Problem z robakami komputerowymi!

**Posty:** 5 · przez **dixon90** 02 Cze 2010, 01:06

Witam wczoraj ściągnąłem sobie program a-squared HiJackFree który pokazuje mi, że procesy smss.exe, svchost.exe(w procesach widnieje z 8 razy), csrss.exe(w procesach widnieje 2 razy), services.exe,explorer.exe,winlogon.exe, alg.exe są zainfekowane robakami komputerowymi. Patrząc w szczegóły zauważyłem, że chodzi o robaki Win32.Jeefo.a, Win32.Netsky.d, Email-Worm.Win32.Sober.z. Myślałem, że uruchomienie ComboFixa pomoże, lecz myliłem się. Dlatego uruchomiłem AD-Aware, ale także nie pomogło. Da się te dziadostwo jakoś usunąć?

Zainstalowałem jeszcze HiJackThis i przesyłam loga

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:06:38, on 2010-06-02 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18904) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe C:\Program Files\ATKOSD2\ATKOSD2.exe C:\Windows\System32\igfxtray.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\CyberLink\Shared Files\brs.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Comodo\COMODO Internet Security\cfp.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\ipla\ipla.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\mobsync.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\conime.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\a-squared HiJackFree\a2hijackfree.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\MediaBar\DataMngr\IEBHO.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Users\dawid\AppData\Roaming\Nowe Gadu-Gadu\_userdata\ggbho.1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\ASUSTek\ASUSDVD\Language\Language.exe" O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe" O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe O4 - HKLM\..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Skytel] Skytel.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll/206 (file missing) O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{DA99DEBB-D543-4F72-BE33-4C0545848EEB}: NameServer = 156.154.70.22,156.154.71.22 O17 - HKLM\System\CCS\Services\Tcpip\..\{EF179CE9-6ABC-471B-9377-B6CD1C50A16C}: NameServer = 156.154.70.22,156.154.71.22 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\BEARSH~3\MediaBar\DataMngr\datamngr.dll C:\Windows\system32\guard32.dll O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe O23 - Service: SAMSUNG KiesAllShare Service (KiesAllShare) - Unknown owner - C:\Program Files\Samsung\Kies\WiselinkPro\WiselinkPro.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SMTP Server Service (SMTPMainService) - F Key Solutions Inc - C:\Program Files\1st SMTP Server\SMTPListener.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe -- End of file - 10122 bytes

i ComboFix zapisał mi:

Kod: Zaznacz wszystko: ComboFix 10-06-01.01 - dawid 2010-06-01 20:25:10.1.2 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.48.1045.18.2038.1093 [GMT 2:00] Uruchomiony z: c:\users\dawid\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . [i] ADS - Windows: deleted 24 bytes in 1 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Mozilla Firefox\Plugins\NPMyGlSh.dll c:\program files\myglobalsearch c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST c:\program files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL c:\users\dawid\eMule0.50a-Installer.exe c:\windows\system32\muzapp.exe . ((((((((((((((((((((((((( Pliki utworzone od 2010-05-01 do 2010-06-01 ))))))))))))))))))))))))))))))) . 2010-06-01 18:49 . 2010-06-01 19:00 -------- d-----w- c:\users\dawid\AppData\Local\temp 2010-06-01 18:49 . 2010-06-01 18:49 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-06-01 14:53 . 2010-06-01 14:53 -------- d-----w- c:\program files\Microsoft Silverlight 2010-06-01 14:19 . 2010-06-01 14:19 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-06-01 14:13 . 2010-06-01 15:39 -------- d-----w- c:\programdata\Lavasoft 2010-05-31 13:45 . 2010-05-31 13:45 -------- d-----w- c:\program files\a-squared HiJackFree 2010-05-26 14:00 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll 2010-05-21 17:42 . 2010-05-21 17:42 -------- d-----w- C:\unicat 2010-05-12 10:04 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll 2010-05-10 09:01 . 2010-05-10 09:01 229224 ----a-w- c:\windows\system32\drivers\VMM.sys 2010-05-10 08:55 . 2010-05-10 08:55 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help 2010-05-07 18:46 . 2010-05-07 18:46 -------- d-----w- c:\program files\PlayReady . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-06-01 18:59 . 2010-02-03 21:19 -------- d-----w- c:\users\dawid\AppData\Roaming\ipla 2010-06-01 18:59 . 2008-10-08 13:14 45056 ----a-w- c:\windows\system32\acovcnt.exe 2010-06-01 15:41 . 2008-04-17 09:47 667080 ----a-w- c:\windows\system32\perfh015.dat 2010-06-01 15:41 . 2008-04-17 09:47 128880 ----a-w- c:\windows\system32\perfc015.dat 2010-06-01 13:47 . 2009-02-23 19:50 -------- d-----w- c:\users\dawid\AppData\Roaming\Skype 2010-06-01 13:12 . 2009-02-23 19:52 -------- d-----w- c:\users\dawid\AppData\Roaming\skypePM 2010-06-01 05:36 . 2009-11-19 23:19 680 ----a-w- c:\users\dawid\AppData\Local\d3d9caps.dat 2010-05-29 13:49 . 2009-11-07 15:50 -------- d-----w- c:\users\dawid\AppData\Roaming\uTorrent 2010-05-24 14:09 . 2010-02-14 12:27 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2010-05-24 14:09 . 2010-02-14 12:27 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2010-05-24 14:02 . 2010-02-14 12:27 88 --sh--r- c:\programdata\8B6612F6B3.sys 2010-05-24 14:02 . 2010-02-14 12:27 88 --sh--r- c:\programdata\8B6612F6B3.sys 2010-05-23 19:06 . 2009-12-01 20:20 164880 ---ha-w- c:\users\dawid\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll 2010-05-20 10:01 . 2009-02-03 18:54 -------- d-----w- c:\users\dawid\AppData\Roaming\Winamp 2010-05-14 21:33 . 2009-01-23 15:15 -------- d-----w- c:\users\dawid\AppData\Roaming\BESTplayer 2010-05-13 09:20 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-05-13 09:19 . 2008-10-08 11:31 -------- d-----w- c:\programdata\Microsoft Help 2010-05-12 09:21 . 2009-10-03 11:12 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-05-10 09:18 . 2009-01-23 13:26 104024 ----a-w- c:\users\dawid\AppData\Local\GDIPFONTCACHEV1.DAT 2010-05-10 08:57 . 2009-02-09 19:16 -------- d-----w- c:\program files\Microsoft Works 2010-05-07 18:46 . 2010-02-03 21:19 -------- d-----w- c:\programdata\ipla 2010-05-07 18:42 . 2010-02-03 21:19 -------- d-----w- c:\program files\ipla 2010-04-20 21:30 . 2010-04-20 21:30 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf 2010-04-20 21:26 . 2010-04-20 21:26 -------- d-----w- c:\programdata\PC Suite 2010-04-20 21:26 . 2010-04-20 21:26 -------- d-----w- c:\users\dawid\AppData\Roaming\PC Suite 2010-04-20 21:26 . 2008-10-08 11:42 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-04-20 21:17 . 2010-04-20 21:11 -------- d-----w- c:\program files\Samsung 2010-04-20 21:16 . 2010-04-20 21:16 -------- d-----w- c:\program files\DIFX 2010-04-20 21:15 . 2010-04-20 21:12 -------- d-----w- c:\program files\PC Connectivity Solution 2010-04-20 21:14 . 2010-04-20 21:11 -------- d-----w- c:\programdata\Samsung 2010-04-20 21:11 . 2010-04-20 21:11 -------- d-----w- c:\users\dawid\AppData\Roaming\Samsung 2010-04-20 21:11 . 2010-04-20 21:10 -------- d-----w- c:\program files\Common Files\Samsung 2010-04-20 21:11 . 2010-04-20 21:11 -------- d-----w- c:\program files\MarkAny 2010-04-20 21:08 . 2010-04-20 20:56 147360320 ----a-w- c:\users\dawid\Kies_1.5.0.10024_74.exe 2010-04-20 20:43 . 2009-01-23 13:28 -------- d-----w- c:\program files\Common Files\Adobe 2010-04-19 17:20 . 2010-04-19 17:20 -------- d-----w- c:\programdata\eMule 2010-04-19 17:19 . 2010-04-19 17:19 -------- d-----w- c:\program files\eMule 2010-04-19 17:19 . 2010-04-19 16:53 -------- d-----w- c:\program files\BearShare Applications 2010-04-18 12:23 . 2010-04-18 12:18 39215616 ----a-w- c:\users\dawid\eav_nt32_plk.msi 2010-04-07 19:09 . 2010-04-07 19:09 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys 2010-04-07 19:08 . 2010-04-07 19:08 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys 2010-04-07 19:05 . 2010-04-07 19:05 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys 2010-04-03 20:48 . 2009-08-04 12:32 -------- d-----w- c:\programdata\OpenFM 2010-03-05 14:01 . 2010-04-14 21:35 420352 ----a-w- c:\windows\system32\vbscript.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}] 2009-12-20 09:51 87480 ----a-w- c:\program files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}] 2010-03-28 09:16 393144 ----a-w- c:\program files\BearShare Applications\MediaBar\DataMngr\IEBHO.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{0974BA1E-64EC-11DE-B2A5-E43756D89593}"= "c:\program files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480] [HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1] @="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}" [HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}] 2007-06-02 00:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "IPLA!"="c:\program files\ipla\ipla.exe" [2010-05-04 15994776] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LanguageShortcut"="c:\program files\ASUSTek\ASUSDVD\Language\Language.exe" [2008-02-22 62760] "CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936] "P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304] "ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240] "ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-10-18 7737344] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-22 141848] "RtHDVCpl"="RtHDVCpl.exe" [2008-08-21 6265376] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Skytel"="Skytel.exe" [2008-08-21 1833504] "BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-05-07 75048] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-04-07 2145000] c:\users\dawid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\BEARSH~3\MediaBar\DataMngr\datamngr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "VistaSp2"=hex(b):7b,d5,6e,3c,bf,4c,ca,01 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2465332076-3500459218-2332865531-1000] "EnableNotificationsRef"=dword:00000003 R3 KiesAllShare;SAMSUNG KiesAllShare Service;c:\program files\Samsung\Kies\WiselinkPro\WiselinkPro.exe [2010-01-18 9201664] R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2010-01-20 98432] R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2010-01-20 14848] R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2010-01-20 123648] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984] S2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/12/27 18:34];c:\program files\CyberLink\PowerDVD9\000.fcl [2009-05-07 20:05 87536] S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-02-04 95568] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 134024] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-04-07 810120] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-07 96896] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704] S2 SMTPMainService;SMTP Server Service;c:\program files\1st SMTP Server\SMTPListener.exe [2009-04-24 896512] S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-02-04 18136] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-12-22 36640] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - FSUSBEXDISK [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Zawartość folderu 'Zaplanowane zadania' 2010-05-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465332076-3500459218-2332865531-1000Core.job - c:\users\dawid\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-28 16:37] 2010-06-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465332076-3500459218-2332865531-1000UA.job - c:\users\dawid\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-28 16:37] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.bearshare.com/ uInternet Settings,ProxyOverride = *.local IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx FF - ProfilePath - c:\users\dawid\AppData\Roaming\Mozilla\Firefox\Profiles\lu5840wh.default\ FF - prefs.js: browser.search.selectedEngine - BearShare Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/ FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&q= FF - component: c:\users\dawid\AppData\Roaming\Mozilla\Firefox\Profiles\lu5840wh.default\extensions\playbox@toolbar\components\toolbarhomewmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll FF - plugin: c:\users\dawid\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\users\dawid\AppData\Roaming\Mozilla\plugins\np-mswmp.dll FF - plugin: c:\users\dawid\AppData\Roaming\Nowe Gadu-Gadu\_userdata\npgg.1.dll FF - plugin: c:\users\dawid\AppData\Roaming\Nowe Gadu-Gadu\_userdata\nppl3260.dll FF - plugin: c:\users\dawid\AppData\Roaming\Nowe Gadu-Gadu\_userdata\nprpjplug.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - USUNIĘTO PUSTE WPISY - - - - AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-06-01 21:00 Windows 6.0.6002 Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... C:\ADSM_PData_0150 c:\users\dawid\AppData\Roaming\ipla\data\pool001.dat 546 bytes skanowanie pomyślnie ukończone ukryte pliki: 2 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.032" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.abr" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.ani" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.arw" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.bay" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.bmp" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.bw" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.cr2" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.crw" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.cs1" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.cur" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.dcr" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.dcx" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.dib" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.djv" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.djvu" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.dng" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.emf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.eps" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.erf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.fff" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.fpx" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice] @Denied: (2) (S-1-5-21-2465332076-3500459218-2332865531-1000) @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.gif" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.hdr" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.icl" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.icn" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.iff" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.ilbm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.int" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.inta" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.iw4" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.j2c" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.j2k" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jbr" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jfif" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jif" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jp2" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jpc" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jpe" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice] @Denied: (2) (S-1-5-21-2465332076-3500459218-2332865531-1000) @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jpeg" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jpk" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.jpx" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.kdc" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.lbm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.mef" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.mos" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.mrw" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.nef" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.orf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pbm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pbr" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pcd" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pct" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pcx" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pef" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pgm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pic" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pict" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pix" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice] @Denied: (2) (S-1-5-21-2465332076-3500459218-2332865531-1000) @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.png" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.ppm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.psd" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.psp" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pspbrush" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.pspimage" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.raf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.ras" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.raw" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.rgb" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.rgba" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.rle" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.rsb" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.sgi" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.sr2" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.srf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.tga" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.thm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.tif" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.tiff" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.ttc" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.ttf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11o\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.v11o" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11p\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.v11p" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11pf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.v11pf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.wbm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.wbmp" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.wmf" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.xbm" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.xif" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.xmp" [HKEY_USERS\S-1-5-21-2465332076-3500459218-2332865531-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee Photo Manager 2009.xpm" [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'Explorer.exe'(3108) c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll c:\program files\Microsoft Virtual PC\VPCShExH.DLL . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe c:\program files\ASUS\ATK Hotkey\ASLDRSrv.exe c:\program files\ATKGFNEX\GFNEXSrv.exe c:\windows\system32\WLANExt.exe c:\windows\system32\agrsmsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\Protexis\License Service\PsiService_2.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe c:\program files\ASUS\ATK Hotkey\HControl.exe c:\program files\Wireless Console 2\wcourier.exe c:\program files\ASUS\Splendid\ACMON.exe c:\program files\ASUS\NB Probe\SPM\spmgr.exe c:\windows\System32\ACEngSvr.exe c:\windows\system32\WUDFHost.exe c:\program files\ASUS\ATK Hotkey\ATKOSD.exe c:\program files\ASUS\ATK Hotkey\KBFiltr.exe c:\program files\ASUS\ATK Hotkey\WDC.exe c:\windows\system32\conime.exe c:\windows\RtHDVCpl.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Synaptics\SynTP\SynTPHelper.exe . ************************************************************************** . Czas ukończenia: 2010-06-01 21:09:48 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-06-01 19:09 Przed: 49 360 400 384 bajtów wolnych Po: 64 373 022 720 bajtów wolnych - - End Of File - - 15D71C4B470077347D9E0D640E1EF110

Niestety nie mogę wygenerować loga z Gmera, ponieważ skanuje skanuje i w pewnym momencie wyskakuje błąd i program zawiesza się

**Posty:** 1916 · przez **lamar** 02 Cze 2010, 07:38

Przeczytaj DOKŁADNIE obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html
- brak loga z OTL
- brak loga Extas
- brak loga z Gmera

**Posty:** 5 · przez **dixon90** 02 Cze 2010, 16:29

Loga z OTL
plik OTL.txt ->http://www.wklej.org/id/344048/
plik Extras.txt -> http://www.wklej.org/id/344051/

Czekam na szybką odpowiedź:)

**Posty:** 2183 · przez **NieWiem** 02 Cze 2010, 17:32

Albo Gmer albo zapomnij o czymkolwiek.

**Posty:** 250 · przez **tenzin** 02 Cze 2010, 18:17

dixon90 napisał(a):Niestety nie mogę wygenerować loga z Gmera, ponieważ skanuje skanuje i w pewnym momencie wyskakuje błąd i program zawiesza się

Ja, tam się nie znam, ale może spróbuj wygenerować log z Gmera w trybie awaryjnym.
Pozdrawiam,

**Posty:** 5 · przez **dixon90** 03 Cze 2010, 00:57

udało mi się wkońcu wyciągnąć te loga od Gmera

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-06-03 00:52:59 Windows 6.0.6002 Service Pack 2 Running: etvzn09d.exe; Driver: C:\Users\dawid\AppData\Local\Temp\pwlcapod.sys ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73C17817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73C6A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73C1BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73C0F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73C175E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73C0E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [73C48395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [73C1DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73C0FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73C0FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73C071CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [73C9CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [73C3C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73C0D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73C06853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73C0687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73C12AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs AsDsm.sys (Data Security Manager Driver/Windows (R) Codename Longhorn DDK provider) AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) Device \FileSystem\fastfat \Fat 805DAA7A AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Menedżer filtrów systemu plików firmy Microsoft/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib@Last Counter 5368 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib@Last Help 5369 ---- Files - GMER 1.0.15 ---- File C:\ADSM_PData_0150 0 bytes File C:\ADSM_PData_0150\DB 0 bytes File C:\ADSM_PData_0150\DB\SI.db 624 bytes File C:\ADSM_PData_0150\DB\UL.db 16 bytes File C:\ADSM_PData_0150\DB\VL.db 16 bytes File C:\ADSM_PData_0150\DB\WAL.db 2048 bytes File C:\ADSM_PData_0150\DB\_avt 512 bytes File C:\ADSM_PData_0150\DragWait.exe 315392 bytes executable File C:\ADSM_PData_0150\_avt 512 bytes File C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86 0 bytes File C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\AsDsm.sys 29752 bytes executable File C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\_avt 512 bytes ---- EOF - GMER 1.0.15 ----

Teraz czekam na odpowiedź

**Posty:** 2183 · przez **NieWiem** 03 Cze 2010, 12:05

NetSky co prawda daje fałszywe alarmy, ale jeśli rzeczywiście jest tu Jeefo to mamy solidny problem... Bardzo solidny.

Pobierz program Dr Web Cure It.
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Kliknij Scan żeby odpalić szybkie skanowanie, w wyskakującym okienku wciśnij OK.
Jeśli coś zostanie znalezione, kliknij Yes żeby wyleczyć/usunąć.
Po szybkim skanowaniu wybierz opcję Complete Scan.
Po prawej stronie kliknij zieloną strzałkę.
Jeśli zostaniesz poproszony w trakcie skanowania, kliknij Yes to all (automatyczne leczenie i/lub usuwanie).
Ten skan może trwać bardzo długo - zalecam, żeby odpalić go na noc, zostawiając komputer włączonym!
Po ukończeniu skanowania, wybierz Menu File => Save Report list.
Plik zapisz na pulpicie. Będzie nazywał się DrWeb.cvs
Zrestartuj komputer - to bardzo ważne, ponieważ Dr Web niektóre pliki będzie mógł wyleczyć/usunąć dopiero po restarcie!
Za pomocą notatnika otwórz plik DrWeb.csv i wklej jego zawartość na forum w znacznikach [code] na forum, albo na stronie http://www.wklej.org, a w poście daj tylko linka.

W zależności od wyników tego skanowania podejmę dalsze kroki.

**Posty:** 5 · przez **dixon90** 04 Cze 2010, 20:22

Przeprowadziłem skanowanie tym DrWeb. Skanowało ponad 10 godzin, ale niestety pech chciał, że gdy przeskanowało wszystkie pliki wyskoczył błąd i aplikacja została zamknięta

, ale DrWeb w trakcie nie wykrył, żadnej infekcji, czy mam spróbować skanować jeszcze raz?

**Posty:** 2183 · przez **NieWiem** 05 Cze 2010, 12:08

Zajrzyj w ten temat:
http://www.searchengines.pl/Bootowalne-antywirusowe-CD-t112329.html

Jest tam lista boootowalnych AV płytek. Wypal którąś (na niezainfekowanym komputerze, czyli nie tym Twoim!) i z jej poziomu przeprowadź skanowanie. Powiesz mi czy i co wykryło (przepisz na kartce i wklej do posta).

Muszę mieć pewność że nei ma tu Jeefo.

**Posty:** 5 · przez **dixon90** 06 Cze 2010, 00:03

Dopiero teraz zobaczyłem twój ostatni wpis na forum, ale dokonałem drugiego skanowania DrWeb. Skanowanie się skończyło, ale plik zapisz raport, czy coś w tym stylu nie zrobiło się dostępne. Więc skopiowałem loga, które zapisywały się przez ten program w innej lokalizacji określonej w ustawieniach. Niestety nie wkleiłem ich na wklej.org, ponieważ plik zajmuje 40Mb. Oto link do pliku z logami http://www.speedyshare.com/files/22811831/CureIt.log. A odnośnie tego wypalenia tej płytki to mam to zrobić bo jeśli tak to uruchomię w nocy z poniedziałku na wtorek??

Kto jest na forum