> Quarantined and deleted successfully. c:\WINDOWS\system32\jj461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\kj461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\oo461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\qt461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\tt461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\ij461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\nt461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\sk461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\ti461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\njklmn.sys (Trojan.KillAV) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\icxpa.cmd (Spyware.OnlineGames) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\ij461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\ik461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\jj461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\jl416823.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\kj461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\kl461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\k~252703.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\nmdfgds0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\no461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\og252703.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\olhrwef.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\oo461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\rk461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\si461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\sk461543.dll (Virus.Sality) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\07182009_161922\WINDOWS\System32\ti461543.dll (Virus.Sality) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247752.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247780.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247789.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247796.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247876.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247878.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247881.exe (Trojan.Agent) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248004.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248013.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248014.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248125.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248129.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248134.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248214.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248217.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248223.exe (Trojan.Agent) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248326.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248344.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248345.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249064.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248092.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249322.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249092.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249098.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249105.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249195.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249197.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249201.exe (Trojan.Agent) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249330.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249331.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250086.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250115.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250120.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250123.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250205.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250207.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250211.exe (Trojan.Agent) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250286.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250315.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. d:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250316.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\6phx.com (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\8gig0ofk.com (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{008145df-cb7e-41be-9c6b-cf94f9494dca}\RP86\A0070180.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{008145df-cb7e-41be-9c6b-cf94f9494dca}\RP86\A0070523.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{008145df-cb7e-41be-9c6b-cf94f9494dca}\RP87\A0071157.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{008145df-cb7e-41be-9c6b-cf94f9494dca}\RP87\A0071484.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{008145df-cb7e-41be-9c6b-cf94f9494dca}\RP87\A0072151.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247753.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247781.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247783.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247844.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247962.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248621.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247994.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248002.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248093.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248111.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248122.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248167.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248292.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248325.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248339.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248538.exe (Trojan.Agent) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248628.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248636.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248637.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249066.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249096.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249097.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249152.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249280.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249311.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249319.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249508.exe (Trojan.Agent) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249596.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249611.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249619.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249620.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250087.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250113.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250118.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250175.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250290.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250329.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250338.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250539.exe (Trojan.Agent) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250614.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250621.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250629.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250630.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0030212.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0031029.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0030852.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0031469.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0032085.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0032308.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP15\A0032934.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP16\A0033170.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP16\A0033599.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\system volume information\_restore{e6ab0dd1-f695-4328-825c-71bcc631180d}\RP16\A0034226.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\FoReST\Tibia8.11\tibiabot ng 8.11\tibiabot ng 8.11\TibiaBot NG.exe (Worm.Wukill) -> Quarantined and deleted successfully. e:\sopcast_3.0.3(www.programypc.pl)\Setup-SopCast-3.0.3-2008-4-30.exe (Rogue.Installer) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247755.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247784.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247787.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247804.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247826.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247828.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0247830.exe (Trojan.Agent) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248095.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248124.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248131.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248140.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248169.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248171.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248175.exe (Trojan.Agent) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248380.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248460.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0248461.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249067.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249094.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249099.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249114.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249144.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249148.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249153.exe (Trojan.Agent) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249377.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249458.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP102\A0249459.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250089.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250117.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250122.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250131.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250153.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250155.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250157.exe (Trojan.Agent) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250384.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250458.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. f:\system volume information\_restore{32f037bb-e8c1-4914-a065-c1df30e0d4e3}\RP103\A0250459.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.

cos jeszcze musze robic? ;p
dalej ten podgladacz obrazow mi nie dziala

**Posty:** 18165 · przez **wojtas** 19 Lip 2009, 23:15

masz pendriva lub cos ? podlacz go i odpal combofixa ... bo caly czas cos wraca

**Posty:** 13 · przez **FoReST333** 20 Lip 2009, 10:52

log combofixa odpalonego z pendriva

Kod: Zaznacz wszystko: ComboFix 09-07-19.04 - User 2009-07-20 10:42.4.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1665 [GMT 2:00] Uruchomiony z: I:\ComboFix.exe . Następujące pliki zostały wyłączone z działania w czasie skanowania: c:\windows\system32\sk461543.dll ((((((((((((((((((((((((( Pliki utworzone od 2009-06-20 do 2009-07-20 ))))))))))))))))))))))))))))))) . 2009-07-19 19:00 . 2009-07-19 19:00 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Malwarebytes 2009-07-19 19:00 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-19 19:00 . 2009-07-19 19:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-19 19:00 . 2009-07-19 19:00 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2009-07-19 19:00 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\xircom 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\oobe 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\srchasst 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\msagent 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\program files\microsoft frontpage 2009-07-19 14:21 . 2009-07-20 08:39 81920 ----a-w- c:\windows\system32\qt461543.dll 2009-07-19 13:06 . 2009-07-20 07:47 81920 ----a-w- c:\windows\system32\nt461543.dll 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\windows\USB Vibration 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\program files\USB Vibration 2009-07-19 08:23 . 2009-07-20 08:41 81920 ----a-w- c:\windows\system32\sk461543.dll 2009-07-19 08:23 . 2009-07-20 08:39 81920 ----a-w- c:\windows\system32\sk461543.dll.vir 2009-07-18 18:43 . 2009-07-20 08:41 81920 ----a-w- c:\windows\system32\kj461543.dll 2009-07-18 14:25 . 2009-07-19 20:10 81920 ----a-w- c:\windows\system32\jj461543.dll 2009-07-18 14:21 . 2009-07-20 08:37 81920 ----a-w- c:\windows\system32\oo461543.dll 2009-07-18 14:21 . 2009-07-20 07:47 81920 ----a-w- c:\windows\system32\si461543.dll 2009-07-18 14:21 . 2009-07-20 07:47 81920 ----a-w- c:\windows\system32\ij461543.dll 2009-07-18 14:21 . 2009-07-20 08:46 81920 ----a-w- c:\windows\system32\ti461543.dll 2009-07-18 14:20 . 2009-07-20 07:47 81920 ----a-w- c:\windows\system32\qs461543.dll 2009-07-18 14:19 . 2009-07-18 14:19 -------- d-----w- C:\_OTL 2009-07-18 09:41 . 2008-06-16 13:28 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll 2009-07-18 09:21 . 2009-07-18 13:29 -------- d-----w- c:\program files\trend micro 2009-07-18 09:21 . 2009-07-18 09:21 -------- d-----w- C:\rsit 2009-07-18 09:17 . 2009-07-18 09:23 -------- d-----w- C:\SDFix 2009-07-16 09:07 . 2009-07-16 09:07 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Identities 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200whnt.sys 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200wh.sys 2009-07-13 07:11 . 2006-11-07 08:42 61504 ----a-r- c:\windows\system32\drivers\w200bus.sys 2009-07-11 08:12 . 2009-07-11 08:12 -------- d-----w- C:\Python24 2009-07-10 16:41 . 2009-07-10 16:41 -------- d-----w- c:\windows\Logs 2009-07-09 15:54 . 2009-07-09 15:54 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Adobe 2009-07-09 12:37 . 2009-07-09 12:46 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ventrilo 2009-07-09 12:04 . 2009-07-09 12:05 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Tibia 2009-07-09 10:09 . 2009-07-09 10:09 -------- d-----w- c:\program files\uTorrent 2009-07-09 10:09 . 2009-07-20 06:32 -------- d-----w- c:\documents and settings\User\Dane aplikacji\uTorrent 2009-07-09 08:28 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-07-09 08:28 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-07-09 08:28 . 2009-04-28 20:20 129520 ----a-w- c:\windows\system32\pxafs.dll 2009-07-09 07:06 . 2009-07-09 07:06 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 2009-07-09 07:05 . 2009-07-10 15:23 -------- d-----w- c:\documents and settings\User\Gadu-Gadu 2009-07-09 07:05 . 2009-07-09 07:05 -------- d-----w- c:\program files\Gadu-Gadu 2009-07-08 17:15 . 2009-07-08 17:15 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Media Player Classic . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-20 08:45 . 2009-07-19 20:08 5077 ----a-w- c:\windows\system32\drivers\njklmn.sys 2009-07-20 08:45 . 2009-07-20 08:42 81920 ----a-w- c:\windows\system32\ku461543.dll 2009-07-20 07:44 . 2009-07-20 07:05 81920 ----a-w- c:\windows\system32\ju461543.dll 2009-07-20 07:43 . 2009-07-20 07:43 9240 ----a-w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-07-20 06:50 . 2009-07-08 14:50 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-20 06:36 . 2009-07-20 06:32 81920 ----a-w- c:\windows\system32\kl461543.dll 2009-07-20 06:35 . 2009-07-08 16:27 81920 ----a-w- c:\windows\system32\kl416823.dll 2009-07-20 06:32 . 2009-07-20 06:32 -------- d-----w- c:\program files\Alcohol Soft 2009-07-16 07:14 . 2009-07-08 14:34 557056 ----a-w- c:\windows\system32\mspaint.exe 2009-07-09 10:26 . 2009-07-08 16:19 -------- d-----w- c:\program files\Winamp 2009-07-08 16:31 . 2009-07-08 16:30 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\xing shared 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\Real 2009-07-08 16:24 . 2009-07-08 16:24 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-07-08 16:24 . 2009-07-08 16:24 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Real 2009-07-08 16:23 . 2009-07-08 16:22 -------- d-----w- c:\program files\Google 2009-07-08 16:21 . 2009-07-08 16:21 -------- d-----w- c:\program files\Common Files\Adobe 2009-07-08 15:19 . 2009-07-08 15:19 0 ----a-w- c:\windows\nsreg.dat 2009-07-08 15:08 . 2009-07-08 15:05 -------- d-----w- c:\program files\Common Files\Ahead 2009-07-08 15:08 . 2009-07-08 15:08 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ahead 2009-07-08 15:05 . 2009-07-08 15:05 -------- d-----w- c:\program files\Nero 2009-07-08 15:04 . 2009-07-08 15:04 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Logitech 2009-07-08 15:03 . 2009-07-08 15:03 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Leadertech 2009-07-08 15:03 . 2009-07-08 15:03 10134 ----a-r- c:\documents and settings\User\Dane aplikacji\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe 2009-07-08 15:03 . 2009-07-08 15:01 -------- d-----w- c:\program files\Common Files\Logishrd 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\program files\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\User\Dane aplikacji\InstallShield 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-07-08 14:50 . 2009-07-08 14:46 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-08 14:45 . 2009-07-08 14:45 -------- d-----w- c:\program files\VDOTool 2009-07-08 14:42 . 2008-06-16 13:28 47898 ----a-w- c:\windows\system32\perfc015.dat 2009-07-08 14:42 . 2008-06-16 13:28 352770 ----a-w- c:\windows\system32\perfh015.dat 2009-07-08 14:37 . 2009-07-08 14:37 -------- d-----w- c:\program files\Usługi online 2009-07-08 14:35 . 2009-07-08 14:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-08 14:34 . 2009-07-08 14:34 -------- d-----w- c:\program files\Windows Media Connect 2 2009-06-02 16:11 . 2009-07-08 16:30 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-29 21:37 . 2009-07-08 16:30 205824 ----a-w- c:\windows\system32\xvidvfw.dll 2009-05-29 21:31 . 2009-07-08 16:30 881664 ----a-w- c:\windows\system32\xvidcore.dll 2009-05-01 21:02 . 2009-07-08 16:30 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-07-08 16:30 685056 ----a-w- c:\windows\system32\divx.dll 2009-04-28 20:20 . 2009-07-08 16:19 44944 ------w- c:\windows\system32\drivers\pxhelp20.sys 2009-07-10 11:35 . 2009-07-08 15:12 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ------- Sigcheck ------- [-] 2007-07-11 05:06 642560 CE594E18FE0D0AF804F1F3694921CE62 c:\windows\system32\user32.dll [-] 2008-06-16 13:28 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:\windows\system32\drivers\tcpip.sys [-] 2008-06-16 13:28 549888 335813EACD16E84F3047A3326F6E5473 c:\windows\system32\winlogon.exe [-] 2008-07-19 00:33 2074240 0DBF1939DF18AC8F8C1E4BD63D7D4B0F c:\windows\system32\ntkrnlpa.exe [-] 2008-07-07 09:44 2197376 37D5DAAEDA594B9BEE00C82F185CC549 c:\windows\system32\ntoskrnl.exe [-] 2008-06-27 15:36 1482240 12B143C653DFA3F953EDA4534B1AAEA8 c:\windows\explorer.exe [-] 2008-06-16 13:28 1420800 4678172D19476FA7D539682FCA42C942 c:\windows\system32\comres.dll [-] 2008-06-16 13:28 724992 7F059A93D251284A8BC758327ECD3D69 c:\windows\system32\comctl32.dll [7] 2008-06-16 13:28 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [7] 2008-06-16 13:28 1054208 737739FACEAD60683AA8D7FF7602FD14 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll [-] 2008-06-16 13:28 1571840 C8BDAD4065118558B3DC360FC96D81DB c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-19_14.32.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-20 06:32 . 2009-07-20 06:32 62464 c:\windows\Installer\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}\IconE9F814234.exe + 2009-07-20 06:50 . 2009-07-20 06:50 11502 c:\windows\Installer\{9322A850-9091-4D0E-B252-3E82EDA3D94A}\ARPPRODUCTICON.exe + 2009-07-20 06:32 . 2004-04-30 07:33 5248 c:\windows\system32\drivers\a347scsi.sys + 2007-07-23 02:34 . 2007-07-23 02:34 811008 c:\windows\system32\nvcplui.exe + 2009-07-20 06:32 . 2004-04-30 07:37 160640 c:\windows\system32\drivers\a347bus.sys + 2009-07-20 06:32 . 2009-07-20 06:32 958464 c:\windows\Installer\23c4366.msi + 2009-07-20 06:32 . 2009-07-20 06:32 106496 c:\windows\Installer\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}\IconE9F814236.exe + 2009-07-20 06:50 . 2009-07-20 06:50 25352192 c:\windows\Installer\3713d.msi . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 151552] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 212992] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-07-23 1683456] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-11-29 55824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-16 124928] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-8 846352] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) "EnableLUA"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-01-09 10:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "f:\\PES 2009\\pes2009.exe"= "f:\\Program Files\\Activision\\Prototype\\prototypef.exe"= S2 gupdate1c9ffe8612be232;Usługa Google Update (gupdate1c9ffe8612be232);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 133104] S2 MCIDRV_2600_6_0;MCIDRV_2600_6_0;c:\windows\system32\drivers\njklmn.sys [2009-07-19 5077] . Zawartość folderu 'Zaplanowane zadania' 2009-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] 2009-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\idg199yp.default\ FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-20 10:45 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(644) c:\windows\system32\sfc_os.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll c:\windows\system32\cscui.dll - - - - - - - > 'lsass.exe'(700) c:\windows\system32\scecli.dll - - - - - - - > 'explorer.exe'(2452) c:\windows\system32\SHDOCVW.dll c:\windows\system32\qs461543.dll c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\msi.dll c:\windows\system32\LINKINFO.dll c:\windows\system32\ntshrui.dll c:\windows\system32\msimtf.dll c:\windows\system32\MSCTF.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll . Czas ukończenia: 2009-07-20 10:48 ComboFix-quarantined-files.txt 2009-07-20 08:47 ComboFix2.txt 2009-07-19 17:11 ComboFix3.txt 2009-07-19 16:37 ComboFix4.txt 2009-07-19 14:34 Przed: 4 884 717 568 bajtów wolnych Po: 4 880 429 056 bajtów wolnych 235 --- E O F --- 2009-07-14 12:59

jak odpalilem to mi sie wyswietlilo ze jest nowsza wersja wiec dalem zeby pobrał i wyskoczylo takie okienko:
http://img268.imageshack.us/img268/5282/blad4.jpg
czekam na dalsze instrukcje ;p

**Posty:** 18165 · przez **wojtas** 20 Lip 2009, 17:29

Pobierz i uruchom narzędzie
The Avenger
Wklej do okienka programu

Files to delete:

c:\windows\system32\qt461543.dll
c:\windows\system32\nt461543.dll
c:\windows\system32\sk461543.dll
c:\windows\system32\sk461543.dll.vir
c:\windows\system32\kj461543.dll
c:\windows\system32\jj461543.dll
c:\windows\system32\oo461543.dll
c:\windows\system32\si461543.dll
c:\windows\system32\ij461543.dll
c:\windows\system32\ti461543.dll
c:\windows\system32\qs461543.dll
c:\windows\system32\ku461543.dll
c:\windows\system32\ju461543.dll
c:\windows\system32\kl461543.dll
c:\windows\system32\kl416823.dll
c:\windows\system32\drivers\njklmn.sys

Drivers to unload:

MCIDRV_2600_6_0

Klikasz Execute,

wklejasz na forum raport: C:\avenger.txt + log z combo

**Posty:** 13 · przez **FoReST333** 20 Lip 2009, 17:57

log avengera. gdy sie resetował pojawil mi sie niebieski ekran z błędem krytycznym i ze system zostal zamkniety. po zresetowaniu wszystko poszło ;p

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "c:\windows\system32\qt461543.dll" deleted successfully. File "c:\windows\system32\nt461543.dll" deleted successfully. File "c:\windows\system32\sk461543.dll" deleted successfully. Error: file "c:\windows\system32\sk461543.dll.vir" not found! Deletion of file "c:\windows\system32\sk461543.dll.vir" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "c:\windows\system32\kj461543.dll" deleted successfully. File "c:\windows\system32\jj461543.dll" deleted successfully. File "c:\windows\system32\oo461543.dll" deleted successfully. File "c:\windows\system32\si461543.dll" deleted successfully. File "c:\windows\system32\ij461543.dll" deleted successfully. File "c:\windows\system32\ti461543.dll" deleted successfully. File "c:\windows\system32\qs461543.dll" deleted successfully. File "c:\windows\system32\ku461543.dll" deleted successfully. File "c:\windows\system32\ju461543.dll" deleted successfully. File "c:\windows\system32\kl461543.dll" deleted successfully. File "c:\windows\system32\kl416823.dll" deleted successfully. File "c:\windows\system32\drivers\njklmn.sys" deleted successfully. Driver "MCIDRV_2600_6_0" deleted successfully. Completed script processing. ******************* Finished! Terminate.

log combofixa

Kod: Zaznacz wszystko: ComboFix 09-07-19.04 - User 2009-07-20 17:41.5.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2047.1703 [GMT 2:00] Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe . Następujące pliki zostały wyłączone z działania w czasie skanowania: c:\windows\system32\sk461543.dll ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Installer\263661.msi . ((((((((((((((((((((((((( Pliki utworzone od 2009-06-20 do 2009-07-20 ))))))))))))))))))))))))))))))) . 2009-07-20 15:42 . 2009-07-20 15:45 81920 ----a-w- c:\windows\system32\ru461543.dll 2009-07-20 15:37 . 2009-07-20 15:45 5077 ----a-w- c:\windows\system32\drivers\njklmn.sys 2009-07-20 15:36 . 2009-07-20 15:36 -------- d-----w- c:\windows\system32\%commonprogramfiles% 2009-07-20 14:29 . 2009-07-20 15:11 81920 ----a-w- c:\windows\system32\qu461543.dll 2009-07-20 08:50 . 2009-07-20 08:50 81920 ----a-w- c:\windows\system32\ik461543.dll 2009-07-20 07:43 . 2009-07-20 07:43 9240 ----a-w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-07-20 06:36 . 2009-07-20 06:36 -------- d-sh--w- c:\windows\ftpcache 2009-07-20 06:32 . 2004-04-30 07:37 160640 ----a-w- c:\windows\system32\drivers\a347bus.sys 2009-07-20 06:32 . 2004-04-30 07:33 5248 ----a-w- c:\windows\system32\drivers\a347scsi.sys 2009-07-20 06:32 . 2009-07-20 06:32 -------- d-----w- c:\program files\Alcohol Soft 2009-07-19 19:00 . 2009-07-19 19:00 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Malwarebytes 2009-07-19 19:00 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-19 19:00 . 2009-07-19 19:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-19 19:00 . 2009-07-19 19:00 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2009-07-19 19:00 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\xircom 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\system32\oobe 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\srchasst 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\windows\msagent 2009-07-19 14:30 . 2009-07-19 14:30 -------- d-----w- c:\program files\microsoft frontpage 2009-07-19 14:21 . 2009-07-20 15:39 81920 ----a-w- c:\windows\system32\qt461543.dll 2009-07-19 13:06 . 2009-07-20 15:38 81920 ----a-w- c:\windows\system32\nt461543.dll 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\windows\USB Vibration 2009-07-19 11:15 . 2009-07-19 11:15 -------- d-----w- c:\program files\USB Vibration 2009-07-19 08:23 . 2009-07-20 15:40 81920 ----a-w- c:\windows\system32\sk461543.dll 2009-07-19 08:23 . 2009-07-20 15:40 81920 ----a-w- c:\windows\system32\sk461543.dll.vir 2009-07-18 14:25 . 2009-07-20 15:37 81920 ----a-w- c:\windows\system32\jj461543.dll 2009-07-18 14:21 . 2009-07-20 15:38 81920 ----a-w- c:\windows\system32\oo461543.dll 2009-07-18 14:21 . 2009-07-20 15:37 81920 ----a-w- c:\windows\system32\si461543.dll 2009-07-18 14:21 . 2009-07-20 15:37 81920 ----a-w- c:\windows\system32\ij461543.dll 2009-07-18 14:21 . 2009-07-20 15:45 81920 ----a-w- c:\windows\system32\ti461543.dll 2009-07-18 14:20 . 2009-07-20 15:37 81920 ----a-w- c:\windows\system32\qs461543.dll 2009-07-18 14:19 . 2009-07-18 14:19 -------- d-----w- C:\_OTL 2009-07-18 09:41 . 2008-06-16 13:28 26624 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll 2009-07-18 09:21 . 2009-07-18 13:29 -------- d-----w- c:\program files\trend micro 2009-07-18 09:21 . 2009-07-18 09:21 -------- d-----w- C:\rsit 2009-07-18 09:17 . 2009-07-18 09:23 -------- d-----w- C:\SDFix 2009-07-16 09:07 . 2009-07-16 09:07 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Identities 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200whnt.sys 2009-07-13 07:11 . 2006-11-07 08:42 5840 ----a-r- c:\windows\system32\drivers\w200wh.sys 2009-07-13 07:11 . 2006-11-07 08:42 61504 ----a-r- c:\windows\system32\drivers\w200bus.sys 2009-07-11 08:12 . 2009-07-11 08:12 -------- d-----w- C:\Python24 2009-07-10 16:41 . 2009-07-10 16:41 -------- d-----w- c:\windows\Logs 2009-07-09 15:54 . 2009-07-20 13:32 -------- d-----w- c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Adobe 2009-07-09 12:37 . 2009-07-09 12:46 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ventrilo 2009-07-09 12:04 . 2009-07-09 12:05 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Tibia 2009-07-09 10:09 . 2009-07-09 10:09 -------- d-----w- c:\program files\uTorrent 2009-07-09 10:09 . 2009-07-20 15:20 -------- d-----w- c:\documents and settings\User\Dane aplikacji\uTorrent 2009-07-09 08:28 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-07-09 08:28 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-07-09 08:28 . 2009-04-28 20:20 129520 ----a-w- c:\windows\system32\pxafs.dll 2009-07-09 07:06 . 2009-07-09 07:06 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 2009-07-09 07:05 . 2009-07-10 15:23 -------- d-----w- c:\documents and settings\User\Gadu-Gadu 2009-07-09 07:05 . 2009-07-09 07:05 -------- d-----w- c:\program files\Gadu-Gadu 2009-07-08 17:15 . 2009-07-08 17:15 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Media Player Classic . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-20 06:50 . 2009-07-08 14:50 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-16 07:14 . 2009-07-08 14:34 557056 ----a-w- c:\windows\system32\mspaint.exe 2009-07-09 10:26 . 2009-07-08 16:19 -------- d-----w- c:\program files\Winamp 2009-07-08 16:31 . 2009-07-08 16:30 -------- d-----w- c:\program files\K-Lite Codec Pack 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\xing shared 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Common Files\Real 2009-07-08 16:24 . 2009-07-08 16:24 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-07-08 16:24 . 2009-07-08 16:24 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-07-08 16:24 . 2009-07-08 16:24 -------- d-----w- c:\program files\Real 2009-07-08 16:23 . 2009-07-08 16:22 -------- d-----w- c:\program files\Google 2009-07-08 16:21 . 2009-07-08 16:21 -------- d-----w- c:\program files\Common Files\Adobe 2009-07-08 15:19 . 2009-07-08 15:19 0 ----a-w- c:\windows\nsreg.dat 2009-07-08 15:08 . 2009-07-08 15:05 -------- d-----w- c:\program files\Common Files\Ahead 2009-07-08 15:08 . 2009-07-08 15:08 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Ahead 2009-07-08 15:05 . 2009-07-08 15:05 -------- d-----w- c:\program files\Nero 2009-07-08 15:04 . 2009-07-08 15:04 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Logitech 2009-07-08 15:03 . 2009-07-08 15:03 -------- d-----w- c:\documents and settings\User\Dane aplikacji\Leadertech 2009-07-08 15:03 . 2009-07-08 15:03 10134 ----a-r- c:\documents and settings\User\Dane aplikacji\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe 2009-07-08 15:03 . 2009-07-08 15:01 -------- d-----w- c:\program files\Common Files\Logishrd 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-07-08 15:02 . 2009-07-08 15:02 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\program files\Logitech 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\User\Dane aplikacji\InstallShield 2009-07-08 15:01 . 2009-07-08 15:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-07-08 14:50 . 2009-07-08 14:46 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-08 14:45 . 2009-07-08 14:45 -------- d-----w- c:\program files\VDOTool 2009-07-08 14:42 . 2008-06-16 13:28 47898 ----a-w- c:\windows\system32\perfc015.dat 2009-07-08 14:42 . 2008-06-16 13:28 352770 ----a-w- c:\windows\system32\perfh015.dat 2009-07-08 14:37 . 2009-07-08 14:37 -------- d-----w- c:\program files\Usługi online 2009-07-08 14:35 . 2009-07-08 14:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-08 14:34 . 2009-07-08 14:34 -------- d-----w- c:\program files\Windows Media Connect 2 2009-06-02 16:11 . 2009-07-08 16:30 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-29 21:37 . 2009-07-08 16:30 205824 ----a-w- c:\windows\system32\xvidvfw.dll 2009-05-29 21:31 . 2009-07-08 16:30 881664 ----a-w- c:\windows\system32\xvidcore.dll 2009-05-01 21:02 . 2009-07-08 16:30 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-07-08 16:30 685056 ----a-w- c:\windows\system32\divx.dll 2009-04-28 20:20 . 2009-07-08 16:19 44944 ------w- c:\windows\system32\drivers\pxhelp20.sys 2009-07-10 11:35 . 2009-07-08 15:12 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ------- Sigcheck ------- [-] 2007-07-11 05:06 642560 CE594E18FE0D0AF804F1F3694921CE62 c:\windows\system32\user32.dll [-] 2008-06-16 13:28 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:\windows\system32\drivers\tcpip.sys [-] 2008-06-16 13:28 549888 335813EACD16E84F3047A3326F6E5473 c:\windows\system32\winlogon.exe [-] 2008-07-19 00:33 2074240 0DBF1939DF18AC8F8C1E4BD63D7D4B0F c:\windows\system32\ntkrnlpa.exe [-] 2008-07-07 09:44 2197376 37D5DAAEDA594B9BEE00C82F185CC549 c:\windows\system32\ntoskrnl.exe [-] 2008-06-27 15:36 1482240 12B143C653DFA3F953EDA4534B1AAEA8 c:\windows\explorer.exe [-] 2008-06-16 13:28 1420800 4678172D19476FA7D539682FCA42C942 c:\windows\system32\comres.dll [-] 2008-06-16 13:28 724992 7F059A93D251284A8BC758327ECD3D69 c:\windows\system32\comctl32.dll [7] 2008-06-16 13:28 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [7] 2008-06-16 13:28 1054208 737739FACEAD60683AA8D7FF7602FD14 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll [-] 2008-06-16 13:28 1571840 C8BDAD4065118558B3DC360FC96D81DB c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-19_14.32.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-20 06:32 . 2009-07-20 06:32 62464 c:\windows\Installer\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}\IconE9F814234.exe + 2007-07-23 02:34 . 2007-07-23 02:34 811008 c:\windows\system32\nvcplui.exe + 2009-07-20 06:32 . 2009-07-20 06:32 958464 c:\windows\Installer\23c4366.msi + 2009-07-20 06:32 . 2009-07-20 06:32 106496 c:\windows\Installer\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}\IconE9F814236.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 151552] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-06-26 2165272] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 212992] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-07-23 1683456] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-11-29 55824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-06-16 124928] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-8 846352] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-01-09 10:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [COLOR=RED] Klucz Trybu Awaryjnego wymaga naprawy. Komputer nie może wejść w Tryb Awaryjny. [/COLOR] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] @="Driver Group" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "f:\\PES 2009\\pes2009.exe"= S2 gupdate1c9ffe8612be232;Usługa Google Update (gupdate1c9ffe8612be232);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 133104] S2 MCIDRV_2600_6_0;MCIDRV_2600_6_0;c:\windows\system32\drivers\njklmn.sys [2009-07-20 5077] . Zawartość folderu 'Zaplanowane zadania' 2009-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] 2009-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-08 16:23] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\idg199yp.default\ FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-20 17:45 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(648) c:\windows\system32\sfc_os.dll c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll c:\windows\system32\cscui.dll - - - - - - - > 'lsass.exe'(704) c:\windows\system32\scecli.dll . Czas ukończenia: 2009-07-20 17:47 ComboFix-quarantined-files.txt 2009-07-20 15:47 ComboFix2.txt 2009-07-20 08:48 ComboFix3.txt 2009-07-19 17:11 ComboFix4.txt 2009-07-19 16:37 ComboFix5.txt 2009-07-20 15:40 Przed: 4 844 220 416 bajtów wolnych Po: 4 843 200 512 bajtów wolnych 236 --- E O F --- 2009-07-14 12:59

**Posty:** 18165 · przez **wojtas** 23 Lip 2009, 17:38

niestety infekcja caly czas wraca. pojawiaja sie nowe pliki wirusa

**Posty:** 13 · przez **FoReST333** 23 Lip 2009, 19:37

czyli co moge zrobic? ;o

**Posty:** 18165 · przez **wojtas** 23 Lip 2009, 19:40

sam nie wiem nigdy sie nie spotkalem z tak dziwną infekcją...

**Posty:** 13 · przez **FoReST333** 23 Lip 2009, 20:53

no to super xD i tak nie zrobie formata wszystkich dysków ;p

**Posty:** 8001 · przez **Okocza** 23 Lip 2009, 20:58

FoReST333, zanim cokolwiek zrobisz, podłącz wszystkie pendrivy i sformatuj je, potem użyj sdfixa i combofixa - wklej obydwa logi na forum

**Posty:** 1290 · przez **Xfire** 23 Lip 2009, 22:22

FoReST333, masz w ogóle jakiegoś antywirusa? może zainstaluj kacpra 2009, odpal trial i niech robi porządek (możesz spróbować w trybie awaryjnym jak coś)

**Posty:** 13 · przez **FoReST333** 24 Lip 2009, 14:44

pendriva zadnego nie mam.. jedyne co podlaczam do kompa jako pendrive to telefon ;p
pisalem wczesniej ze tryb awaryjny mi nie wchodzi... nie wiem jak jest dzis ale nie mam za bardzo czasu bo brat ma urlop i siedzi na kompie...
jak cos to sie odezwe jak znajde czasu i zaczne kombinowac ;p
co do antywira... mialem kiedys zone alarm i przez niego zaczal mi sie system sypac... najwidoczniej tak te virusy reagują na antyvirusy ;]
nie wiem... mowie jak bede mial wiecej czasu na kompie to zaczne sie znow bawic takze do później ;p

Dodano Dzisiaj, 16:09:
dobra brat juz nie ma urlopu wiec moge sie zaczac bawic ;p
opłaca sie instalowac antywira skoro i tak bedzie zarazony? bo moim zdaniem nie ;p
pendrive'ów zadnych nie mam ;p
więc co mam teraz zrobic?

czekam.

Kto jest na forum