Problem z win 32

**Posty:** 10 · przez **Burza_78** 12 Gru 2008, 18:52

Witam.
Mam problem z trojanami nie mogę się ich pozbyć na początku program avist wykrył Win 32 Ski Morph i Trojan-gen. Później załapałam coś jeszcze i nie mogę się tego pozbyć ponieważ chciałam odinstalować avist a zainstalować avg jednakże teraz coś mi blokuje lub coś mam usunięte bo nie mogę żadnego programu odinstalować. Wirus przestawia mi też datę i zegar i odpalam kompa za pomocą F2 i dopiero jest start systemu. Avist też nie działa - bo jest blokowany albo część się usunęła przy deinstalacji. Dodam jeszcze że nie mogę też go ponownie zainstalować ani innego op. Kompa skanuje na razie tylko Spyware doktor poniżej zamieszczam loga z hijackThis proszę o pomoc.

Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:17:15, on 2008-12-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lectra\Digitizer\bin\digitizer.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Lectra\IManager\bin\fontserver.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Lectra\IManager\bin\lpdaemon.exe C:\Program Files\Lectra\Modaservice\modaserv.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe C:\WINDOWS\System32\imapi.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Spyware Doctor\pctsGui.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ButtonBox.lnk = C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe O4 - Global Startup: Digitizer.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1215193532290 O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Advanced Web Ranking Server (AWRServer) - Caphyon - C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Lectra Font Service (FontServer) - Unknown owner - C:\Program Files\Lectra\IManager\bin\fontserver.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lectra Print Service (LpDaemon) - Unknown owner - C:\Program Files\Lectra\IManager\bin\lpdaemon.exe O23 - Service: Modaservice - Unknown owner - C:\Program Files\Lectra\Modaservice\modaserv.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Lectra VigiPrint Service (VPDaemon) - Unknown owner - C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe O23 - Service: Lectra XChangCutOut Service (XCDaemon) - Unknown owner - C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe -- End of file - 10174 bytes

**Posty:** 18165 · przez **wojtas** 12 Gru 2008, 20:51

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 10 · przez **Burza_78** 14 Gru 2008, 17:21

Witam ponownie.
1. zastosowałam program do zamknięcia portów był problem raz zamykają się a innym razem otwarte są

a. Ten dodatek do windowsa (WindowsXP-KB894391-x86-PLK) nie chce się zainstalować pisze że nie ma potrzeby bo mam nowszą wersje.
2. z F8 uruchomołam SDFix i przeskanowałam poniżej wynik

Kod: Zaznacz wszystko
[b]SDFix: Version 1.240 [/b] Run by Magdalena on 2008-12-13 at 15:11 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-13 15:33:12 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\Lectra\\ModarisV5R2\\bin\\ModarisV5R2.exe"="C:\\Program Files\\Lectra\\ModarisV5R2\\bin\\ModarisV5R2.exe:*:Enabled:ModarisV5R2" "C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sat 13 Dec 2008 750,016 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\19db395f07b4ea57f58c6126880eb512\BITDE.tmp" Sat 13 Dec 2008 5,212,511 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\23841a39b22e831bb6d17bfc00226453\BITDF.tmp" Sat 13 Dec 2008 9,018,224 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28fa3d552b86948b1c727cfe113ce6b9\BITE0.tmp" Sat 13 Dec 2008 246,905 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\74527552c85695f6da4aaf4636e2cd44\BITDA.tmp" Sat 13 Dec 2008 613,744 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9449d5b5cebdd99ee9310a3d128d9fed\BITDB.tmp" Sat 13 Dec 2008 6,485,904 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a2efaa031a9870a89b1729abb65c1054\BITDD.tmp" Sat 13 Dec 2008 249,364 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b1b2fa76f94f5a551abbbe9b97448e9d\BITE1.tmp" Sat 13 Dec 2008 13,859,801 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e790bbfb0c87246fcb989eb0e7c12df2\BITDC.tmp" [b]Finished![/b]

3. Hijacthis oto log poniżej

Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:06:45, on 2008-12-14 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe C:\Program Files\Lectra\Digitizer\bin\digitizer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Lectra\IManager\bin\fontserver.exe C:\Program Files\Lectra\IManager\bin\lpdaemon.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Lectra\Modaservice\modaserv.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ButtonBox.lnk = C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe O4 - Global Startup: Digitizer.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll (file missing) O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1215193532290 O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Advanced Web Ranking Server (AWRServer) - Caphyon - C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Lectra Font Service (FontServer) - Unknown owner - C:\Program Files\Lectra\IManager\bin\fontserver.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Lectra Print Service (LpDaemon) - Unknown owner - C:\Program Files\Lectra\IManager\bin\lpdaemon.exe O23 - Service: Modaservice - Unknown owner - C:\Program Files\Lectra\Modaservice\modaserv.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Lectra VigiPrint Service (VPDaemon) - Unknown owner - C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe O23 - Service: Lectra XChangCutOut Service (XCDaemon) - Unknown owner - C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe -- End of file - 8993 bytes

4.combofix i log

Kod: Zaznacz wszystko
ComboFix 08-12-12.02 - Magdalena 2008-12-13 16:32:47.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.503.191 [GMT 1:00] Uruchomiony z: c:\documents and settings\Magdalena\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\windows\system32\geBqPIba.dll c:\windows\Tasks\icstbnbv.job . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-13 do 2008-12-13 ))))))))))))))))))))))))))))))) . 2008-12-13 09:39 . 2008-12-13 09:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant 2008-12-13 08:48 . 2008-12-13 08:48 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-12 21:11 . 2008-12-13 15:51 <DIR> d-------- C:\SDFix 2008-12-12 20:42 . 2008-12-12 20:42 <DIR> d-------- c:\program files\Karta 2008-12-12 18:58 . 2008-12-13 08:45 <DIR> d-------- c:\windows\ERUNT 2008-12-12 18:58 . 2008-12-12 18:58 <DIR> d-------- C:\ERDNT 2008-12-12 18:14 . 2008-12-12 18:14 <DIR> d-------- c:\windows\system32\Kaspersky Lab 2008-12-12 11:00 . 2008-12-12 20:34 <DIR> d-------- c:\program files\Spyware Doctor(3) 2008-12-11 22:29 . 2008-12-11 23:00 4,785 --a------ c:\windows\system32\warning.gif 2008-12-11 22:29 . 2008-12-11 23:00 1,347 --a------ c:\windows\system32\ahtn.htm 2008-12-11 22:29 . 2008-12-11 22:29 473 --a------ c:\windows\system32\win32hlp.cnf 2008-12-11 22:28 . 2008-12-11 22:28 1 --a------ c:\windows\system32\uniq.tll 2008-12-11 22:28 . 2008-12-11 22:28 1 --a------ c:\windows\system32\test.ttt 2008-12-01 18:55 . 2008-12-01 18:55 <DIR> d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-06-16 21:06 29,024 ----a-w c:\windows\system32\drivers\hasp_emu.sys 2008-12-12 19:46 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-12 19:40 --------- d-----w c:\program files\Spyware Doctor(2) 2008-12-12 19:34 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-11 21:30 --------- d-----w c:\program files\eMule 2008-12-10 15:06 --------- d-----w c:\documents and settings\Magdalena\Dane aplikacji\Lectra 2008-12-10 06:36 --------- d-----w c:\program files\Java 2008-12-08 20:57 --------- d-----w c:\documents and settings\Magdalena\Dane aplikacji\OpenOffice.org2 2008-11-28 20:31 --------- d-----w c:\documents and settings\Magdalena\Dane aplikacji\Skype 2008-11-10 18:19 --------- d-----w c:\program files\Common Files\HP 2008-11-08 19:44 --------- d-----w c:\program files\Alwil Software 2008-11-08 08:23 --------- d-----w c:\program files\assyst 2008-11-03 20:34 0 ----a-w c:\windows\system32\drivers\96d992ae.sys 2008-10-28 16:09 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-28 16:09 --------- d-----w c:\program files\MouseWare 2008-10-27 20:24 --------- d-----w c:\documents and settings\support\Dane aplikacji\ESET 2008-10-27 20:10 --------- d-----w c:\program files\HP 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-22 07:56 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-16 19:32 --------- d-----w c:\documents and settings\Magdalena\Dane aplikacji\ESET 2008-10-16 19:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET 2008-10-16 16:37 --------- d-----w c:\program files\Norton AntiVirus 2008-10-16 16:37 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-10-16 16:15 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-04 13:45 33,056 ----a-w c:\documents and settings\Magdalena\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-07-09 22:05 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008063020080707\index.dat 2008-07-09 22:05 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008071020080711\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-03-11 155648] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-11 114688] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-03-27 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-03-27 634880] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-01-19 221184] "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-19 458752] "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-19 217088] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696] "EM_EXEC"="c:\progra~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2002-05-01 28672] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ ButtonBox.lnk - c:\program files\Lectra\ButtonBox\bin\microclavier.exe [2008-08-06 167936] Digitizer.lnk - c:\program files\Lectra\Digitizer\bin\digitizer.exe [2008-08-06 159232] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624] HP Photosmart Premier - Szybkie uruchomienie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\eMule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Lectra\\ModarisV5R2\\bin\\ModarisV5R2.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-08 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-08 20560] R2 AWRServer;Advanced Web Ranking Server;"c:\program files\Caphyon\Advanced Web Ranking\AWRServer.exe" [2008-05-19 115384] R2 ECBatteryDRV;ECBatteryDRV;c:\windows\system32\drivers\ECBatteryDRV.sys [2008-07-04 6144] R2 ECMonitorDRV;ECMonitorDRV;c:\windows\system32\drivers\ECMonitorDRV.sys [2008-07-04 6144] R2 ECUtilityDRV;ECUtilityDRV;c:\windows\system32\drivers\ECUtilityDRV.sys [2008-07-04 6144] R2 FontServer;Lectra Font Service;c:\program files\Lectra\IManager\bin\fontserver.exe [2008-08-06 456704] R2 Hasp_emu;Hasp_emu;c:\windows\system32\drivers\hasp_emu.SYS [2008-10-27 29024] R2 HotCPUDRV;HotCPUDRV;c:\windows\system32\drivers\HotCPUDRV.sys [2008-07-04 7240] R2 LpDaemon;Lectra Print Service;c:\program files\Lectra\IManager\bin\lpdaemon.exe [2008-08-06 227840] R2 Modaservice;Modaservice;c:\program files\Lectra\Modaservice\modaserv.exe [2008-08-06 188575] R2 VPDaemon;Lectra VigiPrint Service;c:\program files\Lectra\VigiPrint\bin\vpdaemon.exe [2008-08-06 86016] R2 WinBootDRV;WinBootDRV;c:\windows\system32\drivers\WinBootDRV.sys [2008-07-04 7242] R2 XCDaemon;Lectra XChangCutOut Service;c:\program files\Lectra\XChangCutOut\bin\xcdaemon.exe [2008-08-07 86016] R3 {5C8B2B62-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-A;c:\windows\system32\drivers\A311.sys [2008-07-04 31287] R3 {5C8B2B65-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-B;c:\windows\system32\drivers\A310.sys [2008-07-04 33335] R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;c:\windows\system32\DRIVERS\DP83815.SYS [2003-02-13 18392] S1 96d992ae;96d992ae;c:\windows\system32\drivers\96d992ae.sys [2008-11-02 0] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-07-08 31592] *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-09-24 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local IE: Download &Flash Movies - c:\program files\Flash2X\Flash Hunter\save.htm O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd c:\windows\Downloaded Program Files\SignActivX.ocx - O16 -: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} hxxps://www.bph.pl/sezam/components/SignActivX.cab FF - ProfilePath - c:\documents and settings\Magdalena\Dane aplikacji\Mozilla\Firefox\Profiles\8d9shdib.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - plugin: c:\documents and settings\Magdalena\Dane aplikacji\Mozilla\Firefox\Profiles\8d9shdib.default\extensions\SignPlugin@bph.pl\plugins\NPSignPlugin.dll FF - plugin: c:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-13 16:43:53 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(2964) c:\program files\Gadu-Gadu\ggwhook.dll . Czas ukończenia: 2008-12-13 16:52:40 ComboFix-quarantined-files.txt 2008-12-13 15:52:27 Przed: 35 551 608 832 bajtów wolnych Po: 35,546,173,440 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 195 --- E O F --- 2008-11-13 10:20:19

Przeskanowałam kompa skaner online F-Secure on line virus scanner skanował się prawie dobe lecz nie wiem z jakim rezultatem bo jak wróciłam do domu ti explorer był wyłączony i zero wyników (tylko w trakcie widziałam że napewno było 8 ....+2 spyware ale nie wiem czy usunął)
Dalej coś siedzi.
Strasznie jest też zumylony
1. Nie moge dalej odinstalować dalej avista
2. Komp chce pobrać aktualizacje i nie może jest zablokowany więc proszę chlopaki zerknijcie w moje logi i co mam jeszcze zrobić :cry:

Pomocy!!!

**Posty:** 18165 · przez **wojtas** 14 Gru 2008, 17:34

te plik/i :

c:\windows\system32\drivers\hasp_emu.sys
c:\windows\system32\warning.gif
c:\windows\system32\ahtn.htm
c:\windows\system32\win32hlp.cnf
c:\windows\system32\uniq.tll
c:\windows\system32\test.ttt

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

**Posty:** 10 · przez **Burza_78** 15 Gru 2008, 21:53

Witam ponownie
Nie przeskanowała kompa Kaspersky online gdyż czały czas woła odemnie jave 1.5 lub nowszą a ja mam zainstalowaną wersje 6.0.110.90 i instalowałam na nowo i nic nie dało. Nie wiem dlaczego w czym tkwi błąd nawet sprawdzałam ustawienia javy ale tam wszystko gra.
Po niżej wklejam te przeskanowane pliki i raporty (nie było łatwo strasznie muli i wieszał się)
1.c:\windows\system32\drivers\hasp_emu.sys

Kod: Zaznacz wszystko
Service load: 0% 100% File: hasp_emu.sys Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: f535ec9c1e5dab373c0957d06ba22d6b Packers detected: - Scanner results Scan taken on 15 Dec 2008 11:12:05 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

Kod: Zaznacz wszystko
Plik haspflt.sys.dmp otrzymany 2008.12.02 15:05:25 (CET) Obecny status: zakończono Wynik: 0/37 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.2.2 2008.12.02 - AntiVir 7.9.0.36 2008.12.02 - Authentium 5.1.0.4 2008.12.02 - Avast 4.8.1281.0 2008.12.01 - AVG 8.0.0.199 2008.12.02 - BitDefender 7.2 2008.12.02 - CAT-QuickHeal 10.00 2008.12.02 - ClamAV 0.94.1 2008.12.02 - DrWeb 4.44.0.09170 2008.12.02 - eSafe 7.0.17.0 2008.11.30 - eTrust-Vet 31.6.6239 2008.12.02 - Ewido 4.0 2008.12.02 - F-Prot 4.4.4.56 2008.12.01 - F-Secure 8.0.14332.0 2008.12.02 - Fortinet 3.117.0.0 2008.12.02 - GData 19 2008.12.02 - Ikarus T3.1.1.45.0 2008.12.02 - K7AntiVirus 7.10.539 2008.12.01 - Kaspersky 7.0.0.125 2008.12.02 - McAfee 5451 2008.12.01 - McAfee+Artemis 5451 2008.12.01 - Microsoft 1.4104 2008.12.02 - NOD32 3657 2008.12.02 - Norman 5.80.02 2008.12.02 - Panda 9.0.0.4 2008.12.02 - PCTools 4.4.2.0 2008.12.02 - Prevx1 V2 2008.12.02 - Rising 21.06.12.00 2008.12.02 - SecureWeb-Gateway 6.7.6 2008.12.02 - Sophos 4.36.0 2008.12.02 - Sunbelt 3.1.1832.2 2008.12.01 - Symantec 10 2008.12.02 - TheHacker 6.3.1.2.171 2008.12.02 - TrendMicro 8.700.0.1004 2008.12.02 - VBA32 3.12.8.9 2008.12.01 - ViRobot 2008.12.2.1496 2008.12.02 - VirusBuster 4.5.11.0 2008.12.01 - Dodatkowe informacje File size: 29024 bytes MD5...: f535ec9c1e5dab373c0957d06ba22d6b SHA1..: f3eaa4245aa1787740334c0791506cfe84535fdb SHA256: 2f2c21821bcb343a2fafe211f0403b4357b884b8bef008cd084b1f0cae47c638 SHA512: 17894d10eeb19587c4820ab28d2b91f9f576a91d52f4793d7c9c28c0ed03b32e e37e5cfb0274a2eed9ca322137330829e074acb1d64474831814be268a7435f7 ssdeep: 768:vZmU6GnGAjV8qrBTDpMuG7KzKVqjRP9DnJ9D:hmUR9jV8qdTVGdO3nJ9 PEiD..: - TrID..: File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1075c timedatestamp.....: 0x3f8645ab (Fri Oct 10 05:37:47 2003) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x280 0x69f8 0x6a00 6.35 7ef22f9176b3fd5f3e1960a56b916479 .data 0x6c80 0x1c 0x20 0.00 70bc8f4b72a86921468bf8e8441dce51 INIT 0x6ca0 0x1d2 0x1e0 4.73 03bad3e088e2a7862c84d4eeacfca4b3 .reloc 0x6e80 0x2da 0x2e0 6.22 5813da95485f8590a5afa4b7e6ecbfaa ( 2 imports ) > HAL.DLL: KfReleaseSpinLock, KfAcquireSpinLock > NTOSKRNL.EXE: ObfDereferenceObject, IoGetDeviceObjectPointer, RtlInitUnicodeString, KeInitializeSpinLock, DbgPrint, IofCompleteRequest, ExFreePool, ZwQueryValueKey, RtlUnicodeStringToInteger, ExAllocatePoolWithTag, ZwOpenKey, ZwEnumerateKey, ZwQueryKey, ZwClose ( 0 exports )

2. c:\windows\system32\warning.gif

Kod: Zaznacz wszystko
Plik warning.gif otrzymany 2008.12.12 06:59:15 (CET) Obecny status: zakończono Wynik: 0/37 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.0 2008.12.11 - AntiVir 7.9.0.45 2008.12.11 - Authentium 5.1.0.4 2008.12.11 - Avast 4.8.1281.0 2008.12.11 - AVG 8.0.0.199 2008.12.12 - BitDefender 7.2 2008.12.12 - CAT-QuickHeal 10.00 2008.12.11 - ClamAV 0.94.1 2008.12.11 - Comodo 718 2008.12.10 - DrWeb 4.44.0.09170 2008.12.12 - eSafe 7.0.17.0 2008.12.11 - eTrust-Vet 31.6.6256 2008.12.11 - Ewido 4.0 2008.12.11 - F-Prot 4.4.4.56 2008.12.11 - F-Secure 8.0.14332.0 2008.12.12 - Fortinet 3.117.0.0 2008.12.12 - GData 19 2008.12.12 - Ikarus T3.1.1.45.0 2008.12.12 - K7AntiVirus 7.10.551 2008.12.11 - Kaspersky 7.0.0.125 2008.12.12 - McAfee 5461 2008.12.11 - McAfee+Artemis 5461 2008.12.11 - Microsoft 1.4205 2008.12.12 - NOD32 3685 2008.12.12 - Norman 5.80.02 2008.12.11 - Panda 9.0.0.4 2008.12.11 - Prevx1 V2 2008.12.12 - Rising 21.07.40.00 2008.12.12 - SecureWeb-Gateway 6.7.6 2008.12.11 - Sophos 4.36.0 2008.12.12 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.12 - TheHacker 6.3.1.2.184 2008.12.11 - TrendMicro 8.700.0.1004 2008.12.12 - VBA32 3.12.8.10 2008.12.11 - ViRobot 2008.12.12.1514 2008.12.12 - VirusBuster 4.5.11.0 2008.12.11 - Dodatkowe informacje File size: 4785 bytes MD5...: 2a6c59b33927df1213bea4c75a2fb150 SHA1..: 94b4082460c839bdf0cf07ab1f666d52d6702197 SHA256: f4989cf739d6858d1da08f17fc09eee026fc668730908e76b8f6fd5174040da2 SHA512: d85b99c97a2fd69f2866fb6639802ba1b8035d58844d5eb8813d9389b0e4eec6 7fe150d9a29a42d7fd8cd6c7dbcb8db003f3ba49ebe3a23ff1b6b5d592418269 ssdeep: 96:ezVkbkf33PNIwU1dqiSCD5mNDO2140/qOHazOMm2TrsTIreMh2CCPrHDb8:cQ knSwUW8D5mNDcuqOUPmiI072NrDw PEiD..: - TrID..: File type identification GIF animated bitmap (59.1%) GIF89a Bitmap (24.4%) GIF Bitmap (generic) (12.2%) PrintFox (C64) bitmap (4.0%) PEInfo: -

Kod: Zaznacz wszystko
Service load: 0% 100% File: warning.gif Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: 2a6c59b33927df1213bea4c75a2fb150 Packers detected: Scanner results Scan taken on 15 Dec 2008 10:11:43 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

3.c:\windows\system32\ahtn.htm

Kod: Zaznacz wszystko
Service load: 0% 100% File: win32hlp.cnf Status: OK MD5: fc7e49ac587c395255b0ed81929618eb Packers detected: - Scanner results Scan taken on 15 Dec 2008 11:06:34 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

Kod: Zaznacz wszystko
Plik win32hlp.cnf otrzymany 2008.12.04 06:43:42 (CET) Obecny status: zakończono Wynik: 0/37 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.4.0 2008.12.03 - AntiVir 7.9.0.36 2008.12.03 - Authentium 5.1.0.4 2008.12.04 - Avast 4.8.1281.0 2008.12.03 - AVG 8.0.0.199 2008.12.03 - BitDefender 7.2 2008.12.04 - CAT-QuickHeal 10.00 2008.12.04 - ClamAV 0.94.1 2008.12.04 - DrWeb 4.44.0.09170 2008.12.04 - eSafe 7.0.17.0 2008.12.03 - eTrust-Vet 31.6.6242 2008.12.04 - Ewido 4.0 2008.12.03 - F-Prot 4.4.4.56 2008.12.03 - F-Secure 8.0.14332.0 2008.12.04 - Fortinet 3.117.0.0 2008.12.04 - GData 19 2008.12.04 - Ikarus T3.1.1.45.0 2008.12.04 - K7AntiVirus 7.10.541 2008.12.03 - Kaspersky 7.0.0.125 2008.12.04 - McAfee 5453 2008.12.03 - McAfee+Artemis 5453 2008.12.03 - Microsoft 1.4205 2008.12.04 - NOD32 3662 2008.12.03 - Norman 5.80.02 2008.12.03 - Panda 9.0.0.4 2008.12.03 - PCTools 4.4.2.0 2008.12.03 - Prevx1 V2 2008.12.04 - Rising 21.06.30.00 2008.12.04 - SecureWeb-Gateway 6.7.6 2008.12.03 - Sophos 4.36.0 2008.12.04 - Sunbelt 3.1.1832.2 2008.12.01 - Symantec 10 2008.12.04 - TheHacker 6.3.1.2.174 2008.12.04 - TrendMicro 8.700.0.1004 2008.12.04 - VBA32 3.12.8.10 2008.12.03 - ViRobot 2008.12.4.1499 2008.12.04 - VirusBuster 4.5.11.0 2008.12.03 - Dodatkowe informacje File size: 473 bytes MD5...: fc7e49ac587c395255b0ed81929618eb SHA1..: 8414d4057bd6193d3936619facb491f56bd6a26a SHA256: 0406ce01daa39c041dc2f11b1198df3734a97c98f9d56c2d4097850723288f52 SHA512: b4af57aff14034fda5418229367829e5f03e52a124e8223429c016aeabac67ed 79575f1386a0463bb9d01947385e48955da90b2b15a9827af4883dfab46e35d9 ssdeep: 6:pfX6gqAM8AW3RC0QVKX6r2hBHQ6RqAM8AWd0RqAM8Gp8LYWzrKRqAMxLBXTJIR q3:pfX6AEAX6Y+qeCqsIusDJAzqj2bfI9h PEiD..: - TrID..: File type identification Unknown! PEInfo: -

4.c:\windows\system32\unig.tll

Kod: Zaznacz wszystko
Plik winlogon.htm otrzymany 2008.12.12 06:59:18 (CET) Obecny status: zakończono Wynik: 0/37 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.0 2008.12.11 - AntiVir 7.9.0.45 2008.12.11 - Authentium 5.1.0.4 2008.12.11 - Avast 4.8.1281.0 2008.12.11 - AVG 8.0.0.199 2008.12.12 - BitDefender 7.2 2008.12.12 - CAT-QuickHeal 10.00 2008.12.11 - ClamAV 0.94.1 2008.12.11 - Comodo 718 2008.12.10 - DrWeb 4.44.0.09170 2008.12.12 - eSafe 7.0.17.0 2008.12.11 - eTrust-Vet 31.6.6256 2008.12.11 - Ewido 4.0 2008.12.11 - F-Prot 4.4.4.56 2008.12.11 - F-Secure 8.0.14332.0 2008.12.12 - Fortinet 3.117.0.0 2008.12.12 - GData 19 2008.12.12 - Ikarus T3.1.1.45.0 2008.12.12 - K7AntiVirus 7.10.551 2008.12.11 - Kaspersky 7.0.0.125 2008.12.12 - McAfee 5461 2008.12.11 - McAfee+Artemis 5461 2008.12.11 - Microsoft 1.4205 2008.12.12 - NOD32 3685 2008.12.12 - Norman 5.80.02 2008.12.11 - Panda 9.0.0.4 2008.12.11 - Prevx1 V2 2008.12.12 - Rising 21.07.40.00 2008.12.12 - SecureWeb-Gateway 6.7.6 2008.12.11 - Sophos 4.36.0 2008.12.12 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.12 - TheHacker 6.3.1.2.184 2008.12.11 - TrendMicro 8.700.0.1004 2008.12.12 - VBA32 3.12.8.10 2008.12.11 - ViRobot 2008.12.12.1514 2008.12.12 - VirusBuster 4.5.11.0 2008.12.11 - Dodatkowe informacje File size: 1347 bytes MD5...: da6b3ca5dc3e5008e3c521b2153a8249 SHA1..: 3171b8e7c6bf48c1a6989ddb185b08626411c13f SHA256: bb1c8f015faba6bb0748e1598e870bcd32750a35d951ef06e460a4b8f112d3f6 SHA512: 8e1ded17553066e96f86543cb508145ddbeddd8d4613a5bb34236a06b4017bf4 2ff06ee9cbbcbd0ba823927ee7f3bdc13a9d464326d47e7eecb6227530ce2452 ssdeep: 24:2IxRenGnEQOs+RwpGK/FY+VS3mABo6z6oAsebdd1q5LL5E58ddu59ebddyME7 Mxq:2ILE1RtKRBARVAsMddwHEyddEMddyMEX PEiD..: - TrID..: File type identification HyperText Markup Language (100.0%) PEInfo: -

Kod: Zaznacz wszystko
Service Service load: 0% 100% File: ahtn.htm Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: da6b3ca5dc3e5008e3c521b2153a8249 Packers detected: - Scanner results Scan taken on 15 Dec 2008 10:19:24 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

4.c:\windows\system32\win32hlp.cnf

Kod: Zaznacz wszystko
Plik uniq.tll_ otrzymany 2008.12.03 15:18:16 (CET) Obecny status: zakończono Wynik: 0/36 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.2.2 2008.12.03 - AntiVir 7.9.0.36 2008.12.03 - Authentium 5.1.0.4 2008.12.03 - Avast 4.8.1281.0 2008.12.02 - AVG 8.0.0.199 2008.12.03 - BitDefender 7.2 2008.12.03 - CAT-QuickHeal 10.00 2008.12.03 - ClamAV 0.94.1 2008.12.03 - DrWeb 4.44.0.09170 2008.12.03 - eSafe 7.0.17.0 2008.12.02 - eTrust-Vet 31.6.6241 2008.12.03 - Ewido 4.0 2008.12.03 - F-Prot 4.4.4.56 2008.12.03 - F-Secure 8.0.14332.0 2008.12.03 - Fortinet 3.117.0.0 2008.12.03 - GData 19 2008.12.03 - Ikarus T3.1.1.45.0 2008.12.03 - K7AntiVirus 7.10.540 2008.12.02 - Kaspersky 7.0.0.125 2008.12.03 - McAfee 5452 2008.12.02 - McAfee+Artemis 5452 2008.12.02 - Microsoft 1.4205 2008.12.03 - NOD32 3660 2008.12.03 - Norman 5.80.02 2008.12.02 - Panda 9.0.0.4 2008.12.03 - PCTools 4.4.2.0 2008.12.03 - Rising 21.06.22.00 2008.12.03 - SecureWeb-Gateway 6.7.6 2008.12.03 - Sophos 4.36.0 2008.12.03 - Sunbelt 3.1.1832.2 2008.12.01 - Symantec 10 2008.12.03 - TheHacker 6.3.1.2.172 2008.12.02 - TrendMicro 8.700.0.1004 2008.12.03 - VBA32 3.12.8.10 2008.12.03 - ViRobot 2008.12.3.1498 2008.12.03 - VirusBuster 4.5.11.0 2008.12.03 - Dodatkowe informacje File size: 1 bytes MD5...: 4a8a08f09d37b73795649038408b5f33 SHA1..: 84a516841ba77a5b4648de2cd0dfcb30ea46dbb4 SHA256: 2e7d2c03a9507ae265ecf5b5356885a53393a2029d241394997265a1a25aefc6 SHA512: acc28db2beb7b42baa1cb0243d401ccb4e3fce44d7b02879a52799aadff54152 2d8822598b2fa664f9d5156c00c924805d75c3868bd56c2acb81d37e98e35adc ssdeep: 3:G:G PEiD..: - TrID..: File type identification Unknown! PEInfo: -

Kod: Zaznacz wszystko
Service load: 0% 100% File: uniq.tll Status: OK MD5: 4a8a08f09d37b73795649038408b5f33 Packers detected: - Scanner results Scan taken on 15 Dec 2008 10:54:51 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

5.c:\windows\system32\test.ttt

Kod: Zaznacz wszystko
Plik loads.php_code_3 otrzymany 2008.12.12 06:59:00 (CET) Obecny status: zakończono Wynik: 0/38 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.0 2008.12.11 - AntiVir 7.9.0.45 2008.12.11 - Authentium 5.1.0.4 2008.12.11 - Avast 4.8.1281.0 2008.12.11 - AVG 8.0.0.199 2008.12.12 - BitDefender 7.2 2008.12.12 - CAT-QuickHeal 10.00 2008.12.11 - ClamAV 0.94.1 2008.12.11 - Comodo 733 2008.12.11 - DrWeb 4.44.0.09170 2008.12.12 - eSafe 7.0.17.0 2008.12.11 - eTrust-Vet 31.6.6256 2008.12.11 - Ewido 4.0 2008.12.11 - F-Prot 4.4.4.56 2008.12.11 - F-Secure 8.0.14332.0 2008.12.12 - Fortinet 3.117.0.0 2008.12.12 - GData 19 2008.12.12 - Ikarus T3.1.1.45.0 2008.12.12 - K7AntiVirus 7.10.551 2008.12.11 - Kaspersky 7.0.0.125 2008.12.12 - McAfee 5461 2008.12.11 - McAfee+Artemis 5461 2008.12.11 - Microsoft 1.4205 2008.12.12 - NOD32 3685 2008.12.12 - Norman 5.80.02 2008.12.11 - Panda 9.0.0.4 2008.12.11 - PCTools 4.4.2.0 2008.12.11 - Prevx1 V2 2008.12.12 - Rising 21.07.40.00 2008.12.12 - SecureWeb-Gateway 6.7.6 2008.12.11 - Sophos 4.36.0 2008.12.12 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.12 - TheHacker 6.3.1.2.184 2008.12.11 - TrendMicro 8.700.0.1004 2008.12.12 - VBA32 3.12.8.10 2008.12.11 - ViRobot 2008.12.12.1514 2008.12.12 - VirusBuster 4.5.11.0 2008.12.11 - Dodatkowe informacje File size: 1 bytes MD5...: 68b329da9893e34099c7d8ad5cb9c940 SHA1..: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc SHA256: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b SHA512: be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc1569 7b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09 ssdeep: 3:v:v PEiD..: - TrID..: File type identification Unknown! PEInfo: -

Kod: Zaznacz wszystko
Service load: 0% 100% File: test.ttt Status: OK MD5: 68b329da9893e34099c7d8ad5cb9c940 Packers detected: - Scanner results Scan taken on 15 Dec 2008 11:03:17 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

I RATORT Z http://www.kaspersky.pl/virusscanner.html nie ma
Co dalej czy już mnie czeka format? co dalej???

**Posty:** 18165 · przez **wojtas** 15 Gru 2008, 22:07

daj loga z rsita

**Posty:** 10 · przez **Burza_78** 16 Gru 2008, 01:34

Kod: Zaznacz wszystko
Logfile of random's system information tool 1.04 (written by random/random) Run by Magdalena at 2008-12-16 00:29:48 Microsoft Windows XP Home Edition Dodatek Service Pack 3 System drive C: has 33 GB (42%) free of 80 GB Total RAM: 503 MB (28% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:30:29, on 2008-12-16 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Lectra\IManager\bin\fontserver.exe C:\Program Files\Lectra\IManager\bin\lpdaemon.exe C:\Program Files\Lectra\Modaservice\modaserv.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe C:\Program Files\Lectra\Digitizer\bin\digitizer.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Magdalena\Pulpit\RSIT.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\Magdalena.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ButtonBox.lnk = C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe O4 - Global Startup: Digitizer.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash2X Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O9 - Extra 'Tools' menuitem: &Launch Flash Hunter - {77B563A5-2A35-4E6B-BFC8-F4B6BB65D5DF} - C:\Program Files\Flash2X\Flash Hunter\save.htm (file missing) (HKCU) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1215193532290 O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Advanced Web Ranking Server (AWRServer) - Caphyon - C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Lectra Font Service (FontServer) - Unknown owner - C:\Program Files\Lectra\IManager\bin\fontserver.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lectra Print Service (LpDaemon) - Unknown owner - C:\Program Files\Lectra\IManager\bin\lpdaemon.exe O23 - Service: Modaservice - Unknown owner - C:\Program Files\Lectra\Modaservice\modaserv.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Lectra VigiPrint Service (VPDaemon) - Unknown owner - C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe O23 - Service: Lectra XChangCutOut Service (XCDaemon) - Unknown owner - C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe -- End of file - 9228 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-15 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-15 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-15 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2003-03-11 155648] "HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2003-03-11 114688] "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2003-03-27 110592] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2003-03-27 634880] "ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-16 221184] "ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] "LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-01-19 221184] "LogitechVideoRepair"=C:\Program Files\Logitech\Video\ISStart.exe [2005-01-19 458752] "LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe [2005-01-19 217088] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-04-01 36352] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696] "EM_EXEC"=C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE [2002-05-01 28672] "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-15 136600] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-07-09 2119104] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart ButtonBox.lnk - C:\Program Files\Lectra\ButtonBox\bin\microclavier.exe Digitizer.lnk - C:\Program Files\Lectra\Digitizer\bin\digitizer.exe HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe HP Photosmart Premier - Szybkie uruchomienie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxsrvc.dll [2003-03-11 315392] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoDrives"=0 "NoDriveAutoRun"=67108863 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"= "NoDriveAutoRun"= "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe"="C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\Program Files\Lectra\ModarisV5R2\bin\ModarisV5R2.exe"="C:\Program Files\Lectra\ModarisV5R2\bin\ModarisV5R2.exe:*:Enabled:ModarisV5R2" "C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\Polish\setup.exe"="C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\Polish\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======File associations====== .js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" ======List of files/folders created in the last 1 months====== 2008-12-16 00:29:48 ----D---- C:\rsit 2008-12-15 18:41:21 ----A---- C:\WINDOWS\system32\javaws.exe 2008-12-15 18:41:21 ----A---- C:\WINDOWS\system32\javaw.exe 2008-12-15 18:41:21 ----A---- C:\WINDOWS\system32\java.exe 2008-12-15 12:27:08 ----A---- C:\WINDOWS\system32\deploytk.dll 2008-12-15 09:10:24 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2008-12-14 16:35:42 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2008-12-14 16:31:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2008-12-13 17:53:22 ----D---- C:\fsaua.data 2008-12-13 17:20:17 ----SHD---- C:\RECYCLER 2008-12-13 16:52:46 ----A---- C:\ComboFix.txt 2008-12-13 16:22:17 ----RASHD---- C:\cmdcons 2008-12-13 16:10:28 ----A---- C:\WINDOWS\NIRCMD.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\zip.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\VFIND.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\SWSC.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\SWREG.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\sed.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\grep.exe 2008-12-13 16:10:27 ----A---- C:\WINDOWS\fdsv.exe 2008-12-13 09:39:18 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2008-12-13 09:01:16 ----D---- C:\Documents and Settings\Magdalena\Dane aplikacji\WinRAR 2008-12-12 21:11:50 ----D---- C:\SDFix 2008-12-12 20:42:19 ----D---- C:\Program Files\Karta 2008-12-12 18:58:28 ----D---- C:\ERDNT 2008-12-12 18:58:12 ----D---- C:\WINDOWS\ERUNT 2008-12-12 18:50:47 ----A---- C:\Boot.bak 2008-12-12 18:24:41 ----D---- C:\WINDOWS\ERDNT 2008-12-12 18:24:41 ----D---- C:\Qoobox 2008-12-12 11:00:38 ----D---- C:\Program Files\Spyware Doctor(3) 2008-12-12 10:37:49 ----A---- C:\WINDOWS\imsins.BAK 2008-12-01 18:55:46 ----D---- C:\Program Files\Trend Micro ======List of files/folders modified in the last 1 months====== 2008-12-16 00:26:30 ----D---- C:\Documents and Settings\Magdalena\Dane aplikacji\Lectra 2008-12-15 22:39:07 ----D---- C:\Documents and Settings\Magdalena\Dane aplikacji\OpenOffice.org2 2008-12-15 19:03:12 ----D---- C:\Program Files\Mozilla Firefox 2008-12-15 18:44:52 ----SHD---- C:\WINDOWS\Installer 2008-12-15 18:41:48 ----HD---- C:\Config.Msi 2008-12-15 18:41:24 ----D---- C:\WINDOWS\system32 2008-12-15 18:38:50 ----D---- C:\Program Files\Java 2008-12-15 18:33:00 ----D---- C:\WINDOWS\Temp 2008-12-15 18:22:15 ----D---- C:\WINDOWS 2008-12-15 18:21:33 ----D---- C:\AWR User Data 2008-12-15 18:20:23 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-15 18:18:41 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-12-15 18:18:29 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-15 17:12:53 ----HD---- C:\WINDOWS\inf 2008-12-15 16:05:44 ----D---- C:\Program Files\Mozilla Thunderbird 2008-12-15 12:43:00 ----D---- C:\WINDOWS\Debug 2008-12-15 09:10:36 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-15 09:06:51 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-13 16:44:05 ----A---- C:\WINDOWS\system.ini 2008-12-13 16:37:53 ----D---- C:\WINDOWS\system32\drivers 2008-12-13 16:37:49 ----D---- C:\Program Files\Common Files 2008-12-13 16:37:48 ----D---- C:\WINDOWS\AppPatch 2008-12-13 16:22:35 ----RASH---- C:\boot.ini 2008-12-13 15:10:40 ----A---- C:\WINDOWS\ntbtlog.txt 2008-12-13 09:39:31 ----D---- C:\WINDOWS\WinSxS 2008-12-13 09:01:36 ----D---- C:\WINDOWS\Prefetch 2008-12-13 08:54:20 ----RD---- C:\Program Files 2008-12-12 20:54:27 ----D---- C:\WINDOWS\system32\CatRoot 2008-12-12 20:48:28 ----D---- C:\WINDOWS\system32\config 2008-12-12 20:47:14 ----D---- C:\WINDOWS\system32\wbem 2008-12-12 20:47:11 ----D---- C:\WINDOWS\Registration 2008-12-12 20:40:57 ----D---- C:\Program Files\Spyware Doctor(2) 2008-12-12 20:34:21 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-12-12 19:26:52 ----SD---- C:\WINDOWS\Tasks 2008-12-12 00:07:50 ----SD---- C:\Documents and Settings\Magdalena\Dane aplikacji\Microsoft 2008-12-11 23:28:00 ----D---- C:\WINDOWS\system32\Restore 2008-12-11 22:30:08 ----D---- C:\Program Files\eMule 2008-12-10 00:24:37 ----A---- C:\WINDOWS\system32\MRT.exe 2008-12-03 06:31:00 ----D---- C:\WINDOWS\Help 2008-11-28 21:31:24 ----D---- C:\Documents and Settings\Magdalena\Dane aplikacji\Skype ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944] R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912] R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40448] R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416] R2 ECBatteryDRV;ECBatteryDRV; C:\WINDOWS\system32\drivers\ECBatteryDRV.sys [2003-03-19 6144] R2 ECMonitorDRV;ECMonitorDRV; C:\WINDOWS\system32\drivers\ECMonitorDRV.sys [2003-01-29 6144] R2 ECUtilityDRV;ECUtilityDRV; C:\WINDOWS\system32\drivers\ECUtilityDRV.sys [2003-01-29 6144] R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys [] R2 Hasp_emu;Hasp_emu; C:\WINDOWS\System32\drivers\hasp_emu.SYS [2014-06-16 29024] R2 Haspnt;Haspnt; \??\C:\WINDOWS\system32\drivers\Haspnt.sys [] R2 HotCPUDRV;HotCPUDRV; C:\WINDOWS\system32\drivers\HotCPUDRV.sys [2003-01-29 7240] R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2004-05-14 76288] R2 WinBootDRV;WinBootDRV; C:\WINDOWS\system32\drivers\WinBootDRV.sys [2003-01-29 7242] R3 {5C8B2B62-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-A; C:\WINDOWS\system32\drivers\A311.sys [2003-03-13 31287] R3 {5C8B2B65-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-B; C:\WINDOWS\system32\drivers\A310.sys [2003-03-13 33335] R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-13 112288] R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-13 78496] R3 akshasp;Aladdin HASP Key; C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 327808] R3 aksusb;Aladdin USB Key; C:\WINDOWS\system32\DRIVERS\aksusb.sys [2005-07-20 100096] R3 CmBatt;Sterownik adaptera prądu zmiennego Microsoft; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952] R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver; C:\WINDOWS\System32\DRIVERS\DP83815.SYS [2003-02-13 18392] R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2008-06-10 30728] R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664] R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2003-03-13 90395] R3 MODEMCSA;Urządzenie filtru strumieniowego usługi Unimodem; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2002-09-23 12160] R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys [2003-05-20 210592] R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\System32\DRIVERS\slntamr.sys [2003-05-13 521408] R3 SlWdmSup;SlWdmSup; C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys [2003-01-17 39348] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\System32\DRIVERS\SynTP.sys [2003-03-27 268784] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 VIAudio;VIA AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudios.sys [2003-04-14 88704] S1 96d992ae;96d992ae; C:\WINDOWS\System32\drivers\96d992ae.sys [] S1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152] S3 FA312;Sterownik karty NETGEAR FA330/FA312/FA311 Fast Ethernet; C:\WINDOWS\System32\DRIVERS\FA312nd5.sys [2001-08-17 16074] S3 Mtlstrm;Mtlstrm; C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys [2003-06-04 1295600] S3 NtMtlFax;NtMtlFax; C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys [2003-05-19 169120] S3 RecAgent;recagent; \??\C:\WINDOWS\System32\DRIVERS\RecAgent.sys [] S3 SlNtHal;SlNtHal; C:\WINDOWS\System32\DRIVERS\Slnthal.sys [2003-05-20 85688] S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [] S3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056] R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640] R2 AWRServer;Advanced Web Ranking Server; C:\Program Files\Caphyon\Advanced Web Ranking\AWRServer.exe [2008-05-19 115384] R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376] R2 FontServer;Lectra Font Service; C:\Program Files\Lectra\IManager\bin\fontserver.exe [2003-05-05 456704] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-15 152984] R2 LpDaemon;Lectra Print Service; C:\Program Files\Lectra\IManager\bin\lpdaemon.exe [2003-05-05 227840] R2 Modaservice;Modaservice; C:\Program Files\Lectra\Modaservice\modaserv.exe [2007-01-03 188575] R2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2003-05-20 45056] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] R2 VPDaemon;Lectra VigiPrint Service; C:\Program Files\Lectra\VigiPrint\bin\vpdaemon.exe [2006-06-12 86016] R2 XCDaemon;Lectra XChangCutOut Service; C:\Program Files\Lectra\XChangCutOut\bin\xcdaemon.exe [2004-10-07 86016] S3 aspnet_state;Usługa stanu ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040] S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344] S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-07-04 654848] S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-06-26 31592] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 09:55

Burza_78, skanujesz kompa po kolei:

program-szukajacy-trojanow-i-malware-vt97108.html

potem Norman Malware Cleaner:

narzedzia-do-usuwania-plikow-vt96629.html

i na koniec log z RSIT'a

**Posty:** 10 · przez **Burza_78** 16 Gru 2008, 13:25

1. log z FixIEDef

Kod: Zaznacz wszystko
******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6874 * * * ******************************************************************************** Created at 09:30:08 on Tuesday, December 16, 2008 Time Zone : Logged On User : Magdalena Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 2.66GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 80 GB System Drive Free : 33.35 GB Total Physical Memory: 503 MB Free Physical Memory : 230 MB Total Page File : 503 MB Free Page File : 969 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1967 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\drv2.dll C:\WINDOWS\system32\drv1.dll C:\WINDOWS\system32\drvc.dll -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

2. narzedzia-do-usuwania-plikow-vt96629.html uruchomiłam ten program ale nie wiem który plik mu wskazać czy te 5 powyżej czy system32 aby sobie szkód nie narobić. Proszę o wskazówkę.

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 14:32

Burza_78, wszystkie dyski lokalne, masz malware na dysku.

**Posty:** 10 · przez **Burza_78** 18 Gru 2008, 01:23

Jeszcze raz ja.
Wiem że mam wirusy ale nie potrafię wskazać plików do usunięcia przez program Norman Malware Cleaner:
narzedzia-do-usuwania-plikow-vt96629.html nie chce narobić szkód nie sztuka usunąć w ciemno program anytwirusowy nie działa (avist) a odinstalować w całości się nie chce (nie wykonuje polecenia) i przez to nie mogę zainstalować żadnego innego programu. Napisano mi że mam malware na dyskach lokalnych - tyle wiem ale co z tymi plikam :cry:

nie wiem które usunąć :cry:

2 . Z logów nie potrafię rozszyfrować które pliki są zainfekowane.
3. Czy jedynym wyjściem jest format dysku

Ps. Kaspersky online nie mogę przeskanować pisałam o problemie wyżej.
Jeszcze raz proszę o pomoc co z tym programem do czyszczenia??? :cry:

**Posty:** 18165 · przez **wojtas** 18 Gru 2008, 18:31

a przeskanuj tym:

http://www.ewido.net/en/onlinescan/

**Posty:** 8001 · przez **Okocza** 18 Gru 2008, 18:58

Burza_78 napisał(a):nie potrafię wskazać plików do usunięcia przez program Norman Malware Cleaner:

bo masz nim przeskanować tylko dyski

on sam usunie jak znajdzie... wszystkie dyski powinny być od razu dodane do skanowania...

Problem z win 32

Problem z win 32

Problem z win 32

Re: problem z win 32

Problem z win 32

Re: problem z win 32

Problem z win 32

Re: problem z win 32

Problem z win 32

Re: problem z win 32

Problem z win 32

Re: problem z win 32

Problem z win 32

Problem z win 32

Kto jest na forum