proszę o sprawdzenie loga

**Posty:** 555 · przez **MarcepanowyPiesek** 30 Paź 2007, 21:28

Więc tak:

1. Komputer zwolnił, łąpie zwiechy itd...
2. Przy wyłączaniu komputera konczy mi sie jakis proces z niepolskimi znaczkami (trojkaty)

Oto logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:21:05, on 2007-10-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Novina\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/pl/ý R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DLD.EXE] C:\Program Files\Download Direct\DLD.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F38DEA17-2059-4E37-AF70-A4BF64923A64}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

Kod: Zaznacz wszystko: ComboFix 07-10-29.1 - Novina 2007-10-30 20:24:01.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.217 [GMT 1:00] Running from: C:\Documents and Settings\Novina\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-30 ))))))))))))))))))))))))))))))) . 2007-10-30 20:23 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-30 17:14 <DIR> d-------- C:\Program Files\Java 2007-10-30 17:09 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-26 16:36 <DIR> d-------- C:\WINDOWS\Cache 2007-10-21 12:11 327,168 --a------ C:\WINDOWS\IsUn0419.exe 2007-10-21 08:21 <DIR> d-------- C:\WINDOWS\vf_hip 2007-10-21 08:21 <DIR> d-------- C:\Program Files\Hide IP Platinum 2007-10-19 14:25 <DIR> d-------- C:\games 2007-10-06 12:25 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\DeepBurner 2007-10-06 11:31 <DIR> d-------- C:\Program Files\Ares 2007-09-29 21:46 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-09-27 17:14 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-09-27 17:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2007-09-27 17:13 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-09-23 12:15 <DIR> d-------- C:\totalcmd 2007-09-23 12:15 545 --a------ C:\WINDOWS\UC.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-21 19:29 <DIR> d-------- C:\Program Files\eMule 2007-09-21 14:20 <DIR> d-------- C:\WINDOWS\solcache 2007-09-21 14:19 <DIR> d-------- C:\Program Files\Sierra On-Line 2007-09-21 14:19 1,022,976 --a------ C:\WINDOWS\system32\SierraNW.dll 2007-09-21 14:19 231,936 --a------ C:\WINDOWS\system32\SNWValid.dll 2007-09-21 14:18 327,168 --a------ C:\WINDOWS\IsUninst.exe 2007-09-21 14:17 <DIR> d-------- C:\Documents and Settings\Novina\WINDOWS 2007-09-21 11:04 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-21 08:17 <DIR> d-------- C:\Program Files\mozilla.org 2007-09-21 08:17 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Talkback 2007-09-20 17:31 <DIR> d-------- C:\Program Files\Opera 2007-09-18 14:49 <DIR> d-------- C:\WINDOWS\ShellNew 2007-09-18 14:48 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Microsoft Web Folders 2007-09-18 07:44 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2007-09-18 07:41 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-17 14:47 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-16 19:38 <DIR> d---s---- C:\Documents and Settings\Novina\UserData 2007-09-16 16:58 <DIR> d-------- C:\Program Files\Astonsoft 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Ahead 2007-09-16 16:56 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-09-16 16:56 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-09-16 16:56 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-09-16 16:56 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-09-16 16:56 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-09-16 16:56 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-09-16 16:55 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-09-16 02:23 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Gadu-Gadu 2007-09-16 02:01 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-09-15 23:14 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-09-15 22:31 <DIR> d-------- C:\WINDOWS\pss 2007-09-15 22:21 <DIR> d-------- C:\Program Files\Winamp 2007-09-15 18:18 <DIR> d-------- C:\Program Files\Lavalys 2007-09-15 18:02 11,286 --a------ C:\WINDOWS\mozver.dat 2007-09-15 18:01 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Hamachi 2007-09-15 18:00 <DIR> d-------- C:\Program Files\Hamachi 2007-09-15 18:00 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 07:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-11 18:07 --------- d-----w C:\Program Files\Gadu-Gadu 2007-09-18 13:48 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-15 11:24 --------- d-----w C:\Program Files\Realtek Sound Manager 2007-09-15 11:24 --------- d-----w C:\Program Files\AvRack 2007-09-15 11:23 --------- d-----w C:\Program Files\Realtek AC97 2007-09-15 11:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-15 11:09 --------- d-----w C:\Documents and Settings\Novina\Dane aplikacji\ATI 2007-09-15 11:07 --------- d-----w C:\Program Files\ATI Technologies 2007-09-15 10:34 --------- d-----w C:\Program Files\Usługi online 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-09 13:11 584,192 ----a-w C:\WINDOWS\system32\rpcrt4.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-24 23:27] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 C:\WINDOWS\soundman.exe] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "Device Detector"="DevDetect.exe" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "DLD.EXE"="C:\Program Files\Download Direct\DLD.exe" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2004-11-24 23:27:20] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Novina^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Novina\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe S3 ddsxeiservice;ddsxeiservice;\??\C:\Program Files\sXe Injected\ddsxei.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6f9132c-7f0e-11dc-abc7-000fea6af0b8}] AutoRun\command - G:\Autorun.exe *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-30 20:25:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-30 20:25:48 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 30 Paź 2007, 22:21

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6f9132c-7f0e-11dc-abc7-000fea6af0b8}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Marcepanowypiesek napisał(a):2. Przy wyłączaniu komputera konczy mi sie jakis proces z niepolskimi znaczkami (trojkaty)

screen

**Posty:** 555 · przez **MarcepanowyPiesek** 31 Paź 2007, 23:19

Zrobiłęm to było OK ale teraz Avast ifnormuje mnie, że mam wirusa:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:15:55, on 2007-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Avast\aswUpdSv.exe E:\Programy\Avast\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe E:\Programy\Avast\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\sysxp.exe to chyba ten wirus C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe E:\Programy\Avast\ashMaiSv.exe E:\Programy\Avast\ashWebSv.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe E:\Programy\Avast\ashLogV.exe C:\Documents and Settings\Novina\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/pl/ý R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] E:\Programy\Avast\ashDisp.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [SYSXP] C:\WINDOWS\System32\sysxp.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F38DEA17-2059-4E37-AF70-A4BF64923A64}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Programy\Avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - E:\Programy\Avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - E:\Programy\Avast\ashWebSv.exe" /service (file missing)

Kod: Zaznacz wszystko: ComboFix 07-10-29.1 - Novina 2007-10-31 22:17:09.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.229 [GMT 1:00] Running from: C:\Documents and Settings\Novina\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-31 ))))))))))))))))))))))))))))))) . 2007-10-31 15:59 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-10-31 15:59 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-31 15:59 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-31 15:59 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-31 15:59 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-31 15:59 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-31 15:58 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-10-31 15:58 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-10-31 15:58 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll 2007-10-31 15:58 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll 2007-10-30 20:23 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-30 17:14 <DIR> d-------- C:\Program Files\Java 2007-10-30 17:09 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-26 16:36 <DIR> d-------- C:\WINDOWS\Cache 2007-10-21 12:11 327,168 --a------ C:\WINDOWS\IsUn0419.exe 2007-10-21 08:21 <DIR> d-------- C:\WINDOWS\vf_hip 2007-10-21 08:21 <DIR> d-------- C:\Program Files\Hide IP Platinum 2007-10-19 14:25 <DIR> d-------- C:\games 2007-10-06 12:25 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\DeepBurner 2007-10-06 11:31 <DIR> d-------- C:\Program Files\Ares 2007-09-29 21:46 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-09-27 17:14 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-09-27 17:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2007-09-27 17:13 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-09-23 12:15 <DIR> d-------- C:\totalcmd 2007-09-23 12:15 545 --a------ C:\WINDOWS\UC.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-21 19:29 <DIR> d-------- C:\Program Files\eMule 2007-09-21 14:20 <DIR> d-------- C:\WINDOWS\solcache 2007-09-21 14:19 <DIR> d-------- C:\Program Files\Sierra On-Line 2007-09-21 14:19 1,022,976 --a------ C:\WINDOWS\system32\SierraNW.dll 2007-09-21 14:19 231,936 --a------ C:\WINDOWS\system32\SNWValid.dll 2007-09-21 14:18 327,168 --a------ C:\WINDOWS\IsUninst.exe 2007-09-21 14:17 <DIR> d-------- C:\Documents and Settings\Novina\WINDOWS 2007-09-21 11:04 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-21 08:17 <DIR> d-------- C:\Program Files\mozilla.org 2007-09-21 08:17 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Talkback 2007-09-20 17:31 <DIR> d-------- C:\Program Files\Opera 2007-09-18 14:49 <DIR> d-------- C:\WINDOWS\ShellNew 2007-09-18 14:48 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Microsoft Web Folders 2007-09-18 07:44 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2007-09-18 07:41 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-17 14:47 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-16 19:38 <DIR> d---s---- C:\Documents and Settings\Novina\UserData 2007-09-16 16:58 <DIR> d-------- C:\Program Files\Astonsoft 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Ahead 2007-09-16 16:56 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-09-16 16:56 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-09-16 16:56 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-09-16 16:56 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-09-16 16:56 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-09-16 16:56 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-09-16 16:55 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-09-16 02:23 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Gadu-Gadu 2007-09-16 02:01 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-09-15 23:14 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-09-15 22:31 <DIR> d-------- C:\WINDOWS\pss 2007-09-15 22:21 <DIR> d-------- C:\Program Files\Winamp 2007-09-15 18:18 <DIR> d-------- C:\Program Files\Lavalys 2007-09-15 18:02 11,286 --a------ C:\WINDOWS\mozver.dat 2007-09-15 18:01 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Hamachi 2007-09-15 18:00 <DIR> d-------- C:\Program Files\Hamachi 2007-09-15 18:00 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 07:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-11 18:07 --------- d-----w C:\Program Files\Gadu-Gadu 2007-09-18 13:48 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-15 11:24 --------- d-----w C:\Program Files\Realtek Sound Manager 2007-09-15 11:24 --------- d-----w C:\Program Files\AvRack 2007-09-15 11:23 --------- d-----w C:\Program Files\Realtek AC97 2007-09-15 11:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-15 11:09 --------- d-----w C:\Documents and Settings\Novina\Dane aplikacji\ATI 2007-09-15 11:07 --------- d-----w C:\Program Files\ATI Technologies 2007-09-15 10:34 --------- d-----w C:\Program Files\Usługi online 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-09 13:11 584,192 ----a-w C:\WINDOWS\system32\rpcrt4.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-30_20.25.17,14 ))))))))))))))))))))))))))))))))))))))))) . + 2007-10-31 17:21:33 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_660.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 C:\WINDOWS\soundman.exe] "Device Detector"="DevDetect.exe" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "avast!"="E:\Programy\Avast\ashDisp.exe" [2007-09-06 12:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "SYSXP"="C:\WINDOWS\System32\sysxp.exe" [] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Novina^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Novina\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE] C:\Program Files\Download Direct\DLD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe S3 ddsxeiservice;ddsxeiservice;\??\C:\Program Files\sXe Injected\ddsxei.sys . ************************************************************************** catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-31 22:18:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-31 22:19:01 C:\ComboFix2.txt ... 2007-10-30 20:25 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 31 Paź 2007, 23:21

O4 - HKCU\..\Run: [SYSXP] C:\WINDOWS\System32\sysxp.exe

kasujesz wpis + pogrubiony do kosza wywalasz

**Posty:** 555 · przez **MarcepanowyPiesek** 31 Paź 2007, 23:34

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:31:46, on 2007-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Avast\aswUpdSv.exe E:\Programy\Avast\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe E:\Programy\Avast\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\sysxp.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe E:\Programy\Avast\ashMaiSv.exe E:\Programy\Avast\ashWebSv.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Novina\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/pl/ý R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] E:\Programy\Avast\ashDisp.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F38DEA17-2059-4E37-AF70-A4BF64923A64}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Programy\Avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - E:\Programy\Avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - E:\Programy\Avast\ashWebSv.exe" /service (file missing)

Kod: Zaznacz wszystko: ComboFix 07-10-29.1 - Novina 2007-10-31 22:32:26.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.202 [GMT 1:00] Running from: C:\Documents and Settings\Novina\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-31 ))))))))))))))))))))))))))))))) . 2007-10-31 15:59 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-10-31 15:59 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-31 15:59 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-31 15:59 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-31 15:59 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-31 15:59 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-31 15:58 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-10-31 15:58 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-10-31 15:58 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll 2007-10-31 15:58 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll 2007-10-30 20:23 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-30 17:14 <DIR> d-------- C:\Program Files\Java 2007-10-30 17:09 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-26 16:36 <DIR> d-------- C:\WINDOWS\Cache 2007-10-21 12:11 327,168 --a------ C:\WINDOWS\IsUn0419.exe 2007-10-21 08:21 <DIR> d-------- C:\WINDOWS\vf_hip 2007-10-21 08:21 <DIR> d-------- C:\Program Files\Hide IP Platinum 2007-10-19 14:25 <DIR> d-------- C:\games 2007-10-06 12:25 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\DeepBurner 2007-10-06 11:31 <DIR> d-------- C:\Program Files\Ares 2007-09-29 21:46 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-09-27 17:14 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-09-27 17:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2007-09-27 17:13 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-09-23 12:15 <DIR> d-------- C:\totalcmd 2007-09-23 12:15 545 --a------ C:\WINDOWS\UC.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-21 19:29 <DIR> d-------- C:\Program Files\eMule 2007-09-21 14:20 <DIR> d-------- C:\WINDOWS\solcache 2007-09-21 14:19 <DIR> d-------- C:\Program Files\Sierra On-Line 2007-09-21 14:19 1,022,976 --a------ C:\WINDOWS\system32\SierraNW.dll 2007-09-21 14:19 231,936 --a------ C:\WINDOWS\system32\SNWValid.dll 2007-09-21 14:18 327,168 --a------ C:\WINDOWS\IsUninst.exe 2007-09-21 14:17 <DIR> d-------- C:\Documents and Settings\Novina\WINDOWS 2007-09-21 11:04 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-21 08:17 <DIR> d-------- C:\Program Files\mozilla.org 2007-09-21 08:17 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Talkback 2007-09-20 17:31 <DIR> d-------- C:\Program Files\Opera 2007-09-18 14:49 <DIR> d-------- C:\WINDOWS\ShellNew 2007-09-18 14:48 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Microsoft Web Folders 2007-09-18 07:44 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2007-09-18 07:41 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-17 14:47 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-16 19:38 <DIR> d---s---- C:\Documents and Settings\Novina\UserData 2007-09-16 16:58 <DIR> d-------- C:\Program Files\Astonsoft 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Ahead 2007-09-16 16:56 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-09-16 16:56 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-09-16 16:56 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-09-16 16:56 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-09-16 16:56 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-09-16 16:56 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-09-16 16:55 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-09-16 02:23 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Gadu-Gadu 2007-09-16 02:01 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-09-15 23:14 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-09-15 22:31 <DIR> d-------- C:\WINDOWS\pss 2007-09-15 22:21 <DIR> d-------- C:\Program Files\Winamp 2007-09-15 18:18 <DIR> d-------- C:\Program Files\Lavalys 2007-09-15 18:02 11,286 --a------ C:\WINDOWS\mozver.dat 2007-09-15 18:01 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Hamachi 2007-09-15 18:00 <DIR> d-------- C:\Program Files\Hamachi 2007-09-15 18:00 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 07:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-11 18:07 --------- d-----w C:\Program Files\Gadu-Gadu 2007-09-18 13:48 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-15 11:24 --------- d-----w C:\Program Files\Realtek Sound Manager 2007-09-15 11:24 --------- d-----w C:\Program Files\AvRack 2007-09-15 11:23 --------- d-----w C:\Program Files\Realtek AC97 2007-09-15 11:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-15 11:09 --------- d-----w C:\Documents and Settings\Novina\Dane aplikacji\ATI 2007-09-15 11:07 --------- d-----w C:\Program Files\ATI Technologies 2007-09-15 10:34 --------- d-----w C:\Program Files\Usługi online 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-09 13:11 584,192 ----a-w C:\WINDOWS\system32\rpcrt4.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-30_20.25.17,14 ))))))))))))))))))))))))))))))))))))))))) . + 2007-10-31 17:21:33 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_660.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 C:\WINDOWS\soundman.exe] "Device Detector"="DevDetect.exe" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "avast!"="E:\Programy\Avast\ashDisp.exe" [2007-09-06 12:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Novina^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Novina\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE] C:\Program Files\Download Direct\DLD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe S3 ddsxeiservice;ddsxeiservice;\??\C:\Program Files\sXe Injected\ddsxei.sys . ************************************************************************** catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-31 22:33:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-31 22:33:59 C:\ComboFix2.txt ... 2007-10-31 22:19 C:\ComboFix3.txt ... 2007-10-30 20:25 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 31 Paź 2007, 23:35

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\System32\sysxp.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 555 · przez **MarcepanowyPiesek** 31 Paź 2007, 23:45

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:42:23, on 2007-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Avast\aswUpdSv.exe E:\Programy\Avast\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe E:\Programy\Avast\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe E:\Programy\Avast\ashMaiSv.exe E:\Programy\Avast\ashWebSv.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Novina\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/pl/ý R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] E:\Programy\Avast\ashDisp.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F38DEA17-2059-4E37-AF70-A4BF64923A64}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Programy\Avast\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Programy\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - E:\Programy\Avast\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - E:\Programy\Avast\ashWebSv.exe" /service (file missing)

Kod: Zaznacz wszystko: ComboFix 07-10-29.1 - Novina 2007-10-31 22:43:06.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.233 [GMT 1:00] Running from: C:\Documents and Settings\Novina\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-31 ))))))))))))))))))))))))))))))) . 2007-10-31 15:59 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-10-31 15:59 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-31 15:59 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-31 15:59 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-31 15:59 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-31 15:59 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-31 15:58 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-10-31 15:58 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-10-31 15:58 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll 2007-10-31 15:58 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll 2007-10-30 20:23 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-30 17:14 <DIR> d-------- C:\Program Files\Java 2007-10-30 17:09 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-26 16:36 <DIR> d-------- C:\WINDOWS\Cache 2007-10-21 12:11 327,168 --a------ C:\WINDOWS\IsUn0419.exe 2007-10-21 08:21 <DIR> d-------- C:\WINDOWS\vf_hip 2007-10-21 08:21 <DIR> d-------- C:\Program Files\Hide IP Platinum 2007-10-19 14:25 <DIR> d-------- C:\games 2007-10-06 12:25 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\DeepBurner 2007-10-06 11:31 <DIR> d-------- C:\Program Files\Ares 2007-09-29 21:46 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-09-29 21:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-09-27 17:14 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-09-27 17:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2007-09-27 17:13 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-09-23 12:15 <DIR> d-------- C:\totalcmd 2007-09-23 12:15 545 --a------ C:\WINDOWS\UC.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-23 12:15 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-21 19:29 <DIR> d-------- C:\Program Files\eMule 2007-09-21 14:20 <DIR> d-------- C:\WINDOWS\solcache 2007-09-21 14:19 <DIR> d-------- C:\Program Files\Sierra On-Line 2007-09-21 14:19 1,022,976 --a------ C:\WINDOWS\system32\SierraNW.dll 2007-09-21 14:19 231,936 --a------ C:\WINDOWS\system32\SNWValid.dll 2007-09-21 14:18 327,168 --a------ C:\WINDOWS\IsUninst.exe 2007-09-21 14:17 <DIR> d-------- C:\Documents and Settings\Novina\WINDOWS 2007-09-21 11:04 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-09-21 08:17 <DIR> d-------- C:\Program Files\mozilla.org 2007-09-21 08:17 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Talkback 2007-09-20 17:31 <DIR> d-------- C:\Program Files\Opera 2007-09-18 14:49 <DIR> d-------- C:\WINDOWS\ShellNew 2007-09-18 14:48 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Microsoft Web Folders 2007-09-18 07:44 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Program Files\ACD Systems 2007-09-18 07:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2007-09-18 07:41 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-17 14:47 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-09-16 19:38 <DIR> d---s---- C:\Documents and Settings\Novina\UserData 2007-09-16 16:58 <DIR> d-------- C:\Program Files\Astonsoft 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-09-16 16:56 <DIR> d-------- C:\Program Files\Ahead 2007-09-16 16:56 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-09-16 16:56 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-09-16 16:56 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-09-16 16:56 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-09-16 16:56 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-09-16 16:56 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-09-16 16:55 <DIR> d-------- C:\Program Files\SubEdit-Player 2007-09-16 02:23 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Gadu-Gadu 2007-09-16 02:01 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-09-15 23:14 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-09-15 22:31 <DIR> d-------- C:\WINDOWS\pss 2007-09-15 22:21 <DIR> d-------- C:\Program Files\Winamp 2007-09-15 18:18 <DIR> d-------- C:\Program Files\Lavalys 2007-09-15 18:02 11,286 --a------ C:\WINDOWS\mozver.dat 2007-09-15 18:01 <DIR> d-------- C:\Documents and Settings\Novina\Dane aplikacji\Hamachi 2007-09-15 18:00 <DIR> d-------- C:\Program Files\Hamachi 2007-09-15 18:00 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2007-09-15 13:27 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2007-09-15 13:27 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2007-09-15 13:27 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2007-09-15 13:27 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-21 07:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-11 18:07 --------- d-----w C:\Program Files\Gadu-Gadu 2007-09-18 13:48 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-15 11:24 --------- d-----w C:\Program Files\Realtek Sound Manager 2007-09-15 11:24 --------- d-----w C:\Program Files\AvRack 2007-09-15 11:23 --------- d-----w C:\Program Files\Realtek AC97 2007-09-15 11:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-15 11:09 --------- d-----w C:\Documents and Settings\Novina\Dane aplikacji\ATI 2007-09-15 11:07 --------- d-----w C:\Program Files\ATI Technologies 2007-09-15 10:34 --------- d-----w C:\Program Files\Usługi online 2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-09 13:11 584,192 ----a-w C:\WINDOWS\system32\rpcrt4.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-30_20.25.17,14 ))))))))))))))))))))))))))))))))))))))))) . + 2007-10-31 21:41:30 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_654.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 C:\WINDOWS\soundman.exe] "Device Detector"="DevDetect.exe" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "avast!"="E:\Programy\Avast\ashDisp.exe" [2007-09-06 12:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Novina^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Novina\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE] C:\Program Files\Download Direct\DLD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe S3 ddsxeiservice;ddsxeiservice;\??\C:\Program Files\sXe Injected\ddsxei.sys . ************************************************************************** catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-31 22:44:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-31 22:44:41 C:\ComboFix2.txt ... 2007-10-31 22:39 C:\ComboFix3.txt ... 2007-10-31 22:34 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 31 Paź 2007, 23:46

czysto

Autor postu otrzymał pochwałę

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum