prosze o sprawdzenie loga

**Posty:** 99 · przez **The Game** 25 Sie 2007, 19:58

moj problem wyglada nastepujaca.. :

Na zalaczonym obrazku widac jak wyglada moj pulpit po zmianach przez syfy.. mam nowa tapetke ktora przenosi nas nas jakas strone.
Mam takze 3 nowe ikony (widac je pod ikona SE file managera), ktore nie wiem co otwieraja. wyskakuja co chwile rozne okinka ze system jest zagrozony przez trojany ale to nie jest komunikat z antywira... Nastepnie na pasku zadan mam dziwna mrugajaca ikonke krzyzyka na bialym tle ktory co chwile informuje mnie ze system jest zagrozony.. takze strona startowa IE zostala zmieniiona.. aa no i bym zapomnial ze caly czas mam 100% procesora...
Nie pytajcie mnie gdzie to nalapalem bo to weszlo w momencie kiedy moj ojciec byl na kompie... prosze pomozcie usunac ten syf a ponizej log z hijack..

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:47:18, on 2007-08-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Eset\nod32krn.exe C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\Eset\nod32kui.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe D:\documents and settings\the game\pulpit\qttask.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\The Game\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 69.57.152.127 auto.search.msn.com O1 - Hosts: 69.57.152.127 auto.search.msn.es O1 - Hosts: 69.57.152.127 pagead2.googlesyndication.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file) O2 - BHO: MSVPS System - {283A0EE3-2CC1-45AB-8207-B1D7B69C7F83} - C:\WINDOWS\duocore.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\PROGRA~1\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\documents and settings\the game\pulpit\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_72.cab O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_31.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F819639F-1928-46BA-B78F-D00E48C8244E}: NameServer = 80.54.124.253,217.17.34.10 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O21 - SSODL: wmpenv - {CCAB6D9D-EC6F-45C1-AA4F-73771847E1BD} - C:\WINDOWS\wmpenv.dll O21 - SSODL: wmpconf - {3A6A8065-9346-4F06-BB5D-686099E43012} - C:\WINDOWS\wmpconf.dll O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

**Posty:** 18165 · przez **wojtas** 25 Sie 2007, 20:47

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem nowe logi

**Posty:** 99 · przez **The Game** 25 Sie 2007, 22:41

chyba juz jest ok ale dla pewnosci daje loga. dzieki:)

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:32:13, on 2007-08-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\Eset\nod32kui.exe D:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe D:\documents and settings\the game\pulpit\qttask.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Messenger\msmsgs.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\The Game\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 69.57.152.127 auto.search.msn.com O1 - Hosts: 69.57.152.127 auto.search.msn.es O1 - Hosts: 69.57.152.127 pagead2.googlesyndication.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file) O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\PROGRA~1\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\documents and settings\the game\pulpit\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_72.cab O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_31.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F819639F-1928-46BA-B78F-D00E48C8244E}: NameServer = 80.54.124.253,217.17.34.10 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

**Posty:** 18165 · przez **wojtas** 26 Sie 2007, 00:15

O1 - Hosts: 69.57.152.127 auto.search.msn.com
O1 - Hosts: 69.57.152.127 auto.search.msn.es
O1 - Hosts: 69.57.152.127 pagead2.googlesyndication.com
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

skasuj i daj loga z: combofixa

**Posty:** 99 · przez **The Game** 26 Sie 2007, 00:42

oto log:

Kod: Zaznacz wszystko: ComboFix 07-08-25.2 - "The Game" 2007-08-26 0:28:57.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.253 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Reszta\Ulubione\Error Cleaner.url C:\DOCUME~1\Reszta\Ulubione\Privacy Protector.url C:\DOCUME~1\Reszta\Ulubione\Spyware&Malware Protection.url C:\DOCUME~1\THEGAM~1\Ulubione\Error Cleaner.url C:\DOCUME~1\THEGAM~1\Ulubione\Privacy Protector.url C:\DOCUME~1\THEGAM~1\Ulubione\Spyware&Malware Protection.url C:\WINDOWS\dat.txt C:\WINDOWS\rs.txt C:\WINDOWS\system32\Cfx32.lic C:\WINDOWS\system32\cfx32.ocx ((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 ))))))))))))))))))))))))))))))) 2007-08-26 00:28 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-25 21:17 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-08-25 21:04 <DIR> d-------- C:\VundoFix Backups 2007-08-25 20:57 2,578 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-25 20:11 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-08-24 00:09 <DIR> d-------- C:\DOCUME~1\Reszta\DANEAP~1\Lavasoft 2007-08-19 19:29 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2007-08-15 10:04 <DIR> d-------- C:\vcs5BGEffects 2007-08-13 23:01 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-08-13 23:01 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-08-13 23:01 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-08-12 16:36 773,120 --a------ C:\bubbles.scr 2007-08-12 16:36 117,248 --a------ C:\ribbons.scr 2007-08-12 16:36 1,263,616 --a------ C:\aurora.scr 2007-08-09 11:06 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2007-08-09 11:00 <DIR> d-------- C:\WINDOWS\network diagnostic 2007-08-09 10:46 592 --a------ C:\WINDOWS\chgkey.vbs 2007-08-08 20:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2007-08-08 20:01 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-08-08 20:01 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2007-08-03 12:14 8,576 --a------ C:\WINDOWS\system32\drivers\hidgame.sys 2007-08-02 19:45 <DIR> d-------- C:\DOCUME~1\Reszta\DANEAP~1\Media Player Classic 2007-07-31 09:56 16,384 --a------ C:\WINDOWS\system32\drivers\SaiE2.sys 2007-07-29 11:19 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-07-28 10:54 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-07-28 10:52 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-07-27 10:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\InstallShield (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-23 10:21 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-08-22 23:06 --------- d-------- C:\DOCUME~1\THEGAM~1\DANEAP~1\BearShare 2007-08-22 23:06 --------- d-------- C:\DOCUME~1\THEGAM~1\DANEAP~1\BearShare 2007-08-15 11:51 --------- d-------- C:\DOCUME~1\THEGAM~1\DANEAP~1\Skype 2007-08-15 11:51 --------- d-------- C:\DOCUME~1\THEGAM~1\DANEAP~1\Skype 2007-08-12 14:17 219648 --a------ C:\WINDOWS\system32\uxtheme.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-27 10:08 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-24 21:40 --------- d-------- C:\Program Files\ICQ-PL 2007-07-24 21:40 --------- d-------- C:\DOCUME~1\Aga\DANEAP~1\ICQLite 2007-07-11 11:14 --------- d-------- C:\DOCUME~1\Reszta\DANEAP~1\Skype 2007-07-11 10:43 --------- d-------- C:\Program Files\SkanerOnline 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-10-29 16:50] "nwiz"="nwiz.exe" [2004-10-29 16:50 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-10-29 16:50] "SoundMan"="SOUNDMAN.EXE" [2002-08-15 06:46 C:\WINDOWS\SOUNDMAN.EXE] "nod32kui"="D:\Program Files\Eset\nod32kui.exe" [2006-08-24 01:54] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23] "QuickTime Task"="D:\documents and settings\the game\pulpit\qttask.exe" [2006-09-26 16:59] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-02-13 20:29] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2006-10-10 17:51] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] C:\DOCUME~1\Aga\MENUST~1\Programy\AUTOST~1\ ICQ-PL - Auto Update.lnk - C:\Program Files\ICQ-PL\icq-pl.exe [2007-07-24 21:33:05] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^The Game^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\The Game\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^The Game^Menu Start^Programy^Autostart^Yahoo! Widget Engine.lnk] path=C:\Documents and Settings\The Game\Menu Start\Programy\Autostart\Yahoo! Widget Engine.lnk backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2 aim] C:\DOCUME~1\THEGAM~1\DANEAP~1\DRAWAN~1\hold type trust.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start R1 SSHDRV79;SSHDRV79;\??\C:\WINDOWS\system32\drivers\SSHDRV79.sys R2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys R3 actser;actser;C:\WINDOWS\system32\drivers\actser.sys R3 EL90X;Sterownik karty 3Com EtherLink XL 90X;C:\WINDOWS\system32\DRIVERS\el90xnd5.sys R3 imhidusb;Immersion's HID USB Driver;C:\WINDOWS\system32\DRIVERS\imhidusb.sys R3 SaiNtHid;%SAINTHID_NAME%;C:\WINDOWS\system32\DRIVERS\SaiNtHid.sys S3 ntportio;ntportio;\??\C:\Documents and Settings\The Game\Pulpit\GFlash20b6rura\soft\pbbse12_crippled\ntportio.sys S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys *Newly Created Service* - CATCHME Contents of the 'Scheduled Tasks' folder 2007-08-25 22:00:02 C:\WINDOWS\Tasks\AF213F46918AB152.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-26 00:31:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** Completion time: 2007-08-26 0:32:54 C:\ComboFix-quarantined-files.txt ... 2007-08-26 00:32 --- E O F ---

**Posty:** 18165 · przez **wojtas** 26 Sie 2007, 09:00

skasuj plik:

C:\WINDOWS\Tasks\AF213F46918AB152.job

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2 aim]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

te pliki:

C:\bubbles.scr
C:\ribbons.scr
C:\aurora.scr
C:\WINDOWS\chgkey.vbs

przeskanuj tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty

**Posty:** 99 · przez **The Game** 26 Sie 2007, 10:15

w:
[code:cenzura!]Cytat:
C:\bubbles.scr
[/code:cenzura!]
[code:cenzura!]Webwasher-Gateway 6.0.1 2007.08.26 Win32.Malware.gen (suspicious) [/code:cenzura!]
cos takiego...

reszta czysto...

**Posty:** 18165 · przez **wojtas** 26 Sie 2007, 10:19

to skasuj:

C:\bubbles.scr

**Posty:** 99 · przez **The Game** 26 Sie 2007, 10:25

To juz wszystko? jak tak to dzieki za pomoc

**Posty:** 18165 · przez **wojtas** 26 Sie 2007, 10:33

tak powinno juz byc ok :wink:

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum