proszę o sprawdzenie loga

**Posty:** 12 · przez **Misugi** 23 Lip 2007, 22:05

Wojtas a to ? widziałem, że to usuwają

C:\WINDOWS\system32\tmp.reg

**Posty:** 72 · przez **17rafal** 23 Lip 2007, 22:44

dss

Kod: Zaznacz wszystko: Deckard's System Scanner v20070711.54 Run by Rafal on 2007-07-23 at 22:40:03 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Rafal.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 22:40:20, on 2007-07-23 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe E:\Programy\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Documents and Settings\Rafal\Pulpit\dss.exe C:\DOCUME~1\Rafal\Pulpit\HIJACK~1\Rafal.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVP] "e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: Dodaj do blokowanych banerów - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm O8 - Extra context menu item: Download all links using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_17.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C2} (GameDesire Pool 9) - http://67.15.101.3/g_bin/pl/billard9_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_29.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2184E2-837E-4D0B-A0B8-1D80AE297D9C}: NameServer = 194.204.159.1 217.98.63.164 O20 - AppInit_DLLs: e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - e:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing) O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe -- Files created between 2007-06-23 and 2007-07-23 ----------------------------- 2007-07-22 23:24:22 0 d-------- C:\avenger 2007-07-21 16:32:14 0 d-------- C:\WINDOWS\CSC 2007-07-20 20:54:51 126976 --a------ C:\WINDOWS\System32\zip.exe 2007-07-20 20:54:51 175616 --a------ C:\WINDOWS\System32\strings.exe 2007-07-20 20:54:51 16384 --a------ C:\WINDOWS\System32\restart.exe <Not Verified; WareSoft Software; restart> 2007-07-20 20:54:51 39184 --a------ C:\WINDOWS\System32\Ntrights.exe 2007-07-20 20:54:51 11254 --a------ C:\WINDOWS\System32\locate.com 2007-07-20 20:49:22 0 d-------- C:\WINDOWS\pss 2007-07-20 17:20:32 0 --a------ C:\WINDOWS\nsreg.dat 2007-07-20 01:05:53 82258 --a------ C:\WINDOWS\System32\drivers\klin.dat 2007-07-20 01:05:53 82258 --a------ C:\WINDOWS\System32\drivers\klick.dat 2007-07-20 01:05:44 51232 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat 2007-07-20 01:05:44 12436512 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat 2007-07-20 01:02:34 0 d-------- C:\!KillBox 2007-07-20 00:48:41 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-07-20 00:48:41 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-07-20 00:48:41 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-07-02 20:19:41 356437 --a------ C:\WINDOWS\System32\GDS32.DLL <Not Verified; The Firebird Project; Firebird SQL Server> -- Find3M Report --------------------------------------------------------------- 2007-07-23 22:39:50 0 d-------- C:\Program Files\AutoConnect 2007-07-23 18:54:19 0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\OpenOffice.org2 2007-07-22 00:03:41 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2007-07-21 16:35:26 3678 --a------ C:\WINDOWS\System32\tmp.reg 2007-07-21 16:35:11 0 d-------- C:\Program Files\Neostrada TP 2007-07-20 23:55:12 435978 --a------ C:\WINDOWS\System32\perfh015.dat 2007-07-20 23:55:12 67078 --a------ C:\WINDOWS\System32\perfc015.dat 2007-07-20 17:20:30 0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\Mozilla 2007-07-20 06:08:43 1614 --ahs---- C:\WINDOWS\System32\index.dat 2007-06-14 22:57:11 0 d-------- C:\Program Files\Opera 2007-06-09 21:59:56 0 d-------- C:\Program Files\Snake 2007-06-09 21:55:20 487424 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows> 2007-06-09 21:55:18 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows> 2007-06-07 13:26:13 0 d-------- C:\Program Files\Ganymede 2007-06-05 15:18:17 0 d-------- C:\Program Files\Common Files\Panda Software 2007-06-03 14:11:39 0 d-------- C:\Documents and Settings\Rafal\Dane aplikacji\MegauploadToolbar -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMan"="SOUNDMAN.EXE" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime" "Resume copy"="copyfstq.exe /startup" "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "Name of App"="C:\\Program Files\\SAMSUNG\\FW LiveUpdate\\Liveupdate.exe" "WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe" "WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe" "WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "AVP"="\"e:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "AQQ"="C:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe" "AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe" "Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-07-23 at 22:40:42 ---------

combofix

Kod: Zaznacz wszystko: "Rafal" - 2007-07-23 22:21:20 - ComboFix 07-07-14.6 - Dodatek Service Pack. 1 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-23 to 2007-07-23 ))))))))))))))))))))))))))))))) 2007-07-21 20:32 <DIR> d-------- C:\Deckard 2007-07-21 16:32 <DIR> d-------- C:\WINDOWS\CSC 2007-07-20 23:49 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-20 21:09 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-07-20 21:09 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-07-20 21:09 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-07-20 21:09 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-07-20 21:09 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-07-20 21:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-07-20 21:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-07-20 21:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-07-20 20:54 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-07-20 20:54 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-07-20 20:54 16,384 --a------ C:\WINDOWS\system32\restart.exe 2007-07-20 20:54 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-07-20 20:54 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-07-20 20:49 <DIR> d-------- C:\WINDOWS\pss 2007-07-20 17:20 0 --a------ C:\WINDOWS\nsreg.dat 2007-07-20 01:05 82,258 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-07-20 01:05 82,258 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-07-20 01:05 51,232 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-07-20 01:05 12,436,512 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-07-20 01:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\DANEAP~1\Kaspersky Lab 2007-07-20 01:02 <DIR> d-------- C:\!KillBox 2007-07-20 00:48 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-07-20 00:48 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-20 00:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-07-02 20:19 356,437 --a------ C:\WINDOWS\system32\GDS32.DLL (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-23 20:20:20 -------- d-----w C:\Program Files\AutoConnect 2007-07-23 19:52:10 7,892 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-07-23 19:52:09 173,672 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-07-23 16:54:19 -------- d-----w C:\DOCUME~1\Rafal\DANEAP~1\OpenOffice.org2 2007-07-21 22:03:41 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-07-21 14:35:26 3,678 ----a-w C:\WINDOWS\system32\tmp.reg 2007-07-21 14:35:11 -------- d-----w C:\Program Files\Neostrada TP 2007-07-20 21:55:12 67,078 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-20 21:55:12 435,978 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-20 04:08:43 1,614 --sha-w C:\WINDOWS\system32\index.dat 2007-06-14 20:57:11 -------- d-----w C:\Program Files\Opera 2007-06-09 19:59:56 -------- d-----w C:\Program Files\Snake 2007-06-09 19:55:20 487,424 ------w C:\WINDOWS\Setup1.exe 2007-06-09 19:55:18 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-06-07 11:26:13 -------- d-----w C:\Program Files\Ganymede 2007-06-05 13:18:17 -------- d-----w C:\Program Files\Common Files\Panda Software 2007-06-04 15:49:42 80 ----a-w C:\WINDOWS\system32\drivers\netfltConfig.dat 2007-06-03 12:11:39 -------- d-----w C:\DOCUME~1\Rafal\DANEAP~1\MegauploadToolbar ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}] 2007-02-08 07:04 158272 --a------ E:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}] 2006-10-31 08:55 1803720 --a------ C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-07-27 11:01 C:\WINDOWS\SOUNDMAN.EXE] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-25 01:27] "Resume copy"="copyfstq.exe" [2006-09-27 17:01 C:\WINDOWS\copyfstq.exe] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [2006-03-10 09:07] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-14 16:46] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05] "AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14] "Gadu-Gadu"="E:\Programy\Gadu-Gadu\gg.exe" [2007-04-25 17:27] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=e:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-23 22:24:19 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Name of App = C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe??w???w????????????????????Rafa??a?B???????L???????D??????w???w????j??w???w??????????????C????????? ??? ?B?????????????????????061005025147859?5?1?4?7?8?5?9???????????????????0???????????????????????D?????G scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-23 22:25:56 C:\ComboFix-quarantined-files.txt ... 2007-07-23 22:24 C:\ComboFix2.txt ... 2007-07-23 20:11 C:\ComboFix3.txt ... 2007-07-22 20:50 --- E O F ---

[/code]

**Posty:** 18165 · przez **wojtas** 24 Lip 2007, 11:06

Misugi napisał(a):Wojtas a to ? widziałem

mozna zostawic

log jest ok

**Posty:** 72 · przez **17rafal** 24 Lip 2007, 20:02

Dzięki za pomoc :wink:

proszę o sprawdzenie loga

Kto jest na forum