Pozostałości po wirusie

**Posty:** 11 · przez **iwan59** 23 Lut 2009, 17:08

Antywirus wykrył i (niby) usnął wirusa, ale wciąż jest coś nie tak. Po załadowaniu windowsa nie ma 'ekranu powitalnego' i nic się nie dzieje. Pomaga tylko przy włączaniu F8 i wybranie ostatniej sobrej konfiguracji, ale to marne rozwiązanie, bo komputer się zawiesz i pomaga tylko reset.
Próbowałem zrobić skanowanie ComboFix, ale nie reaguje na próbę włączenia. Logi z HiJackThis, Silnet Runners oraz Rsit.

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:25:43, on 2009-02-23 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\MICROS~2\rapimgr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Opera\opera.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nasza-klasa.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts O2 - BHO: SnagIt Toolbar Loader - {00c6482d-c502-44c8-8409-fce54ad9c208} - E:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: flashget urlcatch - {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - e:\Program Files\FlashGet\jccatch.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - e:\Program Files\FlashGet\getflash.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - E:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download All with FlashGet - E:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: block frame with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame O8 - Extra context menu item: block image with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image O8 - Extra context menu item: block link with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link O8 - Extra context menu item: don't filter page with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O8 - Extra context menu item: report page to the ad muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{BEB32B14-E89E-47CC-9A9C-C1DE79A4F20D}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6074 bytes

Silnet Runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\wcescomm.exe"" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {00c6482d-c502-44c8-8409-fce54ad9c208}\(Default) = (no title provided) -> {HKLM...CLSID} = "SnagIt Toolbar Loader" \InProcServer32\(Default) = "E:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll" ["TechSmith Corporation"] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)" -> {HKLM...CLSID} = "Skype add-on (mastermind)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {2f364306-aa45-47b5-9f9d-39a8b94e7ef7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "e:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."] {DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."] {E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl" -> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "e:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {0561EC90-CE54-4f0c-9C55-E226110A740C}\(Default) = "Haali Column Provider" -> {HKLM...CLSID} = "Haali Column Provider" \InProcServer32\(Default) = "e:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll" [null data] {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ AQQFileTransfer\(Default) = "{10677009-C23C-4FC2-A62C-29323A2201F0}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "e:\PROGRA~1\WapSter\WAPSTE~1\System\AQQSHE~1.DLL" [null data] QuickSFV Shell Extension\(Default) = "{906b0e6e-61ce-11d3-8ee2-0060080a7242}" -> {HKLM...CLSID} = "QuickSFV Shell Extension" \InProcServer32\(Default) = "e:\Program Files\QuickSFV\QSFVShll.dll" ["Mercedes"] SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" -> {HKLM...CLSID} = "SnagItShellExt Class" \InProcServer32\(Default) = "E:\Program Files\TechSmith\SnagIt 9\SnagItShellExt.dll" ["TechSmith Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "e:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ QuickSFV Shell Extension\(Default) = "{906b0e6e-61ce-11d3-8ee2-0060080a7242}" -> {HKLM...CLSID} = "QuickSFV Shell Extension" \InProcServer32\(Default) = "e:\Program Files\QuickSFV\QSFVShll.dll" ["Mercedes"] SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" -> {HKLM...CLSID} = "SnagItShellExt Class" \InProcServer32\(Default) = "E:\Program Files\TechSmith\SnagIt 9\SnagItShellExt.dll" ["TechSmith Corporation"] UltraISO\(Default) = "{AD392E40-428C-459F-961E-9B147782D099}" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "e:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "e:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ IconLayout\(Default) = "{19F500E0-9964-11cf-B63D-08002B317C03}" -> {HKLM...CLSID} = "Desktop Icon Layout" \InProcServer32\(Default) = "Layout.dll" ["Microsoft"] UltraISO\(Default) = "{AD392E40-428C-459F-961E-9B147782D099}" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "e:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "e:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "ClearRecentDocsOnExit" = (REG_DWORD) dword:0x00000001 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\iwan\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MSPlayCDAudioOnArrival\ "Provider" = "ALLPlayer" "InvokeProgID" = "AllPlayerFile" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\AllPlayerFile\shell\play\command\(Default) = ""E:\Program Files\ALLPlayer\ALLPlayer.exe" "%1"" ["ALLPlayer"] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] NeroAutoPlay2CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_CDAudio" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "e:\Program Files\Ahead\nero\nero.exe /w /New:AudioCD /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2CopyCD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "PlayCDAudioOnArrival_CopyCD" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_CopyCD\command\(Default) = "e:\Program Files\Ahead\nero\nero.exe /w /Dialog:DiscCopy /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2DataDisc\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_DataDisc" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_DataDisc\command\(Default) = "e:\Program Files\Ahead\nero\nero.exe /w /New:ISODisc /Drive:%L" ["Ahead Software AG"] NeroAutoPlay2LaunchNeroStartSmart\ "Provider" = "Nero StartSmart" "InvokeProgID" = "Nero.AutoPlay2" "InvokeVerb" = "HandleCDBurningOnArrival_LaunchNeroStartSmart" HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_LaunchNeroStartSmart\command\(Default) = "e:\Program Files\Ahead\Nero StartSmart\NeroStartSmart.exe /AutoPlay /Drive:%L" ["Ahead Software AG"] NMMPlayCDAudioOnArrival\ "Provider" = "Nokia Music Manager" "InvokeProgID" = "NokiaMusicManager" "InvokeVerb" = "NMMPlayCD" HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMPlayCD\command\(Default) = "E:\Program Files\Nokia\Nokia PC Suite 7\MusicManager.exe /playCD "%L"" ["Nokia"] NMMRipCDAudioOnArrival\ "Provider" = "Nokia Music Manager" "InvokeProgID" = "NokiaMusicManager" "InvokeVerb" = "NMMRipCD" HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMRipCD\command\(Default) = "E:\Program Files\Nokia\Nokia PC Suite 7\MusicManager.exe /ripCD "%L"" ["Nokia"] Picasa2ImportPicturesOnArrival\ "Provider" = "Picasa3" "InvokeProgID" = "picasa2.autoplay" "InvokeVerb" = "import" HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command\(Default) = "e:\Program Files\Google\Picasa3\Picasa3.exe "%1"" ["Google Inc."] TVPPlayDVDMovieOnArrival\ "Provider" = "Total Video Player" "InvokeProgID" = "totalplayer.dvd" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\totalplayer.dvd\shell\open\command\(Default) = "E:\Program Files\Total Video Converter\tvp.exe -dvd %1" [empty string] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "e:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""e:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""e:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = (no title provided) -> {HKLM...CLSID} = "SnagIt" \InProcServer32\(Default) = "E:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll" ["TechSmith Corporation"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {77BF5300-1474-4EC7-9980-D32B190E9B07}\ "ButtonText" = "Skype" "CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}" -> {HKLM...CLSID} = "Skype add-on (button)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "e:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\ <<H>> "Tabs" = "C:\Documents and Settings\iwan\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html" [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" ["HP"] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ LIDIL hpzll054\Driver = "hpzll054.dll" ["Hewlett-Packard Company"] ---------- (launch time: 2009-02-23 15:26:58) <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 186 seconds. ---------- (total run time: 225 seconds)

Rsit:
log

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.05 (written by random/random) Run by iwan at 2009-02-23 15:55:27 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 6 GB (36%) free of 16 GB Total RAM: 2047 MB (79% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:55:28, on 2009-02-23 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\MICROS~2\rapimgr.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe E:\Program Files\Opera\opera.exe C:\Documents and Settings\iwan\Pulpit\Nowy folder (2)\RSIT.exe E:\Program Files\Trend Micro\HijackThis\iwan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nasza-klasa.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SnagIt Toolbar Loader - {00c6482d-c502-44c8-8409-fce54ad9c208} - E:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: flashget urlcatch - {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - e:\Program Files\FlashGet\jccatch.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - e:\Program Files\FlashGet\getflash.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - E:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download All with FlashGet - E:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: block frame with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame O8 - Extra context menu item: block image with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image O8 - Extra context menu item: block link with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link O8 - Extra context menu item: don't filter page with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O8 - Extra context menu item: report page to the ad muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{BEB32B14-E89E-47CC-9A9C-C1DE79A4F20D}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6062 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00c6482d-c502-44c8-8409-fce54ad9c208}] SnagIt Toolbar Loader - E:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll [2008-09-22 66888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-11-07 1088296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2f364306-aa45-47b5-9f9d-39a8b94e7ef7}] FGCatchUrl - e:\Program Files\FlashGet\jccatch.dll [2007-08-06 94308] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-20 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-20 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-20 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}] FlashGet GetFlash Class - e:\Program Files\FlashGet\getflash.dll [2007-05-18 163840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - E:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll [2008-09-22 161096] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-09 13680640] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=91000000 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "E:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="E:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe" "E:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="E:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe" "E:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="E:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe" "E:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="E:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe" "E:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="E:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe" "E:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="E:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "E:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="E:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "E:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="E:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe" "E:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="E:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe" "E:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="E:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "E:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="E:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe" "E:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="E:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" "C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb" "C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray" "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "E:\Program Files\WapSter\WapSter AQQ\AQQ.exe"="E:\Program Files\WapSter\WapSter AQQ\AQQ.exe:*:Enabled:AQQ" "E:\Program Files\FlashGet\flashget.exe"="E:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget" "E:\Program Files\uTorrent\uTorrent.exe"="E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "E:\Gry\Pro Evolution Soccer 2008\PES2008.exe"="E:\Gry\Pro Evolution Soccer 2008\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "E:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe"="E:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "E:\Program Files\SopCast\adv\SopAdver.exe"="E:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver" "E:\Program Files\SopCast\SopCast.exe"="E:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application" "E:\Gry\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\biahh.exe"="E:\Gry\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\biahh.exe:*:Disabled:biahh" "E:\Gry\Ubisoft\Far Cry 2\bin\FarCry2.exe"="E:\Gry\Ubisoft\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2" "E:\Gry\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"="E:\Gry\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater" "E:\Gry\Ubisoft\Far Cry 2\bin\FC2Editor.exe"="E:\Gry\Ubisoft\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "E:\Gry\Codemasters\DiRT\DiRT.exe"="E:\Gry\Codemasters\DiRT\DiRT.exe:*:Disabled:DiRT Executable" "E:\Gry\Codemasters\GRID\GRID.exe"="E:\Gry\Codemasters\GRID\GRID.exe:*:Enabled:GRID" "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "E:\Program Files\Sports Interactive\Football Manager 2009\fm.exe"="E:\Program Files\Sports Interactive\Football Manager 2009\fm.exe:*:Enabled:Football Manager 2009" "C:\Documents and Settings\iwan\Pulpit\MathCast089\MathCast.exe"="C:\Documents and Settings\iwan\Pulpit\MathCast089\MathCast.exe:*:Enabled:MathCast Equation Editor" "E:\Gry\KONAMI\Pro Evolution Soccer 2009\pes2009.exe"="E:\Gry\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "E:\Gry\Ubisoft\Prince of Persia\Prince of Persia.exe"="E:\Gry\Ubisoft\Prince of Persia\Prince of Persia.exe:*:Enabled:Prince of Persia Dx" "E:\Gry\Ubisoft\Prince of Persia\PrinceOfPersia_Launcher.exe"="E:\Gry\Ubisoft\Prince of Persia\PrinceOfPersia_Launcher.exe:*:Enabled:Prince of Persia Update" "E:\Gry\EA Games\Mirror's Edge\Binaries\MirrorsEdge.exe"="E:\Gry\EA Games\Mirror's Edge\Binaries\MirrorsEdge.exe:*:Enabled:Mirror's Edge™" "E:\Gry\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="E:\Gry\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Disabled:Grand Theft Auto IV" "E:\Gry\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="E:\Gry\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Disabled:Grand Theft Auto IV" "E:\Gry\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="E:\Gry\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Disabled:Rockstar Games Social Club" "E:\Gry\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe"="E:\Gry\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box" "E:\Gry\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe"="E:\Gry\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box" "E:\Gry\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe"="E:\Gry\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath " "C:\WINDOWS\TEMP\init.exe"="C:\WINDOWS\TEMP\init.exe:*:Enabled:ENABLE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" ======File associations====== .ini - open - "E:\Program Files\GetDiz\GetDiz.exe" "%1" ======List of files/folders created in the last 1 months====== 2009-02-23 15:55:27 ----D---- C:\rsit 2009-02-23 15:52:29 ----D---- C:\WINDOWS\ERUNT 2009-02-23 15:52:29 ----D---- C:\WINDOWS\ERDNT 2009-02-23 15:52:29 ----D---- C:\ERDNT 2009-02-23 15:52:26 ----D---- C:\!FixIEDef 2009-02-23 15:23:10 ----A---- C:\combofix.exe 2009-02-22 23:36:06 ----A---- C:\WINDOWS\system32\h323log.txt 2009-02-22 22:57:05 ----SHD---- C:\WINDOWS\CSC 2009-02-22 22:51:24 ----A---- C:\WINDOWS\system32\hccoin.dll 2009-02-22 22:50:44 ----A---- C:\WINDOWS\system32\usbui.dll 2009-02-22 13:32:29 ----A---- C:\WINDOWS\system32\CSVer.dll 2009-02-22 13:27:09 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\DivX 2009-02-22 13:26:42 ----A---- C:\WINDOWS\system32\crypts.dll 2009-02-22 13:25:26 ----D---- C:\Program Files\DivX 2009-02-22 13:22:44 ----A---- C:\WINDOWS\system32\XCEEDZIP.DLL 2009-02-22 13:22:44 ----A---- C:\WINDOWS\system32\XceedCry.dll 2009-02-22 13:22:43 ----D---- C:\Program Files\Driver Magician 2009-02-21 16:10:14 ----D---- C:\WINDOWS\nview 2009-02-21 16:10:14 ----A---- C:\WINDOWS\system32\nvudisp.exe 2009-02-21 16:09:42 ----A---- C:\WINDOWS\system32\NVUNINST.EXE 2009-02-21 16:09:22 ----D---- C:\NVIDIA 2009-02-15 15:22:09 ----A---- C:\WINDOWS\Burnout(TM) Paradise The Ultimate Box Patch Log.txt 2009-02-15 15:14:03 ----A---- C:\WINDOWS\system32\d3dx10_40.dll 2009-02-15 15:14:03 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll 2009-02-15 15:14:02 ----A---- C:\WINDOWS\system32\XAudio2_3.dll 2009-02-15 15:14:02 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll 2009-02-15 15:14:02 ----A---- C:\WINDOWS\system32\xactengine3_3.dll 2009-02-15 15:14:02 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll 2009-02-15 15:14:02 ----A---- C:\WINDOWS\system32\D3DX9_40.dll 2009-02-11 21:29:38 ----D---- C:\WINDOWS\system32\IOSUBSYS 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nwiz.exe 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwssr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwss.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrszht.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrszhc.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrstr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsth.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrssv.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrssl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrssk.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsru.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsptb.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrspt.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrspl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsno.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsnl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsko.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsja.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsit.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrshu.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrshe.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsfr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsfi.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsesm.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrses.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrseng.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsel.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsde.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsda.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrscs.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwrsar.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwimg.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvwddi.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvvitvsr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvvitvs.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvsvc32.exe 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvshell.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrszht.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrszhc.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrstr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsth.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrssv.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrssl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrssk.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsru.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsptb.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrspt.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrspl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsno.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsnl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsko.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsja.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsit.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrshu.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrshe.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsfr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsfi.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsesm.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrses.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrseng.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsel.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsde.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsda.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrscs.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvrsar.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvoglnt.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmoblsr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmobls.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmctray.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmccssr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmccss.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmccsrs.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvmccs.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nview.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvgamesr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvgames.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvdspsch.exe 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvdispsr.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvdisps.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcuda.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcpluir.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcplui.exe 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcpl.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcolor.exe 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcodins.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvcod.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvappbar.exe 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nvapi.dll 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\keystone.exe 2009-02-01 18:26:15 ----D---- C:\WINDOWS\system32\Adobe 2009-01-26 14:07:07 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll 2009-01-26 14:07:04 ----HDC---- C:\WINDOWS\$NtUninstallWdf01007$ 2009-01-25 17:25:15 ----D---- C:\Program Files\Common Files\PCSuite 2009-01-25 17:25:14 ----D---- C:\Program Files\Common Files\Nokia 2009-01-25 17:24:54 ----D---- C:\Program Files\PC Connectivity Solution 2009-01-25 17:24:44 ----A---- C:\WINDOWS\system32\wdfcoinstaller01007.dll ======List of files/folders modified in the last 1 months====== 2009-02-23 15:52:56 ----D---- C:\WINDOWS\Temp 2009-02-23 15:52:29 ----D---- C:\WINDOWS 2009-02-23 15:52:26 ----D---- C:\WINDOWS\system32 2009-02-23 15:41:02 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-02-23 15:17:27 ----A---- C:\WINDOWS\IE4 Error Log.txt 2009-02-23 15:12:47 ----A---- C:\WINDOWS\ntbtlog.txt 2009-02-23 14:59:55 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\uTorrent 2009-02-23 14:33:58 ----A---- C:\WINDOWS\NeroDigital.ini 2009-02-23 13:51:32 ----D---- C:\Program Files\SkanerOnline 2009-02-23 12:50:11 ----D---- C:\WINDOWS\system32\CatRoot2 2009-02-23 12:49:48 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\Skype 2009-02-23 12:27:07 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\skypePM 2009-02-22 23:41:58 ----D---- C:\WINDOWS\Prefetch 2009-02-22 23:22:53 ----D---- C:\WINDOWS\system32\drivers 2009-02-22 23:20:57 ----SHD---- C:\WINDOWS\Installer 2009-02-22 23:20:57 ----HD---- C:\WINDOWS\inf 2009-02-22 23:20:56 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\MegauploadToolbar 2009-02-22 23:20:56 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\EmailNotifier 2009-02-22 23:08:34 ----D---- C:\WINDOWS\network diagnostic 2009-02-22 22:49:16 ----D---- C:\WINDOWS\system32\CatRoot 2009-02-22 22:40:25 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\OpenOffice.org2 2009-02-22 13:32:46 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-02-22 13:26:24 ----RD---- C:\Program Files 2009-02-22 13:25:34 ----HD---- C:\Config.Msi 2009-02-22 13:24:21 ----D---- C:\tmp 2009-02-21 16:11:00 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-02-21 16:10:41 ----D---- C:\Program Files\AGEIA Technologies 2009-02-21 16:10:18 ----D---- C:\WINDOWS\Help 2009-02-15 15:14:04 ----D---- C:\WINDOWS\system32\DirectX 2009-02-15 15:13:54 ----RSD---- C:\WINDOWS\assembly 2009-02-14 16:00:09 ----D---- C:\Documents and Settings 2009-02-13 15:43:23 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\PC Suite 2009-02-11 19:35:33 ----SD---- C:\Documents and Settings\iwan\Dane aplikacji\Microsoft 2009-02-09 13:18:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll 2009-02-06 12:08:12 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\Nokia 2009-02-03 15:57:03 ----A---- C:\WINDOWS\unins000.exe 2009-02-01 18:27:39 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\Macromedia 2009-02-01 18:27:39 ----D---- C:\Documents and Settings\iwan\Dane aplikacji\Adobe 2009-02-01 18:27:38 ----D---- C:\WINDOWS\system32\Macromed 2009-02-01 18:26:16 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-01-26 14:08:30 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-01-25 17:25:26 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-01-25 17:25:15 ----D---- C:\Program Files\Common Files 2009-01-25 17:24:03 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Installations ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448] R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\e:\Program Files\UltraISO\drivers\ISODrive.sys [] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 DynCal;Dynamic Calibration Service; C:\WINDOWS\system32\drivers\Dyncal.sys [2005-09-26 8576] R3 HDAudBus;Sterownik magistrali Microsoft UAA dla High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-06-22 4432384] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2005-11-10 12160] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-09 6307328] R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-04-14 94592] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Standardowy sterownik koncentratora USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 ZSMC301b;Vimicro USB PC Camera (VC0305); C:\WINDOWS\System32\Drivers\usbVM31b.sys [2004-08-17 91263] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024] S3 DualCoreCenter;DualCoreCenter; \??\e:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys [] S3 GMSIPCI;GMSIPCI; \??\H:\INSTALL\GMSIPCI.SYS [] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880] S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664] S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816] S3 RushTopDevice2;RushTopDevice2; \??\e:\Program Files\MSI\DualCoreCenter\RushTop.sys [] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136] S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2005-08-17 58352] S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272] S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232] S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064] S3 usb_rndisx;Karta USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112] S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064] S3 usbstor;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-11-06 28672] S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-20 152984] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-02-17 73728] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-09 163908] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632] R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-11-23 66872] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] S2 msupdate;Microsoft security update service; c:\windows\system32\msvcrtd.exe [] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664] S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 23 Lut 2009, 20:52

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 11 · przez **iwan59** 23 Lut 2009, 23:48

Przy włączaniu wwdc.exe miałem taki komunikat:

, ale porty poblokowałem tak jak w opisie było napisane.
Seconfig XP użyłem również tak jak w opisie było napisne.

Oto raport z SDFix-a:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by iwan on 2009-02-23 at 22:14 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\552269~1 - Deleted C:\autorun.inf - Deleted C:\WINDOWS\system32\~.exe - Deleted C:\WINDOWS\autorun.inf - Deleted C:\WINDOWS\system\mmtaskclean.log - Deleted C:\WINDOWS\system\svchost.exe - Deleted C:\WINDOWS\system\win32in.dll - Deleted C:\WINDOWS\system\win32out.dll - Deleted C:\WINDOWS\system\wupdmgr.exe - Deleted C:\WINDOWS\system32\crypts.dll - Deleted C:\WINDOWS\system32\explorxp.exe - Deleted C:\WINDOWS\system32\settings.dll - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-23 22:20:58 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... disk error: C:\WINDOWS\system32\config\system, 0 scanning hidden registry entries ... disk error: C:\WINDOWS\system32\config\software, 0 disk error: C:\Documents and Settings\iwan\ntuser.dat, 0 scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe" "E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="E:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "E:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"="E:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe:*:Enabled:AQQ" "E:\\Program Files\\FlashGet\\flashget.exe"="E:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "E:\\Program Files\\uTorrent\\uTorrent.exe"="E:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "E:\\Gry\\Pro Evolution Soccer 2008\\PES2008.exe"="E:\\Gry\\Pro Evolution Soccer 2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "E:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"="E:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "E:\\Program Files\\SopCast\\adv\\SopAdver.exe"="E:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "E:\\Program Files\\SopCast\\SopCast.exe"="E:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "E:\\Gry\\Ubisoft\\Gearbox Software\\Brothers in Arms - Hell's Highway\\Binaries\\biahh.exe"="E:\\Gry\\Ubisoft\\Gearbox Software\\Brothers in Arms - Hell's Highway\\Binaries\\biahh.exe:*:Disabled:biahh" "E:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"="E:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe:*:Enabled:Far Cry 2" "E:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"="E:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater" "E:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"="E:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe:*:Enabled:Editor" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "E:\\Gry\\Codemasters\\DiRT\\DiRT.exe"="E:\\Gry\\Codemasters\\DiRT\\DiRT.exe:*:Disabled:DiRT Executable" "E:\\Gry\\Codemasters\\GRID\\GRID.exe"="E:\\Gry\\Codemasters\\GRID\\GRID.exe:*:Enabled:GRID" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "E:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"="E:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe:*:Enabled:Football Manager 2009" "C:\\Documents and Settings\\iwan\\Pulpit\\MathCast089\\MathCast.exe"="C:\\Documents and Settings\\iwan\\Pulpit\\MathCast089\\MathCast.exe:*:Enabled:MathCast Equation Editor" "E:\\Gry\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"="E:\\Gry\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "E:\\Gry\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"="E:\\Gry\\Ubisoft\\Prince of Persia\\Prince of Persia.exe:*:Enabled:Prince of Persia Dx" "E:\\Gry\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"="E:\\Gry\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe:*:Enabled:Prince of Persia Update" "E:\\Gry\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"="E:\\Gry\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe:*:Enabled:Mirror's Edget" "E:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"="E:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe:*:Disabled:Grand Theft Auto IV" "E:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"="E:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe:*:Disabled:Grand Theft Auto IV" "E:\\Gry\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"="E:\\Gry\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Disabled:Rockstar Games Social Club" "E:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"="E:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box" "E:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"="E:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box" "E:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"="E:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box" "C:\\WINDOWS\\TEMP\\init.exe"="C:\\WINDOWS\\TEMP\\init.exe:*:Enabled:ENABLE" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 5 Nov 2007 129,368 A.SHR --- "C:\explore.exe" Mon 5 Nov 2007 129,368 A.SHR --- "C:\WINDOWS\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll" [b]Finished![/b]

ComboFix nie uruchamia się u mnie. Jestem na koncie administratora. W trybie awaryjnym też brak reakcji na próbę włączenia.

Log z HiJackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:38:46, on 2009-02-23 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE E:\Program Files\Winamp\winampa.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\MICROS~2\rapimgr.exe E:\Program Files\Ad Muncher\AdMunch.exe E:\Program Files\Opera\opera.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nasza-klasa.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SnagIt Toolbar Loader - {00c6482d-c502-44c8-8409-fce54ad9c208} - E:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: flashget urlcatch - {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - e:\Program Files\FlashGet\jccatch.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - e:\Program Files\FlashGet\getflash.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - E:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Ad Muncher.lnk = E:\Program Files\Ad Muncher\AdMunch.exe O8 - Extra context menu item: &Download All with FlashGet - E:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: block frame with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame O8 - Extra context menu item: block image with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image O8 - Extra context menu item: block link with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link O8 - Extra context menu item: don't filter page with ad muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O8 - Extra context menu item: report page to the ad muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - e:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{BEB32B14-E89E-47CC-9A9C-C1DE79A4F20D}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: CreateProcess Service (createprocess) - Unknown owner - C:\WINDOWS\system\svchost.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6320 bytes

A tak wygląda mój problem. Zalogowałem się dopiero przy siódmym włączeniu, przy poprzednich sześciu wyglądało to tak: http://pl.tinypic.com/player.php?v=2dr6m44&s=5

**Posty:** 18165 · przez **wojtas** 25 Lut 2009, 16:36

Otworz notatnik i wklej w nim to:

File::
C:\explore.exe
D:\explore.exe
E:\explore.exe

Folder::
C:\WINDOWS\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania. a jak nie da rady to:

sciagnij dafta i go zastosuj

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

C:\explore.exe
D:\explore.exe
E:\explore.exe

Folders to delete:

C:\WINDOWS\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

**Posty:** 11 · przez **iwan59** 26 Lut 2009, 01:24

ComboFix nie działa nadal.
Dafta nie ma pod tym adresem.
Log z aveneger:

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. Hidden driver "UACd.sys" found! ImagePath: \systemroot\system32\drivers\UACkrgiebxx.sys Start Type: 1 (System) Rootkit scan completed. File "C:\explore.exe" deleted successfully. File "D:\explore.exe" deleted successfully. File "E:\explore.exe" deleted successfully. Folder "C:\WINDOWS\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}" deleted successfully. Completed script processing. ******************* Finished! Terminate.

Czarny ekran jest nadal.

**Posty:** 18165 · przez **wojtas** 26 Lut 2009, 17:15

uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

C:\WINDOWS\system32\drivers\UACkrgiebxx.sys
F:\explore.exe

Drivers to unload:

UACd.sys

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt
oraz log z combofixa ( zmien nazwe jego np . programosy.exe lub na lol.com i sprobuj odpalic ) jesli nie to log z rsita lecz lepiej bedzie jak combofixa podasz

**Posty:** 11 · przez **iwan59** 26 Lut 2009, 21:15

Avenger:

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. Hidden driver "UACd.sys" found! ImagePath: \systemroot\system32\drivers\UACkrgiebxx.sys Start Type: 4 (Disabled) Rootkit scan completed. File "C:\WINDOWS\system32\drivers\UACkrgiebxx.sys" deleted successfully. File "F:\explore.exe" deleted successfully. Driver "UACd.sys" deleted successfully. Completed script processing. ******************* Finished! Terminate.

ComboFix odpalił pod inną nazwą.

Kod: Zaznacz wszystko: ComboFix 09-02-21.01 - iwan 2009-02-26 20:03:46.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1689 [GMT 1:00] Uruchomiony z: C:\programosy.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\iwan\Dane aplikacji\EurekaLog C:\explore.exe c:\windows\IE4 Error Log.txt c:\windows\SW_Win2000X24.DLL c:\windows\system\mmtaskclean.log c:\windows\system\svchost.exe c:\windows\system\win32in.dll c:\windows\system\win32out.dll c:\windows\system\wupdmgr.exe c:\windows\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D} c:\windows\system32\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll c:\windows\system32\SkypeComm.dll c:\windows\system32\taskmagr.exe c:\windows\system32\UACmkhbyknd.dll c:\windows\system32\UACogqjeqon.dll c:\windows\system32\UACpulqyqmq.dat c:\windows\system32\UACwiboxvkb.dll c:\windows\system32\wmdmpmsvc.dll D:\Autorun.inf D:\explore.exe E:\Autorun.inf E:\explore.exe F:\Autorun.inf F:\explore.exe ----- BITS: Możliwe zainfekowane strony ----- hxxp://shefo2.fileave.com . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_createprocess -------\Legacy_ISODRIVE -------\Service_createprocess -------\Service_ISODrive ((((((((((((((((((((((((( Pliki utworzone od 2009-01-26 do 2009-02-26 ))))))))))))))))))))))))))))))) . 2009-02-23 23:36 . 2009-02-23 23:36 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\LightScribe 2009-02-23 23:31 . 2009-02-23 23:31 <DIR> d-------- c:\program files\LightScribe Template Labeler 2009-02-23 22:14 . 2009-02-23 22:14 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-02-23 22:09 . 2009-02-23 22:21 <DIR> d-------- C:\SDFix 2009-02-23 21:25 . 2009-02-23 21:26 <DIR> d-------- c:\documents and settings\iwan\Dane aplikacji\Winamp 2009-02-23 17:33 . 2009-02-23 17:33 <DIR> d-------- c:\program files\Haali 2009-02-23 17:31 . 2009-02-23 17:31 <DIR> d-------- c:\program files\K-Lite Codec Pack 2009-02-23 17:31 . 2008-11-06 17:37 3,596,288 --a------ c:\windows\system32\qt-dx331.dll 2009-02-23 16:08 . 2005-05-03 11:43 69,632 -r------- c:\windows\Alcmtr.exe 2009-02-23 15:55 . 2009-02-23 15:55 <DIR> d-------- C:\rsit 2009-02-23 15:52 . 2009-02-23 22:12 <DIR> d-------- c:\windows\ERUNT 2009-02-23 15:52 . 2009-02-23 15:52 <DIR> d-------- C:\ERDNT 2009-02-23 15:52 . 2009-02-23 15:52 <DIR> d-------- C:\!FixIEDef 2009-02-23 15:23 . 2009-02-23 15:23 2,924,943 -ra------ C:\lol.com 2009-02-22 23:14 . 2009-02-22 23:14 103 -ra------ c:\windows\amunres.lsl 2009-02-22 22:51 . 2008-04-13 23:15 30,208 --a------ c:\windows\system32\drivers\usbehci.sys 2009-02-22 22:51 . 2008-04-14 21:50 7,168 --a------ c:\windows\system32\hccoin.dll 2009-02-22 22:50 . 2008-04-13 23:15 143,872 --a------ c:\windows\system32\drivers\usbport.sys 2009-02-22 22:50 . 2008-04-14 21:50 77,312 --a------ c:\windows\system32\usbui.dll 2009-02-22 22:50 . 2008-04-13 23:15 59,520 --a------ c:\windows\system32\drivers\usbhub.sys 2009-02-22 22:50 . 2008-04-13 23:15 20,608 --a------ c:\windows\system32\drivers\usbuhci.sys 2009-02-22 22:49 . 2008-04-14 00:10 96,512 --a------ c:\windows\system32\drivers\atapi.sys 2009-02-22 22:49 . 2008-04-14 22:03 68,608 --a------ c:\windows\system32\drivers\pci.sys 2009-02-22 22:49 . 2008-04-14 00:10 24,960 --a------ c:\windows\system32\drivers\pciidex.sys 2009-02-22 22:49 . 2005-11-10 05:45 3,456 --a------ c:\windows\system32\drivers\pciide.sys 2009-02-22 13:32 . 2008-12-04 09:31 53,248 --a------ c:\windows\system32\CSVer.dll 2009-02-22 13:27 . 2009-02-26 19:24 81,408 --a------ c:\windows\system32\UACsxbrfvlh.dll 2009-02-22 13:27 . 2009-02-26 16:01 5,164 --a------ c:\windows\system32\uacinit.dll 2009-02-22 13:26 . 2009-02-24 07:41 0 --a------ c:\windows\system32\drivers\21e9706.sys 2009-02-22 13:25 . 2009-02-22 23:25 <DIR> d-------- c:\program files\DivX 2009-02-22 13:22 . 2009-02-22 13:22 <DIR> d-------- c:\program files\Driver Magician 2009-02-22 13:22 . 2004-09-28 11:13 526,184 --a------ c:\windows\system32\XceedCry.dll 2009-02-22 13:22 . 2005-01-12 11:19 456,536 --a------ c:\windows\system32\XCEEDZIP.DLL 2009-02-22 13:22 . 2004-03-09 00:00 132,880 --a------ c:\windows\system32\Msinet.ocx 2009-02-22 13:22 . 2004-08-11 15:55 110,602 --a------ c:\windows\system32\xcdsfx32.bin 2009-02-21 16:10 . 2009-02-21 16:10 <DIR> d-------- c:\windows\nview 2009-02-21 16:10 . 2009-02-09 13:18 453,152 --a------ c:\windows\system32\nvudisp.exe 2009-02-21 16:10 . 2009-02-26 20:06 210,919 --a------ c:\windows\system32\nvapps.xml 2009-02-21 16:10 . 2009-02-09 13:18 18,795 --a------ c:\windows\system32\nvdisp.nvu 2009-02-21 16:09 . 2009-02-21 16:09 <DIR> d-------- C:\NVIDIA 2009-02-21 16:09 . 2009-02-05 10:54 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2009-02-15 15:14 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll 2009-02-15 15:14 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll 2009-02-15 15:14 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll 2009-02-15 15:14 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll 2009-02-15 15:14 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll 2009-02-15 15:14 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll 2009-02-15 15:14 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll 2009-02-11 21:29 . 2009-02-11 21:29 <DIR> d-------- c:\windows\system32\IOSUBSYS 2009-02-10 20:08 . 2009-02-10 20:08 230,424 --a------ c:\windows\[u]0[/u]0000000.STI 2009-02-03 15:57 . 2009-02-03 15:57 656 --a------ c:\windows\unins000.dat 2009-02-01 18:26 . 2009-02-01 18:55 <DIR> d-------- c:\windows\system32\Adobe 2009-01-26 14:07 . 2008-03-21 13:57 14,640 --------- c:\windows\system32\spmsgXP_2k3.dll 2009-01-26 14:07 . 2009-01-26 14:07 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-01-26 14:07 . 2009-01-26 14:07 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-26 17:24 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\uTorrent 2009-02-26 11:16 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\Skype 2009-02-26 11:13 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\skypePM 2009-02-25 15:09 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\OpenOffice.org2 2009-02-23 22:28 --------- d-----w c:\program files\Common Files\LightScribe 2009-02-23 15:08 --------- d-----w c:\program files\Realtek 2009-02-23 12:51 --------- d-----w c:\program files\SkanerOnline 2009-02-22 22:20 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\MegauploadToolbar 2009-02-22 22:20 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\EmailNotifier 2009-02-21 15:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-21 15:10 --------- d-----w c:\program files\AGEIA Technologies 2009-02-13 14:43 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\PC Suite 2009-02-09 12:18 6,307,328 ----a-w c:\windows\system32\drivers\nv4_mini.sys 2009-02-06 11:08 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\Nokia 2009-02-03 14:57 72,748 ----a-w c:\windows\unins000.exe 2009-01-25 16:25 --------- d-----w c:\program files\Common Files\PCSuite 2009-01-25 16:25 --------- d-----w c:\program files\Common Files\Nokia 2009-01-25 16:24 --------- d-----w c:\program files\PC Connectivity Solution 2009-01-25 16:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations 2009-01-20 19:25 --------- d-----w c:\program files\Java 2009-01-11 21:29 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\Apple Computer 2009-01-11 21:28 --------- d-----w c:\program files\Apple Software Update 2009-01-11 21:28 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2009-01-09 11:55 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-26 12:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\KONAMI 2008-12-07 20:48 45,056 ----a-w c:\windows\NCUNINST.EXE 2008-10-29 15:34 22,328 ----a-w c:\documents and settings\iwan\Dane aplikacji\PnkBstrK.sys 2008-10-03 17:47 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640] "WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-01-15 37376] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\iwan\Menu Start\Programy\Autostart\ Ad Muncher.lnk - e:\program files\Ad Muncher\AdMunch.exe [2007-11-03 779776] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "e:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "e:\\Program Files\\FlashGet\\flashget.exe"= "e:\\Program Files\\uTorrent\\uTorrent.exe"= "e:\\Gry\\Pro Evolution Soccer 2008\\PES2008.exe"= "e:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "e:\\Program Files\\SopCast\\SopCast.exe"= "e:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"= "e:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"= "e:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "e:\\Gry\\Codemasters\\GRID\\GRID.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "e:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"= "e:\\Gry\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "e:\\Gry\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"= "e:\\Gry\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"= "e:\\Gry\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"= "e:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "e:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "e:\\Gry\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "e:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"= "e:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"= "e:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\DynCal.sys [2005-09-26 8576] S0 roddyh;roddyh;c:\windows\system32\drivers\lpjcmqh.sys --> c:\windows\system32\drivers\lpjcmqh.sys [?] S1 21e9706;21e9706;c:\windows\system32\drivers\21e9706.sys [2009-02-22 0] S3 DualCoreCenter;DualCoreCenter;\??\e:\program files\MSI\DualCoreCenter\NTGLM7X.sys --> e:\program files\MSI\DualCoreCenter\NTGLM7X.sys [?] S3 RushTopDevice2;RushTopDevice2;\??\e:\program files\MSI\DualCoreCenter\RushTop.sys --> e:\program files\MSI\DualCoreCenter\RushTop.sys [?] S3 setupntglm7x;SetupNTGLM7X;\??\h:\ntglm7x.sys --> h:\NTGLM7X.sys [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb0106c-faab-11dd-9d3a-0019dbf38d8a}] \shell\autorun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880d85-aad9-4558-abdc-2ab1552d831f}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file) WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download All with FlashGet - e:\program files\FlashGet\jc_all.htm IE: &Download with FlashGet - e:\program files\FlashGet\jc_link.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Block frame with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame IE: Block image with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image IE: Block link with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link IE: Don't filter page with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude IE: Pobierz za pomocą Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm IE: Report page to the Ad Muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-26 20:07:07 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-796845957-1592454029-725345543-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE] "Currency"=dword:0000001c "GameDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\games" "ShortlistDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\shortlists" "ScreenshotsDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009" "SaveDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\" "HistoryDir"="e:\\Temp\\FM09-dodatki\\FM Genie Scout 2009 XE\\History Points" "LangDB"="e:\\Program Files\\Sports Interactive\\Football Manager 2009\\data\\updates\\update-910\\db\\910\\lang_db.dat" "LastSaveGame"="" "Language"="English" "LoadLangDB"=dword:00000001 "CompressHistoryPoints"=dword:00000000 "HighlightedAttributes"=dword:00000000 "MinCondition"=dword:00000050 "SkinName"="Champions League" "LastUpdateCheck"=dword:00000000 "HighQualityGUI"=dword:00000001 "AutomaticallyUpdateCheck"=dword:00000001 "AdvancedGeneration"=dword:00000000 "TranslateStaffSkills"=dword:00000001 "TranslatePlayerSkills"=dword:00000001 "TranslatePositions"=dword:00000001 "ShowHistory"=dword:00000001 "Version"=dword:00000066 "UniqueID"="C5-E480-E03F" "UseProxy"=dword:00000000 "ProxyHost"="" "ProxyPort"="" "UseAuthentication"=dword:00000000 "UserName"="" "UserPassword"="" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\progra~1\MICROS~2\rapimgr.exe c:\windows\system32\notepad.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-02-26 20:08:06 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-02-26 19:08:04 Przed: 6 599 098 368 bajtów wolnych Po: 6,637,297,664 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 297

**Posty:** 18165 · przez **wojtas** 27 Lut 2009, 14:47

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\UACsxbrfvlh.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\drivers\lpjcmqh.sys

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb0106c-faab-11dd-9d3a-0019dbf38d8a}]

Driver::
roddyh

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

te plik/i :

c:\windows\system32\drivers\21e9706.sys

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 11 · przez **iwan59** 27 Lut 2009, 16:35

http://virusscan.jotti.org/

Kod: Zaznacz wszystko: The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

http://www.virustotal.com/

Kod: Zaznacz wszystko: 0 bytes size received / Se ha recibido un archivo vacio

Zaraz dodam log z ComboFix.

EDIT:

Kod: Zaznacz wszystko: ComboFix 09-02-26.02 - iwan 2009-02-27 15:32:12.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1550 [GMT 1:00] Uruchomiony z: C:\programosy.exe Użyto następujących komend :: C:\CFScript.txt * Utworzono nowy punkt przywracania FILE :: c:\windows\system32\drivers\lpjcmqh.sys c:\windows\system32\uacinit.dll c:\windows\system32\UACsxbrfvlh.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\uacinit.dll c:\windows\system32\UACsxbrfvlh.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_roddyh ((((((((((((((((((((((((( Pliki utworzone od 2009-01-27 do 2009-02-27 ))))))))))))))))))))))))))))))) . 2009-02-23 23:36 . 2009-02-23 23:36 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\LightScribe 2009-02-23 23:31 . 2009-02-23 23:31 <DIR> d-------- c:\program files\LightScribe Template Labeler 2009-02-23 22:14 . 2009-02-23 22:14 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-02-23 22:09 . 2009-02-23 22:21 <DIR> d-------- C:\SDFix 2009-02-23 21:25 . 2009-02-23 21:26 <DIR> d-------- c:\documents and settings\iwan\Dane aplikacji\Winamp 2009-02-23 17:33 . 2009-02-23 17:33 <DIR> d-------- c:\program files\Haali 2009-02-23 17:31 . 2009-02-23 17:31 <DIR> d-------- c:\program files\K-Lite Codec Pack 2009-02-23 17:31 . 2008-11-06 17:37 3,596,288 --a------ c:\windows\system32\qt-dx331.dll 2009-02-23 16:08 . 2005-05-03 11:43 69,632 -r------- c:\windows\Alcmtr.exe 2009-02-23 15:55 . 2009-02-23 15:55 <DIR> d-------- C:\rsit 2009-02-23 15:52 . 2009-02-23 22:12 <DIR> d-------- c:\windows\ERUNT 2009-02-23 15:52 . 2009-02-23 15:52 <DIR> d-------- C:\ERDNT 2009-02-23 15:52 . 2009-02-23 15:52 <DIR> d-------- C:\!FixIEDef 2009-02-23 15:23 . 2009-02-27 15:30 2,925,850 -ra------ C:\programosy.exe 2009-02-22 23:14 . 2009-02-22 23:14 103 -ra------ c:\windows\amunres.lsl 2009-02-22 22:51 . 2008-04-13 23:15 30,208 --a------ c:\windows\system32\drivers\usbehci.sys 2009-02-22 22:51 . 2008-04-14 21:50 7,168 --a------ c:\windows\system32\hccoin.dll 2009-02-22 22:50 . 2008-04-13 23:15 143,872 --a------ c:\windows\system32\drivers\usbport.sys 2009-02-22 22:50 . 2008-04-14 21:50 77,312 --a------ c:\windows\system32\usbui.dll 2009-02-22 22:50 . 2008-04-13 23:15 59,520 --a------ c:\windows\system32\drivers\usbhub.sys 2009-02-22 22:50 . 2008-04-13 23:15 20,608 --a------ c:\windows\system32\drivers\usbuhci.sys 2009-02-22 22:49 . 2008-04-14 00:10 96,512 --a------ c:\windows\system32\drivers\atapi.sys 2009-02-22 22:49 . 2008-04-14 22:03 68,608 --a------ c:\windows\system32\drivers\pci.sys 2009-02-22 22:49 . 2008-04-14 00:10 24,960 --a------ c:\windows\system32\drivers\pciidex.sys 2009-02-22 22:49 . 2005-11-10 05:45 3,456 --a------ c:\windows\system32\drivers\pciide.sys 2009-02-22 13:32 . 2008-12-04 09:31 53,248 --a------ c:\windows\system32\CSVer.dll 2009-02-22 13:26 . 2009-02-24 07:41 0 --a------ c:\windows\system32\drivers\21e9706.sys 2009-02-22 13:25 . 2009-02-22 23:25 <DIR> d-------- c:\program files\DivX 2009-02-22 13:22 . 2009-02-22 13:22 <DIR> d-------- c:\program files\Driver Magician 2009-02-22 13:22 . 2004-09-28 11:13 526,184 --a------ c:\windows\system32\XceedCry.dll 2009-02-22 13:22 . 2005-01-12 11:19 456,536 --a------ c:\windows\system32\XCEEDZIP.DLL 2009-02-22 13:22 . 2004-03-09 00:00 132,880 --a------ c:\windows\system32\Msinet.ocx 2009-02-22 13:22 . 2004-08-11 15:55 110,602 --a------ c:\windows\system32\xcdsfx32.bin 2009-02-21 16:10 . 2009-02-21 16:10 <DIR> d-------- c:\windows\nview 2009-02-21 16:10 . 2009-02-09 13:18 453,152 --a------ c:\windows\system32\nvudisp.exe 2009-02-21 16:10 . 2009-02-27 15:41 210,919 --a------ c:\windows\system32\nvapps.xml 2009-02-21 16:10 . 2009-02-09 13:18 18,795 --a------ c:\windows\system32\nvdisp.nvu 2009-02-21 16:09 . 2009-02-21 16:09 <DIR> d-------- C:\NVIDIA 2009-02-21 16:09 . 2009-02-05 10:54 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2009-02-15 15:14 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll 2009-02-15 15:14 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll 2009-02-15 15:14 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll 2009-02-15 15:14 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll 2009-02-15 15:14 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll 2009-02-15 15:14 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll 2009-02-15 15:14 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll 2009-02-11 21:29 . 2009-02-11 21:29 <DIR> d-------- c:\windows\system32\IOSUBSYS 2009-02-10 20:08 . 2009-02-10 20:08 230,424 --a------ c:\windows\[u]0[/u]0000000.STI 2009-02-03 15:57 . 2009-02-03 15:57 656 --a------ c:\windows\unins000.dat 2009-02-01 18:26 . 2009-02-01 18:55 <DIR> d-------- c:\windows\system32\Adobe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-27 14:30 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\uTorrent 2009-02-27 12:44 --------- d-----w c:\program files\Java 2009-02-26 11:16 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\Skype 2009-02-26 11:13 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\skypePM 2009-02-25 15:09 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\OpenOffice.org2 2009-02-23 22:28 --------- d-----w c:\program files\Common Files\LightScribe 2009-02-23 15:08 --------- d-----w c:\program files\Realtek 2009-02-23 12:51 --------- d-----w c:\program files\SkanerOnline 2009-02-22 22:20 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\MegauploadToolbar 2009-02-22 22:20 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\EmailNotifier 2009-02-21 15:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-21 15:10 --------- d-----w c:\program files\AGEIA Technologies 2009-02-13 14:43 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\PC Suite 2009-02-09 12:18 6,307,328 ----a-w c:\windows\system32\drivers\nv4_mini.sys 2009-02-06 11:08 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\Nokia 2009-02-03 14:57 72,748 ----a-w c:\windows\unins000.exe 2009-01-26 13:07 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-01-26 13:07 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-01-25 16:25 --------- d-----w c:\program files\Common Files\PCSuite 2009-01-25 16:25 --------- d-----w c:\program files\Common Files\Nokia 2009-01-25 16:24 --------- d-----w c:\program files\PC Connectivity Solution 2009-01-25 16:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations 2009-01-11 21:29 --------- d-----w c:\documents and settings\iwan\Dane aplikacji\Apple Computer 2009-01-11 21:28 --------- d-----w c:\program files\Apple Software Update 2009-01-11 21:28 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2009-01-09 11:55 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-07 20:48 45,056 ----a-w c:\windows\NCUNINST.EXE 2008-10-29 15:34 22,328 ----a-w c:\documents and settings\iwan\Dane aplikacji\PnkBstrK.sys 2008-10-03 17:47 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((( SnapShot@2009-02-26_20.07.43.51 ))))))))))))))))))))))))))))))))))))))))) . - 2009-01-16 16:19:40 202,168 ------w c:\windows\system32\Adobe\Director\swdir.dll + 2009-01-16 18:25:34 202,168 ----a-w c:\windows\system32\Adobe\Director\swdir.dll - 2008-10-05 03:24:02 3,695,008 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll + 2009-02-03 02:15:28 3,771,296 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll - 2008-10-05 03:24:04 235,936 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe + 2009-02-03 02:15:30 240,544 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe - 2009-02-08 13:03:29 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe + 2009-02-27 12:45:02 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe + 2009-02-27 14:37:45 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_65c.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640] "WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-01-15 37376] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-20 136600] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\iwan\Menu Start\Programy\Autostart\ Ad Muncher.lnk - e:\program files\Ad Muncher\AdMunch.exe [2007-11-03 779776] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "e:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "e:\\Program Files\\FlashGet\\flashget.exe"= "e:\\Program Files\\uTorrent\\uTorrent.exe"= "e:\\Gry\\Pro Evolution Soccer 2008\\PES2008.exe"= "e:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "e:\\Program Files\\SopCast\\SopCast.exe"= "e:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"= "e:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"= "e:\\Gry\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "e:\\Gry\\Codemasters\\GRID\\GRID.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "e:\\Program Files\\Sports Interactive\\Football Manager 2009\\fm.exe"= "e:\\Gry\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "e:\\Gry\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"= "e:\\Gry\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"= "e:\\Gry\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"= "e:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "e:\\Gry\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "e:\\Gry\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "e:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"= "e:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"= "e:\\Gry\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\DynCal.sys [2005-09-26 8576] S1 21e9706;21e9706;c:\windows\system32\drivers\21e9706.sys [2009-02-22 0] S3 DualCoreCenter;DualCoreCenter;\??\e:\program files\MSI\DualCoreCenter\NTGLM7X.sys --> e:\program files\MSI\DualCoreCenter\NTGLM7X.sys [?] S3 RushTopDevice2;RushTopDevice2;\??\e:\program files\MSI\DualCoreCenter\RushTop.sys --> e:\program files\MSI\DualCoreCenter\RushTop.sys [?] S3 setupntglm7x;SetupNTGLM7X;\??\h:\ntglm7x.sys --> h:\NTGLM7X.sys [?] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880d85-aad9-4558-abdc-2ab1552d831f}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download All with FlashGet - e:\program files\FlashGet\jc_all.htm IE: &Download with FlashGet - e:\program files\FlashGet\jc_link.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Block frame with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_frame IE: Block image with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_image IE: Block link with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_link IE: Don't filter page with Ad Muncher - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_exclude IE: Pobierz za pomocą Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm IE: Report page to the Ad Muncher developers - http://www.admuncher.com/request_will_be_intercepted_by/Ad_Muncher/browserextensions.pl?exbrowser=ie&exversion=0.4&pass=K5PN70AI&id=menu_ie_report TCP: {BEB32B14-E89E-47CC-9A9C-C1DE79A4F20D} = 217.30.129.149 217.30.137.200 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-27 15:41:08 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-796845957-1592454029-725345543-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE] "Currency"=dword:0000001c "GameDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\games" "ShortlistDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\shortlists" "ScreenshotsDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009" "SaveDir"="c:\\Documents and Settings\\iwan\\Moje dokumenty\\Sports Interactive\\Football Manager 2009\\" "HistoryDir"="e:\\Temp\\FM09-dodatki\\FM Genie Scout 2009 XE\\History Points" "LangDB"="e:\\Program Files\\Sports Interactive\\Football Manager 2009\\data\\updates\\update-910\\db\\910\\lang_db.dat" "LastSaveGame"="" "Language"="English" "LoadLangDB"=dword:00000001 "CompressHistoryPoints"=dword:00000000 "HighlightedAttributes"=dword:00000000 "MinCondition"=dword:00000050 "SkinName"="Champions League" "LastUpdateCheck"=dword:00000000 "HighQualityGUI"=dword:00000001 "AutomaticallyUpdateCheck"=dword:00000001 "AdvancedGeneration"=dword:00000000 "TranslateStaffSkills"=dword:00000001 "TranslatePlayerSkills"=dword:00000001 "TranslatePositions"=dword:00000001 "ShowHistory"=dword:00000001 "Version"=dword:00000066 "UniqueID"="C5-E480-E03F" "UseProxy"=dword:00000000 "ProxyHost"="" "ProxyPort"="" "UseAuthentication"=dword:00000000 "UserName"="" "UserPassword"="" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\wscntfy.exe c:\progra~1\MICROS~2\rapimgr.exe . ************************************************************************** . Czas ukończenia: 2009-02-27 15:43:02 - komputer został uruchomiony ponownie [iwan] ComboFix-quarantined-files.txt 2009-02-27 14:43:00 ComboFix2.txt 2009-02-26 19:08:07 Przed: 6 421 241 856 bajtów wolnych Po: 6,430,347,264 bajtów wolnych 269

**Posty:** 18165 · przez **wojtas** 27 Lut 2009, 20:30

skasuj:

c:\windows\system32\drivers\21e9706.sys

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 11 · przez **iwan59** 28 Lut 2009, 21:36

1. Zrobione. Folderu 'Qboox' nie ma na C:\, ani na innych partycjach.
2.-4. Ok.
5. DrWeb.scv

Kod: Zaznacz wszystko: mstest.dll;c:\windows\system32;Trojan.DownLoad.12624;Usunięty.;

6.

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 sobota, 28 luty 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 3 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Saturday, February 28, 2009 15:23:13 Liczba wpisów: 1855767 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: C:\ D:\ E:\ F:\ H:\ Statystyki skanowania: Przeskanowanych plików: 165064 Nazwa zagrożenia: 3 Zainfekowanych obiektów: 4 Podejrzanych obiektów: 0 Czas skanowania: 02:35:26 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń c:\windows\system32\dmserver.dll/c:\windows\system32\dmserver.dll Zainfekowany: Trojan.Win32.Patched.dt 1 C:\WINDOWS\system32\dmserver.dll Zainfekowany: Trojan.Win32.Patched.dt 1 E:\Program Files\Trend Micro\HijackThis\backups\backup-20081117-173052-911.dll Zainfekowany: not-a-virus:AdWare.Win32.MegaSearch.aj 1 E:\Program Files\Trend Micro\HijackThis\backups\backup-20090223-135046-281.dll Zainfekowany: Trojan.Win32.BHO.jgx 1

FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7472 * * * ******************************************************************************** Created at 00:59:41 on Saturday, February 28, 2009 Time Zone : Logged On User : iwan Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 Procesor Intel Pentium III Xeon System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 16 GB System Drive Free : 6.64 GB Total Physical Memory: 2047 MB Free Physical Memory : 1549 MB Total Page File : 2047 MB Free Page File : 3695 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1966 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Tak na marginesie: czemu w tym logu mam "X64 Procesor Intel Pentium III Xeon"? Mój procesor to Core 2 Duo E8200.

**Posty:** 18165 · przez **wojtas** 01 Mar 2009, 10:48

skasuj:

E:\Program Files\Trend Micro\HijackThis\backups

sciagnij:

http://www.speedyshare.com/665626455.html

i umieść ten plik na dysku C

i podmien ten plik tym programem do lokalizacji tej:

C:\WINDOWS\system32\

**Posty:** 11 · przez **iwan59** 01 Mar 2009, 16:55

wojtas napisał(a):sciagnij:

http://www.speedyshare.com/665626455.html

"This file has been deleted for the following reason: too old."

**Posty:** 18165 · przez **wojtas** 01 Mar 2009, 19:02

to z tąd:

http://www.dlldump.com/download-dll-files_new.php/dllfiles/D/dmserver.dll/2600.2180.503.02/download.html

**Posty:** 11 · przez **iwan59** 01 Mar 2009, 23:03

Chyba już wszystko gra. Wielkie dzięki

Dodano Dzisiaj, 20:46:
To chyba jednak nie koniec. Nic nowego nie instalowałem. Nie uaktualniałem niczego. Błąd się pokazał podczas grania w PES2009(nie podczas właczania, lecz po ok 0,5h gry).