Nie wiem co się dzieje ale non stop na moim komputerze pojawiają się pliki WINFILE. Dzieje się to takrze z folderami które bardzo często urzywam. Chciał bym was poprosić o pomoc, jak zwalczyć to dziadostwo oraz jak usunąć virusa który powoduje wklejanie się tekstu HELLO!
Ponirzej logi z HijackThis oraz ComboFix.
Dodam tylko że aby wklejić jakiś tekst muszę to robić bardzo szybko, bo po 3 sekundach znów pojawia się tekst Hello! ...
Pozdrawiam.
HijackThis
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:38:34, on 2009-03-01
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\FRAPS\FRAPS.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\WINDOWS\HELP\NLLIJ.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RavTimeXP] C:\WINDOWS\HELP\NLLIJ.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Usługa bramy warstwy aplikacji (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
--
End of file - 6195 bytes
ComboFix.
- Kod: Zaznacz wszystko
ComboFix 09-02-28.01 - User 2009-03-01 9:48:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1283 [GMT 1:00]
Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
----- Powielacze/Replikatory plików -----
c:\25 to life\25 to Life.exe
c:\25 to life\data\data.exe
c:\25 to life\data\Scripts\Scripts.exe
c:\25 to life\data\xml\xml.exe
c:\documents and settings\User\Moje dokumenty\Downloads\Downloads.exe
c:\documents and settings\User\Moje dokumenty\Muzyka\Muzyka.exe
c:\documents and settings\User\Moje dokumenty\Opera Downloads\DjPremier\DjPremier.exe
c:\documents and settings\User\Moje dokumenty\Opera Downloads\Opera Downloads.exe
c:\documents and settings\User\Moje dokumenty\Wideo\Wideo.exe
c:\documents and settings\User\Pulpit\Nowy folder\Nowy folder.exe
c:\documents and settings\User\Pulpit\Other files\Other files.exe
c:\documents and settings\User\Pulpit\WWO\WWO.exe
c:\metin2_sh\Metin2_SH.exe
c:\metin2_sh\patchskin\patchskin.exe
c:\metin2_sh\platzhalter\platzhalter.exe
c:\program files\Program Files.exe
c:\windows\Help\NLLIJ.exe .. failed to delete
C:\WINFILE.EXE
d:\filmy\Filmy.exe
d:\muzyka\Muzyka.exe
d:\muzyka\Ulubione\Ulubione.exe
d:\nie usuwac\Moje obrazy\dalsze fotki\dalsze fotki.exe
d:\nie usuwac\Moje obrazy\LG FOTKI\LG FOTKI.exe
d:\nie usuwac\Moje obrazy\Moje obrazy.exe
d:\nie usuwac\Moje obrazy\reszta\reszta.exe
d:\nie usuwac\Moje obrazy1\Moje obrazy1.exe
d:\nie usuwac\Nowy folder\Monika.exe
d:\nie usuwac\Nowy folder\Nowy folder.exe
d:\nie usuwac\Nowy folder\shine\shine.exe
d:\kopie zapasowe\Max Payne 2 The Fall of Max Payne\Max Payne 2\Max Payne 2.exe
d:\kopie zapasowe\252Life\252Life.exe
d:\kopie zapasowe\Gothic\Gothic.exe
d:\kopie zapasowe\Max Payne 1\Max Payne 1.exe
d:\kopie zapasowe\Obrazy Płyt.exe
d:\programy\Programy.exe
d:\programy\sterowniki\sterowniki.exe
d:\programy\sa\Virusy BAT\Virusy BAT.exe
d:\recycler\S-1-5-21-57989841-299502267-1801674531-1001\De9.exe
d:\saints row 2\Saints Row 2.exe
d:\saints row 2\shaders\shaders.exe
d:\save\gothic3\Gosia\Gosia.exe
d:\save\gothic3\gothic3.exe
d:\save\Oblivion\Oblivion.exe
d:\save\Save.exe
d:\save\STALKER-SHOC\STALKER-SHOC.exe
d:\win avi\WIN AVI.exe
D:\WINFILE.EXE
.
.
((((((((((((((((((((((((( Pliki utworzone od 2009-02-01 do 2009-03-01 )))))))))))))))))))))))))))))))
.
2009-02-28 11:47 . 2009-02-28 11:47 <DIR> d-------- c:\windows\Sun
2009-02-28 11:45 . 2009-02-28 11:45 <DIR> d-------- c:\program files\Java
2009-02-28 11:45 . 2009-02-28 11:45 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-28 10:24 . 2009-02-28 10:24 <DIR> d-------- c:\windows\system32\xircom
2009-02-28 10:24 . 2009-02-28 10:24 <DIR> d-------- c:\windows\system32\oobe
2009-02-28 10:24 . 2009-02-28 10:24 <DIR> d-------- c:\windows\srchasst
2009-02-28 10:24 . 2009-02-28 10:24 <DIR> d-------- c:\windows\msagent
2009-02-28 10:24 . 2009-02-28 10:24 <DIR> d-------- c:\program files\microsoft frontpage
2009-02-28 09:39 . 2009-02-28 18:09 <DIR> d-------- c:\program files\Spyware Doctor
2009-02-28 09:39 . 2009-02-28 09:39 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\PC Tools
2009-02-28 09:39 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-28 09:39 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-28 09:39 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-28 09:39 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-25 14:15 . 2009-02-28 11:45 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-24 10:32 . 2009-03-01 09:50 <DIR> d-------- C:\25 to Life
2009-02-24 08:29 . 2006-06-03 21:29 48,640 --a------ c:\windows\system32\hpzll4pi.dll
2009-02-24 08:23 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe
2009-02-24 08:23 . 2006-03-03 21:03 282,680 --a------ c:\windows\system32\HPZidr12.dll
2009-02-24 08:23 . 2006-03-03 21:02 204,800 --a------ c:\windows\system32\HPZipr12.dll
2009-02-24 08:23 . 2006-03-03 21:02 94,208 --a------ c:\windows\system32\HPZipt12.dll
2009-02-24 08:23 . 2006-03-03 21:03 69,632 --a------ c:\windows\system32\HPZipm12.exe
2009-02-24 08:23 . 2006-03-03 21:03 65,536 --a------ c:\windows\system32\HPZinw12.exe
2009-02-24 08:23 . 2006-03-03 21:02 57,344 --a------ c:\windows\system32\HPZisn12.dll
2009-02-24 08:22 . 2009-02-24 08:23 <DIR> d-------- c:\program files\HP
2009-02-24 08:22 . 2009-02-24 08:23 123,135 --a------ c:\windows\HPHins12.dat
2009-02-24 08:22 . 2006-05-16 21:25 77,824 --a------ c:\windows\system32\hpzids01.dll
2009-02-24 08:22 . 2008-04-13 22:15 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-02-24 08:22 . 2006-07-17 20:39 14,916 --------- c:\windows\hphmdl12.dat
2009-02-24 08:18 . 2006-06-22 04:03 56 --a------ C:\ut9x.bat
2009-02-24 08:18 . 2006-06-19 22:08 54 --a------ C:\ut.bat
2009-02-24 08:00 . 2008-04-13 22:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-02-23 12:04 . 2009-02-23 12:04 <DIR> d-------- c:\program files\TeamViewer
2009-02-23 12:04 . 2009-02-23 12:04 <DIR> d-------- c:\documents and settings\User\temp
2009-02-23 12:04 . 2009-02-23 12:04 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\TeamViewer
2009-02-23 05:14 . 2009-02-23 05:14 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\Media Player Classic
2009-02-22 17:54 . 2009-02-22 17:54 <DIR> d-------- c:\program files\IDM Computer Solutions
2009-02-22 17:54 . 2009-02-22 17:54 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\IDMComp
2009-02-22 02:50 . 2009-02-22 02:50 <DIR> d-------- c:\program files\Prawo Jazdy 2006
2009-02-22 02:49 . 2009-02-22 02:49 697 ---hs---- C:\comment.htt
2009-02-22 02:49 . 2009-02-22 02:49 72 ---hs---- C:\desktop.ini
2009-02-21 12:52 . 2009-02-21 12:52 <DIR> d-------- c:\windows\speech
2009-02-21 12:51 . 2009-02-21 12:52 <DIR> d-------- c:\program files\ivo
2009-02-21 08:35 . 2009-02-21 08:35 <DIR> d-------- c:\program files\Hamachi
2009-02-21 08:35 . 2009-02-21 09:22 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\Hamachi
2009-02-21 08:35 . 2009-02-21 08:35 25,280 --a------ c:\windows\system32\drivers\hamachi.sys
2009-02-21 04:17 . 2009-02-21 04:20 <DIR> d-------- c:\program files\GameSpy Arcade
2009-02-20 21:10 . 2009-03-01 09:07 <DIR> d-------- C:\Fraps
2009-02-20 21:01 . 2009-03-01 09:47 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-02-20 19:59 . 2009-02-21 06:46 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\Ashampoo
2009-02-19 19:23 . 2009-02-19 19:23 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\Gadu-Gadu
2009-02-19 15:59 . 2009-03-01 09:50 <DIR> d-------- C:\Metin2_SH
2009-02-19 15:49 . 2009-02-19 15:49 4,096 --a------ c:\windows\d3dx.dat
2009-02-18 05:58 . 2009-02-18 05:59 <DIR> d-------- C:\Gothic PL
2009-02-18 05:58 . 1998-10-07 12:54 327,168 --a------ c:\windows\IsUn0415.exe
2009-02-18 05:13 . 2009-02-25 14:33 <DIR> d-------- c:\program files\Common Files\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 08:50 --------- d-----w c:\documents and settings\User\Dane aplikacji\Skype
2009-03-01 08:49 --------- d-----w c:\documents and settings\User\Dane aplikacji\uTorrent
2009-03-01 08:07 --------- d-----w c:\documents and settings\User\Dane aplikacji\skypePM
2009-02-28 08:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-25 18:06 53,507 ----a-w c:\windows\Help\NLLIJ.exe
2009-02-21 09:19 --------- d-----w c:\documents and settings\User\Dane aplikacji\Winamp
2009-02-21 05:46 --------- d-----w c:\program files\Ashampoo
2009-02-20 20:10 --------- d-----w c:\program files\Winamp
2009-02-20 20:03 --------- d-----w c:\program files\Gadu-Gadu
2009-02-18 03:47 --------- d-----w c:\documents and settings\User\Dane aplikacji\DAEMON Tools Pro
2009-02-18 03:47 --------- d-----w c:\documents and settings\User\Dane aplikacji\DAEMON Tools
2009-02-18 03:46 --------- d-----w c:\program files\DAEMON Tools Toolbar
2009-02-18 03:46 --------- d-----w c:\program files\DAEMON Tools Lite
2009-02-18 03:46 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite
2009-02-18 03:44 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-02-18 03:44 --------- d-----w c:\documents and settings\User\Dane aplikacji\DAEMON Tools Lite
2009-02-18 03:35 --------- d-----w c:\program files\uTorrent
2009-02-18 03:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ashampoo
2009-02-18 03:32 --------- d-----w c:\program files\Real Alternative
2009-02-18 03:29 --------- d-----w c:\program files\Opera
2009-02-18 03:20 --------- d-----w c:\program files\K-Lite Codec Pack
2009-02-18 03:14 --------- d-----w c:\program files\Realtek
2009-02-18 03:09 --------- d-----w c:\program files\Skype
2009-02-18 03:09 --------- d-----w c:\program files\Common Files\Skype
2009-02-18 03:09 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype
2009-02-18 03:05 319,488 ----a-w c:\windows\HideWin.exe
2009-02-18 03:05 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-18 03:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-18 03:00 --------- d-----w c:\program files\AGEIA Technologies
2009-02-18 02:51 --------- d-----w c:\program files\Usługi online
2009-02-18 02:48 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-03 10:59 81,920 ----a-w c:\windows\system32\frapsvid.dll
2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
.
------- Sigcheck -------
2007-07-10 18:06 642560 ce594e18fe0d0af804f1f3694921ce62 c:\windows\system32\user32.dll
2008-06-16 02:28 361344 030dc4d48cc2b894fee2f390d8e66ad5 c:\windows\system32\drivers\tcpip.sys
2008-06-16 02:28 549888 335813eacd16e84f3047a3326f6e5473 c:\windows\system32\winlogon.exe
2008-07-07 22:43 2074240 0dbf1939df18ac8f8c1e4bd63d7d4b0f c:\windows\system32\ntkrnlpa.exe
2008-07-06 22:44 2197376 37d5daaeda594b9bee00c82f185cc549 c:\windows\system32\ntoskrnl.exe
2008-06-27 04:36 1424896 4ec7ed41d95d18b3cd1a2bd9dfefb591 c:\windows\explorer.exe
2008-06-16 02:28 112128 37ed43f3dec4400586554d61c3129478 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"Fraps"="c:\fraps\FRAPS.EXE" [2008-10-02 3309224]
"EXPLORER.EXE"="EXPLORER.EXE" [2008-06-27 c:\windows\explorer.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-28 148888]
"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-23 c:\windows\RTHDCPL.exe]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 c:\windows\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 c:\windows\alcwzrd.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-06-16 c:\windows\system32\advpack.dll]
c:\documents and settings\User\Menu Start\Programy\Autostart\
uTorrent.lnk - c:\program files\uTorrent\uTorrent.exe [2009-02-18 270128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Metin2_SH\\metin_de.exe"=
"d:\\Saints Row 2\\SR2_pc.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-28 356920]
--- Inne Usługi/Sterowniki w Pamięci ---
*Deregistered* - mchInjDrv
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a6bc6c2-fd6d-11dd-941f-c7297c82c383}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-wsctf.exe - wsctf.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
uInternet Connection Wizard,ShellNext = hxxp://www.codecguide.com/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-01 09:50:49
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(1000)
c:\windows\system32\scecli.dll
.
Czas ukończenia: 2009-03-01 9:51:53
ComboFix-quarantined-files.txt 2009-03-01 08:51:51
Przed: 64 342 376 448 bajtów wolnych
Po: 64,498,786,304 bajtów wolnych
255
EDIT: Zapomniałem
http://wklej.org/id/58713/ <ComboFix
http://wklej.org/id/58715/ < HijackThis
