Problem z pokazywaniem ukrytych plików

**Posty:** 3 · przez **konkam10** 24 Sty 2009, 18:33

Witam mam następujący problem. nie mogę ustawić pokazywania ukrytych plików.
Zamieszczam Logi

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:39:48, on 2007-01-24 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\DOCUME~1\Konrad\USTAWI~1\Temp\FPSoftware\ZF.exe L:\FPManager\FPManager.exe C:\DOCUME~1\Konrad\USTAWI~1\Temp\SwitchHidden.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 2392 bytes

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - Konrad 2009-01-24 16:26:52.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1683 [GMT 1:00] Uruchomiony z: c:\documents and settings\Konrad\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Konrad\Pulpit\CFScript.txt AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) FW: Zapora osobista *disabled* * Utworzono nowy punkt przywracania FILE :: C:\DUP2.EXE c:\winnt\system\cscript.exe c:\winnt\system\gm.BAT c:\winnt\system\Hd.vbs c:\winnt\system\svchest.exe c:\winnt\system\svchest.reg c:\winnt\system32\xydzyh.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-24 do 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-24 16:14 . 2009-01-24 16:14 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\ESET 2009-01-24 16:14 . 2008-03-03 14:25 5,702 --ah----- c:\windows\nod32restoretemdono.reg 2009-01-24 16:14 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg 2009-01-24 16:13 . 2009-01-24 16:13 <DIR> d-------- c:\program files\ESET 2009-01-24 16:13 . 2009-01-24 16:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET 2009-01-24 16:12 . 2009-01-24 16:12 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro 2009-01-24 16:11 . 2009-01-24 16:11 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\DAEMON Tools Pro 2009-01-24 16:07 . 2009-01-24 16:16 95,744 -r-hs---- c:\windows\system32\nmdfgds1.dll 2009-01-24 16:06 . 2009-01-24 16:08 <DIR> d-------- c:\program files\DAEMON Tools Pro 2009-01-24 16:05 . 2009-01-24 16:05 685,816 --a------ c:\windows\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-24 15:16 108,512 --sh--r c:\windows\system32\olhrwef.exe 2009-01-24 15:15 95,744 ------w c:\windows\system32\nmdfgds0.dll 2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE . ((((((((((((((((((((((((((((( snapshot@2009-01-24_16.01.01,67 ))))))))))))))))))))))))))))))))))))))))) . + 2009-01-24 15:13:52 10,134 ----a-r c:\windows\Installer\{BFBB5FAF-FF83-4E9E-9732-77A237DB81DC}\callmsi.exe + 2009-01-24 15:13:52 140,544 ----a-r c:\windows\Installer\{BFBB5FAF-FF83-4E9E-9732-77A237DB81DC}\egui.exe + 2009-01-24 15:08:42 9,728 ----a-w c:\windows\system32\BASSMOD.dll + 2008-07-01 07:56:22 39,944 ----a-w c:\windows\system32\drivers\eamon.sys + 2008-07-01 07:57:14 53,256 ----a-w c:\windows\system32\drivers\easdrv.sys + 2008-07-01 08:04:34 71,688 ----a-w c:\windows\system32\drivers\epfw.sys + 2008-07-01 08:04:36 30,728 ----a-w c:\windows\system32\drivers\epfwndis.sys + 2008-07-01 08:04:38 54,280 ----a-w c:\windows\system32\drivers\epfwtdi.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "cdoosoft"="c:\windows\system32\olhrwef.exe" [2009-01-24 108512] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168] "nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain0.dll" [2008-04-14 78848] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= R4 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-07-01 468224] S3 DarkSpy;DarkSpy;c:\windows\system32\DarkSpyKernel.sys [2007-01-24 129536] S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] \Shell\AutoRun\command - K:\autoverify.exe . . ------- Skan uzupełniający ------- . FF - ProfilePath - c:\documents and settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\79r6ykpz.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-24 16:27:17 Windows 5.1.2600 Dodatek Service Pack 3 NTFS

Proszę o pomoc

**Posty:** 760 · przez **gulek** 24 Sty 2009, 19:10

**Posty:** 18165 · przez **wojtas** 24 Sty 2009, 19:22

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
c:\windows\system32\nmdfgds0.dll

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdoosoft"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania

**Posty:** 3 · przez **konkam10** 24 Sty 2009, 19:40

oto ten log

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - Konrad 2009-01-24 18:33:44.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1362 [GMT 1:00] Uruchomiony z: c:\documents and settings\Konrad\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Konrad\Pulpit\CFScript.txt AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) FW: Zapora osobista *disabled* * Utworzono nowy punkt przywracania FILE :: c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\olhrwef.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\uvsqfgwd.cmd c:\windows\system32\nmdfgds0.dll c:\windows\system32\nmdfgds1.dll c:\windows\system32\olhrwef.exe D:\Autorun.inf D:\uvsqfgwd.cmd E:\Autorun.inf E:\uvsqfgwd.cmd F:\Autorun.inf F:\uvsqfgwd.cmd G:\Autorun.inf G:\uvsqfgwd.cmd H:\Autorun.inf H:\uvsqfgwd.cmd I:\Autorun.inf I:\uvsqfgwd.cmd L:\autorun.inf L:\uvsqfgwd.cmd . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-24 do 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-24 16:36 . 2009-01-24 16:36 2,581 -r-hs---- c:\windows\PCGWIN32.LI5 2009-01-24 16:36 . 2009-01-24 16:36 528 -r-hs---- c:\windows\PCGWIN32.LI4 2009-01-24 16:35 . 2009-01-24 16:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Autodata Limited 2009-01-24 16:33 . 2009-01-24 16:33 <DIR> d-------- c:\program files\Common Files\Autodata Limited Shared 2009-01-24 16:33 . 2009-01-24 16:33 <DIR> d-------- C:\ADCDTEMP 2009-01-24 16:33 . 2006-01-24 17:55 <DIR> d-------- C:\ADCDA2 2009-01-24 16:14 . 2009-01-24 16:14 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\ESET 2009-01-24 16:14 . 2008-03-03 14:25 5,702 --ah----- c:\windows\nod32restoretemdono.reg 2009-01-24 16:14 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg 2009-01-24 16:13 . 2009-01-24 16:13 <DIR> d-------- c:\program files\ESET 2009-01-24 16:13 . 2009-01-24 16:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET 2009-01-24 16:12 . 2009-01-24 16:12 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro 2009-01-24 16:11 . 2009-01-24 16:11 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\DAEMON Tools Pro 2009-01-24 16:06 . 2009-01-24 16:08 <DIR> d-------- c:\program files\DAEMON Tools Pro 2009-01-24 16:05 . 2009-01-24 16:05 685,816 --a------ c:\windows\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE . ((((((((((((((((((((((((((((( snapshot@2009-01-24_16.01.01,67 ))))))))))))))))))))))))))))))))))))))))) . + 2006-01-24 16:01:42 217,864 ----a-r c:\windows\Installer\{90120000-006E-0415-0000-0000000FF1CE}\misc.exe + 2006-01-24 16:04:11 20,240 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe + 2006-01-24 16:04:11 184,080 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe + 2006-01-24 16:04:11 217,864 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe + 2006-01-24 16:04:11 18,704 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe + 2006-01-24 16:04:11 35,088 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe + 2006-01-24 16:04:11 922,384 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe + 2006-01-24 16:04:11 888,080 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe + 2006-01-24 16:04:11 1,172,240 ----a-r c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe + 2009-01-24 15:13:52 10,134 ----a-r c:\windows\Installer\{BFBB5FAF-FF83-4E9E-9732-77A237DB81DC}\callmsi.exe + 2009-01-24 15:13:52 140,544 ----a-r c:\windows\Installer\{BFBB5FAF-FF83-4E9E-9732-77A237DB81DC}\egui.exe + 2009-01-24 15:08:42 9,728 ----a-w c:\windows\system32\BASSMOD.dll + 2008-07-01 07:56:22 39,944 ----a-w c:\windows\system32\drivers\eamon.sys + 2008-07-01 07:57:14 53,256 ----a-w c:\windows\system32\drivers\easdrv.sys + 2008-07-01 08:04:34 71,688 ----a-w c:\windows\system32\drivers\epfw.sys + 2008-07-01 08:04:36 30,728 ----a-w c:\windows\system32\drivers\epfwndis.sys + 2008-07-01 08:04:38 54,280 ----a-w c:\windows\system32\drivers\epfwtdi.sys + 2006-01-13 13:00:52 15,872 ----a-w c:\windows\system32\drivers\vd_filedisk.sys + 2007-12-24 12:49:52 7,680 ----a-w c:\windows\system32\ff_vfw.dll + 2006-10-26 13:10:08 1,190,688 ----a-w c:\windows\system32\FM20.DLL + 2006-10-26 12:10:06 33,088 ----a-w c:\windows\system32\FM20ENU.DLL - 2007-01-24 14:17:18 93,480 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-01-24 17:35:19 146,808 ----a-w c:\windows\system32\FNTCACHE.DAT + 2006-10-26 12:45:04 207,360 ----a-w c:\windows\system32\INKED.DLL + 2007-11-21 00:52:38 2,884,992 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll + 2007-11-21 00:52:40 218,496 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe + 2009-01-24 15:32:13 70,264 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe + 2006-10-26 18:56:10 32,592 ----a-w c:\windows\system32\msonpmon.dll + 2006-07-24 09:50:38 125,744 ----a-w c:\windows\system32\MSSTDFMT.DLL + 2004-01-11 22:00:00 348,160 ----a-w c:\windows\system32\msvcr71.dll + 2006-07-24 09:50:40 39,728 ----a-w c:\windows\system32\SCP32.DLL + 2006-10-26 18:56:16 864,080 ----a-w c:\windows\system32\spool\drivers\w32x86\3\msonpdrv.dll + 2006-10-26 18:56:14 67,408 ----a-w c:\windows\system32\spool\drivers\w32x86\3\msonpui.dll + 2006-10-26 18:56:16 864,080 ----a-w c:\windows\system32\spool\drivers\w32x86\msonpdrv.dll + 2006-10-26 18:56:14 67,408 ----a-w c:\windows\system32\spool\drivers\w32x86\msonpui.dll + 2006-10-26 18:56:12 33,104 ----a-w c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll + 2007-09-04 16:56:10 164,352 ----a-w c:\windows\system32\unrar.dll + 2006-07-24 09:50:40 47,920 ----a-w c:\windows\system32\VBAME.DLL + 2006-10-26 12:45:04 293,376 ----a-w c:\windows\system32\WISPTIS.EXE + 2006-10-26 12:40:34 95,744 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll + 2006-10-26 12:40:36 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll + 2006-10-26 12:40:36 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll + 2006-10-26 12:40:36 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll + 2006-10-26 12:40:36 1,093,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll + 2006-10-26 12:40:36 1,079,808 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll + 2006-10-26 12:40:36 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll + 2006-10-26 12:40:36 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll + 2006-10-26 12:40:36 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll + 2006-10-26 12:40:36 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll + 2006-10-26 12:40:36 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll + 2006-10-26 12:40:36 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll + 2006-10-26 12:40:36 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll + 2006-10-26 12:40:36 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll + 2006-10-26 12:40:36 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll + 2006-10-26 12:40:36 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll + 2006-10-26 12:40:36 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168] "nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain0.dll" [2008-04-14 78848] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [2006-01-13 15872] R4 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-07-01 468224] S3 DarkSpy;DarkSpy;c:\windows\system32\DarkSpyKernel.sys [2007-01-24 129536] S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - VD_FILEDISK [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] \Shell\AutoRun\command - K:\autoverify.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98b3e226-ea28-11dd-8e37-001d923a7924}] \Shell\AutoRun\command - M:\autorun.exe . . ------- Skan uzupełniający ------- . uInternet Connection Wizard,ShellNext = hxxp://www.for-ever.cn/nod32/nod32_explain.asp FF - ProfilePath - . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-24 18:35:39 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\AhnRpta.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe c:\windows\system32\nvsvc32.exe c:\docume~1\Konrad\USTAWI~1\Temp\FPSoftware\ZF.exe l:\fpmanager\FPManager.exe c:\docume~1\Konrad\USTAWI~1\Temp\SwitchHidden.exe . ************************************************************************** . Czas ukończenia: 2009-01-24 18:37:52 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-24 17:37:50 ComboFix2.txt 2009-01-24 15:27:43 ComboFix3.txt 2009-01-24 15:24:35 ComboFix4.txt 2009-01-24 15:18:41 ComboFix5.txt 2009-01-24 17:33:07 Przed: 40 271 163 392 bajtów wolnych Po: 40,345,911,296 bajtów wolnych 190

**Posty:** 18165 · przez **wojtas** 24 Sty 2009, 20:10

wklej do notatnika

Windows Registry Editor Version 5.00

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Otworz notatnik i wklej w nim to:

File::
c:\windows\AhnRpta.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 3 · przez **konkam10** 31 Sty 2009, 11:19

To są te logi

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - Konrad 2009-01-31 10:18:07.12 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1510 [GMT 1:00] Uruchomiony z: c:\documents and settings\Konrad\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Konrad\Pulpit\CFScript.txt AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) FW: Zapora osobista *enabled* * Utworzono nowy punkt przywracania . - TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI - FILE :: c:\windows\AhnRpta.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\AhnRpta.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-28 do 2009-01-31 ))))))))))))))))))))))))))))))) . 2009-01-31 09:42 . 2006-01-28 16:11 108,861 -r-hs---- C:\8.bat 2009-01-31 08:54 . 2009-01-31 08:54 <DIR> d-------- C:\fsaua.data 2009-01-31 08:49 . 2009-01-31 09:58 109,127 -r-hs---- C:\hl80c6b1.com 2009-01-31 01:41 . 2009-01-31 01:42 <DIR> d-------- c:\program files\SkanerOnline 2009-01-24 21:06 . 2009-01-24 21:06 <DIR> d-------- c:\program files\Real Alternative 2009-01-24 21:06 . 2009-01-24 21:06 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\Media Player Classic 2009-01-24 21:06 . 2003-03-19 04:14 499,712 --a------ c:\windows\system32\msvcp71.dll 2009-01-24 16:36 . 2009-01-24 16:36 2,581 -r-hs---- c:\windows\PCGWIN32.LI5 2009-01-24 16:36 . 2009-01-24 16:36 528 -r-hs---- c:\windows\PCGWIN32.LI4 2009-01-24 16:35 . 2009-01-24 16:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Autodata Limited 2009-01-24 16:33 . 2009-01-24 16:33 <DIR> d-------- c:\program files\Common Files\Autodata Limited Shared 2009-01-24 16:33 . 2009-01-24 16:33 <DIR> d-------- C:\ADCDTEMP 2009-01-24 16:33 . 2006-01-26 20:51 <DIR> d-------- C:\ADCDA2 2009-01-24 16:14 . 2009-01-24 16:14 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\ESET 2009-01-24 16:14 . 2008-03-03 14:25 5,702 --ah----- c:\windows\nod32restoretemdono.reg 2009-01-24 16:14 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg 2009-01-24 16:13 . 2009-01-24 16:13 <DIR> d-------- c:\program files\ESET 2009-01-24 16:13 . 2009-01-24 16:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET 2009-01-24 16:12 . 2009-01-24 16:12 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro 2009-01-24 16:11 . 2009-01-24 16:11 <DIR> d-------- c:\documents and settings\Konrad\Dane aplikacji\DAEMON Tools Pro 2009-01-24 16:06 . 2006-01-25 15:14 <DIR> d-------- c:\program files\DAEMON Tools Pro 2009-01-24 16:05 . 2009-01-24 16:05 685,816 --a------ c:\windows\system32\drivers\sptd.sys 2009-01-21 17:11 . 2009-01-21 17:11 473,600 --a------ c:\windows\system32\SkanerOnline.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-31 08:58 95,744 --sh--r c:\windows\system32\nmdfgds1.dll 2009-01-31 08:58 109,127 --sh--r c:\windows\system32\olhrwef.exe 2009-01-31 08:57 95,744 ------w c:\windows\system32\nmdfgds0.dll 2009-01-31 08:21 --------- d-----w c:\program files\JetAudio 2008-12-23 20:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE 2008-10-22 04:29 14,303,392 ----a-w c:\windows\system32\xlive.dll 2008-10-22 04:29 13,643,936 ----a-w c:\windows\system32\xlivefnt.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-13 08:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll . ((((((((((((((((((((((((((((( snapshot_2009-01-31_ 1.46.22,17 ))))))))))))))))))))))))))))))))))))))))) . + 2008-02-27 14:59:28 290,816 ----a-w c:\windows\Downloaded Program Files\auc_lib.dll + 2008-02-27 14:59:28 495,616 ----a-w c:\windows\Downloaded Program Files\daas_s.dll + 2008-02-27 15:00:12 262,144 ----a-w c:\windows\Downloaded Program Files\fscax.dll + 2008-02-27 14:59:16 588,392 ----a-w c:\windows\Downloaded Program Files\gatelauncher.exe - 2008-04-14 20:50:10 66,560 -c--a-w c:\windows\system32\dllcache\cdm.dll + 2008-10-16 13:09:44 92,696 -c--a-w c:\windows\system32\dllcache\cdm.dll - 2008-04-14 20:51:00 431,616 -c--a-w c:\windows\system32\dllcache\wuapi.dll + 2008-10-16 13:12:20 561,688 -c--a-w c:\windows\system32\dllcache\wuapi.dll - 2008-04-14 20:51:52 112,128 -c--a-w c:\windows\system32\dllcache\wuauclt.exe + 2008-10-16 13:09:44 51,224 -c--a-w c:\windows\system32\dllcache\wuauclt.exe - 2008-04-14 20:51:02 1,135,616 -c--a-w c:\windows\system32\dllcache\wuaueng.dll + 2008-10-16 13:13:40 1,809,944 -c--a-w c:\windows\system32\dllcache\wuaueng.dll - 2008-04-14 20:51:02 113,664 -c--a-w c:\windows\system32\dllcache\wucltui.dll + 2008-10-16 13:12:22 323,608 -c--a-w c:\windows\system32\dllcache\wucltui.dll - 2008-04-14 20:51:02 32,256 -c--a-w c:\windows\system32\dllcache\wups.dll + 2008-10-16 13:08:58 34,328 -c--a-w c:\windows\system32\dllcache\wups.dll - 2008-04-14 20:51:02 120,320 -c--a-w c:\windows\system32\dllcache\wuweb.dll + 2008-10-16 13:13:40 202,776 -c--a-w c:\windows\system32\dllcache\wuweb.dll + 2008-10-16 13:08:58 34,328 ----a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024] "cdoosoft"="c:\windows\system32\olhrwef.exe" [2009-01-31 109127] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdoosoft] -r-hs---- 2009-01-31 09:58 109127 c:\windows\system32\olhrwef.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-12-26 00:08 1657376 c:\windows\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "g:\\Rockstar Game\\Rockstar Games Social Club\\RGSCLauncher.exe"= "g:\\Rockstar Games\\GTA\\Grand Theft Auto IV\\LaunchGTAIV.exe"= R1 VD_FileDisk;VD_FileDisk;c:\windows\system32\drivers\vd_filedisk.sys [2006-01-13 15872] R4 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-07-01 468224] S3 DarkSpy;DarkSpy;c:\windows\system32\DarkSpyKernel.sys [2007-01-24 129536] S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b55608c2-8dd3-11da-8e40-001d923a7924}] \Shell\AutoRun\command - K:\uvsqfgwd.cmd \Shell\open\Command - K:\uvsqfgwd.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0ad2860-abb7-11db-8e32-ec820eb7325c}] \Shell\AutoRun\command - K:\autoverify.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0ad2861-abb7-11db-8e32-ec820eb7325c}] \Shell\AutoRun\command - autoverify.exe . . ------- Skan uzupełniający ------- . uInternet Connection Wizard,ShellNext = hxxp://www.for-ever.cn/nod32/nod32_explain.asp IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Konrad\Dane aplikacji\Mozilla\Firefox\Profiles\79r6ykpz.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-31 10:18:12 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-31 10:18:41 ComboFix-quarantined-files.txt 2009-01-31 09:18:40 ComboFix2.txt 2009-01-31 08:59:32 ComboFix3.txt 2009-01-31 08:51:15 ComboFix4.txt 2009-01-31 08:32:24 ComboFix5.txt 2009-01-31 09:17:55 Przed: 37 871 292 416 bajtów wolnych Po: 37,860,716,544 bajtów wolnych 160

**Posty:** 2 · przez **whuh** 31 Sty 2009, 20:43

U mnie pomoglo dzieki !