Proszę o sprawdzenie loga (telecalib_logging.dll - problem)

**Posty:** 67 · przez **kamos1602** 09 Lis 2008, 14:57

Witam, ostatnio dzieją mi się dziwne rzeczy z komputerem. Podczas gdy grałem w Metin2 (gra mmorpg) wszystko było dobrze, ale kiedy chciałem sie wylogować i wyłączyć grę komputer, nie wiem chyba zawisł, czekałem na jakąś reakcję 10 minut. Niestety nic się nie działo, więc zresetowałem komputer. Po włączeniu na nowo komputera strasznie powolno pracował i pokazywało mi się okienko: Error launcher.exe (Telecalib_logging.dll nie można znaleść). Czytałem trochę na forum i wiem, że trzeba wejść w:

Kod: Zaznacz wszystko: Start -> Uruchom -> msconfig -> Uruchamianie -> i tam odznaczyć Telecalib_logging.dll

To zrobiłem, ale niestety komputer nadal źle pracuje, a strony wczytują sie po klika minut! Ponadto nic nie mogę instalować ani usuwać bo jest napisane, że:

Kod: Zaznacz wszystko: Nie można uzyskać dostępu do usługi Instalatora Windows. Może się to zdarzyć, jeśli system Windows działa w trybie awaryjnym lub jeśli instalator windows nie jest poprawnie zainstalowany. Skonaktuj się z personelem pomocy technicznej

I na dodatek codziennie jak włączam komputer pokazuję się nowe okienko, że brakuje jakiś składników windows np: htievpyq.dll; ebrhokav.dll. Ale ich nazwy także odznaczyłem w:

Kod: Zaznacz wszystko: Start -> Uruchom -> msconfig -> Uruchamianie -> tutaj

Wklejam log z programu Hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:34:24, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Applications\wcs.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Metin2.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\user\Menu Start\Programy\Autostart\spoolsv.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\user\Pulpit\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [Metin2] C:\Metin2.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdaux.exe] C:\WINDOWS\system32\kdaux.exe O4 - HKLM\..\Run: [KJHJOEJK] %systemroot%\KJHJOEJK.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DVDUpgrade] DVDUpgrd.exe /async O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [QuickTimeTask] C:\Program Files\Applications\wcs.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: spoolsv.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS1\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS2\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS3\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS4\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O20 - AppInit_DLLs: eeovnm.dll O23 - Service: Harmonogram automatycznej usługi LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 7360 bytes

Proszę o pomoc, bo to staje się nieznośne

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 15:00

na fix

Kod: Zaznacz wszystko: C:\Documents and Settings\user\Menu Start\Programy\Autostart\spoolsv.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdaux.exe] C:\WINDOWS\system32\kdaux.exe O4 - HKLM\..\Run: [KJHJOEJK] %systemroot%\KJHJOEJK.exe O4 - Startup: spoolsv.exe O20 - AppInit_DLLs: eeovnm.dll

kolego wklej log z combofix

dwa, znasz te domeny??

Kod: Zaznacz wszystko: O17 - HKLM\System\CCS\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS1\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS2\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS3\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS4\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132

**Posty:** 67 · przez **kamos1602** 09 Lis 2008, 17:24

Przepraszam najmocniej, zapomniałem dodać tego skanu z ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - user 2008-11-09 15:57:04.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1467 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\user\USTAWI~1\Temp\tmp1.tmp c:\docume~1\user\USTAWI~1\Temp\tmp2.tmp c:\program files\Applications\wcs.exe C:\resycled c:\resycled\boot.com c:\windows\olinkinfo.dll c:\windows\system32\acburknf.ini c:\windows\system32\bbHRBJlm.ini c:\windows\system32\bbHRBJlm.ini2 c:\windows\system32\bmjlgf.dll c:\windows\system32\drivers\VPWRNQOS.sys c:\windows\system32\eeovnm.dll c:\windows\system32\eiaesdmc.dll c:\windows\system32\ewfwminb.dll c:\windows\system32\frvbhlaq.dll c:\windows\system32\gjvlkgeu.ini c:\windows\system32\hgkkfufe.ini c:\windows\system32\hsiztl.dll c:\windows\system32\iodmuere.dll c:\windows\system32\ipyiky.dll c:\windows\system32\irkavupq.dll c:\windows\system32\iwlqghqj.dll c:\windows\system32\kdaux.exe c:\windows\system32\khffDSki.dll c:\windows\system32\kxyxduwn.ini c:\windows\system32\lfyhpvdb.ini c:\windows\system32\lomwnssc.ini c:\windows\system32\lythfenp.ini c:\windows\system32\mfheprcs.ini c:\windows\system32\mlJBRHbb.dll c:\windows\system32\mqtbbeqs.dll c:\windows\system32\msansspc.dll c:\windows\system32\mtmwgfpl.dll c:\windows\system32\oarkvdqr.ini c:\windows\system32\opnlJDWq.dll c:\windows\system32\pefkii.dll c:\windows\system32\pmppukvo.ini c:\windows\system32\pnefhtyl.dll c:\windows\system32\qfumtqcb.dll c:\windows\system32\qtkxmgsi.dll c:\windows\system32\qypveith.ini c:\windows\system32\qzbctw.dll c:\windows\system32\riamvg.dll c:\windows\system32\teoffgve.ini c:\windows\system32\thduvcan.ini c:\windows\system32\tmgtfkuo.ini c:\windows\system32\vakohrbe.ini c:\windows\system32\vclmnyww.dll c:\windows\system32\vhdkpv.dll c:\windows\system32\wbydihfl.ini c:\windows\system32\wpykys.dll c:\windows\system32\wzksfe.dll c:\windows\system32\xjkvoo.dll c:\windows\system32\xocaerio.ini c:\windows\system32\yudxgfdh.dll c:\windows\system32\yvkydy.dll c:\windows\wiaservb.log D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_VPWRNQOS -------\Service_VPWRNQOS ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 12:44 . 2008-11-09 12:44 <DIR> d-------- c:\documents and settings\Metin\Dane aplikacji\Symantec 2008-11-09 12:43 . 2008-02-08 17:38 <DIR> d--h----- c:\documents and settings\Metin\Ustawienia lokalne 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> dr------- c:\documents and settings\Metin\Ulubione 2008-11-09 12:43 . 2008-10-28 15:21 <DIR> d--h----- c:\documents and settings\Metin\Szablony 2008-11-09 12:43 . 2008-11-09 12:45 <DIR> d-------- c:\documents and settings\Metin\Pulpit 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> dr------- c:\documents and settings\Metin\Moje dokumenty 2008-11-09 12:43 . 2008-02-08 17:38 <DIR> dr------- c:\documents and settings\Metin\Menu Start 2008-11-09 12:43 . 2008-11-09 12:49 <DIR> dr-h----- c:\documents and settings\Metin\Dane aplikacji 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> d-------- c:\documents and settings\Metin 2008-11-09 11:46 . 2008-11-09 11:46 <DIR> d-------- c:\program files\Real Alternative1 2008-11-09 10:44 . 2008-11-09 11:38 <DIR> d-------- c:\program files\Real Alternative 2008-11-07 23:45 . 2008-11-07 23:45 25 --a------ c:\windows\cdplayer.ini 2008-11-05 18:05 . 2008-11-05 18:15 <DIR> d-------- c:\program files\RegCleaner 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2008-11-05 15:38 . 2008-10-28 15:21 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-11-05 15:38 . 2008-11-05 15:38 <DIR> d-------- c:\documents and settings\Administrator 2008-11-03 17:41 . 2008-11-03 17:54 <DIR> d-------- c:\program files\SkanerOnline 2008-11-02 11:10 . 2008-06-18 09:31 4,477,482 --a------ C:\temp2153.tmp 2008-11-01 16:26 . 2008-06-18 09:31 4,477,482 --a------ C:\temp482.tmp 2008-11-01 16:23 . 2008-06-18 09:31 4,477,482 --a------ C:\temp6639.tmp 2008-11-01 15:28 . 2008-11-01 15:12 2,145,386,496 --a------ c:\windows\MEMORY.DMP 2008-11-01 15:19 . 2008-06-18 09:31 4,477,482 --a------ C:\temp7816.tmp 2008-11-01 15:16 . 2008-06-18 09:31 4,477,482 --a------ C:\temp2128.tmp 2008-11-01 15:05 . 2006-03-02 13:00 10,096,640 --a--c--- c:\windows\system32\dllcache\hwxcht.dll 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\WindowsShell.Manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\ncpa.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-11-01 14:38 . 2006-03-02 13:00 24,661 --a------ c:\windows\system32\spxcoins.dll 2008-11-01 14:38 . 2006-03-02 13:00 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll 2008-11-01 14:38 . 2006-03-02 13:00 13,312 --a------ c:\windows\system32\irclass.dll 2008-11-01 14:38 . 2006-03-02 13:00 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll 2008-11-01 13:57 . 2008-06-18 09:31 4,477,482 --a------ C:\temp9071.tmp 2008-11-01 00:14 . 2008-11-01 00:14 29 --a------ c:\windows\system32\degduotu.tmp 2008-10-28 17:53 . 2008-06-18 09:31 4,477,482 --a------ C:\temp3174.tmp 2008-10-28 16:12 . 2008-11-01 14:17 94,208 --a------ c:\windows\DUMP706d.tmp 2008-10-28 15:49 . 2006-03-02 13:00 221,184 --a------ c:\windows\system32\wmpns.dll 2008-10-28 15:35 . 2007-12-17 13:53 159,458 --a------ c:\windows\system32\nvapps.nvb 2008-10-28 15:21 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET15D.tmp 2008-10-28 15:21 . 2006-03-02 13:00 1,014,483 -ra------ c:\windows\SET15A.tmp 2008-10-28 15:21 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET194.tmp 2008-10-28 15:21 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET169.tmp 2008-10-28 15:20 . 2008-10-30 00:19 319,627 --a------ c:\windows\setupapi.old 2008-10-26 11:35 . 2008-11-09 15:57 <DIR> d-------- c:\program files\Applications 2008-10-26 11:35 . 2008-10-26 11:57 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys 2008-10-22 13:18 . 1998-10-07 11:54 327,168 --a------ c:\windows\IsUn0415.exe 2008-10-21 14:54 . 2008-10-21 14:54 <DIR> d-------- c:\program files\MSXML 4.0 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\program files\Common Files\Teleca Shared 2008-10-20 19:47 . 2008-10-21 13:08 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Teleca 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Documents 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson 2008-10-20 19:46 . 2008-10-20 19:46 <DIR> d-------- c:\program files\Sony Ericsson 2008-10-20 19:46 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Teleca 2008-10-20 19:45 . 2008-10-20 19:45 <DIR> d-------- c:\windows\Downloaded Installations 2008-10-20 19:45 . 2008-10-20 19:45 6,144 --a------ c:\windows\system32\drivers\k750cm.sys 2008-10-20 19:45 . 2008-10-20 19:45 5,744 --a------ c:\windows\system32\drivers\k750wh.sys 2008-10-18 16:54 . 2008-10-18 16:54 <DIR> d-------- C:\Program File 2008-10-18 15:44 . 2008-10-18 15:44 <DIR> d-------- c:\program files\Total Commander 2008-10-18 15:44 . 2008-11-05 19:20 657 --a------ c:\windows\wincmd.ini 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\UC.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\RAR.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\PKZIP.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\PKUNZIP.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\NOCLOSE.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\LHA.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\ARJ.PIF . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 15:05 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-09 09:04 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2008-11-05 16:49 --------- d-----w c:\program files\Valve 2008-11-05 16:45 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-29 21:17 138,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-28 16:58 --------- d-----w c:\program files\Opera 2008-10-28 16:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip 2008-10-28 16:55 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-28 16:55 --------- d-----w c:\documents and settings\user\Dane aplikacji\Hamachi 2008-10-28 16:48 --------- d-----w c:\program files\Tibia Auto 2008-10-28 16:48 --------- d-----w c:\documents and settings\user\Dane aplikacji\vghd 2008-10-27 14:59 --------- d-----w c:\program files\Google 2008-10-26 21:00 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-09-23 15:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\INFO-TECH 2008-09-23 15:23 --------- d-----w c:\program files\Workshop 2008-07-06 14:22 292,965,723 ----a-w c:\program files\Valve.rar 2008-02-16 17:28 22,328 ----a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys . [code]<pre> ----a-w 1,560,576 2008-03-19 11:22:53 c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe ----a-w 1,560,576 2008-03-19 11:22:53 c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe </pre>[/code] ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D023EBF-70B8-45A6-9ED5-556515FA0FE4}] 2008-04-17 08:44 398776 --a------ c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "c:\windows\system32\kdaux.exe"="c:\windows\system32\kdaux.exe" [N/A] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 51048] "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-24 714608] "NeroCheck"="c:\windows\system32\\NeroCheck.exe" [2001-07-09 155648] "Metin2"="C:\Metin2.exe" [2008-05-07 406036] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "BearShare"="c:\program files\BearShare\BearShare.exe" [N/A] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352] "KJHJOEJK"="c:\windows\KJHJOEJK.exe" [N/A] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920] "MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-03-02 159744] "nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-10-16 c:\windows\RTHDCPL.exe] "DVDUpgrade"="DVDUpgrd.exe" [2006-03-02 c:\windows\system32\dvdupgrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "QuickTimeTask"="c:\program files\Applications\wcs.exe" [N/A] c:\documents and settings\user\Menu Start\Programy\Autostart\ spoolsv.exe [2008-06-18 4477482] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=eeovnm.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d4e9fbca] c:\windows\system32\htievpyq.dll [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 15:17 159744 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "d:\\GRY\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"= R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-31 149864] S3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888] S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\Ndisprot.sys [2008-10-26 27904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com d: \Shell\Open\command - d:\resycled\boot.com d: [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{039eafbc-30c4-11dd-a9d9-001d7d33fa3f}] \Shell\Auto\command - J:\fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{163818b8-3d24-11dd-aa0b-001d7d33fa3f}] \Shell\Auto\command - fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220c54dc-8983-11dd-aae9-001d7d33fa3f}] \Shell\Auto\command - F:\fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62817512-8e54-11dd-aaf4-001d7d33fa3f}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com f: \Shell\Open\command - f:\resycled\boot.com f: . Zawartość folderu 'Zaplanowane zadania' 2008-11-03 c:\windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - user.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 18:19] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{302D49CA-575B-4262-9B8C-2F26C2D9F83A} - c:\windows\system32\khffDSki.dll BHO-{44E310A2-8FCE-4F11-8D9E-B875B6924F35} - c:\windows\system32\mlJBRHbb.dll BHO-{6b314c57-9e53-4239-8674-64eafddf6fff} - c:\windows\system32\eeovnm.dll ShellExecuteHooks-{302D49CA-575B-4262-9B8C-2F26C2D9F83A} - c:\windows\system32\khffDSki.dll . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\7yxrcmsq.default\ FF -: plugin - c:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 16:18:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\system32\rundll32.exe c:\documents and settings\user\Menu Start\Programy\Autostart\spoolsv.exe . ************************************************************************** . Czas ukończenia: 2008-11-09 16:21:36 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-09 15:21:33 Przed: 24 115 740 672 bajtów wolnych Po: 24,563,945,472 bajtów wolnych 290 --- E O F --- 2008-10-23 21:14:04

A tych domen nie znam, słabo znam się jeszcze na komputerze... Pozdrawiam i czekam na odpowiedź.

**Posty:** 18165 · przez **wojtas** 09 Lis 2008, 17:55

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt oraz
Ściągnij program Fixwareout i zastosuj go
i wracasz z nowym logiem z hijacka, raportem z sdfixa, nowy log z combofixa...

**Posty:** 67 · przez **kamos1602** 09 Lis 2008, 18:54

Wracam z logami:

HIJACKTHIS:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:44:12, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Metin2.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\dvdupgrd.exe C:\Documents and Settings\user\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: UrlHelper Class - {6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [Metin2] C:\Metin2.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DVDUpgrade] DVDUpgrd.exe /async O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CS2\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O17 - HKLM\System\CS3\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132 O23 - Service: Harmonogram automatycznej usługi LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 6876 bytes

COMBOFIX:

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - user 2008-11-09 17:47:38.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1636 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 17:40 . 2008-11-09 17:43 <DIR> d-------- C:\fixwareout 2008-11-09 17:26 . 2008-11-09 17:26 <DIR> d-------- c:\windows\ERUNT 2008-11-09 17:23 . 2008-11-09 17:36 <DIR> d-------- C:\SDFix 2008-11-09 12:44 . 2008-11-09 12:44 <DIR> d-------- c:\documents and settings\Metin\Dane aplikacji\Symantec 2008-11-09 12:43 . 2008-11-09 17:48 <DIR> d--h----- c:\documents and settings\Metin\Ustawienia lokalne 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> dr------- c:\documents and settings\Metin\Ulubione 2008-11-09 12:43 . 2008-10-28 15:21 <DIR> d--h----- c:\documents and settings\Metin\Szablony 2008-11-09 12:43 . 2008-11-09 12:45 <DIR> d-------- c:\documents and settings\Metin\Pulpit 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> dr------- c:\documents and settings\Metin\Moje dokumenty 2008-11-09 12:43 . 2008-02-08 17:38 <DIR> dr------- c:\documents and settings\Metin\Menu Start 2008-11-09 12:43 . 2008-11-09 12:49 <DIR> dr-h----- c:\documents and settings\Metin\Dane aplikacji 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> d-------- c:\documents and settings\Metin 2008-11-09 11:46 . 2008-11-09 11:46 <DIR> d-------- c:\program files\Real Alternative1 2008-11-09 10:44 . 2008-11-09 11:38 <DIR> d-------- c:\program files\Real Alternative 2008-11-07 23:45 . 2008-11-07 23:45 25 --a------ c:\windows\cdplayer.ini 2008-11-05 18:05 . 2008-11-05 18:15 <DIR> d-------- c:\program files\RegCleaner 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2008-11-05 15:38 . 2008-10-28 15:21 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-11-05 15:38 . 2008-11-05 15:38 <DIR> d-------- c:\documents and settings\Administrator 2008-11-03 17:41 . 2008-11-03 17:54 <DIR> d-------- c:\program files\SkanerOnline 2008-11-02 11:10 . 2008-06-18 09:31 4,477,482 --a------ C:\temp2153.tmp 2008-11-01 16:26 . 2008-06-18 09:31 4,477,482 --a------ C:\temp482.tmp 2008-11-01 16:23 . 2008-06-18 09:31 4,477,482 --a------ C:\temp6639.tmp 2008-11-01 15:28 . 2008-11-01 15:12 2,145,386,496 --a------ c:\windows\MEMORY.DMP 2008-11-01 15:19 . 2008-06-18 09:31 4,477,482 --a------ C:\temp7816.tmp 2008-11-01 15:16 . 2008-06-18 09:31 4,477,482 --a------ C:\temp2128.tmp 2008-11-01 15:05 . 2006-03-02 13:00 10,096,640 --a--c--- c:\windows\system32\dllcache\hwxcht.dll 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\WindowsShell.Manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\ncpa.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-11-01 14:38 . 2006-03-02 13:00 24,661 --a------ c:\windows\system32\spxcoins.dll 2008-11-01 14:38 . 2006-03-02 13:00 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll 2008-11-01 14:38 . 2006-03-02 13:00 13,312 --a------ c:\windows\system32\irclass.dll 2008-11-01 14:38 . 2006-03-02 13:00 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll 2008-11-01 13:57 . 2008-06-18 09:31 4,477,482 --a------ C:\temp9071.tmp 2008-11-01 00:14 . 2008-11-01 00:14 29 --a------ c:\windows\system32\degduotu.tmp 2008-10-28 17:53 . 2008-06-18 09:31 4,477,482 --a------ C:\temp3174.tmp 2008-10-28 16:12 . 2008-11-01 14:17 94,208 --a------ c:\windows\DUMP706d.tmp 2008-10-28 15:49 . 2006-03-02 13:00 221,184 --a------ c:\windows\system32\wmpns.dll 2008-10-28 15:35 . 2007-12-17 13:53 159,458 --a------ c:\windows\system32\nvapps.nvb 2008-10-28 15:21 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET15D.tmp 2008-10-28 15:21 . 2006-03-02 13:00 1,014,483 -ra------ c:\windows\SET15A.tmp 2008-10-28 15:21 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET194.tmp 2008-10-28 15:21 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET169.tmp 2008-10-28 15:20 . 2008-10-30 00:19 319,627 --a------ c:\windows\setupapi.old 2008-10-26 11:35 . 2008-11-09 15:57 <DIR> d-------- c:\program files\Applications 2008-10-26 11:35 . 2008-10-26 11:57 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys 2008-10-22 13:18 . 1998-10-07 11:54 327,168 --a------ c:\windows\IsUn0415.exe 2008-10-21 14:54 . 2008-10-21 14:54 <DIR> d-------- c:\program files\MSXML 4.0 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\program files\Common Files\Teleca Shared 2008-10-20 19:47 . 2008-10-21 13:08 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Teleca 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Documents 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson 2008-10-20 19:46 . 2008-10-20 19:46 <DIR> d-------- c:\program files\Sony Ericsson 2008-10-20 19:46 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Teleca 2008-10-20 19:45 . 2008-10-20 19:45 <DIR> d-------- c:\windows\Downloaded Installations 2008-10-20 19:45 . 2008-10-20 19:45 6,144 --a------ c:\windows\system32\drivers\k750cm.sys 2008-10-20 19:45 . 2008-10-20 19:45 5,744 --a------ c:\windows\system32\drivers\k750wh.sys 2008-10-18 16:54 . 2008-10-18 16:54 <DIR> d-------- C:\Program File 2008-10-18 15:44 . 2008-10-18 15:44 <DIR> d-------- c:\program files\Total Commander 2008-10-18 15:44 . 2008-11-05 19:20 657 --a------ c:\windows\wincmd.ini 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\UC.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\RAR.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\PKZIP.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\PKUNZIP.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\NOCLOSE.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\LHA.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\ARJ.PIF . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 16:40 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-09 15:23 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2008-11-05 16:49 --------- d-----w c:\program files\Valve 2008-11-05 16:45 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-29 21:17 138,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-29 21:17 111,928 ----a-w c:\windows\system32\PnkBstrB.exe 2008-10-28 20:25 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-10-28 16:58 --------- d-----w c:\program files\Opera 2008-10-28 16:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip 2008-10-28 16:55 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-28 16:55 --------- d-----w c:\documents and settings\user\Dane aplikacji\Hamachi 2008-10-28 16:48 --------- d-----w c:\program files\Tibia Auto 2008-10-28 16:48 --------- d-----w c:\documents and settings\user\Dane aplikacji\vghd 2008-10-27 14:59 --------- d-----w c:\program files\Google 2008-10-26 21:00 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-09-23 15:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\INFO-TECH 2008-09-23 15:23 --------- d-----w c:\program files\Workshop 2008-08-19 16:10 152,920 ----a-w c:\windows\system32\vghd.scr 2008-07-06 14:22 292,965,723 ----a-w c:\program files\Valve.rar 2008-02-16 17:28 22,328 ----a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys . [code]<pre> ----a-w 1,560,576 2008-03-19 11:22:53 c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe ----a-w 1,560,576 2008-03-19 11:22:53 c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe </pre>[/code] ((((((((((((((((((((((((((((( snapshot@2008-11-09_16.21.19.42 ))))))))))))))))))))))))))))))))))))))))) . - 2005-02-24 19:36:08 16,096 ----a-w c:\windows\$hf_mig$\KB894391\spmsg.dll + 2005-02-25 03:36:06 16,096 ----a-w c:\windows\$hf_mig$\KB894391\spmsg.dll - 2005-02-24 19:36:08 212,704 ----a-w c:\windows\$hf_mig$\KB894391\spuninst.exe + 2005-02-25 03:36:06 212,704 ----a-w c:\windows\$hf_mig$\KB894391\spuninst.exe - 2005-02-24 19:36:08 22,240 ----a-w c:\windows\$hf_mig$\KB894391\update\spcustom.dll + 2005-02-25 03:36:06 22,240 ----a-w c:\windows\$hf_mig$\KB894391\update\spcustom.dll - 2005-02-24 19:36:08 725,728 ----a-w c:\windows\$hf_mig$\KB894391\update\update.exe + 2005-02-25 03:36:06 725,728 ----a-w c:\windows\$hf_mig$\KB894391\update\update.exe - 2005-02-24 19:36:08 387,296 ----a-w c:\windows\$hf_mig$\KB894391\update\updspapi.dll + 2005-02-25 03:36:07 387,296 ----a-w c:\windows\$hf_mig$\KB894391\update\updspapi.dll + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-11-09 16:26:39 4,923,392 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-09 16:26:39 221,184 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-11-09 16:26:28 4,923,392 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-09 16:26:28 221,184 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2006-03-02 12:00:00 1,281,024 -c--a-w c:\windows\system32\dllcache\ole32.dll + 2005-04-28 19:32:51 1,284,608 -c--a-w c:\windows\system32\dllcache\ole32.dll - 2006-03-02 12:00:00 69,120 -c--a-w c:\windows\system32\dllcache\olecli32.dll + 2005-04-28 19:32:51 75,264 -c--a-w c:\windows\system32\dllcache\olecli32.dll - 2006-03-02 12:00:00 34,304 -c--a-w c:\windows\system32\dllcache\olecnv32.dll + 2005-04-28 19:32:51 37,888 -c--a-w c:\windows\system32\dllcache\olecnv32.dll - 2006-03-02 12:00:00 395,776 -c--a-w c:\windows\system32\dllcache\rpcss.dll + 2005-04-28 19:32:51 395,776 -c--a-w c:\windows\system32\dllcache\rpcss.dll - 2006-03-02 12:00:00 1,281,024 ----a-w c:\windows\system32\ole32.dll + 2005-04-28 19:32:51 1,284,608 ----a-w c:\windows\system32\ole32.dll - 2006-03-02 12:00:00 69,120 ----a-w c:\windows\system32\olecli32.dll + 2005-04-28 19:32:51 75,264 ----a-w c:\windows\system32\olecli32.dll - 2006-03-02 12:00:00 34,304 ----a-w c:\windows\system32\olecnv32.dll + 2005-04-28 19:32:51 37,888 ----a-w c:\windows\system32\olecnv32.dll - 2006-03-02 12:00:00 395,776 ----a-w c:\windows\system32\rpcss.dll + 2005-04-28 19:32:51 395,776 ----a-w c:\windows\system32\rpcss.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D023EBF-70B8-45A6-9ED5-556515FA0FE4}] 2008-04-17 08:44 398776 --a------ c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 51048] "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-24 714608] "NeroCheck"="c:\windows\system32\\NeroCheck.exe" [2001-07-09 155648] "Metin2"="C:\Metin2.exe" [2008-05-07 406036] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "BearShare"="c:\program files\BearShare\BearShare.exe" [N/A] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920] "nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-10-16 c:\windows\RTHDCPL.exe] "DVDUpgrade"="DVDUpgrd.exe" [2006-03-02 c:\windows\system32\dvdupgrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d4e9fbca] c:\windows\system32\htievpyq.dll [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 15:17 159744 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "d:\\GRY\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"= R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-31 149864] S3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888] S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\Ndisprot.sys [2008-10-26 27904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{039eafbc-30c4-11dd-a9d9-001d7d33fa3f}] \Shell\Auto\command - J:\fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{163818b8-3d24-11dd-aa0b-001d7d33fa3f}] \Shell\Auto\command - fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220c54dc-8983-11dd-aae9-001d7d33fa3f}] \Shell\Auto\command - F:\fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62817512-8e54-11dd-aaf4-001d7d33fa3f}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com f: \Shell\Open\command - f:\resycled\boot.com f: . Zawartość folderu 'Zaplanowane zadania' 2008-11-03 c:\windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - user.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 18:19] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\7yxrcmsq.default\ FF -: plugin - c:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 17:48:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-09 17:49:04 ComboFix-quarantined-files.txt 2008-11-09 16:48:46 ComboFix2.txt 2008-11-09 15:21:37 Przed: 24 479 604 736 bajtów wolnych Po: 24,467,881,984 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 245 --- E O F --- 2008-10-23 21:14:04

SDFIX:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by user on 2008-11-09 at 17:28 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 17:35:51 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:8e,87,db,96,ce,90,34,50,d0,a6,fb,d6,4c,e1,f5,99,5a,78,f4,9b,95,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:d2,de,41,3c,63,db,17,08,d6,7d,48,45,86,d3,74,f8,97,ea,ce,fc,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,69,46,f5,cb,26,8e,50,54,09,74,82,39,d7,77,9c,e7,5f,.. "khjeh"=hex:ac,b3,4b,57,af,2b,93,92,9d,b2,50,7b,7c,d1,0e,f5,39,61,f2,24,78,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:5e,3c,33,8a,ba,f7,ec,8e,ac,02,05,a7,b6,01,aa,de,9a,d4,76,86,a3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:06,83,c3,8b,11,46,79,e7,16,51,89,66,7e,23,04,f9,05,ff,e6,64,b0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:8e,87,db,96,ce,90,34,50,d0,a6,fb,d6,4c,e1,f5,99,5a,78,f4,9b,95,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:d2,de,41,3c,63,db,17,08,d6,7d,48,45,86,d3,74,f8,97,ea,ce,fc,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,69,46,f5,cb,26,8e,50,54,09,74,82,39,d7,77,9c,e7,5f,.. "khjeh"=hex:ac,b3,4b,57,af,2b,93,92,9d,b2,50,7b,7c,d1,0e,f5,39,61,f2,24,78,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:5e,3c,33,8a,ba,f7,ec,8e,ac,02,05,a7,b6,01,aa,de,9a,d4,76,86,a3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:06,83,c3,8b,11,46,79,e7,16,51,89,66,7e,23,04,f9,05,ff,e6,64,b0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:8e,87,db,96,ce,90,34,50,d0,a6,fb,d6,4c,e1,f5,99,5a,78,f4,9b,95,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:d2,de,41,3c,63,db,17,08,d6,7d,48,45,86,d3,74,f8,97,ea,ce,fc,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,69,46,f5,cb,26,8e,50,54,09,74,82,39,d7,77,9c,e7,5f,.. "khjeh"=hex:ac,b3,4b,57,af,2b,93,92,9d,b2,50,7b,7c,d1,0e,f5,39,61,f2,24,78,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:5e,3c,33,8a,ba,f7,ec,8e,ac,02,05,a7,b6,01,aa,de,9a,d4,76,86,a3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:06,83,c3,8b,11,46,79,e7,16,51,89,66,7e,23,04,f9,05,ff,e6,64,b0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:8e,87,db,96,ce,90,34,50,d0,a6,fb,d6,4c,e1,f5,99,5a,78,f4,9b,95,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:d2,de,41,3c,63,db,17,08,d6,7d,48,45,86,d3,74,f8,97,ea,ce,fc,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,69,46,f5,cb,26,8e,50,54,09,74,82,39,d7,77,9c,e7,5f,.. "khjeh"=hex:ac,b3,4b,57,af,2b,93,92,9d,b2,50,7b,7c,d1,0e,f5,39,61,f2,24,78,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:5e,3c,33,8a,ba,f7,ec,8e,ac,02,05,a7,b6,01,aa,de,9a,d4,76,86,a3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:06,83,c3,8b,11,46,79,e7,16,51,89,66,7e,23,04,f9,05,ff,e6,64,b0,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "D:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx9.exe"="D:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9" "D:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx10.exe"="D:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10" "D:\\GRY\\Assassin's Creed\\AssassinsCreed_Launcher.exe"="D:\\GRY\\Assassin's Creed\\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update" "D:\\GRY\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"="D:\\GRY\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 7 May 2008 406,036 ...H. --- "C:\Metin2.exe" Thu 2 Mar 2006 93,184 A.SH. --- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" Wed 8 Aug 2007 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg" Wed 8 Aug 2007 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg" [b]Finished![/b]

Pozdrawiam i czekam na odpowiedź.

**Posty:** 18165 · przez **wojtas** 09 Lis 2008, 19:23

skasuj:

O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O17 - HKLM\System\CS2\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132
O17 - HKLM\System\CS3\Services\Tcpip\..\{02124959-DB33-41E5-80E4-19DD1E043993}: NameServer = 85.255.114.74,85.255.112.132

Otworz notatnik i wklej w nim to:

File::
C:\temp2153.tmp
C:\temp482.tmp
C:\temp6639.tmp
C:\temp7816.tmp
C:\temp2128.tmp
C:\temp9071.tmp
C:\windows\system32\degduotu.tmp
C:\temp3174.tmp

Folder::
C:\Program Files\BearShare Applications\BearShare MediaBar

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d4e9fbca]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{039eafbc-30c4-11dd-a9d9-001d7d33fa3f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{163818b8-3d24-11dd-aa0b-001d7d33fa3f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220c54dc-8983-11dd-aae9-001d7d33fa3f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62817512-8e54-11dd-aaf4-001d7d33fa3f}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 67 · przez **kamos1602** 09 Lis 2008, 19:48

Daję log, o który prosiłeś:

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - user 2008-11-09 18:45:21.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1594 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\user\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: C:\temp2128.tmp C:\temp2153.tmp C:\temp3174.tmp C:\temp482.tmp C:\temp6639.tmp C:\temp7816.tmp C:\temp9071.tmp c:\windows\system32\degduotu.tmp . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\BearShare Applications\BearShare MediaBar c:\program files\BearShare Applications\BearShare MediaBar\basis.xml c:\program files\BearShare Applications\BearShare MediaBar\bearshare.bmp c:\program files\BearShare Applications\BearShare MediaBar\bearshare_icons.bmp c:\program files\BearShare Applications\BearShare MediaBar\bearshare_logo.bmp c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll c:\program files\BearShare Applications\BearShare MediaBar\beforeNavigate.js c:\program files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll c:\program files\BearShare Applications\BearShare MediaBar\button_arrow.bmp c:\program files\BearShare Applications\BearShare MediaBar\button_arrow_clk.bmp c:\program files\BearShare Applications\BearShare MediaBar\button_arrow_hl.bmp c:\program files\BearShare Applications\BearShare MediaBar\mailsites.html c:\program files\BearShare Applications\BearShare MediaBar\myemail.bmp c:\program files\BearShare Applications\BearShare MediaBar\myemail_hl.bmp c:\program files\BearShare Applications\BearShare MediaBar\mysites.bmp c:\program files\BearShare Applications\BearShare MediaBar\mysites_hl.bmp c:\program files\BearShare Applications\BearShare MediaBar\resizer.bmp c:\program files\BearShare Applications\BearShare MediaBar\search.bmp c:\program files\BearShare Applications\BearShare MediaBar\search_clk.bmp c:\program files\BearShare Applications\BearShare MediaBar\search_hl.bmp c:\program files\BearShare Applications\BearShare MediaBar\search_images.bmp c:\program files\BearShare Applications\BearShare MediaBar\search_maps.bmp c:\program files\BearShare Applications\BearShare MediaBar\search_news.bmp c:\program files\BearShare Applications\BearShare MediaBar\search_videos.bmp c:\program files\BearShare Applications\BearShare MediaBar\showSettings.js c:\program files\BearShare Applications\BearShare MediaBar\storesearchcriteria.js c:\program files\BearShare Applications\BearShare MediaBar\topsites.html c:\program files\BearShare Applications\BearShare MediaBar\Uninstall.exe c:\program files\BearShare Applications\BearShare MediaBar\version.txt c:\program files\BearShare Applications\BearShare MediaBar\web.bmp C:\temp2128.tmp C:\temp2153.tmp C:\temp3174.tmp C:\temp482.tmp C:\temp6639.tmp C:\temp7816.tmp C:\temp9071.tmp c:\windows\system32\degduotu.tmp . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-09 17:40 . 2008-11-09 17:43 <DIR> d-------- C:\fixwareout 2008-11-09 17:26 . 2008-11-09 17:26 <DIR> d-------- c:\windows\ERUNT 2008-11-09 17:23 . 2008-11-09 17:36 <DIR> d-------- C:\SDFix 2008-11-09 12:44 . 2008-11-09 12:44 <DIR> d-------- c:\documents and settings\Metin\Dane aplikacji\Symantec 2008-11-09 12:43 . 2008-11-09 18:46 <DIR> d--h----- c:\documents and settings\Metin\Ustawienia lokalne 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> dr------- c:\documents and settings\Metin\Ulubione 2008-11-09 12:43 . 2008-10-28 15:21 <DIR> d--h----- c:\documents and settings\Metin\Szablony 2008-11-09 12:43 . 2008-11-09 12:45 <DIR> d-------- c:\documents and settings\Metin\Pulpit 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> dr------- c:\documents and settings\Metin\Moje dokumenty 2008-11-09 12:43 . 2008-02-08 17:38 <DIR> dr------- c:\documents and settings\Metin\Menu Start 2008-11-09 12:43 . 2008-11-09 12:49 <DIR> dr-h----- c:\documents and settings\Metin\Dane aplikacji 2008-11-09 12:43 . 2008-11-09 12:43 <DIR> d-------- c:\documents and settings\Metin 2008-11-09 11:46 . 2008-11-09 11:46 <DIR> d-------- c:\program files\Real Alternative1 2008-11-09 10:44 . 2008-11-09 11:38 <DIR> d-------- c:\program files\Real Alternative 2008-11-07 23:45 . 2008-11-07 23:45 25 --a------ c:\windows\cdplayer.ini 2008-11-05 18:05 . 2008-11-05 18:15 <DIR> d-------- c:\program files\RegCleaner 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2008-11-05 15:38 . 2008-10-28 15:21 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-11-05 15:38 . 2008-02-08 17:38 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-11-05 15:38 . 2008-11-05 15:38 <DIR> d-------- c:\documents and settings\Administrator 2008-11-03 17:41 . 2008-11-03 17:54 <DIR> d-------- c:\program files\SkanerOnline 2008-11-01 15:28 . 2008-11-01 15:12 2,145,386,496 --a------ c:\windows\MEMORY.DMP 2008-11-01 15:05 . 2006-03-02 13:00 10,096,640 --a--c--- c:\windows\system32\dllcache\hwxcht.dll 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\WindowsShell.Manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 749 -rah----- c:\windows\system32\ncpa.cpl.manifest 2008-11-01 15:02 . 2008-11-01 15:02 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-11-01 14:38 . 2006-03-02 13:00 24,661 --a------ c:\windows\system32\spxcoins.dll 2008-11-01 14:38 . 2006-03-02 13:00 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll 2008-11-01 14:38 . 2006-03-02 13:00 13,312 --a------ c:\windows\system32\irclass.dll 2008-11-01 14:38 . 2006-03-02 13:00 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll 2008-10-28 16:12 . 2008-11-01 14:17 94,208 --a------ c:\windows\DUMP706d.tmp 2008-10-28 15:49 . 2006-03-02 13:00 221,184 --a------ c:\windows\system32\wmpns.dll 2008-10-28 15:35 . 2007-12-17 13:53 159,458 --a------ c:\windows\system32\nvapps.nvb 2008-10-28 15:21 . 2006-03-02 13:00 1,086,058 -ra------ c:\windows\SET15D.tmp 2008-10-28 15:21 . 2006-03-02 13:00 1,014,483 -ra------ c:\windows\SET15A.tmp 2008-10-28 15:21 . 2006-03-02 13:00 14,573 -ra------ c:\windows\SET194.tmp 2008-10-28 15:21 . 2006-03-02 13:00 14,043 -ra------ c:\windows\SET169.tmp 2008-10-28 15:20 . 2008-10-30 00:19 319,627 --a------ c:\windows\setupapi.old 2008-10-26 11:35 . 2008-11-09 15:57 <DIR> d-------- c:\program files\Applications 2008-10-26 11:35 . 2008-10-26 11:57 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys 2008-10-22 13:18 . 1998-10-07 11:54 327,168 --a------ c:\windows\IsUn0415.exe 2008-10-21 14:54 . 2008-10-21 14:54 <DIR> d-------- c:\program files\MSXML 4.0 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\program files\Common Files\Teleca Shared 2008-10-20 19:47 . 2008-10-21 13:08 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Teleca 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Documents 2008-10-20 19:47 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson 2008-10-20 19:46 . 2008-10-20 19:46 <DIR> d-------- c:\program files\Sony Ericsson 2008-10-20 19:46 . 2008-10-20 19:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Teleca 2008-10-20 19:45 . 2008-10-20 19:45 <DIR> d-------- c:\windows\Downloaded Installations 2008-10-20 19:45 . 2008-10-20 19:45 6,144 --a------ c:\windows\system32\drivers\k750cm.sys 2008-10-20 19:45 . 2008-10-20 19:45 5,744 --a------ c:\windows\system32\drivers\k750wh.sys 2008-10-18 16:54 . 2008-10-18 16:54 <DIR> d-------- C:\Program File 2008-10-18 15:44 . 2008-10-18 15:44 <DIR> d-------- c:\program files\Total Commander 2008-10-18 15:44 . 2008-11-05 19:20 657 --a------ c:\windows\wincmd.ini 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\UC.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\RAR.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\PKZIP.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\PKUNZIP.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\NOCLOSE.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\LHA.PIF 2008-10-18 15:44 . 2008-08-08 06:04 545 --a------ c:\windows\ARJ.PIF . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 17:45 --------- d-----w c:\program files\BearShare Applications 2008-11-09 17:27 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Symantec 2008-11-09 16:59 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-05 16:49 --------- d-----w c:\program files\Valve 2008-11-05 16:45 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-29 21:17 138,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-29 21:17 111,928 ----a-w c:\windows\system32\PnkBstrB.exe 2008-10-28 20:25 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-10-28 16:58 --------- d-----w c:\program files\Opera 2008-10-28 16:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WinZip 2008-10-28 16:55 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-28 16:55 --------- d-----w c:\documents and settings\user\Dane aplikacji\Hamachi 2008-10-28 16:48 --------- d-----w c:\program files\Tibia Auto 2008-10-28 16:48 --------- d-----w c:\documents and settings\user\Dane aplikacji\vghd 2008-10-27 14:59 --------- d-----w c:\program files\Google 2008-10-26 21:00 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-09-23 15:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\INFO-TECH 2008-09-23 15:23 --------- d-----w c:\program files\Workshop 2008-08-19 16:10 152,920 ----a-w c:\windows\system32\vghd.scr 2008-07-06 14:22 292,965,723 ----a-w c:\program files\Valve.rar 2008-02-16 17:28 22,328 ----a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys . [code]<pre> ----a-w 1,560,576 2008-03-19 11:22:53 c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe ----a-w 1,560,576 2008-03-19 11:22:53 c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe </pre>[/code] ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-11-14 2131392] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 51048] "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-24 714608] "NeroCheck"="c:\windows\system32\\NeroCheck.exe" [2001-07-09 155648] "Metin2"="C:\Metin2.exe" [2008-05-07 406036] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "BearShare"="c:\program files\BearShare\BearShare.exe" [N/A] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-07-09 36352] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920] "nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-10-16 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 15:17 159744 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "d:\\GRY\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "d:\\GRY\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"= R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-31 149864] S3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888] S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\Ndisprot.sys [2008-10-26 27904] . Zawartość folderu 'Zaplanowane zadania' 2008-11-03 c:\windows\Tasks\Norton Internet Security - Uruchom pełne skanowanie systemu - user.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 18:19] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 18:46:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-09 18:47:15 ComboFix-quarantined-files.txt 2008-11-09 17:46:58 ComboFix2.txt 2008-11-09 16:49:04 ComboFix3.txt 2008-11-09 15:21:37 Przed: 24 471 093 248 bajtów wolnych Po: 24,455,835,648 bajtów wolnych 226 --- E O F --- 2008-10-23 21:14:04

**Posty:** 7956 · przez **Magik** 09 Lis 2008, 20:11

kamos1602 napisał(a):c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe
c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe

przeskanuj to na virustotal.com i wkelj raport

do tego http://www.kaspersky.com/virusscanner
i raport takze wrzuc na forum

**Posty:** 67 · przez **kamos1602** 09 Lis 2008, 21:52

c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe:

Kod: Zaznacz wszystko: http://www.virustotal.com/analisis/55e3775eae5576dd09ca57c3fbb7ef59

c:\documents and settings\user\Pulpit\bugi\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) (2)\M2 MULTIHACK 1.83 (beta) .exe:

Kod: Zaznacz wszystko: http://www.virustotal.com/analisis/55e3775eae5576dd09ca57c3fbb7ef59

Skan:

Kod: Zaznacz wszystko: http://img517.imageshack.us/img517/5225/skanerdc1.png

Dodano Dzisiaj, 21:52:
To już koniec całej tej czynności?? Już będzie dobrze z kompem? Proszę o odpowiedź.

**Posty:** 18165 · przez **wojtas** 10 Lis 2008, 01:48

skasuj ten plik co masz w raporcie zapisanego jako wirus.. cos z demona

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

**Posty:** 67 · przez **kamos1602** 11 Lis 2008, 00:11

okej zrobione, co teraz?

**Posty:** 7956 · przez **Magik** 11 Lis 2008, 00:14

kamos1602 napisał(a):okej zrobione, co teraz?

mozesz iść spać, ew pojsc sobie na spacer---> w tym temacie juz wszystko zostalo powiedziane

Komp czysty

Pozdro

Autor postu otrzymał pochwałę

**Posty:** 67 · przez **kamos1602** 11 Lis 2008, 01:00

Ok, dzięki wielkie, odrazu szybciej pracuje i nie ma żadnych problemów. Pozdrawiam i oczywiście dam "+".