Prosze o sprawdzenie loga (zamula komputer i przekierowuje)

**Posty:** 2 · przez **Durka** 02 Gru 2008, 20:03

Witam. Proszę o sprawdzenie loga, gdyż komputer wolno pracuje i linki w google przekierowują mnie na losowe strony. Z góry dziękuje.

Log z Hi Jacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:52:49, on 2008-12-02 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe F:\Program Files\Lavasoft\Ad-Aware\aawservice.exe F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe F:\Program Files\Alwil Software\Avast4\ashServ.exe F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe F:\WINDOWS\system32\CTsvcCDA.exe F:\Program Files\Java\jre6\bin\jqs.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\system32\PnkBstrA.exe F:\WINDOWS\system32\PnkBstrB.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\Explorer.EXE F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe F:\Program Files\Alwil Software\Avast4\ashWebSv.exe F:\WINDOWS\system32\RUNDLL32.EXE F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe F:\WINDOWS\RTHDCPL.EXE F:\Program Files\Java\jre6\bin\jusched.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\DAEMON Tools Lite\daemon.exe F:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe F:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe F:\Program Files\Gadu-Gadu\gg.exe F:\Program Files\Opera\opera.exe F:\Documents and Settings\Piotr\Pulpit\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - F:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - F:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [PSPVideoConverter_upgrade] "F:\Program Files\E-Zsoft\PSPVideoConverter\PSPVideoConverter.exe" /upgrade O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "F:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [CTSyncU.exe] "F:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [SVCHOST.EXE] F:\WINDOWS\system32\drivers\svchost.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = F:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'SYSTEM') O4 - .DEFAULT Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = F:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - F:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LiveUpdate - Symantec Corporation - F:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - F:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Symantec Core LC - Unknown owner - F:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

**Posty:** 300 · przez **sgsman** 02 Gru 2008, 20:14

Wrzuć log z Combofixa.

**Posty:** 2 · przez **Durka** 02 Gru 2008, 20:47

Combofix niestety nie działa na moim komputerze. Dokładniej pojawia sie proces w menedżerze zadań ale na ekranie nie pojawia sie żadna instalacja/okienko/cokolwiek.

[Edit] Combofix zadziałał po zmianie nazwy. Log:

Kod: Zaznacz wszystko: ComboFix 08-12-01.03 - Piotr 2008-12-02 20:23:03.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1593 [GMT 1:00] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\15432.exe f:\windows\system32\drivers\TDSSpqlt.sys f:\windows\system32\TDSShrxr.dll f:\windows\system32\TDSSkkbi.log f:\windows\system32\TDSSlrvd.dat f:\windows\system32\TDSSlxwp.dll f:\windows\system32\TDSSnmxh.log f:\windows\system32\TDSSoiqt.dll f:\windows\system32\TDSSrhyp.log f:\windows\system32\TDSSrtqp.dll f:\windows\system32\TDSSsihc.dll f:\windows\system32\TDSSxfum.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSSERV.SYS -------\Legacy_TDSSSERV.SYS ((((((((((((((((((((((((( Pliki utworzone od 2008-11-02 do 2008-12-02 ))))))))))))))))))))))))))))))) . 2008-12-02 14:32 . 2008-12-02 14:31 410,976 --a------ f:\windows\system32\deploytk.dll 2008-11-28 00:36 . 2008-11-28 02:54 <DIR> d-------- f:\program files\Spybot - Search & Destroy 2008-11-28 00:36 . 2008-11-28 01:04 <DIR> d-------- f:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-11-28 00:23 . 2008-11-28 00:23 <DIR> d-------- f:\program files\Windows Sidebar 2008-11-28 00:23 . 2008-11-28 00:23 <DIR> d-------- f:\program files\Symantec 2008-11-28 00:23 . 2008-11-28 00:26 <DIR> d-------- f:\program files\Norton AntiVirus 2008-11-28 00:23 . 2008-11-28 00:25 <DIR> d-------- f:\documents and settings\All Users\Dane aplikacji\Symantec 2008-11-28 00:23 . 2008-11-28 00:23 123,952 --a------ f:\windows\system32\drivers\SYMEVENT.SYS 2008-11-28 00:23 . 2008-11-28 00:23 60,808 --a------ f:\windows\system32\S32EVNT1.DLL 2008-11-28 00:23 . 2008-11-28 00:23 10,652 --a------ f:\windows\system32\drivers\SYMEVENT.CAT 2008-11-28 00:23 . 2008-11-28 00:23 806 --a------ f:\windows\system32\drivers\SYMEVENT.INF 2008-11-28 00:21 . 2008-12-02 18:49 <DIR> d-------- f:\program files\Common Files\Symantec Shared 2008-11-28 00:10 . 2008-11-28 00:41 <DIR> d-------- f:\program files\SkanerOnline 2008-11-25 21:44 . 2008-11-25 22:26 <DIR> d-------- F:\Filmy 2008-11-25 21:09 . 2008-11-25 21:09 <DIR> d-------- f:\program files\Enigma Software Productions 2008-11-20 21:50 . 2008-10-10 04:52 4,379,984 --a------ f:\windows\system32\D3DX9_40.dll 2008-11-20 21:50 . 2008-10-10 04:52 2,036,576 --a------ f:\windows\system32\D3DCompiler_40.dll 2008-11-20 21:50 . 2008-10-27 10:04 514,384 --a------ f:\windows\system32\XAudio2_3.dll 2008-11-20 21:50 . 2008-10-10 04:52 452,440 --a------ f:\windows\system32\d3dx10_40.dll 2008-11-20 21:50 . 2008-10-27 10:04 235,856 --a------ f:\windows\system32\xactengine3_3.dll 2008-11-20 21:50 . 2008-10-27 10:04 70,992 --a------ f:\windows\system32\XAPOFX1_2.dll 2008-11-20 21:50 . 2008-10-27 10:04 23,376 --a------ f:\windows\system32\X3DAudio1_5.dll 2008-11-12 16:45 . 2008-09-04 18:17 1,106,944 -----c--- f:\windows\system32\dllcache\msxml3.dll 2008-11-12 16:45 . 2008-10-24 12:21 455,296 -----c--- f:\windows\system32\dllcache\mrxsmb.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 13:31 --------- d-----w f:\program files\Java 2008-11-25 21:33 --------- d-----w f:\program files\ChrisTV Lite 2008-11-25 20:09 --------- d--h--w f:\program files\InstallShield Installation Information 2008-11-24 17:10 137,688 ----a-w f:\windows\system32\drivers\PnkBstrK.sys 2008-11-24 17:09 202,040 ----a-w f:\windows\system32\PnkBstrB.exe 2008-11-23 22:32 --------- d-----w f:\documents and settings\Greg\Dane aplikacji\OpenOffice.org2 2008-11-22 18:31 --------- d-----w f:\program files\Gadu-Gadu 2008-11-14 19:58 --------- d-----w f:\documents and settings\Piotr\Dane aplikacji\Bioshock 2008-11-12 15:53 --------- d-----w f:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-11-12 12:45 453,152 ----a-w f:\windows\system32\NVUNINST.EXE 2008-10-31 15:56 --------- d-----w f:\program files\Opera 2008-10-27 13:59 --------- d-----w f:\documents and settings\Piotr\Dane aplikacji\DeepBurner 2008-10-24 11:21 455,296 ----a-w f:\windows\system32\drivers\mrxsmb.sys 2008-10-16 13:52 --------- d-----w f:\program files\Counter-Strike 2008-10-15 12:31 --------- d-----w f:\program files\Aspell 2008-10-15 12:14 --------- d-----w f:\program files\FreeCommander 2008-10-14 14:31 --------- d-----w f:\program files\DevalVR 2008-10-08 17:30 --------- d-----w f:\documents and settings\Piotr\Dane aplikacji\U3 2008-10-07 14:31 66,872 ----a-w f:\windows\system32\PnkBstrA.exe 2008-10-07 14:25 22,328 ----a-w f:\documents and settings\Piotr\Dane aplikacji\PnkBstrK.sys 2008-09-26 18:53 107,888 ----a-w f:\windows\system32\CmdLineExt.dll 2008-09-15 15:27 1,846,656 ----a-w f:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ------w f:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w f:\windows\system32\msxml3.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="f:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Lite"="f:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952] "CTSyncU.exe"="f:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2008-05-03 13529088] "NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2008-05-03 86016] "Adobe Reader Speed Launcher"="f:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "avast!"="f:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "SunJavaUpdateSched"="f:\program files\Java\jre6\bin\jusched.exe" [2008-12-02 136600] "ccApp"="f:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-08-24 51048] "osCheck"="f:\program files\Norton AntiVirus\osCheck.exe" [2007-08-24 714608] "nwiz"="nwiz.exe" [2008-05-03 f:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2008-05-07 f:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="f:\windows\system32\CTFMON.EXE" [2008-04-14 15360] f:\documents and settings\Greg\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - f:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440] f:\documents and settings\Edyta\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - f:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "f:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "f:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "f:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "f:\\Program Files\\Skype\\Phone\\Skype.exe"= "f:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "f:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "f:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "f:\\WINDOWS\\system32\\PnkBstrA.exe"= "f:\\WINDOWS\\system32\\PnkBstrB.exe"= "f:\\Program Files\\Reality Pump\\Earth 2160\\Earth2160_NO_SSE.exe"= "f:\\Program Files\\Reality Pump\\Earth 2160\\Earth2160_SSE.exe"= "f:\\Program Files\\Ascaron Entertainment\\Sacred\\Sacred.exe"= "f:\\Program Files\\Opera\\opera.exe"= "f:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "f:\\Soldat\\Soldat.exe"= "f:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"= "f:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"= "f:\\Program Files\\Gadu-Gadu\\gg.exe"= "f:\\Program Files\\Counter-Strike\\hl.exe"= "f:\\Documents and Settings\\Piotr\\Pulpit\\GRY\\[rs] Cod 4\\CoD4.xtremew.org\\bLuE^^-blueplanet-MauSeX\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "f:\\Documents and Settings\\Piotr\\Pulpit\\CoD - World at War\\n1.Call.of.Duty.WaW.Full-Rip.Skullptura.Iros\\Call of Duty - World at War\\CoDWaW.exe"= "f:\\Documents and Settings\\Piotr\\Pulpit\\CoD - World at War\\n1.Call.of.Duty.WaW.Full-Rip.Skullptura.Iros\\Call of Duty - World at War\\CoDWaWmp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "28960:UDP"= 28960:UDP:CoD4:Modern Warfare R0 trm3x5;trm3x5;f:\windows\system32\DRIVERS\trm3x5.sys [2008-06-24 22016] R1 aswSP;avast! Self Protection;f:\windows\system32\drivers\aswSP.sys [2008-06-23 110160] R1 UserPort;UserPort;\??\f:\windows\system32\Drivers\UserPort.sys [2008-07-13 4256] R2 aswFsBlk;aswFsBlk;f:\windows\system32\DRIVERS\aswFsBlk.sys [2008-06-23 20560] R2 LiveUpdate Notice;LiveUpdate Notice;"f:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2007-08-24 149864] R3 3xHybrid;Philips SAA713x PCI Card;f:\windows\system32\DRIVERS\3xHybrid.sys [2008-07-27 1302368] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\f:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-28 112688] R3 phil2vid;Kamera Philips USB VGA;f:\windows\system32\DRIVERS\philcam2.sys [2008-06-23 173696] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19d480f9-4164-11dd-afa5-806d6172696f}] \Shell\AutoRun\command - E:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{22294bba-5cbe-11dd-a6b8-001d7dd44875}] \Shell\AutoRun\command - I:\LaunchU3.exe -a *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' 2008-11-27 f:\windows\Tasks\Norton AntiVirus - Uruchom pełne skanowanie systemu - Greg.job - f:\program files\Norton AntiVirus\Navw32.exe [2007-08-26 18:19] . - - - - USUNIĘTO PUSTE WPISY - - - - Toolbar-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file) WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file) HKLM-Run-PSPVideoConverter_upgrade - f:\program files\E-Zsoft\PSPVideoConverter\PSPVideoConverter.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - f:\documents and settings\Piotr\Dane aplikacji\Mozilla\Firefox\Profiles\zp5qpory.default\ FF -: plugin - f:\program files\Opera\program\plugins\npdevalvr.dll FF -: plugin - f:\program files\Opera\program\plugins\NPOFF12.DLL FF -: plugin - f:\program files\Opera\program\plugins\nppl3260.dll FF -: plugin - f:\program files\Opera\program\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-02 20:26:45 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet004\Services\TDSSserv.sys] "imagepath"="\systemroot\system32\drivers\TDSSpqlt.sys" . Czas ukończenia: 2008-12-02 20:27:29 ComboFix-quarantined-files.txt 2008-12-02 19:27:27 Przed: 217,694,511,104 bajtów wolnych Po: 218,259,603,456 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] f:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 191 --- E O F --- 2008-11-12 16:28:16

**Posty:** 18165 · przez **wojtas** 02 Gru 2008, 22:51

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\system\ControlSet004\Services\TDSSserv.sys]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.