pojawianie sie okieniek z inforamcja o wirusie

[Gacek89]

Wyskauje mi pełno okienek ze mam wirusa tylko ze on sa fauszywe i prowada dodiwnych skanerów online, niesty troche sie dałe na poczatku nabrać
Niemoge uruchomic nawet menagera zadan ponieważ jest zablokowany przez administratora, a ja se nieprzypominam bym go blokował, nawet niewiem jak

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 02:59:31, on 2007-12-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Copy Handler\ch.exe
D:\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\lexpps.exe
D:\Konnekt\konnekt.exe
C:\Program Files\Trust\Trust Keyboard 15036\PS2USBKbdDrv.exe
C:\WINDOWS\system32\ctfmon.exe
D:\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\explorer.exe
H:\backup D\Program Files\Cream Software\Pajaczek 5 NxG\Pajaczek.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ESET\nod32.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\BitComet\BitComet.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Krzysiek\USTAWI~1\Temp\Rar$EX01.062\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: BDEX System - {7F719D62-623C-4F70-9244-8CAEC58B041B} - C:\WINDOWS\ttvbonfwt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O3 - Toolbar: The leosrv - {C31D988D-A314-49BB-BA51-7F57DEE5EA34} - C:\WINDOWS\leosrv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\Trust\Trust Keyboard 15036\StartAutorun.exe PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] D:\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [RoboForm] "D:\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Personalizuj Menu - file://D:\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Wypełnij Pola - file://D:\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Zapisz Pola - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: xcvwer - {F1FB7F40-D34A-4E0C-8F33-07990763228B} - C:\WINDOWS\xcvwer.dll
O21 - SSODL: hjoqor - {5828B858-8C13-4B60-96E9-9EBCAD5E6A2B} - C:\WINDOWS\hjoqor.dll
O23 - Service: Usługa licencjonowania programu ABBYY FineReader 9.0 (ABBYY.Licensing.FineReader.Professional.9.0) - Unknown owner - D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe" -service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe



[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Gacek89]

Kod: Zaznacz wszystko

SmitFraudFix v2.274

Scan done at 16:43:20,01, 2007-12-22
Run from C:\Documents and Settings\Krzysiek\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\binret.exe Deleted
C:\WINDOWS\hjoqor.dll Deleted
Deleting [HKEY_CLASSES_ROOT\CLSID\{5828B858-8C13-4B60-96E9-9EBCAD5E6A2B}]
C:\WINDOWS\leosrv.dll Deleted
C:\WINDOWS\ttvbon???.dll Deleted
C:\WINDOWS\xcvwer.dll Deleted
Deleting [HKEY_CLASSES_ROOT\CLSID\{F1FB7F40-D34A-4E0C-8F33-07990763228B}]
C:\DOCUME~1\Krzysiek\Pulpit\Error Cleaner.url Deleted
C:\DOCUME~1\Krzysiek\Pulpit\Privacy Protector.url Deleted
C:\DOCUME~1\Krzysiek\Pulpit\Spyware?Malware Protection.url Deleted
C:\DOCUME~1\Krzysiek\Ulubione\Error Cleaner.url Deleted
C:\DOCUME~1\Krzysiek\Ulubione\Privacy Protector.url Deleted
C:\DOCUME~1\Krzysiek\Ulubione\Spyware?Malware Protection.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 62.179.1.63
DNS Server Search Order: 62.179.1.62

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4ED1E57A-DB8D-4D6B-84DE-CE15585DC617}: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4ED1E57A-DB8D-4D6B-84DE-CE15585DC617}: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4ED1E57A-DB8D-4D6B-84DE-CE15585DC617}: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=62.179.1.63 62.179.1.62


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End



Kod: Zaznacz wszystko

[12/22/2007, 17:01:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Krzysiek\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\VirtumundoBeGone.exe" )
[12/22/2007, 17:01:40] - Detected System Information:
[12/22/2007, 17:01:40] -  Windows Version: 5.1.2600, Dodatek Service Pack 2
[12/22/2007, 17:01:40] -  Current Username: Krzysiek (Admin)
[12/22/2007, 17:01:40] -  Windows is in NORMAL mode.
[12/22/2007, 17:01:40] - Searching for Browser Helper Objects:
[12/22/2007, 17:01:40] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[12/22/2007, 17:01:40] -  BHO 2: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[12/22/2007, 17:01:40] -  BHO 3: {724d43a9-0d85-11d4-9908-00400523e39a} ()
[12/22/2007, 17:01:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/22/2007, 17:01:40] -  Checking for HKLM\...\Winlogon\Notify\roboform
[12/22/2007, 17:01:40] -  Key not found: HKLM\...\Winlogon\Notify\roboform, continuing.
[12/22/2007, 17:01:40] -  BHO 4: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (Groove GFS Browser Helper)
[12/22/2007, 17:01:40] -  BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/22/2007, 17:01:40] -  BHO 6: {7F719D62-623C-4F70-9244-8CAEC58B041B} (BDEX System)
[12/22/2007, 17:01:40] - Finished Searching Browser Helper Objects
[12/22/2007, 17:01:40] - Finishing up...
[12/22/2007, 17:01:40] - Nothing found! Exiting...

Kod: Zaznacz wszystko

SDFix: Version 1.119

Run by Krzysiek on 2007-12-22 at 18:10

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\dat.txt  - Deleted
C:\WINDOWS\rs.txt  - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 18:20:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:5ab271a2
"s1"=dword:868217bc
"s2"=dword:9f980ce3
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:0c,cf,e6,c5,a9,ad,d8,83,6b,d5,33,f5,12,23,56,85,82,d1,36,3a,02,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:0c,cf,e6,c5,a9,ad,d8,83,6b,d5,33,f5,12,23,56,85,82,d1,36,3a,02,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000052
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\\gadcd\\Program Files\\Gadu-Gadu\\gg.exe"="H:\\gadcd\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"H:\\goldenb game archive\\tremulous\\tremulous.exe"="H:\\goldenb game archive\\tremulous\\tremulous.exe:*:Enabled:tremulous"
"D:\\Konnekt\\konnekt.exe"="D:\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core"
"C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\\eMule\\emule.exe"="D:\\eMule\\emule.exe:*:Enabled:eMuleMorphXT"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed  3 May 2006       163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007        31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Sun  2 Sep 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 22 Dec 2007        85,946 A..H. --- "C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Temp\BIT1.tmp"
Sat 22 Dec 2007        85,946 A..H. --- "C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Temp\BIT2.tmp"
Sat 22 Dec 2007        85,946 A..H. --- "C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Temp\BIT4553.tmp"
Sat 22 Dec 2007        85,946 A..H. --- "C:\Documents and Settings\Krzysiek\Ustawienia lokalne\Temp\BIT478F.tmp"

Finished!


gotowe

[wojtas]

prosze o wszystkie logi o ktore prosilem

[Gacek89]

Wszytko dodałem o co prosiłeś, te skanery nic niewykryły

[wojtas]

daj loga calego z
combofixa

[Gacek89]

Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Krzysiek 2007-12-22 18:29:31.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.353 [GMT 1:00]
Running from: C:\Documents and Settings\Krzysiek\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2007-11-22 to 2007-12-22  )))))))))))))))))))))))))))))))
.

2007-12-22 18:10 . 2007-12-22 18:10   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-22 16:52 . 2007-12-22 16:52   <DIR>   d--------   C:\VundoFix Backups
2007-12-22 16:43 . 2007-12-22 16:43   2,020   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-22 16:42 . 2007-09-05 23:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2007-12-22 16:42 . 2006-04-27 16:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-12-22 16:42 . 2007-12-20 23:11   81,920   --a------   C:\WINDOWS\system32\IEDFix.exe
2007-12-22 16:42 . 2003-06-05 20:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-12-22 16:42 . 2004-07-31 17:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-12-22 16:42 . 2007-10-03 23:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2007-12-22 16:41 . 2007-12-22 16:47   <DIR>   d--------   C:\Documents and Settings\Krzysiek\SmitfraudFix
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--h-----   C:\Documents and Settings\postgres\Ustawienia lokalne
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--------   C:\Documents and Settings\postgres\Ulubione
2007-12-22 14:58 . 2006-01-01 13:45   <DIR>   d--h-----   C:\Documents and Settings\postgres\Szablony
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--------   C:\Documents and Settings\postgres\Pulpit
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--------   C:\Documents and Settings\postgres\Moje dokumenty
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   dr-------   C:\Documents and Settings\postgres\Menu Start
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   dr-h-----   C:\Documents and Settings\postgres\Dane aplikacji
2007-12-22 02:55 . 2007-12-22 02:55   <DIR>   d--------   C:\Documents and Settings\Krzysiek\Dane aplikacji\Grisoft
2007-12-22 02:54 . 2007-12-22 02:54   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2007-12-22 02:54 . 2007-05-30 13:10   10,872   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-21 22:40 . 2007-12-21 22:42   32,809,152   --a------   C:\Tatu - Mal'chik Gej (live).avi.MP4
2007-12-21 22:37 . 2007-12-21 22:37   <DIR>   d--------   C:\Program Files\AviSynth 2.5
2007-12-21 22:37 . 2004-02-22 10:11   719,872   --a------   C:\WINDOWS\system32\devil.dll
2007-12-21 22:37 . 2006-10-07 17:43   502,784   --a------   C:\WINDOWS\x2.64.exe
2007-12-21 22:37 . 2007-05-14 15:24   394,240   --a------   C:\WINDOWS\system32\Smab.dll
2007-12-21 22:37 . 2007-05-17 17:30   318,976   --a------   C:\WINDOWS\system32\avisynth.dll
2007-12-21 22:37 . 2005-02-28 13:16   240,128   --a------   C:\WINDOWS\system32\x.264.exe
2007-12-21 22:37 . 2006-04-12 09:47   217,073   --a------   C:\WINDOWS\meta4.exe
2007-12-21 22:37 . 2004-01-25 00:00   70,656   --a------   C:\WINDOWS\system32\i420vfw.dll
2007-12-21 22:37 . 2006-04-05 08:09   66,560   --a------   C:\WINDOWS\MOTA113.exe
2007-12-21 22:37 . 2005-07-14 12:31   27,648   --a------   C:\WINDOWS\system32\AVSredirect.dll
2007-12-21 22:35 . 2006-09-12 11:46   227,328   -r-hs----   C:\WINDOWS\system32\ac3DX.ax
2007-12-21 22:35 . 2005-02-22 16:55   81,920   -r-hs----   C:\WINDOWS\system32\aac_parser.ax
2007-12-21 22:35 . 2007-07-03 06:59   9,292   ---h-----   C:\WINDOWS\super.chm
2007-12-21 22:22 . 2007-12-21 22:22   <DIR>   d--------   C:\Documents and Settings\Krzysiek\Dane aplikacji\ABBYY
2007-12-21 21:31 . 2007-12-21 21:37   <DIR>   d--------   C:\Program Files\MediaVideoCodec
2007-12-21 21:02 . 2001-08-23 17:00   1,700,352   --a------   C:\WINDOWS\system32\gdiplus.dll
2007-12-18 16:07 . 2007-12-21 22:25   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ABBYY
2007-12-18 15:54 . 2007-12-18 16:34   <DIR>   d--------   C:\Program Files\ABBYY FineReader 9.0
2007-12-18 15:54 . 2007-12-22 18:14   <DIR>   d-a------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-07 03:07 . 2007-12-07 03:07   102,400   --a------   C:\WINDOWS\system32\SampleGrabber.ax
2007-12-06 00:57 . 2007-12-06 00:57   <DIR>   d--------   C:\Program Files\AMD
2007-12-06 00:57 . 2007-06-29 14:47   34,304   --a------   C:\WINDOWS\system32\drivers\AmdLLD.sys
2007-12-05 13:25 . 2007-12-05 13:28   <DIR>   d--------   C:\Program Files\sXe Injected
2007-11-29 12:15 . 2007-11-29 12:15   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\RoboForm
2007-11-29 12:14 . 2007-11-29 12:14   <DIR>   d--------   C:\Nowy folder
2007-11-29 12:11 . 2007-11-29 12:11   <DIR>   d--------   C:\Program Files\Siber Systems
2007-11-27 22:21 . 2007-11-27 22:21   <DIR>   d--------   C:\Documents and Settings\Krzysiek\TmpInstall
2007-11-27 22:19 . 2007-11-27 22:22   <DIR>   d--------   C:\Program Files\Aspell
2007-11-25 21:20 . 2007-11-25 21:20   <DIR>   d--------   C:\Documents and Settings\Krzysiek\Dane aplikacji\Echo Software

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 22:47   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\MyPhoneExplorer
2007-12-06 19:14   ---------   d-----w   C:\Program Files\Opera
2007-12-05 18:29   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-04 19:14   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2007-12-03 17:28   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Ahead
2007-11-29 23:15   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Winamp
2007-11-19 22:26   111,104   ----a-w   C:\WINDOWS\system32\uha.exe
2007-11-17 20:44   ---------   d-----w   C:\Program Files\Trust
2007-11-09 00:50   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype
2007-11-03 16:35   ---------   d-----w   C:\Documents and Settings\Iza.GACEK\Dane aplikacji\Teleca
2007-11-03 14:48   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-11-03 13:12   ---------   d-----w   C:\Program Files\Disc2Phone
2007-11-03 13:01   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Teleca
2007-11-03 12:59   ---------   d-----w   C:\Program Files\Common Files\Teleca Shared
2007-11-03 12:59   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2007-11-03 12:58   ---------   d-----w   C:\Program Files\Sony Ericsson
2007-11-03 12:58   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2007-11-02 15:11   ---------   d-----w   C:\Program Files\Common Files\Adobe
2007-11-02 14:55   ---------   d-----w   C:\Program Files\Bonjour
2007-11-02 14:47   ---------   d-----w   C:\Program Files\Common Files\Macrovision Shared
2007-11-01 21:05   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-10-30 13:27   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Cream Software
2007-04-05 11:38   76,880   ----a-w   C:\Documents and Settings\Krzysiek\Autorun.exe
2006-05-03 09:06   163,328   --sh--r   C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47   31,232   --sh--r   C:\WINDOWS\system32\msfDX.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F719D62-623C-4F70-9244-8CAEC58B041B}]
         C:\WINDOWS\ttvbonfwt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{724D43A0-0D85-11D4-9908-00400523E39A}
{C31D988D-A314-49BB-BA51-7F57DEE5EA34}

[HKEY_CLASSES_ROOT\clsid\{c31d988d-a314-49bb-ba51-7f57dee5ea34}]
[HKEY_CLASSES_ROOT\leosrv.ToolBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{8AF57300-635D-4046-9589-EC2F8A957D6A}]
[HKEY_CLASSES_ROOT\leosrv.ToolBar]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
@={30351346-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
@={30351347-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
@={30351348-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
@={3035134B-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
@={3035134C-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
@={3035134D-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
@={3035134E-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Konnekt"="D:\Konnekt\konnekt.exe" [2005-05-24 22:41]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 13:20]
"RoboForm"="D:\AI RoboForm\RoboTaskBarIcon.exe" [2007-11-29 12:11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 07:27 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-06 14:26]
"OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 11:05]
"Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 09:51]
"Copy Handler"="C:\Program Files\Copy Handler\ch.exe" [2005-01-31 09:18]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"WireLessKeyboard"="C:\Program Files\Trust\Trust Keyboard 15036\StartAutorun.exe" [2005-11-30 12:48]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06]
"PWRISOVM.EXE"="D:\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05]
"!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 15:14   147456   --a------   C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-03 23:44   15360   --a------   C:\WINDOWS\system32\ctfmon.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
         H:\gadcd\Program Files\Gadu-Gadu\gg.exe /tray
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47   31016   --a------   C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
         C:\WINDOWS\system32\LXSUPMON.EXE RUN
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
         C:\Program Files\Messenger\msmsgs.exe /background
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 14:40   155648   --a------   C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
         C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
         RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
         nwiz.exe /install
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
         SkyTel.EXE
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 03:00   132496   --a------   C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2007-10-10 06:28   36352   --a------   D:\Program Files\Winamp\winampa.exe

R1 VFILT;Outpost Firewall Kernel Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2006-03-30 09:53]
R2 ABBYY.Licensing.FineReader.Professional.9.0;Usługa licencjonowania programu ABBYY FineReader 9.0;"D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe" -service []
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2006-03-30 09:53]
R3 AmdLLD;AMD Low Level Device Driver;C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 14:47]
R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2006-03-30 09:53]
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2006-03-30 09:53]
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2006-03-30 09:53]
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2006-03-30 09:53]
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2006-03-30 09:53]
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2006-03-30 09:53]
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2006-03-30 09:53]
R3 KEYBOARDWDFilter;KEYBOARDWDFilter;C:\WINDOWS\System32\Drivers\KEYBOARDWD.SYS [2006-07-17 16:59]
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2006-03-30 09:53]
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2006-03-30 09:53]
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2006-03-30 09:53]
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2006-03-30 09:53]
R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2006-03-30 09:53]
S3 FoxAwdWINFLASH;FoxAwdWINFLASH;C:\Program Files\LiveUpdate\FoxAwdWINFLASH.SYS [2006-06-06 17:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\Setup.exe -auto

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ff1186e-71c5-11dc-9a7e-001558784796}]
\Shell\AutoRun\command - K:\travel&work.exe
\Shell\Shell00\Command - K:\travel&work.exe

*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 18:31:01
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 18:31:26


Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:41:23, on 2007-12-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Copy Handler\ch.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Trust\Trust Keyboard 15036\PS2USBKbdDrv.exe
D:\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Konnekt\konnekt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Krzysiek\USTAWI~1\Temp\Rar$EX00.532\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: BDEX System - {7F719D62-623C-4F70-9244-8CAEC58B041B} - C:\WINDOWS\ttvbonfwt.dll (file missing)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O3 - Toolbar: The leosrv - {C31D988D-A314-49BB-BA51-7F57DEE5EA34} - C:\WINDOWS\leosrv.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\Trust\Trust Keyboard 15036\StartAutorun.exe PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] D:\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [RoboForm] "D:\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Personalizuj Menu - file://D:\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Wypełnij Pola - file://D:\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Zapisz Pola - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Usługa licencjonowania programu ABBYY FineReader 9.0 (ABBYY.Licensing.FineReader.Professional.9.0) - Unknown owner - D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe" -service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe



[wojtas]

zastosuj:

smitfraudfix z opcji 2
(sciagnij, wlacz , nacisnij 2 i enter i czekaj)

potem nowy log z hijacka i combofixa

[Gacek89]

zastosuj:

smitfraudfix z opcji 2
(sciagnij, wlacz , nacisnij 2 i enter i czekaj)

potem nowy log z hijacka i combofixa

w trybie normalmym czy zwykłym?

[ Dodano: Dzisiaj o 22:00 ]

Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Krzysiek 2007-12-22 18:29:31.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.353 [GMT 1:00]
Running from: C:\Documents and Settings\Krzysiek\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2007-11-22 to 2007-12-22  )))))))))))))))))))))))))))))))
.

2007-12-22 18:10 . 2007-12-22 18:10   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-22 16:52 . 2007-12-22 16:52   <DIR>   d--------   C:\VundoFix Backups
2007-12-22 16:43 . 2007-12-22 16:43   2,020   --a------   C:\WINDOWS\system32\tmp.reg
2007-12-22 16:42 . 2007-09-05 23:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2007-12-22 16:42 . 2006-04-27 16:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-12-22 16:42 . 2007-12-20 23:11   81,920   --a------   C:\WINDOWS\system32\IEDFix.exe
2007-12-22 16:42 . 2003-06-05 20:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-12-22 16:42 . 2004-07-31 17:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-12-22 16:42 . 2007-10-03 23:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2007-12-22 16:41 . 2007-12-22 16:47   <DIR>   d--------   C:\Documents and Settings\Krzysiek\SmitfraudFix
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--h-----   C:\Documents and Settings\postgres\Ustawienia lokalne
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--------   C:\Documents and Settings\postgres\Ulubione
2007-12-22 14:58 . 2006-01-01 13:45   <DIR>   d--h-----   C:\Documents and Settings\postgres\Szablony
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--------   C:\Documents and Settings\postgres\Pulpit
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   d--------   C:\Documents and Settings\postgres\Moje dokumenty
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   dr-------   C:\Documents and Settings\postgres\Menu Start
2007-12-22 14:58 . 2006-01-01 07:27   <DIR>   dr-h-----   C:\Documents and Settings\postgres\Dane aplikacji
2007-12-22 02:55 . 2007-12-22 02:55   <DIR>   d--------   C:\Documents and Settings\Krzysiek\Dane aplikacji\Grisoft
2007-12-22 02:54 . 2007-12-22 02:54   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2007-12-22 02:54 . 2007-05-30 13:10   10,872   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-21 22:40 . 2007-12-21 22:42   32,809,152   --a------   C:\Tatu - Mal'chik Gej (live).avi.MP4
2007-12-21 22:37 . 2007-12-21 22:37   <DIR>   d--------   C:\Program Files\AviSynth 2.5
2007-12-21 22:37 . 2004-02-22 10:11   719,872   --a------   C:\WINDOWS\system32\devil.dll
2007-12-21 22:37 . 2006-10-07 17:43   502,784   --a------   C:\WINDOWS\x2.64.exe
2007-12-21 22:37 . 2007-05-14 15:24   394,240   --a------   C:\WINDOWS\system32\Smab.dll
2007-12-21 22:37 . 2007-05-17 17:30   318,976   --a------   C:\WINDOWS\system32\avisynth.dll
2007-12-21 22:37 . 2005-02-28 13:16   240,128   --a------   C:\WINDOWS\system32\x.264.exe
2007-12-21 22:37 . 2006-04-12 09:47   217,073   --a------   C:\WINDOWS\meta4.exe
2007-12-21 22:37 . 2004-01-25 00:00   70,656   --a------   C:\WINDOWS\system32\i420vfw.dll
2007-12-21 22:37 . 2006-04-05 08:09   66,560   --a------   C:\WINDOWS\MOTA113.exe
2007-12-21 22:37 . 2005-07-14 12:31   27,648   --a------   C:\WINDOWS\system32\AVSredirect.dll
2007-12-21 22:35 . 2006-09-12 11:46   227,328   -r-hs----   C:\WINDOWS\system32\ac3DX.ax
2007-12-21 22:35 . 2005-02-22 16:55   81,920   -r-hs----   C:\WINDOWS\system32\aac_parser.ax
2007-12-21 22:35 . 2007-07-03 06:59   9,292   ---h-----   C:\WINDOWS\super.chm
2007-12-21 22:22 . 2007-12-21 22:22   <DIR>   d--------   C:\Documents and Settings\Krzysiek\Dane aplikacji\ABBYY
2007-12-21 21:31 . 2007-12-21 21:37   <DIR>   d--------   C:\Program Files\MediaVideoCodec
2007-12-21 21:02 . 2001-08-23 17:00   1,700,352   --a------   C:\WINDOWS\system32\gdiplus.dll
2007-12-18 16:07 . 2007-12-21 22:25   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ABBYY
2007-12-18 15:54 . 2007-12-18 16:34   <DIR>   d--------   C:\Program Files\ABBYY FineReader 9.0
2007-12-18 15:54 . 2007-12-22 18:14   <DIR>   d-a------   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-12-07 03:07 . 2007-12-07 03:07   102,400   --a------   C:\WINDOWS\system32\SampleGrabber.ax
2007-12-06 00:57 . 2007-12-06 00:57   <DIR>   d--------   C:\Program Files\AMD
2007-12-06 00:57 . 2007-06-29 14:47   34,304   --a------   C:\WINDOWS\system32\drivers\AmdLLD.sys
2007-12-05 13:25 . 2007-12-05 13:28   <DIR>   d--------   C:\Program Files\sXe Injected
2007-11-29 12:15 . 2007-11-29 12:15   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\RoboForm
2007-11-29 12:14 . 2007-11-29 12:14   <DIR>   d--------   C:\Nowy folder
2007-11-29 12:11 . 2007-11-29 12:11   <DIR>   d--------   C:\Program Files\Siber Systems
2007-11-27 22:21 . 2007-11-27 22:21   <DIR>   d--------   C:\Documents and Settings\Krzysiek\TmpInstall
2007-11-27 22:19 . 2007-11-27 22:22   <DIR>   d--------   C:\Program Files\Aspell
2007-11-25 21:20 . 2007-11-25 21:20   <DIR>   d--------   C:\Documents and Settings\Krzysiek\Dane aplikacji\Echo Software

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 22:47   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\MyPhoneExplorer
2007-12-06 19:14   ---------   d-----w   C:\Program Files\Opera
2007-12-05 18:29   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-12-04 19:14   ---------   d-----w   C:\Program Files\NAPI-PROJEKT
2007-12-03 17:28   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Ahead
2007-11-29 23:15   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Winamp
2007-11-19 22:26   111,104   ----a-w   C:\WINDOWS\system32\uha.exe
2007-11-17 20:44   ---------   d-----w   C:\Program Files\Trust
2007-11-09 00:50   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype
2007-11-03 16:35   ---------   d-----w   C:\Documents and Settings\Iza.GACEK\Dane aplikacji\Teleca
2007-11-03 14:48   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-11-03 13:12   ---------   d-----w   C:\Program Files\Disc2Phone
2007-11-03 13:01   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Teleca
2007-11-03 12:59   ---------   d-----w   C:\Program Files\Common Files\Teleca Shared
2007-11-03 12:59   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2007-11-03 12:58   ---------   d-----w   C:\Program Files\Sony Ericsson
2007-11-03 12:58   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2007-11-02 15:11   ---------   d-----w   C:\Program Files\Common Files\Adobe
2007-11-02 14:55   ---------   d-----w   C:\Program Files\Bonjour
2007-11-02 14:47   ---------   d-----w   C:\Program Files\Common Files\Macrovision Shared
2007-11-01 21:05   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-10-30 13:27   ---------   d-----w   C:\Documents and Settings\Krzysiek\Dane aplikacji\Cream Software
2007-04-05 11:38   76,880   ----a-w   C:\Documents and Settings\Krzysiek\Autorun.exe
2006-05-03 09:06   163,328   --sh--r   C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47   31,232   --sh--r   C:\WINDOWS\system32\msfDX.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F719D62-623C-4F70-9244-8CAEC58B041B}]
         C:\WINDOWS\ttvbonfwt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{724D43A0-0D85-11D4-9908-00400523E39A}
{C31D988D-A314-49BB-BA51-7F57DEE5EA34}

[HKEY_CLASSES_ROOT\clsid\{c31d988d-a314-49bb-ba51-7f57dee5ea34}]
[HKEY_CLASSES_ROOT\leosrv.ToolBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{8AF57300-635D-4046-9589-EC2F8A957D6A}]
[HKEY_CLASSES_ROOT\leosrv.ToolBar]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
@={30351346-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
@={30351347-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
@={30351348-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
@={3035134B-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
@={3035134C-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
@={3035134D-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
@={3035134E-7B7D-4FCC-81B4-1E394CA267EB}

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
2007-08-26 10:40   536576   --a------   C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Konnekt"="D:\Konnekt\konnekt.exe" [2005-05-24 22:41]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 13:20]
"RoboForm"="D:\AI RoboForm\RoboTaskBarIcon.exe" [2007-11-29 12:11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 07:27 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-06 14:26]
"OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-05-11 11:05]
"Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-03-30 09:51]
"Copy Handler"="C:\Program Files\Copy Handler\ch.exe" [2005-01-31 09:18]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"WireLessKeyboard"="C:\Program Files\Trust\Trust Keyboard 15036\StartAutorun.exe" [2005-11-30 12:48]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06]
"PWRISOVM.EXE"="D:\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05]
"!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Krzysiek^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 15:14   147456   --a------   C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-03 23:44   15360   --a------   C:\WINDOWS\system32\ctfmon.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
         H:\gadcd\Program Files\Gadu-Gadu\gg.exe /tray
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47   31016   --a------   C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
         C:\WINDOWS\system32\LXSUPMON.EXE RUN
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
         C:\Program Files\Messenger\msmsgs.exe /background
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 14:40   155648   --a------   C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
         C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
         RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
         nwiz.exe /install
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
         SkyTel.EXE
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 03:00   132496   --a------   C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
         
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2007-10-10 06:28   36352   --a------   D:\Program Files\Winamp\winampa.exe

R1 VFILT;Outpost Firewall Kernel Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2006-03-30 09:53]
R2 ABBYY.Licensing.FineReader.Professional.9.0;Usługa licencjonowania programu ABBYY FineReader 9.0;"D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe" -service []
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2006-03-30 09:53]
R3 AmdLLD;AMD Low Level Device Driver;C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 14:47]
R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2006-03-30 09:53]
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2006-03-30 09:53]
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2006-03-30 09:53]
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2006-03-30 09:53]
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2006-03-30 09:53]
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2006-03-30 09:53]
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2006-03-30 09:53]
R3 KEYBOARDWDFilter;KEYBOARDWDFilter;C:\WINDOWS\System32\Drivers\KEYBOARDWD.SYS [2006-07-17 16:59]
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2006-03-30 09:53]
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2006-03-30 09:53]
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2006-03-30 09:53]
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2006-03-30 09:53]
R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2006-03-30 09:53]
S3 FoxAwdWINFLASH;FoxAwdWINFLASH;C:\Program Files\LiveUpdate\FoxAwdWINFLASH.SYS [2006-06-06 17:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\Setup.exe -auto

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ff1186e-71c5-11dc-9a7e-001558784796}]
\Shell\AutoRun\command - K:\travel&work.exe
\Shell\Shell00\Command - K:\travel&work.exe

*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 18:31:01
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 18:31:26


Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:38:41, on 2007-12-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Copy Handler\ch.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Trust\Trust Keyboard 15036\PS2USBKbdDrv.exe
D:\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Konnekt\konnekt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
D:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\NOTEPAD.EXE
C:\DOCUME~1\Krzysiek\USTAWI~1\Temp\Rar$EX10.42641\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: BDEX System - {7F719D62-623C-4F70-9244-8CAEC58B041B} - C:\WINDOWS\ttvbonfwt.dll (file missing)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O3 - Toolbar: The leosrv - {C31D988D-A314-49BB-BA51-7F57DEE5EA34} - C:\WINDOWS\leosrv.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\Trust\Trust Keyboard 15036\StartAutorun.exe PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] D:\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [RoboForm] "D:\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Personalizuj Menu - file://D:\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Wypełnij Pola - file://D:\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Zapisz Pola - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Usługa licencjonowania programu ABBYY FineReader 9.0 (ABBYY.Licensing.FineReader.Professional.9.0) - Unknown owner - D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe" -service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe



[wojtas]

w trybie normalmym czy zwykłym?

w trybie awaryjnym (F8 przy starcie kompa)

skasuj:

O2 - BHO: BDEX System - {7F719D62-623C-4F70-9244-8CAEC58B041B} - C:\WINDOWS\ttvbonfwt.dll (file missing)
O3 - Toolbar: The leosrv - {C31D988D-A314-49BB-BA51-7F57DEE5EA34} - C:\WINDOWS\leosrv.dll (file missing)

i wroc z logami nowymu

[Gacek89]

Kod: Zaznacz wszystko

SmitFraudFix v2.274

Scan done at 14:05:28,23, 2007-12-24
Run from C:\Documents and Settings\Krzysiek\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 62.179.1.63
DNS Server Search Order: 62.179.1.62

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4ED1E57A-DB8D-4D6B-84DE-CE15585DC617}: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4ED1E57A-DB8D-4D6B-84DE-CE15585DC617}: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4ED1E57A-DB8D-4D6B-84DE-CE15585DC617}: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=62.179.1.63 62.179.1.62
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=62.179.1.63 62.179.1.62


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End



Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:25:55, on 2007-12-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Copy Handler\ch.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Trust\Trust Keyboard 15036\PS2USBKbdDrv.exe
D:\PowerISO\PWRISOVM.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Konnekt\konnekt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Krzysiek\USTAWI~1\Temp\Rar$EX00.172\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\Trust\Trust Keyboard 15036\StartAutorun.exe PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] D:\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [RoboForm] "D:\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Personalizuj Menu - file://D:\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Wypełnij Pola - file://D:\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Zapisz Pola - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Usługa licencjonowania programu ABBYY FineReader 9.0 (ABBYY.Licensing.FineReader.Professional.9.0) - Unknown owner - D:\ABBYY FineReader 9.0\NetworkLicenseServer.exe" -service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe



[wojtas]

czysto

Autor postu otrzymał pochwałę

[Gacek89]

dzieki pomogło po smitfraudfix
znasz moze sposób na odplenie trybu awaryjnego kiedy ma sie kalwatóre na USB? (F8 niedziała bo ktawiatóra jest niekatywana)

[wojtas]

Użyj narzędzia BootSafe zaznacz opcje Safe Mode- Networking i kliknij reboot . bedziesz po restarcie w trybie awaryjnym

[Gacek89]

dzieki