proszę o sprawdzenie loga (ocgrep)

**Posty:** 6 · przez **solar7018** 24 Paź 2007, 16:39

Witam
Chciałem sobie ulepszyć jeden program i załatwiłem sobie kompa

w sumie najpierw poczytałem o tym świństwie (za dużo nie mogłem znaleźć (ale 2 gości miało podobny syf a logach i wywaliłem to hijackiem.
mam prośbę do fgachowców o sprawdzenie czy wszystko usunąłem:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:33:07, on 2007-10-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\thlirc_ctrl.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\regsvr32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\pegaz\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: run= O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: (no name) - {6F63E13C-1C88-6094-A39F-066B001B4716} - C:\Program Files\vndnpwqx\kwvmqnpd.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "e:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [zmzufkdu] regsvr32 /u "C:\Documents and Settings\All Users\Dane aplikacji\zmzufkdu.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MyTraveler] C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe O23 - Service: NBService - Nero AG - E:\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: TwinHan WinLIRC service (ThLircService) - Unknown owner - C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe -- End of file - 6291 bytes

dodam jeszcze, że plik po pobraniu z netu skanowałem kasperskim i nic skubany nie pokazał

**Posty:** 18165 · przez **wojtas** 24 Paź 2007, 16:43

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt oraz daj loga z hijacka oraz combofixa

**Posty:** 6 · przez **solar7018** 24 Paź 2007, 17:29

dzięki za szybki odzew

zrobiłem co kazałeś - poniżej logi:

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - pegaz 2007-10-24 17:21:21.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.582 [GMT 2:00] Running from: C:\Documents and Settings\pegaz\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 ))))))))))))))))))))))))))))))) . 2007-10-24 17:13 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-24 16:58 <DIR> d--hs---- C:\FOUND.047 2007-10-24 16:54 2,560 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-24 16:53 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-24 16:53 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-24 16:53 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-24 16:53 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-24 16:53 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-24 16:49 <DIR> d-------- C:\VundoFix Backups 2007-10-24 16:43 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-24 16:22 <DIR> d--hs---- C:\FOUND.046 2007-10-23 23:37 <DIR> d-------- C:\Program Files\vndnpwqx 2007-10-23 23:35 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-10-23 19:08 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\Winamp 2007-10-22 19:25 <DIR> d-------- C:\Program Files\MoorHunt 2007-10-22 01:09 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-10-20 11:30 <DIR> d-------- C:\Program Files\Winamp Toolbar 2007-10-20 11:30 <DIR> d-------- C:\Program Files\Winamp Remote 2007-10-20 11:26 <DIR> d-------- C:\Program Files\Winamp 2007-10-20 11:26 <DIR> d-------- C:\Documents and Settings\Konradek\Dane aplikacji\Winamp 2007-10-17 17:09 122,884 --a------ C:\WINDOWS\UnGins.exe 2007-10-17 16:26 <DIR> d-------- C:\7thLevel 2007-10-17 16:26 297,472 --a------ C:\WINDOWS\uninst.exe 2007-10-16 12:55 5,112 --a------ C:\WINDOWS\GPCIDrv.sys 2007-10-13 19:45 <DIR> d-------- C:\Program Files\ProgEdit 2007-10-13 13:05 <DIR> dr-h----- C:\Documents and Settings\Konradek\Dane aplikacji\SecuROM 2007-10-11 00:00 11,187 --a------ C:\WINDOWS\system32\drivers\ab_hid.sys 2007-10-10 19:47 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-10-10 19:47 14,848 --a------ C:\WINDOWS\system32\dllcache\kbdhid.sys 2007-10-10 16:55 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-10-10 16:55 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-10-10 15:12 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-09 15:55 <DIR> d-------- C:\ProgDVB 2007-10-09 00:33 307,200 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-10-08 22:10 <DIR> d-------- C:\Program Files\PC-TV 2007-10-08 22:07 26,730 -ra------ C:\WINDOWS\system32\drivers\DtvVideo.sys 2007-10-08 22:07 10,330 -ra------ C:\WINDOWS\system32\drivers\DtvAudio.sys 2007-10-07 13:34 <DIR> d-------- C:\Program Files\Norton Security Scan 2007-10-06 23:29 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\CyberLink 2007-10-06 22:35 <DIR> d-------- C:\Program Files\D-Tools 2007-10-06 22:34 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-10-06 07:37 <DIR> d-------- C:\Program Files\EA SPORTS 2007-10-05 21:38 17,962 --a------ C:\WINDOWS\system32\drivers\GVTDrv.sys 2007-10-05 21:36 <DIR> d-------- C:\Program Files\GIGABYTE 2007-10-05 19:09 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-10-04 23:47 <DIR> d-------- C:\Program Files\Cyberlink 2007-10-04 23:46 505,392 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-10-04 22:33 <DIR> d--hs---- C:\FOUND.045 2007-10-03 17:31 <DIR> d--hs---- C:\FOUND.044 2007-10-02 21:22 <DIR> d---s---- C:\Documents and Settings\pegaz\UserData 2007-10-02 21:15 <DIR> d-------- C:\Program Files\SopCast 2007-10-02 21:15 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\SopCast 2007-10-02 20:38 <DIR> d-------- C:\Program Files\Skype 2007-10-02 20:38 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-10-02 20:38 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\Skype 2007-10-02 20:24 <DIR> d--hs---- C:\FOUND.043 2007-10-02 14:51 <DIR> d--hs---- C:\FOUND.042 2007-10-02 14:32 <DIR> d--hs---- C:\FOUND.041 2007-10-02 13:57 <DIR> d--hs---- C:\FOUND.040 2007-10-01 13:47 <DIR> d-------- C:\Documents and Settings\Konradek\Dane aplikacji\Sports Interactive 2007-10-01 12:03 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-10-01 12:03 <DIR> d--h----- C:\Documents and Settings\pegaz\InstallAnywhere 2007-09-27 20:16 <DIR> d-------- C:\Documents and Settings\Anitka\Dane aplikacji\AdobeUM 2007-09-27 13:05 <DIR> d--hs---- C:\FOUND.039 2007-09-26 21:06 <DIR> d-------- C:\Program Files\uTorrent 2007-09-26 21:06 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\uTorrent . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-24 14:47 698,444 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-24 14:47 16,496 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-24 14:47 1,869,088 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-24 14:47 1,277,952 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-04 21:46 353,840 ----a-w C:\WINDOWS\system32\msvcr71.dll 2007-10-01 10:06 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-22 07:53 --------- d-----w C:\Program Files\Driver Cleaner 2007-09-21 17:37 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\dvdcss 2007-09-21 17:15 --------- d-----w C:\Documents and Settings\Milenka\Dane aplikacji\Ahead 2007-09-21 17:13 --------- d-----w C:\Documents and Settings\Milenka\Dane aplikacji\vlc 2007-09-20 11:56 --------- d-----w C:\Program Files\lol 2007-09-13 16:40 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler 2007-09-11 16:00 --------- d-----w C:\Documents and Settings\Konradek\Dane aplikacji\Tibia 2007-09-10 18:22 --------- d-----w C:\Program Files\Ubisoft 2007-09-10 18:18 --------- d-----w C:\Documents and Settings\Konradek\Dane aplikacji\Ahead 2007-09-09 12:49 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\OTVREG 2007-09-09 08:44 --------- d-----w C:\Program Files\Miranda IM 2007-09-04 22:45 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-09-02 19:03 --------- d-----w C:\Program Files\Common Files\Ahead 2007-08-25 19:26 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\TransRender 2007-08-25 19:26 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\Temporary 2007-08-25 19:26 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\ConvertTemp 2007-08-24 11:14 --------- d-----w C:\Program Files\WebServ 2007-08-22 13:19 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-22 13:19 661,504 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-22 13:19 616,448 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-22 13:19 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-22 13:19 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-22 13:19 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-08-22 13:19 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-22 13:19 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-22 13:19 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-22 13:19 3,079,168 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-22 13:19 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-22 13:19 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-22 13:19 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-22 13:19 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2007-08-22 13:19 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-22 13:19 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-08-22 13:19 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll 2007-08-22 13:19 1,022,976 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2007-08-22 02:08 268,800 ------w C:\WINDOWS\system32\ati2dvag.dll 2007-08-22 02:07 2,417,664 ----a-w C:\WINDOWS\system32\dllcache\ati2mtag.sys 2007-08-22 01:47 3,091,392 ------w C:\WINDOWS\system32\ati3duag.dll 2007-08-22 01:35 1,586,816 ------w C:\WINDOWS\system32\ativvaxx.dll 2007-08-22 01:11 450,560 ------w C:\WINDOWS\system32\ati2cqag.dll 2007-08-21 10:30 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:18 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-24_16.48.38.21 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 08:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-10-23 01:32:48 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-10-24 15:14:00 3,579,904 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2007-10-24 15:14:00 32,768 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-23 01:32:48 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-10-24 15:13:58 3,579,904 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2007-10-24 15:13:58 32,768 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6F63E13C-1C88-6094-A39F-066B001B4716}] 2007-10-23 23:37 110592 --a------ C:\Program Files\vndnpwqx\kwvmqnpd.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51] "kis"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 19:09] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57] "RemoteControl"="e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24] "LanguageShortcut"="e:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43] "nwiz"="nwiz.exe" [2006-08-11 15:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 15:43] "VGAUtil"="C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe" [2007-01-02 10:22] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03] "MyTraveler"="C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe" [2007-05-23 14:41] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\e:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl R2 ThLircService;TwinHan WinLIRC service;C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe R3 3xHybrid;TV-Station DVR service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys R3 AB_HID;AB_HID;C:\WINDOWS\system32\drivers\ab_hid.sys R3 DtvAudio;DtvAudio;C:\WINDOWS\system32\DRIVERS\DtvAudio.sys R3 DtvVideo;DtvVideo;C:\WINDOWS\system32\DRIVERS\DtvVideo.sys R3 GPCIDrv;GPCIDrv;\??\C:\WINDOWS\GPCIDrv.sys R3 GVTDrv;GVTDrv;\??\C:\WINDOWS\system32\Drivers\GVTDrv.sys S3 AC2003;AC2003;C:\WINDOWS\system32\Drivers\AC2003.sys S3 DSDrvNT;DSDrvNT;\??\E:\zrzuty\VirtualDub1493VCR+SYNC\DSDrvNT.sys S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys S3 TimerStop;TimerStop;\??\I:\TimerStop.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command - G:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f91ef96b-3011-11dc-af15-806d6172696f}] AutoRun\command - G:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f91ef96c-3011-11dc-af15-806d6172696f}] AutoRun\command - H:\Autorun.exe root.ini . Contents of the 'Scheduled Tasks' folder "2007-10-19 13:00:02 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-24 17:23:03 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-24 17:23:51 C:\ComboFix2.txt ... 2007-10-24 16:49 . --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:20:23, on 2007-10-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\thlirc_ctrl.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Skype\Phone\Skype.exe C:\Documents and Settings\pegaz\Pulpit\hijackthis.com C:\Program Files\Skype\Plugin Manager\skypePM.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: (no name) - {6F63E13C-1C88-6094-A39F-066B001B4716} - C:\Program Files\vndnpwqx\kwvmqnpd.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "e:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MyTraveler] C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe O23 - Service: NBService - Nero AG - E:\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: TwinHan WinLIRC service (ThLircService) - Unknown owner - C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe -- End of file - 6044 bytes

Kod: Zaznacz wszystko: SDFix: Version 1.111 Run by pegaz on 2007-10-24 at 17:14 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\sdfix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------

**Posty:** 18165 · przez **wojtas** 24 Paź 2007, 17:43

O2 - BHO: (no name) - {6F63E13C-1C88-6094-A39F-066B001B4716} - C:\Program Files\vndnpwqx\kwvmqnpd.dll
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

skasuj te wpisy + pogrubiony wywal do kosza

znasz to:

O4 - HKCU\..\Run: [MyTraveler] C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f91ef96b-3011-11dc-af15-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f91ef96c-3011-11dc-af15-806d6172696f}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 6 · przez **solar7018** 24 Paź 2007, 17:57

wojtas19162 napisał(a):

znasz to:

O4 - HKCU\..\Run: [MyTraveler] C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe

to jet aplikacja od pendriva
Zrobiłem to co mówiłeś i podaję log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:55:00, on 2007-10-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\thlirc_ctrl.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Documents and Settings\pegaz\Pulpit\hijackthis.com C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "e:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MyTraveler] C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe O23 - Service: NBService - Nero AG - E:\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: TwinHan WinLIRC service (ThLircService) - Unknown owner - C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe -- End of file - 5796 bytes

**Posty:** 18165 · przez **wojtas** 24 Paź 2007, 18:02

znasz to :

O23 - Service: TwinHan WinLIRC service (ThLircService) - Unknown owner - C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe

bo wyglada podejzanie

daj loga z combofixa jeszcze

**Posty:** 6 · przez **solar7018** 24 Paź 2007, 18:03

to jest aplikacja od pilota karty TV-sat

**Posty:** 18165 · przez **wojtas** 24 Paź 2007, 18:11

aha czyli daj loga z combofixa

**Posty:** 6 · przez **solar7018** 24 Paź 2007, 18:29

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - pegaz 2007-10-24 18:26:26.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.583 [GMT 2:00] Running from: C:\Documents and Settings\pegaz\Pulpit\czyszczenie wirus\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 ))))))))))))))))))))))))))))))) . 2007-10-24 17:13 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-24 16:58 <DIR> d--hs---- C:\FOUND.047 2007-10-24 16:54 2,560 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-24 16:53 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-24 16:53 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-24 16:53 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-24 16:53 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-24 16:53 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-24 16:49 <DIR> d-------- C:\VundoFix Backups 2007-10-24 16:43 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-24 16:22 <DIR> d--hs---- C:\FOUND.046 2007-10-23 23:35 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-10-23 19:08 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\Winamp 2007-10-22 19:25 <DIR> d-------- C:\Program Files\MoorHunt 2007-10-22 01:09 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-10-20 11:30 <DIR> d-------- C:\Program Files\Winamp Toolbar 2007-10-20 11:30 <DIR> d-------- C:\Program Files\Winamp Remote 2007-10-20 11:26 <DIR> d-------- C:\Program Files\Winamp 2007-10-20 11:26 <DIR> d-------- C:\Documents and Settings\Konradek\Dane aplikacji\Winamp 2007-10-17 17:09 122,884 --a------ C:\WINDOWS\UnGins.exe 2007-10-17 16:26 <DIR> d-------- C:\7thLevel 2007-10-17 16:26 297,472 --a------ C:\WINDOWS\uninst.exe 2007-10-16 12:55 5,112 --a------ C:\WINDOWS\GPCIDrv.sys 2007-10-13 19:45 <DIR> d-------- C:\Program Files\ProgEdit 2007-10-13 13:05 <DIR> dr-h----- C:\Documents and Settings\Konradek\Dane aplikacji\SecuROM 2007-10-11 00:00 11,187 --a------ C:\WINDOWS\system32\drivers\ab_hid.sys 2007-10-10 19:47 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-10-10 19:47 14,848 --a------ C:\WINDOWS\system32\dllcache\kbdhid.sys 2007-10-10 16:55 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-10-10 16:55 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-10-10 15:12 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-09 15:55 <DIR> d-------- C:\ProgDVB 2007-10-09 00:33 307,200 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-10-08 22:10 <DIR> d-------- C:\Program Files\PC-TV 2007-10-08 22:07 26,730 -ra------ C:\WINDOWS\system32\drivers\DtvVideo.sys 2007-10-08 22:07 10,330 -ra------ C:\WINDOWS\system32\drivers\DtvAudio.sys 2007-10-07 13:34 <DIR> d-------- C:\Program Files\Norton Security Scan 2007-10-06 23:29 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\CyberLink 2007-10-06 22:35 <DIR> d-------- C:\Program Files\D-Tools 2007-10-06 22:34 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-10-06 07:37 <DIR> d-------- C:\Program Files\EA SPORTS 2007-10-05 21:38 17,962 --a------ C:\WINDOWS\system32\drivers\GVTDrv.sys 2007-10-05 21:36 <DIR> d-------- C:\Program Files\GIGABYTE 2007-10-05 19:09 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-10-04 23:47 <DIR> d-------- C:\Program Files\Cyberlink 2007-10-04 23:46 505,392 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-10-04 22:33 <DIR> d--hs---- C:\FOUND.045 2007-10-03 17:31 <DIR> d--hs---- C:\FOUND.044 2007-10-02 21:22 <DIR> d---s---- C:\Documents and Settings\pegaz\UserData 2007-10-02 21:15 <DIR> d-------- C:\Program Files\SopCast 2007-10-02 21:15 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\SopCast 2007-10-02 20:38 <DIR> d-------- C:\Program Files\Skype 2007-10-02 20:38 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-10-02 20:38 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\Skype 2007-10-02 20:24 <DIR> d--hs---- C:\FOUND.043 2007-10-02 14:51 <DIR> d--hs---- C:\FOUND.042 2007-10-02 14:32 <DIR> d--hs---- C:\FOUND.041 2007-10-02 13:57 <DIR> d--hs---- C:\FOUND.040 2007-10-01 13:47 <DIR> d-------- C:\Documents and Settings\Konradek\Dane aplikacji\Sports Interactive 2007-10-01 12:03 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-10-01 12:03 <DIR> d--h----- C:\Documents and Settings\pegaz\InstallAnywhere 2007-09-27 20:16 <DIR> d-------- C:\Documents and Settings\Anitka\Dane aplikacji\AdobeUM 2007-09-27 13:05 <DIR> d--hs---- C:\FOUND.039 2007-09-26 21:06 <DIR> d-------- C:\Program Files\uTorrent 2007-09-26 21:06 <DIR> d-------- C:\Documents and Settings\pegaz\Dane aplikacji\uTorrent . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-24 15:50 698,444 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-24 15:50 16,544 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-24 15:50 1,869,088 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-24 15:50 1,277,952 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-04 21:46 353,840 ----a-w C:\WINDOWS\system32\msvcr71.dll 2007-10-01 10:06 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-22 07:53 --------- d-----w C:\Program Files\Driver Cleaner 2007-09-21 17:37 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\dvdcss 2007-09-21 17:15 --------- d-----w C:\Documents and Settings\Milenka\Dane aplikacji\Ahead 2007-09-21 17:13 --------- d-----w C:\Documents and Settings\Milenka\Dane aplikacji\vlc 2007-09-20 11:56 --------- d-----w C:\Program Files\lol 2007-09-13 16:40 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler 2007-09-11 16:00 --------- d-----w C:\Documents and Settings\Konradek\Dane aplikacji\Tibia 2007-09-10 18:22 --------- d-----w C:\Program Files\Ubisoft 2007-09-10 18:18 --------- d-----w C:\Documents and Settings\Konradek\Dane aplikacji\Ahead 2007-09-09 12:49 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\OTVREG 2007-09-09 08:44 --------- d-----w C:\Program Files\Miranda IM 2007-09-04 22:45 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-09-02 19:03 --------- d-----w C:\Program Files\Common Files\Ahead 2007-08-25 19:26 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\TransRender 2007-08-25 19:26 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\Temporary 2007-08-25 19:26 --------- d-----w C:\Documents and Settings\pegaz\Dane aplikacji\ConvertTemp 2007-08-24 11:14 --------- d-----w C:\Program Files\WebServ 2007-08-22 13:19 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-22 13:19 661,504 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-22 13:19 616,448 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-22 13:19 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-22 13:19 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-22 13:19 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-08-22 13:19 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-22 13:19 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-22 13:19 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-22 13:19 3,079,168 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-22 13:19 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-22 13:19 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-22 13:19 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-22 13:19 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2007-08-22 13:19 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-22 13:19 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-08-22 13:19 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll 2007-08-22 13:19 1,022,976 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2007-08-22 02:08 268,800 ------w C:\WINDOWS\system32\ati2dvag.dll 2007-08-22 02:07 2,417,664 ----a-w C:\WINDOWS\system32\dllcache\ati2mtag.sys 2007-08-22 01:47 3,091,392 ------w C:\WINDOWS\system32\ati3duag.dll 2007-08-22 01:35 1,586,816 ------w C:\WINDOWS\system32\ativvaxx.dll 2007-08-22 01:11 450,560 ------w C:\WINDOWS\system32\ati2cqag.dll 2007-08-21 10:30 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:18 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-24_16.48.38.21 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 08:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-10-23 01:32:48 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-10-24 15:14:00 3,579,904 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2007-10-24 15:14:00 32,768 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-23 01:32:48 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-10-24 15:13:58 3,579,904 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2007-10-24 15:13:58 32,768 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51] "kis"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 19:09] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57] "RemoteControl"="e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24] "LanguageShortcut"="e:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43] "nwiz"="nwiz.exe" [2006-08-11 15:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 15:43] "VGAUtil"="C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe" [2007-01-02 10:22] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03] "MyTraveler"="C:\Documents and Settings\pegaz\Dane aplikacji\MyTraveler\MyTraveler.exe" [2007-05-23 14:41] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\e:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl R2 ThLircService;TwinHan WinLIRC service;C:\Documents and Settings\pegaz\Pulpit\th_lirc\th_lirc\th_lirc\th_lirc.exe R3 3xHybrid;TV-Station DVR service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys R3 AB_HID;AB_HID;C:\WINDOWS\system32\drivers\ab_hid.sys R3 DtvAudio;DtvAudio;C:\WINDOWS\system32\DRIVERS\DtvAudio.sys R3 DtvVideo;DtvVideo;C:\WINDOWS\system32\DRIVERS\DtvVideo.sys R3 GPCIDrv;GPCIDrv;\??\C:\WINDOWS\GPCIDrv.sys R3 GVTDrv;GVTDrv;\??\C:\WINDOWS\system32\Drivers\GVTDrv.sys S3 AC2003;AC2003;C:\WINDOWS\system32\Drivers\AC2003.sys S3 DSDrvNT;DSDrvNT;\??\E:\zrzuty\VirtualDub1493VCR+SYNC\DSDrvNT.sys S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys S3 TimerStop;TimerStop;\??\I:\TimerStop.sys . Contents of the 'Scheduled Tasks' folder "2007-10-19 13:00:02 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-24 18:28:16 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-24 18:28:54 C:\ComboFix3.txt ... 2007-10-24 16:49 C:\ComboFix2.txt ... 2007-10-24 17:23 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 24 Paź 2007, 18:33

jest ok

**Posty:** 6 · przez **solar7018** 24 Paź 2007, 18:36

no to dzięki serdeczne
A możesz mi powiedzieć co to było za świństwo?
i czy mogło pobrać np jakieś dane?

**Posty:** 18165 · przez **wojtas** 24 Paź 2007, 18:43

solar7018 napisał(a):A możesz mi powiedzieć co to było za świństwo?

byl to najprawdopodobniej trojan vundo

solar7018 napisał(a):i czy mogło pobrać np jakieś dane?

nie sadze

proszę o sprawdzenie loga (ocgrep)

proszę o sprawdzenie loga (ocgrep)

Kto jest na forum