Problem z pobieraniem plików z sieci

**Posty:** 1495 · przez **Buszinio** 26 Paź 2008, 14:07

Witam! Od pewnego czasu nie mogę pobrać z sieci żadnego programu, wyskakują podczas przeglądania stron dziwne komunikaty typu reklamy. Podejrzewam, że wkradł mi się jakiś wirus. Proszę o pomoc.

oto log z Hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:00:05, on 2008-10-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\WinMgCt.exe C:\Program Files\Applications\wcs.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\CmWatch.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\algg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Patryk01\Pulpit\HiJackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windiwsfsearch.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windiwsfsearch.com/ie6.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://windiwsfsearch.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windiwsfsearch.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windiwsfsearch.com/ie6.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://windiwsfsearch.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windiwsfsearch.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windiwsfsearch.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdbbs.exe] C:\WINDOWS\system32\kdbbs.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [ares] "D:\Ares\Ares.exe" -h O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [wblogon] C:\WINDOWS\system32\algg.exe O4 - HKLM\..\Policies\Explorer\Run: [QuickTimeTask] C:\Program Files\Applications\wcs.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9BCA92D0-8A24-4476-9B1E-D4E286D121EC}: NameServer = 85.255.114.13,85.255.112.174 O17 - HKLM\System\CCS\Services\Tcpip\..\{CADCC701-7704-4715-B0AE-73856A3F1515}: NameServer = 85.255.114.13,85.255.112.174 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL vmcifu.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- End of file - 8186 bytes

**Posty:** 7956 · przez **Magik** 26 Paź 2008, 14:08

wklej log z combofixa i

program-szukajacy-trojanow-i-malware-vt97108.html

i mozemy zaczac rozmawiac

**Posty:** 1495 · przez **Buszinio** 26 Paź 2008, 14:20

Jest taki problem, że nie mogę go ściągnąc z żadnej ze stron

**Posty:** 7956 · przez **Magik** 26 Paź 2008, 14:24

Buszinio napisał(a):Jest taki problem, że nie mogę go ściągnąc z żadnej ze stron

kolego moglbys precyzowac swe wypowiedzi?? mam sie domyslac, ze chodzi Ci o combofix'a??

http://rapidshare.com/files/157691027/ComboFix.exe.html

**Posty:** 1495 · przez **Buszinio** 26 Paź 2008, 15:06

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-10-25.01 - Patryk01 2008-10-26 13:48:15.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.641 [GMT 1:00] Uruchomiony z: C:\Documents and Settings\Patryk01\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Program Files\Applications\wcs.exe C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0626A07 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]062711C C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]06273BC.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]06276B9.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]06278FC.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\resycled C:\resycled\boot.com C:\WINDOWS\system32\675873 C:\WINDOWS\system32\675873\675873.dll C:\WINDOWS\system32\awtsRhHa.dll C:\WINDOWS\system32\awtTnnNh.dll C:\WINDOWS\system32\kdbbs.exe C:\WINDOWS\system32\vtUmmNGy.dll C:\WINDOWS\system32\yGNmmUtv.ini C:\WINDOWS\system32\yGNmmUtv.ini2 D:\Autorun.inf D:\UPDATE.EXE . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-26 do 2008-10-26 ))))))))))))))))))))))))))))))) . 2008-10-26 13:59 . 2008-10-26 13:59 <DIR> d-------- C:\WINDOWS\system32\675873 2008-10-25 12:45 . 2008-10-25 12:45 27,904 --a------ C:\WINDOWS\system32\drivers\ndisprot.sys 2008-10-25 12:45 . 2008-10-25 12:45 20,992 --a------ C:\WINDOWS\system32\algg.exe 2008-10-25 12:44 . 2008-10-26 13:48 <DIR> d-------- C:\Program Files\Applications 2008-10-23 19:39 . 2007-04-23 14:54 100,488 -ra------ C:\WINDOWS\system32\drivers\s115mgmt.sys 2008-10-23 19:39 . 2007-04-23 14:54 98,568 -ra------ C:\WINDOWS\system32\drivers\s115obex.sys 2008-10-23 19:38 . 2007-04-23 14:54 108,680 -ra------ C:\WINDOWS\system32\drivers\s115mdm.sys 2008-10-23 19:38 . 2007-04-23 14:54 83,208 -ra------ C:\WINDOWS\system32\drivers\s115bus.sys 2008-10-23 19:38 . 2007-04-23 14:54 15,112 -ra------ C:\WINDOWS\system32\drivers\s115mdfl.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115whnt.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115wh.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115cmnt.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115cm.sys 2008-10-19 11:03 . 2008-10-19 11:03 <DIR> d-------- C:\Program Files\Common Files\Borland Shared 2008-10-11 09:45 . 2007-06-19 08:51 21,928 -ra------ C:\WINDOWS\system32\drivers\s816nd5.sys 2008-10-11 09:44 . 2007-06-19 08:51 107,304 -ra------ C:\WINDOWS\system32\drivers\s816mdm.sys 2008-10-11 09:44 . 2007-06-19 08:51 99,112 -ra------ C:\WINDOWS\system32\drivers\s816mgmt.sys 2008-10-11 09:44 . 2007-06-19 08:51 97,704 -ra------ C:\WINDOWS\system32\drivers\s816unic.sys 2008-10-11 09:44 . 2007-06-19 08:51 97,320 -ra------ C:\WINDOWS\system32\drivers\s816obex.sys 2008-10-11 09:44 . 2007-06-19 08:51 81,832 -ra------ C:\WINDOWS\system32\drivers\s816bus.sys 2008-10-11 09:44 . 2007-06-19 08:51 13,864 -ra------ C:\WINDOWS\system32\drivers\s816mdfl.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816whnt.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816wh.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816cmnt.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816cm.sys 2008-10-11 09:44 . 2007-06-19 08:51 9,768 -ra------ C:\WINDOWS\system32\drivers\s816cr.sys 2008-10-09 20:19 . 2008-10-09 20:41 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-09 20:15 . 2008-10-09 20:15 <DIR> d-------- C:\WINDOWS\system32\LogFiles . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 13:00 --------- d-----w C:\Documents and Settings\Patryk01\Dane aplikacji\Skype 2008-10-26 08:34 --------- d-----w C:\Documents and Settings\Patryk01\Dane aplikacji\skypePM 2008-10-25 11:45 --------- d-----w C:\Program Files\Opera 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll 2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll 2006-07-01 19:33 49,564 --shatr C:\WINDOWS\system32\WinMgCt.exe . ------- Sigcheck ------- 2008-04-14 18:21 510464 51fd2e13d723857b9ca239ae77150f48 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\winlogon.exe 2008-05-05 17:03 504832 033dfd0b69af3fbc60138c0ac5c75042 C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{030A0F33-5B99-482E-83F5-2EEB8457878B}] 2008-10-26 13:59 15872 --a------ C:\WINDOWS\system32\675873\675873.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Comrade.exe"="C:\Program Files\GameSpy\Comrade\Comrade.exe" [2007-05-27 36864] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-28 68856] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-05-30 21834536] "wblogon"="C:\WINDOWS\system32\algg.exe" [2008-10-25 20992] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-05-05 839680] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2008-05-05 565248] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\vtUmmNGy [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"= "D:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"= "D:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"= "D:\\eMule\\emule.exe"= "D:\\SopCast\\adv\\SopAdver.exe"= "D:\\SopCast\\SopCast.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\BearShare\\BearShare.exe"= "D:\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 116992] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 64000] S2 WinMgct;Windows Management Controllor;C:\WINDOWS\system32\WinMgCt.exe [2006-07-01 49564] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-10-09 29744] S3 Ndisprot;ArcNet NDIS Protocol Driver;C:\WINDOWS\system32\drivers\Ndisprot.sys [2008-10-25 27904] S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568] S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 81832] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 13864] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 107304] S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 99112] S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 21928] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 97320] S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 97704] S3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2004-07-13 48512] S3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-11-04 178913] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c1f1342-1abd-11dd-a3ff-4d6564696130}] \Shell\AutoRun\command - I:\USBNB.exe . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{6690A949-0104-4CE1-9034-14089A75AE07} - C:\WINDOWS\system32\awtTnnNh.dll BHO-{90EE7DD8-990E-40CD-AB67-AB58A4FAB61D} - C:\WINDOWS\system32\vtUmmNGy.dll HKCU-Run-ares - D:\Ares\Ares.exe HKLM-Run-C:\WINDOWS\system32\kdbbs.exe - C:\WINDOWS\system32\kdbbs.exe HKLM-Explorer_Run-QuickTimeTask - C:\Program Files\Applications\wcs.exe ShellExecuteHooks-{6690A949-0104-4CE1-9034-14089A75AE07} - C:\WINDOWS\system32\awtTnnNh.dll . ------- Skan uzupełniający ------- . R0 -: HKCU-Main,Start Page = hxxp://search.bearshare.com/pl/ R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://windiwsfsearch.com/search?q={searchTerms} R0 -: HKCU-Main,Default_Search_URL = hxxp://windiwsfsearch.com R0 -: HKLM-Main,Search Bar = hxxp://windiwsfsearch.com/ie6.html R0 -: HKLM-Main,SearchMigratedDefaultURL = hxxp://windiwsfsearch.com/search?q={searchTerms} R1 -: HKLM-Internet Explorer,SearchURL = hxxp://windiwsfsearch.com O8 -: E&ksportuj do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O17 -: HKLM\CCS\Interface\{CADCC701-7704-4715-B0AE-73856A3F1515}: NameServer = 83.238.255.76 213.241.79.37 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-26 13:59:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-10-26 14:01:58 - komputer został uruchomiony ponownie [Patryk01] ComboFix-quarantined-files.txt 2008-10-26 13:01:55 Przed: 20 872 015 872 bajtów wolnych Po: 21,985,570,816 bajtów wolnych 198 --- E O F --- 2008-10-24 21:02:52

FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6705 * * * ******************************************************************************** Created at 14:02:55 on Sunday, October 26, 2008 Time Zone : Logged On User : Patryk01 Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Sempron(tm) 2500+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 30 GB System Drive Free : 20.98 GB Total Physical Memory: 1023 MB Free Physical Memory : 699 MB Total Page File : 1023 MB Free Page File : 1472 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1973 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 8001 · przez **Okocza** 26 Paź 2008, 15:10

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\algg.exe Folder:: C:\WINDOWS\system32\675873 Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{030A0F33-5B99-482E-83F5-2EEB8457878B}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "wblogon"=-

wklejasz to do notatnika i zapisujesz jako CFScript.txt i przeciągasz na ikonkę combofix.exe

**Posty:** 7956 · przez **Magik** 26 Paź 2008, 15:17

W HJT w trybie awaryjnym na fix:

Kod: Zaznacz wszystko: C:\WINDOWS\system32\WinMgCt.exe C:\Program Files\Applications\wcs.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdbbs.exe] C:\WINDOWS\system32\kdbbs.exe O4 - HKCU\..\Run: [wblogon] C:\WINDOWS\system32\algg.exe O4 - HKLM\..\Policies\Explorer\Run: [QuickTimeTask] C:\Program Files\Applications\wcs.exe O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL vmcifu.dll

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\algg.exe C:\WINDOWS\system32\675873\675873.dll FOLDER:: C:\WINDOWS\system32\675873

Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Vesrion 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c1f1342-1abd-11dd-a3ff-4d6564696130}]

zapisz jako fix.reg i odpal

pzreskanuj obszar komputera i wklej raport

http://www.kaspersky.com/virusscanner

kolego Ty nie masz zadnego firewalla a ni antywirusa

**Posty:** 1495 · przez **Buszinio** 26 Paź 2008, 16:35

kaspersky raport

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, October 26, 2008 Operating System: Microsoft Windows XP Home Edition Dodatek Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, October 26, 2008 06:21:05 Records in database: 1347147 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - Critical Areas: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart C:\Documents and Settings\Patryk01\Menu Start\Programy\Autostart C:\Program Files C:\WINDOWS Scan statistics: Files scanned: 28290 Threat name: 1 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 00:32:28 File name / Threat name / Threats count C:\WINDOWS\system32\WinMgCt.exe/C:\WINDOWS\system32\WinMgCt.exe Infected: Trojan-PSW.Win32.QQPass.mx 1 C:\WINDOWS\system32\WinMgCt.exe Infected: Trojan-PSW.Win32.QQPass.mx 1 C:\WINDOWS\temp\gtmp Infected: Trojan-PSW.Win32.QQPass.mx 1 The selected area was scanned.

To nie mój komputer tylko kumpla i właśnie też mnie to zdziwiło, że nie ma antywirusa...

**Posty:** 7956 · przez **Magik** 26 Paź 2008, 16:40

sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\WinMgCt.exe

Plik -> zapisz jako -> CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

i wklej nowy log. ktory powstanie

**Posty:** 1495 · przez **Buszinio** 26 Paź 2008, 16:47

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-10-25.01 - Patryk01 2008-10-26 15:44:36.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.571 [GMT 1:00] Uruchomiony z: C:\Documents and Settings\Patryk01\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Patryk01\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\WINDOWS\system32\WinMgCt.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\WinMgCt.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-26 do 2008-10-26 ))))))))))))))))))))))))))))))) . 2008-10-26 14:23 . 2008-10-26 14:23 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-26 14:02 . 2008-10-26 14:02 <DIR> d-------- C:\!FixIEDef 2008-10-25 12:45 . 2008-10-25 12:45 27,904 --a------ C:\WINDOWS\system32\drivers\ndisprot.sys 2008-10-25 12:44 . 2008-10-26 14:28 <DIR> d-------- C:\Program Files\Applications 2008-10-23 19:39 . 2007-04-23 14:54 100,488 -ra------ C:\WINDOWS\system32\drivers\s115mgmt.sys 2008-10-23 19:39 . 2007-04-23 14:54 98,568 -ra------ C:\WINDOWS\system32\drivers\s115obex.sys 2008-10-23 19:38 . 2007-04-23 14:54 108,680 -ra------ C:\WINDOWS\system32\drivers\s115mdm.sys 2008-10-23 19:38 . 2007-04-23 14:54 83,208 -ra------ C:\WINDOWS\system32\drivers\s115bus.sys 2008-10-23 19:38 . 2007-04-23 14:54 15,112 -ra------ C:\WINDOWS\system32\drivers\s115mdfl.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115whnt.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115wh.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115cmnt.sys 2008-10-23 19:38 . 2007-04-23 14:54 12,424 -ra------ C:\WINDOWS\system32\drivers\s115cm.sys 2008-10-19 11:03 . 2008-10-19 11:03 <DIR> d-------- C:\Program Files\Common Files\Borland Shared 2008-10-11 09:45 . 2007-06-19 08:51 21,928 -ra------ C:\WINDOWS\system32\drivers\s816nd5.sys 2008-10-11 09:44 . 2007-06-19 08:51 107,304 -ra------ C:\WINDOWS\system32\drivers\s816mdm.sys 2008-10-11 09:44 . 2007-06-19 08:51 99,112 -ra------ C:\WINDOWS\system32\drivers\s816mgmt.sys 2008-10-11 09:44 . 2007-06-19 08:51 97,704 -ra------ C:\WINDOWS\system32\drivers\s816unic.sys 2008-10-11 09:44 . 2007-06-19 08:51 97,320 -ra------ C:\WINDOWS\system32\drivers\s816obex.sys 2008-10-11 09:44 . 2007-06-19 08:51 81,832 -ra------ C:\WINDOWS\system32\drivers\s816bus.sys 2008-10-11 09:44 . 2007-06-19 08:51 13,864 -ra------ C:\WINDOWS\system32\drivers\s816mdfl.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816whnt.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816wh.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816cmnt.sys 2008-10-11 09:44 . 2007-06-19 08:51 11,176 -ra------ C:\WINDOWS\system32\drivers\s816cm.sys 2008-10-11 09:44 . 2007-06-19 08:51 9,768 -ra------ C:\WINDOWS\system32\drivers\s816cr.sys 2008-10-09 20:19 . 2008-10-09 20:41 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-09 20:15 . 2008-10-09 20:15 <DIR> d-------- C:\WINDOWS\system32\LogFiles . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 13:32 --------- d-----w C:\Documents and Settings\Patryk01\Dane aplikacji\Skype 2008-10-26 08:34 --------- d-----w C:\Documents and Settings\Patryk01\Dane aplikacji\skypePM 2008-10-25 11:45 --------- d-----w C:\Program Files\Opera 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll 2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll . ------- Sigcheck ------- 2008-04-14 18:21 510464 51fd2e13d723857b9ca239ae77150f48 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\winlogon.exe 2008-05-05 17:03 504832 033dfd0b69af3fbc60138c0ac5c75042 C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-26_14.01.33.26 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Comrade.exe"="C:\Program Files\GameSpy\Comrade\Comrade.exe" [2007-05-27 36864] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-28 68856] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-05-30 21834536] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-05-05 839680] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2008-05-05 565248] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"= "D:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"= "D:\\gry\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"= "D:\\eMule\\emule.exe"= "D:\\SopCast\\adv\\SopAdver.exe"= "D:\\SopCast\\SopCast.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "D:\\Program Files\\BearShare\\BearShare.exe"= "D:\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 116992] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 64000] S2 WinMgct;Windows Management Controllor;C:\WINDOWS\system32\WinMgCt.exe [ ] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-10-09 29744] S3 Ndisprot;ArcNet NDIS Protocol Driver;C:\WINDOWS\system32\drivers\Ndisprot.sys [2008-10-25 27904] S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568] S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 81832] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 13864] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 107304] S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 99112] S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 21928] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 97320] S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 97704] S3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2004-07-13 48512] S3 V0260VID;Live! Cam Vista IM;C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-11-04 178913] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c1f1342-1abd-11dd-a3ff-4d6564696130}] \Shell\AutoRun\command - I:\USBNB.exe . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-26 15:45:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\Ati2evxx.dll . Czas ukończenia: 2008-10-26 15:46:23 ComboFix-quarantined-files.txt 2008-10-26 14:46:17 ComboFix2.txt 2008-10-26 13:19:04 ComboFix3.txt 2008-10-26 13:01:59 Przed: 21 803 618 304 bajtów wolnych Po: 21,836,533,760 bajtów wolnych 144 --- E O F --- 2008-10-24 21:02:52

**Posty:** 7956 · przez **Magik** 26 Paź 2008, 16:52

niech kolega zainstaluje firewalla i antywirusa

i zrob jeszcze ten fix.reg z poprzednich postow

i nic wiecej nie mowie :wink:

Autor postu otrzymał pochwałę

**Posty:** 1495 · przez **Buszinio** 26 Paź 2008, 16:57

Dzięki wielkie!

Kto jest na forum