Proszę o sprawdzenie loga, problem z otwieraniem dysków

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 14:48

Witam! jestem kobietą i mam problem z kompem, nie mogę otwierać dysków, tylko przez foldery. Przypuszcam, że jeden z anytwirusów usunął mi za dużo rzeczy i teraz się tak dzieje. Skaner mks nie wykazał żadnego wirusa. Mam zainstalowanego avasta. Proszę o pomoc i wskazannie mi jak najprostszym językiem, co mam zrobić, żeby uniknąć formata i czy to w ogóle jest możliwe. Poniżej log z hijack.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:07:04, on 2008-08-24 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\OSD.exe C:\Program Files\Launch Manager\OSDCtrl.exe C:\Program Files\Launch Manager\Wbutton.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\PrevxCSI\prevxcsi.exe C:\Program Files\PrevxCSI\prevxcsi.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Opera\opera.exe C:\Program Files\DC++\DCPlusPlus.exe C:\DOCUME~1\BEATA1~1\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\DOCUME~1\BEATA1~1\USTAWI~1\Temp\Katalog tymczasowy 2 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: OdysseyClient - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: CSIScanner - Unknown owner - C:\Program Files\PrevxCSI\prevxcsi.exe" /service (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

**Posty:** 18165 · przez **wojtas** 24 Sie 2008, 14:54

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 684 · przez **djarta** 24 Sie 2008, 14:57

Dodatkowo do wypowiedzi wojtasa

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

========================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 15:26

NA wstępie dziękuję! Dysk C już się otwiera po zastosowaniu SDFix, tylko nadal jest problem z dyskiem D. Nadal się nie otwiera, jedynie przez foldery. Proszę o wskazówkę, co mam teraz zrobić. Czy kontynuwać z COMBOFIX-em i wysłać ten rapor z SDFix?

pozdrawiam serdecznie

**Posty:** 684 · przez **djarta** 24 Sie 2008, 15:28

Wyślij raport z SDFix, i daj log z ComboFix.

====================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 15:41

Jesteście genialni!

Djarta uratowałeś mi kompa przed formatem:-) Otwiera się zarówno dysk C i D. Mam zatem pytanie, czy wysyłać raport i log z ComboFixa??? Poza tym mam pytanie, co zrobić, żeby się przez kolejną taką akcją? zainwestować w jakiegoś anywirusa, a jeżeli wystarczy darmowy anywirus i firewall, to co mam pościągać? Używam Opery i nie wiem, skąd się biorą te trojany:-(

JESZCZE RAZ WIELKIE DZIĘKUJĘ ZA POMOC WSZYSTKIM!!!!!

**Posty:** 684 · przez **djarta** 24 Sie 2008, 16:54

To nie koniec, daj log z ComboFixa po usuwaniu, i SDFix oczywiście.

====================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 17:12

oto log z ComboFixa

Kod: Zaznacz wszystko: ComboFix 08-08-23.03 - beata1983 2008-08-24 15:31:12.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.100 [GMT 2:00] Running from: C:\Documents and Settings\beata1983\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))) . 2008-08-24 15:13 . 2008-08-24 15:13 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-08-24 15:10 . 2008-08-24 15:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-24 15:05 . 2008-08-24 15:21 <DIR> d-------- C:\SDFix 2008-08-24 13:48 . 2008-08-24 13:48 100 --a------ C:\index.ini 2008-08-24 09:57 . 2008-08-24 09:57 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-08-24 09:39 . 2008-08-24 09:39 <DIR> d-------- C:\Program Files\PrevxCSI 2008-08-24 09:39 . 2008-08-24 09:39 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys 2008-08-24 09:38 . 2008-08-24 14:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI 2008-08-23 14:10 . 2008-08-23 14:10 <DIR> d-------- C:\Program Files\Alwil Software 2008-08-23 14:03 . 2008-08-23 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg8 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-23 09:08 . 2008-08-23 09:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-23 08:50 . 2008-08-23 08:50 <DIR> d-------- C:\WINDOWS\EHome 2008-08-22 23:58 . 2008-08-23 10:30 <DIR> d-------- C:\Program Files\PokerStars 2008-08-22 18:57 . 2004-08-03 22:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys 2008-08-22 18:57 . 2004-08-03 22:29 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys 2008-08-22 18:57 . 2004-08-03 22:41 126,686 --------- C:\WINDOWS\system32\drivers\mtlmnt5.sys 2008-08-22 18:57 . 2004-07-17 11:35 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img 2008-08-22 18:57 . 2004-08-04 14:00 36,644 -----c--- C:\WINDOWS\system32\dllcache\mplayer2.inf 2008-08-22 18:57 . 2004-08-04 14:00 22,060 -----c--- C:\WINDOWS\system32\dllcache\npds.zip 2008-08-22 18:57 . 2004-08-04 14:00 2,778 -----c--- C:\WINDOWS\system32\dllcache\mplogoh.gif 2008-08-22 18:57 . 2004-08-04 14:00 2,545 -----c--- C:\WINDOWS\system32\dllcache\mplogo.gif 2008-08-22 18:57 . 2004-08-04 14:00 403 -----c--- C:\WINDOWS\system32\dllcache\npdrmv2.zip 2008-08-22 18:56 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-08-22 18:56 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys 2008-08-22 18:56 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys 2008-08-22 18:56 . 2004-08-04 14:00 5,971 -----c--- C:\WINDOWS\system32\dllcache\events.js 2008-08-22 18:55 . 2004-08-04 14:00 184,137 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz 2008-08-22 18:55 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty 2008-08-22 18:55 . 2004-08-04 14:00 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css 2008-08-22 18:55 . 2004-08-04 14:00 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif 2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif 2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif 2008-08-22 18:55 . 2004-08-04 14:00 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif 2008-08-22 18:55 . 2004-08-04 14:00 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif 2008-08-22 18:55 . 2004-08-04 14:00 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif 2008-08-15 19:16 . 2008-08-23 08:00 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-08-15 19:10 . 2008-08-15 21:37 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-08-15 18:56 . 2008-08-15 18:56 <DIR> d-------- C:\Documents and Settings\beata1983\DoctorWeb 2008-08-15 14:47 . 2008-08-15 15:16 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-08-15 13:53 . 2008-08-15 13:53 <DIR> d-------- C:\fsaua.data 2008-08-15 13:24 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-03 00:12 . 2008-08-23 09:53 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\foobar2000 2008-08-03 00:11 . 2008-08-03 00:12 <DIR> d-------- C:\Program Files\foobar2000 2008-08-02 15:32 . 2008-08-02 15:32 21,916 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-08-02 15:19 . 2008-08-02 22:06 <DIR> d-------- C:\Program Files\Picasa2 2008-08-02 15:19 . 2008-08-02 15:19 <DIR> d-------- C:\Program Files\Google 2008-08-02 15:03 . 2008-08-09 06:11 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\gtk-2.0 2008-08-02 15:03 . 2008-08-02 15:03 <DIR> d-------- C:\Documents and Settings\beata1983\.thumbnails 2008-08-02 15:01 . 2008-08-09 06:10 <DIR> d-------- C:\Documents and Settings\beata1983\.gimp-2.4 2008-08-02 15:00 . 2008-08-02 15:00 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-08-02 14:50 . 2008-08-02 14:57 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Program Files\Ashampoo 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Ashampoo 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-08-02 14:37 . 2008-08-02 14:37 <DIR> d-------- C:\Program Files\WebHat Software 2008-08-02 07:52 . 2008-08-02 07:52 <DIR> d-------- C:\Program Files\Nowy folder (2) 2008-08-01 18:32 . 2008-08-09 19:22 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\skypePM 2008-08-01 18:32 . 2008-08-01 18:32 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-08-01 18:30 . 2008-08-09 19:29 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Program Files\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-07-29 13:49 . 2008-07-29 13:49 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Ahead 2008-07-29 13:23 . 2008-08-24 15:05 <DIR> d-------- C:\Program Files\DC++ 2008-07-26 09:09 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-23 13:36 --------- d-----w C:\Program Files\SkanerOnline 2008-08-22 15:40 --------- d-----w C:\Program Files\Opera 2008-08-16 16:55 --------- d-----w C:\Program Files\SubEdit-Player 2008-08-09 04:37 --------- d-----w C:\Program Files\Java 2008-08-02 05:24 --------- d-----w C:\Program Files\Winamp Remote 2008-08-01 19:49 --------- d-----w C:\Program Files\PartyGaming.Net 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-06 07:51 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\DivX 2008-07-05 22:27 --------- d-----w C:\Program Files\PartyGaming 2008-07-05 22:23 --------- d-----w C:\Program Files\B2BPOKER 2008-07-05 22:11 --------- d-----w C:\Program Files\DivX 2008-07-05 22:07 --------- d-----w C:\Program Files\AC3Filter 2008-07-05 22:05 --------- d-----w C:\Program Files\CONEXANT 2008-07-05 21:53 --------- d-----w C:\Program Files\Microsoft Works 2008-07-05 21:49 532,558 ----a-w C:\WINDOWS\system32\odGinaLibrary.dll 2008-07-05 21:49 139,330 ----a-w C:\WINDOWS\system32\odyGina.dll 2008-07-05 21:49 106,496 ----a-w C:\WINDOWS\system32\odyEvent.dll 2008-07-05 21:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-05 21:49 --------- d-----w C:\Program Files\Launch Manager 2008-07-05 21:47 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-05 21:26 --------- d-----w C:\Program Files\IrfanView 2008-07-05 21:07 --------- d-----w C:\Program Files\Ahead 2008-07-05 21:06 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-05 21:03 --------- d-----w C:\Program Files\Common Files\Ahead 2008-07-05 21:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-07-05 20:54 --------- d-----w C:\Program Files\ATI Technologies 2008-07-05 20:52 --------- d-----w C:\Program Files\AMD 2008-07-05 20:14 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-05 20:08 --------- d-----w C:\Program Files\Nowy folder 2008-07-05 19:36 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-05 19:35 --------- d-----w C:\Program Files\Common Files\Java 2008-07-05 19:29 --------- d-----w C:\Program Files\Usługi online 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:13 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-06-11 00:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-06-11 00:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-06-11 00:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:21 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 21:05 339968] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768] "HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-05-02 14:09 57344] "LMgrVolOSD"="C:\Program Files\Launch Manager\OSD.exe" [2005-03-16 13:52 204800] "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 10:47 245760] "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-04-18 11:41 81920] "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008] "SoundMan"="SOUNDMAN.EXE" [2005-03-24 20:20 77824 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 19:21 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\jre1.5.0\\bin\\javaw.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-08-24 09:39] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-08-24 09:39] R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 14:18] S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [] S3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2005-05-18 13:52] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - yssjnngm.cmd \Shell\explore\Command - yssjnngm.cmd \Shell\open\Command - yssjnngm.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - yssjnngm.cmd \Shell\explore\Command - yssjnngm.cmd \Shell\open\Command - yssjnngm.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d7b586e-4ad6-11dd-bc88-000ae4b65ecc}] \Shell\AutoRun\command - F:\l3v.exe \Shell\explore\Command - F:\l3v.exe \Shell\open\Command - F:\l3v.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ade91692-6c4c-11dd-bcb3-000ae4b65ecc}] \Shell\AutoRun\command - F:\t1ypkh.exe \Shell\explore\Command - F:\t1ypkh.exe \Shell\open\Command - F:\t1ypkh.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b17aead6-5adf-11dd-bc94-000ae4b65ecc}] \Shell\AutoRun\command - F:\t1ypkh.exe \Shell\explore\Command - F:\t1ypkh.exe \Shell\open\Command - F:\t1ypkh.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b17aead7-5adf-11dd-bc94-000ae4b65ecc}] \Shell\AutoRun\command - G:\t1ypkh.exe \Shell\explore\Command - G:\t1ypkh.exe \Shell\open\Command - G:\t1ypkh.exe *Newly Created Service* - PROCEXP90 . - - - - ORPHANS REMOVED - - - - HKLM-Run-WinampAgent - C:\Program Files\Winamp\winampa.exe Notify-OdysseyClient - (no file) . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.onet.pl/ R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore O9 -: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 -: {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://arcaonline.arcabit.com/ArcaOnline.cab C:\WINDOWS\Downloaded Program Files\ArcaOnline.inf C:\WINDOWS\system32\ArcaMicroScanUpdater.exe C:\WINDOWS\system32\ArcaOnlineUninstall.exe C:\WINDOWS\system32\ArcaOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\system32\SkanerOnlineUninstall.exe C:\WINDOWS\system32\SkanerOnline.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-24 15:33:08 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?????T??????|x??|????q??|?j?wQj?w????????0??? ???|???????????\??????|????????h?????@??J?????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s??????7~??@?N'?s?E9?-6@??E9???????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-24 15:34:40 ComboFix-quarantined-files.txt 2008-08-24 13:34:15 Pre-Run: 3,172,515,840 bajtów wolnych Post-Run: 3,886,514,176 bajtów wolnych 227 --- E O F --- 2008-08-23 16:36:02

a to SDFix raport

Kod: Zaznacz wszystko: [b]SDFix: Version 1.219 [/b] Run by beata1983 on 2008-08-24 at 15:14 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\autorun.inf - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-24 15:19:50 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "C:\\Program Files\\Java\\jre1.5.0\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0\\bin\\javaw.exe:*:Disabled:Java(TM) 2 Platform Standard Edition binary" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sat 2 Aug 2008 6,104,632 A..H. --- "C:\Program Files\Picasa2\setup.exe" [b]Finished![/b]

**Posty:** 684 · przez **djarta** 24 Sie 2008, 17:27

1)

Wylecz pendriva lub kartę pamięci
Perlovga Removal Tool
Flash Disinfector
lub format

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: F:\l3v.exe C:\l3v.exe D:\l3v.exe G:\l3v.exe F:\t1ypkh.exe C:\t1ypkh.exe D:\t1ypkh.exe G:\t1ypkh.exe Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d7b586e-4ad6-11dd-bc88-000ae4b65ecc}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ade91692-6c4c-11dd-bcb3-000ae4b65ecc}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b17aead6-5adf-11dd-bc94-000ae4b65ecc}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b17aead7-5adf-11dd-bc94-000ae4b65ecc}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

=============================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 17:50

oto log jaki powstał po usuwaniu. Usunęłam już też ręcznie C:\Qoobox.

Kod: Zaznacz wszystko: ComboFix 08-08-23.03 - beata1983 2008-08-24 17:41:20.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.136 [GMT 2:00] Running from: C:\Documents and Settings\beata1983\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\beata1983\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\l3v.exe C:\t1ypkh.exe D:\l3v.exe D:\t1ypkh.exe F:\l3v.exe F:\t1ypkh.exe G:\l3v.exe G:\t1ypkh.exe . ((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))) . 2008-08-24 15:13 . 2008-08-24 15:13 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-08-24 15:10 . 2008-08-24 15:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-24 15:05 . 2008-08-24 15:21 <DIR> d-------- C:\SDFix 2008-08-24 13:48 . 2008-08-24 13:48 100 --a------ C:\index.ini 2008-08-24 09:57 . 2008-08-24 09:57 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-08-24 09:39 . 2008-08-24 09:39 <DIR> d-------- C:\Program Files\PrevxCSI 2008-08-24 09:39 . 2008-08-24 09:39 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys 2008-08-24 09:38 . 2008-08-24 14:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI 2008-08-23 14:10 . 2008-08-23 14:10 <DIR> d-------- C:\Program Files\Alwil Software 2008-08-23 14:03 . 2008-08-23 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg8 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-23 09:08 . 2008-08-23 09:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-23 08:50 . 2008-08-23 08:50 <DIR> d-------- C:\WINDOWS\EHome 2008-08-22 23:58 . 2008-08-23 10:30 <DIR> d-------- C:\Program Files\PokerStars 2008-08-22 18:57 . 2004-08-03 22:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys 2008-08-22 18:57 . 2004-08-03 22:29 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys 2008-08-22 18:57 . 2004-08-03 22:41 126,686 --------- C:\WINDOWS\system32\drivers\mtlmnt5.sys 2008-08-22 18:57 . 2004-07-17 11:35 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img 2008-08-22 18:57 . 2004-08-04 14:00 36,644 -----c--- C:\WINDOWS\system32\dllcache\mplayer2.inf 2008-08-22 18:57 . 2004-08-04 14:00 22,060 -----c--- C:\WINDOWS\system32\dllcache\npds.zip 2008-08-22 18:57 . 2004-08-04 14:00 2,778 -----c--- C:\WINDOWS\system32\dllcache\mplogoh.gif 2008-08-22 18:57 . 2004-08-04 14:00 2,545 -----c--- C:\WINDOWS\system32\dllcache\mplogo.gif 2008-08-22 18:57 . 2004-08-04 14:00 403 -----c--- C:\WINDOWS\system32\dllcache\npdrmv2.zip 2008-08-22 18:56 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-08-22 18:56 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys 2008-08-22 18:56 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys 2008-08-22 18:56 . 2004-08-04 14:00 5,971 -----c--- C:\WINDOWS\system32\dllcache\events.js 2008-08-22 18:55 . 2004-08-04 14:00 184,137 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz 2008-08-22 18:55 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty 2008-08-22 18:55 . 2004-08-04 14:00 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css 2008-08-22 18:55 . 2004-08-04 14:00 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif 2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif 2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif 2008-08-22 18:55 . 2004-08-04 14:00 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif 2008-08-22 18:55 . 2004-08-04 14:00 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif 2008-08-22 18:55 . 2004-08-04 14:00 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif 2008-08-15 19:16 . 2008-08-23 08:00 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-08-15 19:10 . 2008-08-15 21:37 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-08-15 18:56 . 2008-08-15 18:56 <DIR> d-------- C:\Documents and Settings\beata1983\DoctorWeb 2008-08-15 14:47 . 2008-08-15 15:16 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-08-15 13:53 . 2008-08-15 13:53 <DIR> d-------- C:\fsaua.data 2008-08-15 13:24 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-03 00:12 . 2008-08-24 17:03 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\foobar2000 2008-08-03 00:11 . 2008-08-03 00:12 <DIR> d-------- C:\Program Files\foobar2000 2008-08-02 15:32 . 2008-08-02 15:32 21,916 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-08-02 15:19 . 2008-08-02 22:06 <DIR> d-------- C:\Program Files\Picasa2 2008-08-02 15:19 . 2008-08-02 15:19 <DIR> d-------- C:\Program Files\Google 2008-08-02 15:03 . 2008-08-09 06:11 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\gtk-2.0 2008-08-02 15:03 . 2008-08-02 15:03 <DIR> d-------- C:\Documents and Settings\beata1983\.thumbnails 2008-08-02 15:01 . 2008-08-09 06:10 <DIR> d-------- C:\Documents and Settings\beata1983\.gimp-2.4 2008-08-02 15:00 . 2008-08-02 15:00 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-08-02 14:50 . 2008-08-02 14:57 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Program Files\Ashampoo 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Ashampoo 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-08-02 14:37 . 2008-08-02 14:37 <DIR> d-------- C:\Program Files\WebHat Software 2008-08-02 07:52 . 2008-08-02 07:52 <DIR> d-------- C:\Program Files\Nowy folder (2) 2008-08-01 18:32 . 2008-08-09 19:22 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\skypePM 2008-08-01 18:32 . 2008-08-01 18:32 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-08-01 18:30 . 2008-08-09 19:29 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Program Files\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-07-29 13:49 . 2008-07-29 13:49 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Ahead 2008-07-29 13:23 . 2008-08-24 15:43 <DIR> d-------- C:\Program Files\DC++ 2008-07-26 09:09 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-23 13:36 --------- d-----w C:\Program Files\SkanerOnline 2008-08-22 15:40 --------- d-----w C:\Program Files\Opera 2008-08-16 16:55 --------- d-----w C:\Program Files\SubEdit-Player 2008-08-09 04:37 --------- d-----w C:\Program Files\Java 2008-08-02 05:24 --------- d-----w C:\Program Files\Winamp Remote 2008-08-01 19:49 --------- d-----w C:\Program Files\PartyGaming.Net 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-06 07:51 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\DivX 2008-07-05 22:27 --------- d-----w C:\Program Files\PartyGaming 2008-07-05 22:23 --------- d-----w C:\Program Files\B2BPOKER 2008-07-05 22:11 --------- d-----w C:\Program Files\DivX 2008-07-05 22:07 --------- d-----w C:\Program Files\AC3Filter 2008-07-05 22:05 --------- d-----w C:\Program Files\CONEXANT 2008-07-05 21:53 --------- d-----w C:\Program Files\Microsoft Works 2008-07-05 21:49 532,558 ----a-w C:\WINDOWS\system32\odGinaLibrary.dll 2008-07-05 21:49 139,330 ----a-w C:\WINDOWS\system32\odyGina.dll 2008-07-05 21:49 106,496 ----a-w C:\WINDOWS\system32\odyEvent.dll 2008-07-05 21:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-05 21:49 --------- d-----w C:\Program Files\Launch Manager 2008-07-05 21:47 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-05 21:26 --------- d-----w C:\Program Files\IrfanView 2008-07-05 21:07 --------- d-----w C:\Program Files\Ahead 2008-07-05 21:06 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-05 21:03 --------- d-----w C:\Program Files\Common Files\Ahead 2008-07-05 21:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-07-05 20:54 --------- d-----w C:\Program Files\ATI Technologies 2008-07-05 20:52 --------- d-----w C:\Program Files\AMD 2008-07-05 20:14 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-05 20:08 --------- d-----w C:\Program Files\Nowy folder 2008-07-05 19:36 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-05 19:35 --------- d-----w C:\Program Files\Common Files\Java 2008-07-05 19:29 --------- d-----w C:\Program Files\Usługi online 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:13 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-06-11 00:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-06-11 00:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-06-11 00:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll . ((((((((((((((((((((((((((((( snapshot@2008-08-24_15.33.57.50 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-24 15:06:29 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_540.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:21 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 21:05 339968] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768] "HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-05-02 14:09 57344] "LMgrVolOSD"="C:\Program Files\Launch Manager\OSD.exe" [2005-03-16 13:52 204800] "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 10:47 245760] "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-04-18 11:41 81920] "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008] "SoundMan"="SOUNDMAN.EXE" [2005-03-24 20:20 77824 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 19:21 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\jre1.5.0\\bin\\javaw.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-08-24 09:39] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-08-24 09:39] R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 14:18] S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [] S3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2005-05-18 13:52] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-24 17:42:54 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?????T??????|x??|????q??|?j?wQj?w????????0??? ???|???????????\??????|????????h?????@??J?????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s??????7~??@?N'?s?E9?-6@??E9???????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-24 17:43:57 ComboFix-quarantined-files.txt 2008-08-24 15:43:47 ComboFix2.txt 2008-08-24 13:34:41 Pre-Run: 3,870,113,792 bajtów wolnych Post-Run: 3,858,812,928 bajtów wolnych 193 --- E O F --- 2008-08-23 16:36:02

proszę też o odpowiedź czy mam się zastosować też do :
Wylecz pendriva lub kartę pamięci
Perlovga Removal Tool
Flash Disinfector
i mam użyć też te programy mimo tych wszystkich ruchów, czy razem z pendrivem je zastsoawać????

Dziękuję za pomoc!

**Posty:** 684 · przez **djarta** 24 Sie 2008, 17:52

proszę też o odpowiedź czy mam się zastosować też do :

Użyj tylko jednego "wariantu", którego chcesz.

i mam użyć też te programy mimo tych wszystkich ruchów, czy razem z pendrivem je zastsoawać????

Tak, podepnij pena i użyj czego chcesz. :wink:

==========================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 17:58

ok, zaraz tak zrobię, czy potem to już wsio??? i mam też idiotyczne pytanie, czy na komórce, która ma kartę pamięci tez mogą być wirusy??? bo łączyłam ją z kompem

i proszę ewentualnie o wskazówki, czy ją też czymś przeskanowac

dzięki serdeczne za całą pomoc

**Posty:** 684 · przez **djarta** 24 Sie 2008, 18:01

Wszystko co podpinasz pod komputer jest zainfekowane, więc podłącz komórkę i zrób to samo.Tym samym przeskanuj.

Potem po wszystkich podpięciach pod komputer, odpinasz i dajesz nowy log z ComboFixa. :wink:

==================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 18:04

oczyściłam pendrive, o ile polega to na dwóch ruchach OK i potem komunikat DONE. Proszę o ostateczne wskazówki (skąd mam wiedzieć, że już wszystko ok- poza tym, że jestem przeszczęśliwa, że otwierają się dyski

).

Uprzejmie proszę też o informacje o antywirusie i firewall-u.

Dzięki za wszystko!

**Posty:** 684 · przez **djarta** 24 Sie 2008, 18:07

Jeśli wszystko oczyśćiłaś to teraz nowy log z ComboFixa.

Uprzejmie proszę też o informacje o antywirusie i firewall-u.

To znaczy?Możesz mi głębiej wytłumaczyć? :wink:

===========================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 18:13

oczyściłam pendrive i komórkę i wysyłam nowy log z ComboFix-a i czekam na wyrok....

Kod: Zaznacz wszystko: ComboFix 08-08-23.03 - beata1983 2008-08-24 18:08:44.3 - NTFSx86 Running from: C:\Documents and Settings\beata1983\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))) . 2008-08-24 15:13 . 2008-08-24 15:13 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-08-24 15:10 . 2008-08-24 15:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-24 15:05 . 2008-08-24 15:21 <DIR> d-------- C:\SDFix 2008-08-24 13:48 . 2008-08-24 13:48 100 --a------ C:\index.ini 2008-08-24 09:57 . 2008-08-24 09:57 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-08-24 09:39 . 2008-08-24 09:39 <DIR> d-------- C:\Program Files\PrevxCSI 2008-08-24 09:39 . 2008-08-24 09:39 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys 2008-08-24 09:38 . 2008-08-24 14:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI 2008-08-23 14:10 . 2008-08-23 14:10 <DIR> d-------- C:\Program Files\Alwil Software 2008-08-23 14:03 . 2008-08-23 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg8 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-23 09:08 . 2008-08-23 09:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-23 08:50 . 2008-08-23 08:50 <DIR> d-------- C:\WINDOWS\EHome 2008-08-22 23:58 . 2008-08-23 10:30 <DIR> d-------- C:\Program Files\PokerStars 2008-08-22 18:57 . 2004-08-03 22:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys 2008-08-22 18:57 . 2004-08-03 22:29 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys 2008-08-22 18:57 . 2004-08-03 22:41 126,686 --------- C:\WINDOWS\system32\drivers\mtlmnt5.sys 2008-08-22 18:57 . 2004-07-17 11:35 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img 2008-08-22 18:57 . 2004-08-04 14:00 36,644 -----c--- C:\WINDOWS\system32\dllcache\mplayer2.inf 2008-08-22 18:57 . 2004-08-04 14:00 22,060 -----c--- C:\WINDOWS\system32\dllcache\npds.zip 2008-08-22 18:57 . 2004-08-04 14:00 2,778 -----c--- C:\WINDOWS\system32\dllcache\mplogoh.gif 2008-08-22 18:57 . 2004-08-04 14:00 2,545 -----c--- C:\WINDOWS\system32\dllcache\mplogo.gif 2008-08-22 18:57 . 2004-08-04 14:00 403 -----c--- C:\WINDOWS\system32\dllcache\npdrmv2.zip 2008-08-22 18:56 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-08-22 18:56 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys 2008-08-22 18:56 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys 2008-08-22 18:56 . 2004-08-04 14:00 5,971 -----c--- C:\WINDOWS\system32\dllcache\events.js 2008-08-22 18:55 . 2004-08-04 14:00 184,137 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz 2008-08-22 18:55 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty 2008-08-22 18:55 . 2004-08-04 14:00 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css 2008-08-22 18:55 . 2004-08-04 14:00 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif 2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif 2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif 2008-08-22 18:55 . 2004-08-04 14:00 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif 2008-08-22 18:55 . 2004-08-04 14:00 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif 2008-08-22 18:55 . 2004-08-04 14:00 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif 2008-08-15 19:16 . 2008-08-23 08:00 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-08-15 19:10 . 2008-08-15 21:37 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-08-15 18:56 . 2008-08-15 18:56 <DIR> d-------- C:\Documents and Settings\beata1983\DoctorWeb 2008-08-15 14:47 . 2008-08-15 15:16 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-08-15 13:53 . 2008-08-15 13:53 <DIR> d-------- C:\fsaua.data 2008-08-15 13:24 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-03 00:12 . 2008-08-24 17:03 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\foobar2000 2008-08-03 00:11 . 2008-08-03 00:12 <DIR> d-------- C:\Program Files\foobar2000 2008-08-02 15:32 . 2008-08-02 15:32 21,916 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-08-02 15:19 . 2008-08-02 22:06 <DIR> d-------- C:\Program Files\Picasa2 2008-08-02 15:19 . 2008-08-02 15:19 <DIR> d-------- C:\Program Files\Google 2008-08-02 15:03 . 2008-08-09 06:11 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\gtk-2.0 2008-08-02 15:03 . 2008-08-02 15:03 <DIR> d-------- C:\Documents and Settings\beata1983\.thumbnails 2008-08-02 15:01 . 2008-08-09 06:10 <DIR> d-------- C:\Documents and Settings\beata1983\.gimp-2.4 2008-08-02 15:00 . 2008-08-02 15:00 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-08-02 14:50 . 2008-08-02 14:57 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Program Files\Ashampoo 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Ashampoo 2008-08-02 14:46 . 2008-08-02 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-08-02 14:37 . 2008-08-02 14:37 <DIR> d-------- C:\Program Files\WebHat Software 2008-08-02 07:52 . 2008-08-02 07:52 <DIR> d-------- C:\Program Files\Nowy folder (2) 2008-08-01 18:32 . 2008-08-09 19:22 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\skypePM 2008-08-01 18:32 . 2008-08-01 18:32 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-08-01 18:30 . 2008-08-09 19:29 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Program Files\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-08-01 18:29 . 2008-08-01 18:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-07-29 13:49 . 2008-07-29 13:49 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\Ahead 2008-07-29 13:23 . 2008-08-24 15:43 <DIR> d-------- C:\Program Files\DC++ 2008-07-26 09:09 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-23 13:36 --------- d-----w C:\Program Files\SkanerOnline 2008-08-22 15:40 --------- d-----w C:\Program Files\Opera 2008-08-16 16:55 --------- d-----w C:\Program Files\SubEdit-Player 2008-08-09 04:37 --------- d-----w C:\Program Files\Java 2008-08-02 05:24 --------- d-----w C:\Program Files\Winamp Remote 2008-08-01 19:49 --------- d-----w C:\Program Files\PartyGaming.Net 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-06 07:51 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\DivX 2008-07-05 22:27 --------- d-----w C:\Program Files\PartyGaming 2008-07-05 22:23 --------- d-----w C:\Program Files\B2BPOKER 2008-07-05 22:11 --------- d-----w C:\Program Files\DivX 2008-07-05 22:07 --------- d-----w C:\Program Files\AC3Filter 2008-07-05 22:05 --------- d-----w C:\Program Files\CONEXANT 2008-07-05 21:53 --------- d-----w C:\Program Files\Microsoft Works 2008-07-05 21:49 532,558 ----a-w C:\WINDOWS\system32\odGinaLibrary.dll 2008-07-05 21:49 139,330 ----a-w C:\WINDOWS\system32\odyGina.dll 2008-07-05 21:49 106,496 ----a-w C:\WINDOWS\system32\odyEvent.dll 2008-07-05 21:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-05 21:49 --------- d-----w C:\Program Files\Launch Manager 2008-07-05 21:47 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-05 21:26 --------- d-----w C:\Program Files\IrfanView 2008-07-05 21:07 --------- d-----w C:\Program Files\Ahead 2008-07-05 21:06 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-05 21:03 --------- d-----w C:\Program Files\Common Files\Ahead 2008-07-05 21:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-07-05 20:54 --------- d-----w C:\Program Files\ATI Technologies 2008-07-05 20:52 --------- d-----w C:\Program Files\AMD 2008-07-05 20:14 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-05 20:08 --------- d-----w C:\Program Files\Nowy folder 2008-07-05 19:36 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-05 19:35 --------- d-----w C:\Program Files\Common Files\Java 2008-07-05 19:29 --------- d-----w C:\Program Files\Usługi online 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:13 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-06-11 00:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-06-11 00:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-06-11 00:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:21 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 21:05 339968] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768] "HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-05-02 14:09 57344] "LMgrVolOSD"="C:\Program Files\Launch Manager\OSD.exe" [2005-03-16 13:52 204800] "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 10:47 245760] "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-04-18 11:41 81920] "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008] "SoundMan"="SOUNDMAN.EXE" [2005-03-24 20:20 77824 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 19:21 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\jre1.5.0\\bin\\javaw.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-08-24 09:39] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-08-24 09:39] R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 14:18] S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [] S3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2005-05-18 13:52] . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.onet.pl/ R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore O9 -: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 -: {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://arcaonline.arcabit.com/ArcaOnline.cab C:\WINDOWS\Downloaded Program Files\ArcaOnline.inf C:\WINDOWS\system32\ArcaMicroScanUpdater.exe C:\WINDOWS\system32\ArcaOnlineUninstall.exe C:\WINDOWS\system32\ArcaOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\system32\SkanerOnlineUninstall.exe C:\WINDOWS\system32\SkanerOnline.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-24 18:10:31 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?????T??????|x??|????q??|?j?wQj?w????????0??? ???|???????????\??????|????????h?????@??J?????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s??????7~??@?N'?s?E9?-6@??E9???????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-24 18:11:49 ComboFix-quarantined-files.txt 2008-08-24 16:11:38 ComboFix2.txt 2008-08-24 15:43:58 Pre-Run: 3,865,702,400 bajtów wolnych Post-Run: 3,854,520,320 bajtów wolnych 194 --- E O F --- 2008-08-23 16:36:02

**Posty:** 684 · przez **djarta** 24 Sie 2008, 18:16

Ja nie widzę teraz nic ciekawego.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=======================
K.

**Posty:** 26 · przez **fendi83** 24 Sie 2008, 18:32

ta cała reszta przy następnym razie. teraz muszę odstawić kompa, ale jak już będę miała raport to umieszczę. Dzięki za pomoc. Pozdrawiam!

Dodano Dzisiaj, 17:23:
Proszę o opinię i sprawdzenie loga z FixIEDef.

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.6.6088 * * * ******************************************************************************** Created at 17:21:04 on Friday, September 05, 2008 Time Zone : Logged On User : beata1983 Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Turion(tm) 64 Mobile Technology ML-32 System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 391328 KB Free Physical Memory : 138112 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2020772 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\autorun.inf -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kto jest na forum