Problem z zobaczeniem ukrytych plików

**Posty:** 84 · przez **becik23** 17 Sty 2009, 20:17

Witam, na wstępie od razu powiem, że jestem osobą niezbyt znaną się na komputerach..stąd prośba o wyrozumiałość - dzięki.
Problem jaki się pojawił u mnie jest taki- nie mogę zobaczyć ukrytych plików. Po wyborze Narzędzia-Opcje folderów- Pokaż ukryte...niestety funkcja ta nie działa. Skanowałam komputer avastem, ale nie wykrył wirusów (poza dwiema bombami dekompresyjnymi, ale nie jestem pewna czy to jest wirus). Prosiłabym o pomoc, dziękuję smile.gif

**Posty:** 760 · przez **gulek** 19 Sty 2009, 00:45

Spróbuj ten trick z rejestrem jak nie pomoże to daj loga z ComboFix'a i HijackThis'a

P.S. google nie gryzie :wink:

**Posty:** 84 · przez **becik23** 19 Sty 2009, 21:33

szukałam takich tematów i znalazłam, ale nie do końca byłam pewna czy te rozwiązania są dobre dla wszystkich komputerów, czy raczej podchodzi się do nich tak indywidualnie...i stąd mój post tutaj

Dziękuję za pomoc, pomogło

A jeśli avast wykrył "bomby dekompresyjne" to powinnam usunąć te pliki z komputera??

Tutaj logi, z góry dzięki za pomoc

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:29:53, on 2009-01-19 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\PROGRAMY\PowerDVD\PDVDServ.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\PROGRAMY\RocketDock\RocketDock.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RemoteControl] D:\PROGRAMY\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] D:\PROGRAMY\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [RocketDock] "D:\PROGRAMY\RocketDock\RocketDock.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa konfiguracji Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe -- End of file - 7272 bytes

Kod: Zaznacz wszystko: ComboFix 09-01-16.03 - B.U.M 2009-01-19 20:19:49.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.502.113 [GMT 1:00] Uruchomiony z: c:\documents and settings\B.U.M\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090118-0] *On-access scanning disabled* (Outdated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\hpowiax7.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-19 do 2009-01-19 ))))))))))))))))))))))))))))))) . 2009-01-01 12:04 . 2009-01-01 12:04 <DIR> d-------- c:\program files\MSXML 4.0 2008-12-30 18:24 . 2008-12-30 18:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\WEBREG 2008-12-30 18:22 . 2008-12-30 18:22 <DIR> d-------- c:\documents and settings\B.U.M\Dane aplikacji\HP 2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant 2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP 2008-12-30 18:14 . 2008-12-30 18:14 <DIR> d-------- c:\program files\Hewlett-Packard 2008-12-30 18:14 . 2008-12-30 18:14 <DIR> d-------- c:\program files\Common Files\HP 2008-12-30 18:14 . 2008-12-30 18:14 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard 2008-12-30 18:13 . 2007-10-30 10:25 49,920 -ra------ c:\windows\system32\drivers\HPZid412.sys 2008-12-30 18:13 . 2007-10-30 10:25 21,568 -ra------ c:\windows\system32\drivers\HPZius12.sys 2008-12-30 18:13 . 2007-10-30 10:25 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys 2008-12-30 18:12 . 2008-12-30 18:12 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-12-30 18:12 . 2007-10-30 10:11 581,632 -ra------ c:\windows\system32\hpotscl6.dll 2008-12-30 18:12 . 2007-10-30 10:25 372,736 -ra------ c:\windows\system32\hppldcoi.dll 2008-12-30 18:12 . 2007-10-30 10:25 309,760 -ra------ c:\windows\system32\difxapi.dll 2008-12-30 18:12 . 2007-10-30 10:11 303,104 -ra------ c:\windows\system32\hpovst15.dll 2008-12-30 18:11 . 2008-12-30 18:15 <DIR> d-------- c:\program files\HP 2008-12-30 18:09 . 2008-12-30 18:09 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard 2008-12-30 18:09 . 2008-12-30 18:23 169,233 --a------ c:\windows\hpoins27.dat 2008-12-30 18:09 . 2008-01-18 16:56 932 --------- c:\windows\hpomdl27.dat 2008-12-30 18:08 . 2007-11-08 15:52 271,704 -ra------ c:\windows\system32\hpzids01.dll 2008-12-30 18:08 . 2007-10-20 18:25 117,760 --a------ c:\windows\system32\hpzll5mu.dll 2008-12-30 18:07 . 2008-04-13 20:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-12-30 18:07 . 2008-04-13 20:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2008-12-30 18:07 . 2008-04-13 20:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-12-30 18:07 . 2008-04-13 20:47 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-18 19:29 --------- d-----w c:\documents and settings\B.U.M\Dane aplikacji\U3 2009-01-16 22:14 --------- d-----w c:\documents and settings\B.U.M\Dane aplikacji\Skype 2008-11-22 19:15 --------- d-----w c:\program files\FastStone Image Viewer 2008-11-22 19:15 --------- d-----w c:\documents and settings\B.U.M\Dane aplikacji\FastStone 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-04-14 17:20 157,225 --sha-r c:\windows\system32\kvujzor.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208] "RocketDock"="d:\programy\RocketDock\RocketDock.exe" [2006-08-16 364544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "ACU"="c:\program files\Atheros\ACU.exe" [2006-08-09 344187] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "RemoteControl"="d:\programy\PowerDVD\PDVDServ.exe" [2005-12-07 30208] "LanguageShortcut"="d:\programy\PowerDVD\Language\Language.exe" [2006-05-18 49152] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 18:21 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 05:24 286720 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-05-10 15:09 23395880 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "\\\\PPP-F5D029F6844\\C\\Gadu-Gadu\\gg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6131:TCP"= 6131:TCP:krvmt R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-16 111184] R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2007-05-15 54432] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-16 20560] S4 fqsmm;Security Server;c:\windows\system32\svchost.exe -k netsvcs [2004-08-04 14336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs fqsmm [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f68c0e6-911a-11dc-a031-00197e1c9ae5}] \Shell\AutoRun\command - H:\LaunchU3.exe -a . Zawartość folderu 'Zaplanowane zadania' 2008-11-05 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-INPROCOMMWireless - c:\program files\Atheros\Wireless\Utility\WlanUtil.exe . ------- Skan uzupełniający ------- . uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\B.U.M\Dane aplikacji\Mozilla\Firefox\Profiles\9pegmlhe.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-19 20:21:40 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fqsmm] "ServiceDll"="c:\windows\system32\kvujzor.dll" . Czas ukończenia: 2009-01-19 20:23:02 ComboFix-quarantined-files.txt 2009-01-19 19:22:55 Przed: 9˙756˙053˙504 bajt˘w wolnych Po: 9,767,223,296 bajt˘w wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 153 --- E O F --- 2009-01-01 11:05:00

**Posty:** 18165 · przez **wojtas** 19 Sty 2009, 22:35

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\kvujzor.dll

Driver::
fqsmm

Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fqsmm]
"ServiceDll"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 84 · przez **becik23** 20 Sty 2009, 13:57

o to ten log

Kod: Zaznacz wszystko: ComboFix 09-01-16.03 - B.U.M 2009-01-20 12:49:27.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.502.118 [GMT 1:00] Uruchomiony z: c:\documents and settings\B.U.M\Pulpit\becik\ComboFix.exe Użyto następujących komend :: c:\documents and settings\B.U.M\Pulpit\CFScript.txt AV: avast! antivirus 4.8.1296 [VPS 090119-0] *On-access scanning disabled* (Outdated) * Utworzono nowy punkt przywracania FILE :: c:\windows\system32\kvujzor.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\kvujzor.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FQSMM -------\Service_fqsmm ((((((((((((((((((((((((( Pliki utworzone od 2008-12-20 do 2009-01-20 ))))))))))))))))))))))))))))))) . 2009-01-19 20:29 . 2009-01-19 20:29 <DIR> d-------- c:\program files\Trend Micro 2009-01-19 20:23 . 2009-01-19 20:24 <DIR> d-------- c:\documents and settings\B.U.M\Dane aplikacji\HPAppData 2009-01-01 12:04 . 2009-01-01 12:04 <DIR> d-------- c:\program files\MSXML 4.0 2008-12-30 18:24 . 2008-12-30 18:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\WEBREG 2008-12-30 18:22 . 2008-12-30 18:22 <DIR> d-------- c:\documents and settings\B.U.M\Dane aplikacji\HP 2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant 2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP 2008-12-30 18:14 . 2008-12-30 18:14 <DIR> d-------- c:\program files\Hewlett-Packard 2008-12-30 18:14 . 2008-12-30 18:14 <DIR> d-------- c:\program files\Common Files\HP 2008-12-30 18:14 . 2008-12-30 18:14 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard 2008-12-30 18:13 . 2007-10-30 10:25 49,920 -ra------ c:\windows\system32\drivers\HPZid412.sys 2008-12-30 18:13 . 2007-10-30 10:25 21,568 -ra------ c:\windows\system32\drivers\HPZius12.sys 2008-12-30 18:13 . 2007-10-30 10:25 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys 2008-12-30 18:12 . 2008-12-30 18:12 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-12-30 18:12 . 2007-10-30 10:11 581,632 -ra------ c:\windows\system32\hpotscl6.dll 2008-12-30 18:12 . 2007-10-30 10:25 372,736 -ra------ c:\windows\system32\hppldcoi.dll 2008-12-30 18:12 . 2007-10-30 10:25 309,760 -ra------ c:\windows\system32\difxapi.dll 2008-12-30 18:12 . 2007-10-30 10:11 303,104 -ra------ c:\windows\system32\hpovst15.dll 2008-12-30 18:11 . 2008-12-30 18:15 <DIR> d-------- c:\program files\HP 2008-12-30 18:09 . 2008-12-30 18:09 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard 2008-12-30 18:09 . 2008-12-30 18:23 169,233 --a------ c:\windows\hpoins27.dat 2008-12-30 18:09 . 2008-01-18 16:56 932 --------- c:\windows\hpomdl27.dat 2008-12-30 18:08 . 2007-11-08 15:52 271,704 -ra------ c:\windows\system32\hpzids01.dll 2008-12-30 18:08 . 2007-10-20 18:25 117,760 --a------ c:\windows\system32\hpzll5mu.dll 2008-12-30 18:07 . 2008-04-13 20:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-12-30 18:07 . 2008-04-13 20:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2008-12-30 18:07 . 2008-04-13 20:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-12-30 18:07 . 2008-04-13 20:47 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-18 19:29 --------- d-----w c:\documents and settings\B.U.M\Dane aplikacji\U3 2009-01-16 22:14 --------- d-----w c:\documents and settings\B.U.M\Dane aplikacji\Skype 2008-11-22 19:15 --------- d-----w c:\program files\FastStone Image Viewer 2008-11-22 19:15 --------- d-----w c:\documents and settings\B.U.M\Dane aplikacji\FastStone . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208] "RocketDock"="d:\programy\RocketDock\RocketDock.exe" [2006-08-16 364544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "ACU"="c:\program files\Atheros\ACU.exe" [2006-08-09 344187] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "RemoteControl"="d:\programy\PowerDVD\PDVDServ.exe" [2005-12-07 30208] "LanguageShortcut"="d:\programy\PowerDVD\Language\Language.exe" [2006-05-18 49152] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 18:21 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 05:24 286720 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-05-10 15:09 23395880 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "\\\\PPP-F5D029F6844\\C\\Gadu-Gadu\\gg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6131:TCP"= 6131:TCP:krvmt R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-16 111184] R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2007-05-15 54432] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-16 20560] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f68c0e6-911a-11dc-a031-00197e1c9ae5}] \Shell\AutoRun\command - H:\LaunchU3.exe -a . Zawartość folderu 'Zaplanowane zadania' 2008-11-05 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] . . ------- Skan uzupełniający ------- . uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\B.U.M\Dane aplikacji\Mozilla\Firefox\Profiles\9pegmlhe.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-20 12:52:41 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\acs.exe c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe c:\program files\Cyberlink\Shared files\RichVideo.exe c:\windows\system32\wdfmgr.exe c:\docume~1\BU2280~1.M\USTAWI~1\temp\RtkBtMnt.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Czas ukończenia: 2009-01-20 12:55:21 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-20 11:55:16 Przed: 9˙740˙075˙008 bajt˘w wolnych Po: 9,647,988,736 bajt˘w wolnych 160 --- E O F --- 2009-01-01 11:05:00