proszę sprawidzić loga - zamulony komputer

**Posty:** 112 · przez **dziubek12** 25 Sty 2008, 10:11

Od jakiegoś czasu niemal nie daje sie pracować na komputerze.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:13:11, on 2008-01-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CCPkiWNT.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\AddOn\Fujitsu\PSUtility\TrayManager.exe C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Vision\vservice.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe O4 - HKLM\..\Run: [IndicatorUtility] C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [gemstrmw] C:\WINDOWS\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Oprogramowanie Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7FF324B1-0CAD-40A2-8E3B-71376EF4D42E}: NameServer = 10.4.253.10,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{C4E239D8-3F17-4DF8-AAF0-36A2B639429C}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: CryptoCard Service (CCPkiWNT) - CryptoTech - C:\WINDOWS\system32\CCPkiWNT.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: OracleOUIHomeClientCache - Unknown owner - C:\OraHB\BIN\ONRSD.EXE O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Antywirusy\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Antywirusy\Spyware Doctor\swdsvc.exe O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- End of file - 8910 bytes

**Posty:** 3854 · przez **Dzi@dek** 25 Sty 2008, 10:44

Zastosuj SDFix . Po pobraniu uruchom go - rozpakuje się do C:\SDFix.
Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w trybie awaryjnym uruchom plik

RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zrestartuje.

Później wejdź do folderu C:\SDFix i wrzuć zawartość pliku Report.txt + log z

Combofix-a oraz z Hijackthis

**Posty:** 112 · przez **dziubek12** 25 Sty 2008, 14:09

Tak przy okazji - mam problem z antywirusem symanteca - chyba nie zainstalował mi się do końca. Teraz chcę go usunąc, ale nie widać go w "dodaj/usuń programy", ani żadnym narzędziem do usuwania programów.
Logi:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:55:43, on 2008-01-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CCPkiWNT.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\AddOn\Fujitsu\PSUtility\TrayManager.exe C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Vision\vservice.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=25040 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.krosno.lasy.gov.pl/proxy.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe O4 - HKLM\..\Run: [IndicatorUtility] C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [gemstrmw] C:\WINDOWS\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Oprogramowanie Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7FF324B1-0CAD-40A2-8E3B-71376EF4D42E}: NameServer = 10.4.253.10,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{C4E239D8-3F17-4DF8-AAF0-36A2B639429C}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: CryptoCard Service (CCPkiWNT) - CryptoTech - C:\WINDOWS\system32\CCPkiWNT.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: OracleOUIHomeClientCache - Unknown owner - C:\OraHB\BIN\ONRSD.EXE O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Antywirusy\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Antywirusy\Spyware Doctor\swdsvc.exe O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- End of file - 9160 bytes

Kod: Zaznacz wszystko: ComboFix 08-01-23.1C - admin 2008-01-25 12:31:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.97 [GMT 1:00] Running from: E:\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\vision C:\Program Files\vision\admupdat.exe C:\Program Files\vision\dsexp.exe C:\Program Files\vision\Examples\bd\Bd2cust.dfm C:\Program Files\vision\Examples\bd\Bd2cust.pas C:\Program Files\vision\Examples\bd\Bd2demo.dpr C:\Program Files\vision\Examples\bd\Bd2demo.exe C:\Program Files\vision\Examples\bd\Bd2demo.res C:\Program Files\vision\Examples\bd\Bd2std.dfm C:\Program Files\vision\Examples\bd\Bd2std.pas C:\Program Files\vision\Examples\dropsco.sql C:\Program Files\vision\Examples\Excel\Profit.xls C:\Program Files\vision\Examples\Pb\pb5demo.exe C:\Program Files\vision\Examples\Pb\pb5demo.ico C:\Program Files\vision\Examples\Pb\pb5demo.pbl C:\Program Files\vision\Examples\sales.sql C:\Program Files\vision\Examples\scodemo.sql C:\Program Files\vision\Examples\Vb\Datacon.frm C:\Program Files\vision\Examples\Vb\Datacon.vbp C:\Program Files\vision\Examples\Vb\Grid32.ocx C:\Program Files\vision\Examples\Vb\Threed32.ocx C:\Program Files\vision\Examples\Vb\Vb4demo.exe C:\Program Files\vision\Examples\Vb\Vb4demo.frm C:\Program Files\vision\Examples\Vb\Vb4demo.vbp C:\Program Files\vision\gold32.exe C:\Program Files\vision\hostexp.exe C:\Program Files\vision\HostWiz.exe C:\Program Files\vision\MSGPAD.exe C:\Program Files\vision\ProxyWiz.exe C:\Program Files\vision\rps.exe C:\Program Files\vision\system\Admin.reg C:\Program Files\vision\system\appwiz.reg C:\Program Files\vision\system\Conmon.reg C:\Program Files\vision\system\Dao\dao2532.tlb C:\Program Files\vision\system\Dao\Dao3032.dll C:\Program Files\vision\system\English\Ats.cnt C:\Program Files\vision\system\English\Ats.hlp C:\Program Files\vision\system\English\Cnaccess.hlp C:\Program Files\vision\system\English\Cnodbc.hlp C:\Program Files\vision\system\English\Cnsq.hlp C:\Program Files\vision\system\English\Cnvca.hlp C:\Program Files\vision\system\English\Cnvisn.cnt C:\Program Files\vision\system\English\Cnvisn.hlp C:\Program Files\vision\system\English\Common.hlp C:\Program Files\vision\system\English\Conmon.cnt C:\Program Files\vision\system\English\Conmon.hlp C:\Program Files\vision\system\English\Hostexp.cnt C:\Program Files\vision\system\English\Hostexp.hlp C:\Program Files\vision\system\English\Licts.cnt C:\Program Files\vision\system\English\Licts.hlp C:\Program Files\vision\system\English\Msgpad.cnt C:\Program Files\vision\system\English\Msgpad.hlp C:\Program Files\vision\system\English\Netcheck.cnt C:\Program Files\vision\system\English\Netcheck.hlp C:\Program Files\vision\system\English\ODBCINST.CNT C:\Program Files\vision\system\English\ODBCINST.HLP C:\Program Files\vision\system\English\Ots.cnt C:\Program Files\vision\system\English\Ots.hlp C:\Program Files\vision\system\English\Rps.cnt C:\Program Files\vision\system\English\Rps.hlp C:\Program Files\vision\system\English\Sqlgold.cnt C:\Program Files\vision\system\English\Sqlgold.hlp C:\Program Files\vision\system\English\Userview.cnt C:\Program Files\vision\system\English\Userview.hlp C:\Program Files\vision\system\English\Vcats.cnt C:\Program Files\vision\system\English\Vcats.hlp C:\Program Files\vision\system\English\Vcnacces.cnt C:\Program Files\vision\system\English\Vcnodbc.cnt C:\Program Files\vision\system\English\Vcnusacc.cnt C:\Program Files\vision\system\English\Vcnusodb.cnt C:\Program Files\vision\system\English\Vcnusvca.cnt C:\Program Files\vision\system\English\Vcnvisn.cnt C:\Program Files\vision\system\English\Vconmon.cnt C:\Program Files\vision\system\English\Vhostexp.cnt C:\Program Files\vision\system\English\Vision.cnt C:\Program Files\vision\system\English\Vision.hlp C:\Program Files\vision\system\English\Visionts.cnt C:\Program Files\vision\system\English\Visionts.hlp C:\Program Files\vision\system\English\Vmsgpad.cnt C:\Program Files\vision\system\English\Vnetchec.cnt C:\Program Files\vision\system\English\Vrps.cnt C:\Program Files\vision\system\English\Vsqlgold.cnt C:\Program Files\vision\system\English\Vuserviw.cnt C:\Program Files\vision\system\English\Vwc32.cnt C:\Program Files\vision\system\English\Vwc32.hlp C:\Program Files\vision\system\English\Vwodbc.cnt C:\Program Files\vision\system\English\Vwodbc.hlp C:\Program Files\vision\system\General.reg C:\Program Files\vision\system\HOSTFCTL.dll C:\Program Files\vision\system\Hostview.reg C:\Program Files\vision\system\Infosrv.reg C:\Program Files\vision\system\Launch.reg C:\Program Files\vision\system\MSGPAD.REG C:\Program Files\vision\system\Netcheck.reg C:\Program Files\vision\system\PRTCTL.dll C:\Program Files\vision\system\restrict.reg C:\Program Files\vision\system\rifx.exe C:\Program Files\vision\system\rifxx.dll C:\Program Files\vision\system\Rifxx.reg C:\Program Files\vision\system\rps.reg C:\Program Files\vision\system\Rpsx.dll C:\Program Files\vision\system\Sqlr\dialogs.dll C:\Program Files\vision\system\Sqlr\mkscript.exe C:\Program Files\vision\system\Sqlr\Reboot.exe C:\Program Files\vision\system\Sqlr\script.ini C:\Program Files\vision\system\Sqlr\Upgrade.exe C:\Program Files\vision\system\Sqlrrel.reg C:\Program Files\vision\system\Sqlsetup.reg C:\Program Files\vision\system\Sqrelnot.txt C:\Program Files\vision\system\UPDTCTL.dll C:\Program Files\vision\system\USERVIEW.REG C:\Program Files\vision\system\vwarps.dll C:\Program Files\vision\system\VWARPS.REG C:\Program Files\vision\system\Vwc32.reg C:\Program Files\vision\system\Vwcntrl.reg C:\Program Files\vision\system\vwodbc.reg C:\Program Files\vision\system\vwxlt.reg C:\Program Files\vision\system\Workbsrv.reg C:\Program Files\vision\unixwizd.exe C:\Program Files\vision\User\Browser\Classes\Rprogram\Class C:\Program Files\vision\User\Browser\Classes\Rprogram\Open.rps C:\Program Files\vision\User\Config\Base.vcc C:\Program Files\vision\User\Config\Generic.vcc C:\Program Files\vision\User\Config\Hostfind.vcf C:\Program Files\vision\User\Config\Ipx.vcc C:\Program Files\vision\User\Config\Launch.vcf C:\Program Files\vision\User\Config\Modem.vct C:\Program Files\vision\User\Config\Ser-com1.vct C:\Program Files\vision\User\Config\Serial.vcc C:\Program Files\vision\User\Config\SPX-Unix.vct C:\Program Files\vision\User\Config\Tcp-unix.vct C:\Program Files\vision\User\Config\Tcp.vcc C:\Program Files\vision\User\Config\Update.vcf C:\Program Files\vision\User\Config\Usp-tcp.vct C:\Program Files\vision\userview.exe C:\WINDOWS\system32\v97 . ((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 ))))))))))))))))))))))))))))))) . 2008-01-25 12:29 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-25 12:15 . 2008-01-25 12:16 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-25 08:12 . 2008-01-25 08:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-25 08:12 . 2008-01-25 08:35 250 --a------ C:\WINDOWS\mgutil_reg.ini 2008-01-25 08:11 . 2008-01-25 08:36 <DIR> d-------- C:\Program Files\Mgutil 2008-01-25 08:11 . 2008-01-25 08:35 72 --a------ C:\WINDOWS\mgutil_win.ini 2008-01-25 07:57 . 2008-01-25 07:59 <DIR> d-------- C:\Program Files\Absolute Uninstaller 2008-01-23 07:57 . 2008-01-23 08:19 <DIR> d-------- C:\Program Files\RegCleaner 2008-01-22 15:05 . 2008-01-22 15:05 136,496 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-01-22 15:05 . 2007-09-07 22:37 87,424 --a------ C:\WINDOWS\system32\drivers\SysPlant.sys 2008-01-22 15:05 . 2008-01-22 15:05 60,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-01-22 15:05 . 2008-01-22 15:05 10,652 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-01-22 15:05 . 2008-01-22 15:05 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-01-22 15:04 . 2008-01-23 09:11 <DIR> d-------- C:\Program Files\Symantec 2008-01-20 18:57 . 2008-01-20 18:57 <DIR> d--hs---- C:\found.000 2008-01-16 10:45 . 2008-01-22 14:49 <DIR> d-------- C:\Program Files\Symantec AntiVirus . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-22 14:07 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-11 11:23 --------- d-----w C:\Program Files\English Translator 3 2007-12-20 06:59 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-13 06:54 --------- d-----w C:\Program Files\Antywirusy 2007-11-26 08:45 --------- d-----w C:\Program Files\Kodak . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-04-25 09:59 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-05 08:03 761946] "PSUtility"="C:\AddOn\Fujitsu\PSUtility\TrayManager.exe" [2006-03-09 09:39 118784] "LoadFUJ02E3"="C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-01-27 20:17 73728] "IndicatorUtility"="C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-09-09 23:12 81920] "LoadFujitsuQuickTouch"="C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe" [2005-07-21 13:21 353792] "LoadBtnHnd"="C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe" [2005-07-21 13:20 61440] "AGRSMMSG"="AGRSMMSG.exe" [2006-03-17 12:22 89541 C:\WINDOWS\AGRSMMSG.exe] "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-18 12:57 188416] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 01:56 36975] "gemstrmw"="C:\WINDOWS\system32\gemstrmw.exe" [2003-08-29 22:35 24576] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-03 13:22 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-03 13:26 118784] "GCXX-Manager-Class"="C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2005-03-12 15:41 811113] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-06 13:58 155648] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "Cobian Backup 7"="C:\Program Files\Cobian Backup 7\CobBU.exe" [2005-10-18 14:10 127488] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-08-06 03:08 115560] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] Oprogramowanie Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 04:33:46 282624] Vision Services.lnk - C:\Program Files\Common Files\Vision\vservice.exe [2006-09-07 13:11:06 626688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PSUTY] PSUWNP.dll 2006-03-09 15:58 32768 C:\WINDOWS\system32\PSUWNP.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus] @="Service" R0 SysPlant;SysPlant for NT;C:\WINDOWS\system32\Drivers\SysPlant.sys [2007-09-07 22:37] R1 WPS;WPS;C:\WINDOWS\system32\drivers\wpsdrvnt.sys [2007-09-07 22:34] R3 CSRBC01;CSRBC01.Sys CSR test driver;C:\WINDOWS\system32\Drivers\CSRBC01.sys [2005-12-19 14:12] R3 FUJ02E1;%FUJ02E1.DeviceDesc%;C:\WINDOWS\system32\Drivers\FUJ02E1.sys [2004-10-18 22:08] R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 11:15] R3 Teefer2;Teefer2 Miniport;C:\WINDOWS\system32\DRIVERS\teefer2.sys [2007-08-06 16:29] R3 WpsHelper;WpsHelper;C:\WINDOWS\system32\drivers\WpsHelper.sys [2007-06-21 18:03] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2007-05-29 13:55] S3 SCR33x USB Smart Card Reader;SCR33x USB Smart Card Reader;C:\WINDOWS\system32\DRIVERS\SCR33X2K.sys [2005-08-25 15:00] S3 SEM43XX;Sony Ericsson 802.11 sterownik sieciowego adaptera SEM43XX;C:\WINDOWS\system32\DRIVERS\semwl5.sys [2005-01-03 05:05] S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys [2005-01-03 04:32] S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-01-03 04:32] S3 Sony_EricssonWWSC;Sony Ericsson SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GCXXSC.sys [2004-12-21 17:33] . Contents of the 'Scheduled Tasks' folder "2008-01-21 08:06:02 C:\WINDOWS\Tasks\EasyShare Registration Task.job" - C:\WINDOWS\system32\rundll32.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-25 12:41:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-25 12:51:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-25 11:51:23 . 2008-01-09 14:20:03 --- E O F ---

Kod: Zaznacz wszystko: SDFix: Version 1.131 Run by admin on 2008-01-25 at 12:16 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\explorer.exe No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-25 12:21:02 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "\\\\GRZESIEK\\!kontakt\\instalacje\\sco_win32\\WIN32\\SETUP32.EXE"="\\\\GRZESIEK\\!kontakt\\instalacje\\sco_win32\\WIN32\\SETUP32.EXE:*:Enabled:SETUP32.EXE" "C:\\WINDOWS\\system32\\odbcad32.exe"="C:\\WINDOWS\\system32\\odbcad32.exe:*:Enabled:Microsoft Data Access - \"ODBC Administrator" "C:\\Raporty SILP\\Raporty SILP v. 3.61\\raporty.exe"="C:\\Raporty SILP\\Raporty SILP v. 3.61\\raporty.exe:*:Enabled:Sybase, Inc. Product File" "C:\\Program Files\\JTSoft\\ATermPRO\\ATerm Secure\\ATermS.exe"="C:\\Program Files\\JTSoft\\ATermPRO\\ATerm Secure\\ATermS.exe:*:Enabled:Emulator terminala A-Term Secure" "C:\\Program Files\\Cobian Backup 7\\cobui.exe"="C:\\Program Files\\Cobian Backup 7\\cobui.exe:*:Enabled:Cobian Backup 7 Interface" "C:\\Program Files\\Cobian Backup 7\\CobBU.exe"="C:\\Program Files\\Cobian Backup 7\\CobBU.exe:*:Enabled:Cobian Backup 7 Application" "C:\\Program Files\\Common Files\\Vision\\vservice.exe"="C:\\Program Files\\Common Files\\Vision\\vservice.exe:*:Enabled:Vision Services" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "\\\\GK\\profinfo\\profinfo\\lplocal.exe"="\\\\GK\\profinfo\\profinfo\\lplocal.exe:*:Enabled:lplocal.exe" "C:\\Program Files\\profinfo\\LPLocal.exe"="C:\\Program Files\\profinfo\\LPLocal.exe:*:Enabled:LivePublish Personal Edition HTTP Server" "C:\\Documents and Settings\\All Users\\Dokumenty\\profinfo\\LPLocal.exe"="C:\\Documents and Settings\\All Users\\Dokumenty\\profinfo\\LPLocal.exe:*:Enabled:LivePublish Personal Edition HTTP Server" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Raporty SILP\\Raporty SILP v. 3.70\\raporty.exe"="C:\\Raporty SILP\\Raporty SILP v. 3.70\\raporty.exe:*:Enabled:Sybase, Inc. Product File" "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"="C:\\WINDOWS\\system32\\usmt\\migwiz.exe:*:Enabled:Kreator transferu plik˘w i ustawieä" "C:\\Raporty SILP\\Raporty SILP v. 3.80\\raporty.exe"="C:\\Raporty SILP\\Raporty SILP v. 3.80\\raporty.exe:*:Enabled:Sybase, Inc. Product File" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Documents and Settings\\kamzik\\Moje dokumenty\\Weryfikacja WF 2006\\modelowanie.exe"="C:\\Documents and Settings\\kamzik\\Moje dokumenty\\Weryfikacja WF 2006\\modelowanie.exe:*:Enabled:Sybase, Inc. Product File" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater" "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare" "C:\\Raporty SILP\\Raporty SILP v. 3.90\\raporty.exe"="C:\\Raporty SILP\\Raporty SILP v. 3.90\\raporty.exe:*:Enabled:Sybase, Inc. Product File" "C:\\Program Files\\Common Files\\Vision\\INFOSRV.exe"="C:\\Program Files\\Common Files\\Vision\\INFOSRV.exe:*:Enabled:Information server" "C:\\Program Files\\Common Files\\Vision\\workbsrv.exe"="C:\\Program Files\\Common Files\\Vision\\workbsrv.exe:*:Disabled:Admin Workbench Server" "C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"="C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe:*:Enabled:SMC Service" "C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"="C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE:*:Enabled:SNAC Service" "C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"="C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe:*:Enabled:Symantec Email" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- Files with Hidden Attributes: Thu 1 Sep 2005 80,384 ..SH. --- "C:\Program Files\Polskie Prawo\Mecenas\cc32.dll" Thu 28 Dec 2006 80,384 ..SH. --- "C:\Program Files\Polskie Prawo\Mecenas\ccmove32.dll" Wed 8 Aug 2007 407 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg" Wed 8 Aug 2007 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg" Tue 19 Sep 2006 201 ..SHR --- "C:\Program Files\Polskie Prawo\Mecenas\MEC2-1.164\CCONTROL.SYS" Finished!

**Posty:** 18165 · przez **wojtas** 25 Sty 2008, 17:07

Otworz notatnik i wklej w nim to:

Driver::
SNAC
Symantec AntiVirus
ccSetMgr
ccEvtMgr

Folder::
C:\Program Files\Symantec AntiVirus
C:\Program Files\Symantec
C:\Program Files\Common Files\Symantec Shared

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 3854 · przez **Dzi@dek** 25 Sty 2008, 17:40

Jeśli masz płytę instalacujną od symanteca - odpal ją - masz możliwośc deinstalacji programu.
Jeśli nie - Zajrzyj tutaj

**Posty:** 112 · przez **dziubek12** 25 Sty 2008, 20:26

Nawet mam oryginalna płytę instalacyjną, ale przy odpalaniu nawet nie zxapyta, czy modyfikować, instalować, czy usunąć - jak to zwykle bywa, jesli włoży się instaklę, a wcześniej jest program zainstalowany. W moim przypadku odpala sie instalator, potem powiada, że jest wcześniejsza instalacja i każe przerwac bieżącą.

**Posty:** 3854 · przez **Dzi@dek** 25 Sty 2008, 20:30

Dzi@dek napisał(a):Jeśli nie - Zajrzyj tutaj

Jeśli nie zastosowałeś tematu

wojtas napisał(a):Otworz notatnik i wklej w nim to:
Cytat:

Driver::
SNAC
Symantec AntiVirus
ccSetMgr
ccEvtMgr

Folder::
C:\Program Files\Symantec AntiVirus
C:\Program Files\Symantec
C:\Program Files\Common Files\Symantec Shared

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

Pobierz to narzędzie z listy i próbuj.

**Posty:** 112 · przez **dziubek12** 28 Sty 2008, 10:17

Po zabiegu z CFScript.txt

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:55, on 2008-01-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CCPkiWNT.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\AddOn\Fujitsu\PSUtility\TrayManager.exe C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Vision\vservice.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=25040 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.krosno.lasy.gov.pl/proxy.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe O4 - HKLM\..\Run: [IndicatorUtility] C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [gemstrmw] C:\WINDOWS\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Oprogramowanie Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7FF324B1-0CAD-40A2-8E3B-71376EF4D42E}: NameServer = 10.4.253.10,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{C4E239D8-3F17-4DF8-AAF0-36A2B639429C}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CryptoCard Service (CCPkiWNT) - CryptoTech - C:\WINDOWS\system32\CCPkiWNT.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: OracleOUIHomeClientCache - Unknown owner - C:\OraHB\BIN\ONRSD.EXE O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Antywirusy\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Antywirusy\Spyware Doctor\swdsvc.exe O23 - Service: Sony Ericsson Wireless LAN Tray Service (setrysvc) - Unknown owner - C:\WINDOWS\System32\setrysvc.exe O23 - Service: Symantec Management Client (SmcService) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (file missing) -- End of file - 8223 bytes

Kod: Zaznacz wszystko: ComboFix 08-01-23.1C - admin 2008-01-28 8:57:34.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.189 [GMT 1:00] Running from: E:\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT C:\Program Files\Symantec\Symantec Endpoint Protection\AVMan.log C:\Program Files\Symantec\Symantec Endpoint Protection\AVMan.plg C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\[u]0[/u]x0415.ini C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\Data1.cab C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\IPSDef.zip C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\LuCheck.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\LUSETUP.EXE C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\setAid.ini C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\Setup.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Cached Installs\{699C9CC5-A6F4-4830-8C89-0B379E75E62C}\Setup.ini C:\Program Files\Symantec\Symantec Endpoint Protection\Checksum.exe C:\Program Files\Symantec\Symantec Endpoint Protection\cltdef.dat C:\Program Files\Symantec\Symantec Endpoint Protection\DataMan.dll C:\Program Files\Symantec\Symantec Endpoint Protection\devman.plg C:\Program Files\Symantec\Symantec Endpoint Protection\GUProxy.log C:\Program Files\Symantec\Symantec Endpoint Protection\idstrafficpipe.dll C:\Program Files\Symantec\Symantec Endpoint Protection\LUMan.log C:\Program Files\Symantec\Symantec Endpoint Protection\metadata.dat C:\Program Files\Symantec\Symantec Endpoint Protection\metadata.dat.bak C:\Program Files\Symantec\Symantec Endpoint Protection\Netport.dll C:\Program Files\Symantec\Symantec Endpoint Protection\processlog.log C:\Program Files\Symantec\Symantec Endpoint Protection\protection.dat C:\Program Files\Symantec\Symantec Endpoint Protection\PSSensor.dll C:\Program Files\Symantec\Symantec Endpoint Protection\rawlog.log C:\Program Files\Symantec\Symantec Endpoint Protection\sdi.dat C:\Program Files\Symantec\Symantec Endpoint Protection\seclog.log C:\Program Files\Symantec\Symantec Endpoint Protection\serdef.dat C:\Program Files\Symantec\Symantec Endpoint Protection\sfman.plg C:\Program Files\Symantec\Symantec Endpoint Protection\sigs.dat C:\Program Files\Symantec\Symantec Endpoint Protection\sigs.dat.bak C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SpNet.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SSHelper.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SyLink.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SyLink.xml C:\Program Files\Symantec\Symantec Endpoint Protection\SyLog.dll C:\Program Files\Symantec\Symantec Endpoint Protection\syslog.log C:\Program Files\Symantec\Symantec Endpoint Protection\Teefer2.sys C:\Program Files\Symantec\Symantec Endpoint Protection\TFMAN.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\tralog.log C:\Program Files\Symantec\Symantec Endpoint Protection\trident.dll C:\Program Files\Symantec\Symantec Endpoint Protection\tse.dll C:\Program Files\Symantec\Symantec Endpoint Protection\TSysConf.xml C:\Program Files\Symantec\Symantec Endpoint Protection\wpshelper.sys.bak C:\Program Files\Symantec\Symantec Endpoint Protection\wpsman.dll C:\Program Files\Common Files\Symantec Shared . ---- Previous Run ------- . C:\Program Files\Common Files\Symantec Shared\ccALEng.dll C:\Program Files\Common Files\Symantec Shared\ccAlert.dll C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccDec.dll C:\Program Files\Common Files\Symantec Shared\ccEmlPxy.dll C:\Program Files\Common Files\Symantec Shared\ccErrDsp.dll C:\Program Files\Common Files\Symantec Shared\ccEvtCli.dll C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtPlg.dll C:\Program Files\Common Files\Symantec Shared\ccInst.dll C:\Program Files\Common Files\Symantec Shared\ccL60.dll C:\Program Files\Common Files\Symantec Shared\ccL608.dll C:\Program Files\Common Files\Symantec Shared\ccL60U.dll C:\Program Files\Common Files\Symantec Shared\ccL60U8.dll C:\Program Files\Common Files\Symantec Shared\ccLgView.exe C:\Program Files\Common Files\Symantec Shared\ccProd.dll C:\Program Files\Common Files\Symantec Shared\ccProSub.dll C:\Program Files\Common Files\Symantec Shared\ccScan.dll C:\Program Files\Common Files\Symantec Shared\ccScanW.dll C:\Program Files\Common Files\Symantec Shared\ccSet.dll C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccSetPlg.dll C:\Program Files\Common Files\Symantec Shared\ccSvc.dll C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll C:\Program Files\Common Files\Symantec Shared\ccWebWnd.dll C:\Program Files\Common Files\Symantec Shared\COH\AHS.dll C:\Program Files\Common Files\Symantec Shared\COH\COH32.exe C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg C:\Program Files\Common Files\Symantec Shared\COH\COHClean.dll C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg C:\Program Files\Common Files\Symantec Shared\COH\sesHlp.dll C:\Program Files\Common Files\Symantec Shared\COH\sh0000.dll C:\Program Files\Common Files\Symantec Shared\dec_abi.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2AMG.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ARJ.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2BZIP.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2CAB.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2GZIP.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ID.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LHA.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LZ.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RAR.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RTF.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2SS.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TAR.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Text.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TNEF.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Zip.dll C:\Program Files\Common Files\Symantec Shared\Decomposers\DecSDK.dll C:\Program Files\Common Files\Symantec Shared\Default.rul C:\Program Files\Common Files\Symantec Shared\DefUtDCD.dll C:\Program Files\Common Files\Symantec Shared\ecmldr32.DLL C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys C:\Program Files\Common Files\Symantec Shared\Global Exceptions\GEDataStore.dll C:\Program Files\Common Files\Symantec Shared\Help\CCLGVIEW.CHM C:\Program Files\Common Files\Symantec Shared\MSL\msl.dll C:\Program Files\Common Files\Symantec Shared\rcAlert.dll C:\Program Files\Common Files\Symantec Shared\rcApp.dll C:\Program Files\Common Files\Symantec Shared\rcEmlPxy.dll C:\Program Files\Common Files\Symantec Shared\rcErrDsp.dll C:\Program Files\Common Files\Symantec Shared\rcLgView.dll C:\Program Files\Common Files\Symantec Shared\rcSvcHst.dll C:\Program Files\Common Files\Symantec Shared\SAVSubmissionEngine\SUBCONN.dll C:\Program Files\Common Files\Symantec Shared\SAVSubmissionEngine\SUBENG.dll C:\Program Files\Common Files\Symantec Shared\SAVSubmissionEngine\SUBUPDT.exe C:\Program Files\Common Files\Symantec Shared\sevinst.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SNDSvc.dll C:\Program Files\Common Files\Symantec Shared\SNDunin.dll C:\Program Files\Common Files\Symantec Shared\SPBBC\2008-01-28-0641.kc C:\Program Files\Common Files\Symantec Shared\SPBBC\bbRGen.dll C:\Program Files\Common Files\Symantec Shared\SPBBC\init.kc C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCCli.dll C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.CAT C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.inf C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll C:\Program Files\Common Files\Symantec Shared\SPBBC\UpdMgr.exe C:\Program Files\Common Files\Symantec Shared\SPManifests\ccCmn62.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\ccCmn62.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\ccCmn62.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\ccOEH.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\ccOEH.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\ccOEH.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\COHCfg.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\COHCfg.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\COHCfg.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\dec_abi.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\dec_abi.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\dec_abi.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\eraser.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\eraser.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\eraser.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\MSLight.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\MSLight.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\MSLight.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\SAVSubInst.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\SAVSubInst.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\SAVSubInst.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\scs-sav.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\scs-sav.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\scs-sav.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\Snd.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\Snd.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\Snd.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\SPBBC.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\SPBBC.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\SPBBC.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\srt.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\srt.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\srt.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\SyKnAppS.grd C:\Program Files\Common Files\Symantec Shared\SPManifests\SyKnAppS.sig C:\Program Files\Common Files\Symantec Shared\SPManifests\SyKnAppS.spm C:\Program Files\Common Files\Symantec Shared\SPManifests\SYMEVNT.GRD C:\Program Files\Common Files\Symantec Shared\SPManifests\SYMEVNT.SIG C:\Program Files\Common Files\Symantec Shared\SPManifests\SYMEVNT.SPM C:\Program Files\Common Files\Symantec Shared\SRTSP\SavRT32.dll C:\Program Files\Common Files\Symantec Shared\SRTSP\Srtsp32.dll C:\Program Files\Common Files\Symantec Shared\SRTSP\srtUnin.dll C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\Catalog.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\Categories.xml C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\MetaData.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\sigs.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\v.grd C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\v.sig C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\virscan1.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20070620.002\WpsHelper.sys C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\Catalog.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\Categories.xml C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\MetaData.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\sigs.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\v.grd C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\v.sig C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\virscan1.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\20080116.002\WpsHelper.sys C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\BinHub\catalog.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\BinHub\Categories.xml C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\BinHub\metadata.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\BinHub\sigs.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\BinHub\virscan1.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\BinHub\WpsHelper.sys C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\definfo.dat C:\Program Files\Common Files\Symantec Shared\SymcData\cndcipsdefs\usage.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\CATALOG.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\CCERASER.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ECBOOTIL.VXD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ECMSVR32.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\EECTRL.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ERASER.GRD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ERASER.SIG C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ERASER.SPM C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ERASER.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ESRDEF.BIN C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\HH C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVENG.EXP C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVENG.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVENG.VXD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVENG32.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVEX15.EXP C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVEX15.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVEX15.VXD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NAVEX32A.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\NCSACERT.TXT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\SCRAUTH.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\SYMAVENG.CAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\SYMAVENG.INF C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\SYMERASE.CAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\SYMERASE.INF C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TCDEFS.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TCSCAN7.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TCSCAN8.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TCSCAN9.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TECHNOTE.TXT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TINF.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TINFIDX.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TINFL.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TSCAN1.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\TSCAN1HD.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\V.GRD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\V.SIG C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN.INF C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN1.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN2.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN3.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN4.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN5.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN6.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN7.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN8.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCAN9.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\VIRSCANT.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\WHATSNEW.TXT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070820.048\ZDONE.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\CATALOG.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\CCERASER.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ECBOOTIL.VXD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ECMSVR32.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\EECTRL.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ERASER.GRD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ERASER.SIG C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ERASER.SPM C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ERASER.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ESRDEF.BIN C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\HH C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVENG.EXP C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVENG.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVENG.VXD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVENG32.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVEX15.EXP C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVEX15.SYS C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVEX15.VXD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NAVEX32A.DLL C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\NCSACERT.TXT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\SCRAUTH.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\SYMAVENG.CAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\SYMAVENG.INF C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\SYMERASE.CAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\SYMERASE.INF C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TCDEFS.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TCSCAN7.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TCSCAN8.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TCSCAN9.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TECHNOTE.TXT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TINF.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TINFIDX.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TINFL.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TSCAN1.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\TSCAN1HD.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\V.GRD C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\V.SIG C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN.INF C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN1.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN2.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN3.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN4.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN5.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN6.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN7.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN8.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCAN9.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\VIRSCANT.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\vscanmsx.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\WHATSNEW.TXT C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080121.037\ZDONE.DAT C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\catalog.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\cceraser.dll C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\ecmsvr32.dll C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\eeCtrl.sys C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.grd C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.sig C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.spm C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\ERASER.sys C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\esrdef.bin C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\hh C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\naveng.sys C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\naveng32.dll C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\navex15.sys C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\navex32a.dll C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\ncsacert.txt C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\scrauth.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\symaveng.cat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\symaveng.inf C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\SymErase.cat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\SymErase.inf C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tcdefs.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tcscan7.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tcscan8.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tcscan9.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\technote.txt C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tinf.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tinfidx.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tinfl.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tscan1.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\tscan1hd.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\v.grd C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\v.sig C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan.inf C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan1.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan2.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan3.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan4.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan5.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan6.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan7.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan8.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\virscan9.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\whatsnew.txt C:\Program Files\Common Files\Symantec Shared\VirusDefs\BinHub\zdone.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\definfo.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\TextHub\virscant.dat C:\Program Files\Common Files\Symantec Shared\VirusDefs\usage.dat C:\Program Files\Symantec AntiVirus C:\Program Files\Symantec\S32EVNT1.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\AvPluginImpl.dll C:\Program Files\Symantec\Symantec Endpoint Protection\Cliproxy.dll C:\Program Files\Symantec\Symantec Endpoint Protection\clninst.bat C:\Program Files\Symantec\Symantec Endpoint Protection\Cltdef.dat.bak C:\Program Files\Symantec\Symantec Endpoint Protection\ControlAP.exe C:\Program Files\Symantec\Symantec Endpoint Protection\COUNTRY.DAT C:\Program Files\Symantec\Symantec Endpoint Protection\Dec3.cfg C:\Program Files\Symantec\Symantec Endpoint Protection\Default.dat C:\Program Files\Symantec\Symantec Endpoint Protection\Default.dat.bak C:\Program Files\Symantec\Symantec Endpoint Protection\Default.hst C:\Program Files\Symantec\Symantec Endpoint Protection\DefUDply.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\DefUtDCD.dll C:\Program Files\Symantec\Symantec Endpoint Protection\DefUtDCS.dll C:\Program Files\Symantec\Symantec Endpoint Protection\DoScan.exe C:\Program Files\Symantec\Symantec Endpoint Protection\dot1xtray.exe C:\Program Files\Symantec\Symantec Endpoint Protection\DWHWizrd.exe C:\Program Files\Symantec\Symantec Endpoint Protection\dwLdPntScan.dll C:\Program Files\Symantec\Symantec Endpoint Protection\gdiplus.dll C:\Program Files\Symantec\Symantec Endpoint Protection\GUProxy.plg C:\Program Files\Symantec\Symantec Endpoint Protection\HPPProtectionProviderUI.dll C:\Program Files\Symantec\Symantec Endpoint Protection\I2ldvp3.dll C:\Program Files\Symantec\Symantec Endpoint Protection\IMail.dll C:\Program Files\Symantec\Symantec Endpoint Protection\IMailUI.ocx C:\Program Files\Symantec\Symantec Endpoint Protection\LDDateTm.ocx C:\Program Files\Symantec\Symantec Endpoint Protection\LDVPCtls.ocx C:\Program Files\Symantec\Symantec Endpoint Protection\LDVPDlgs.ocx C:\Program Files\Symantec\Symantec Endpoint Protection\ldvpui.ocx C:\Program Files\Symantec\Symantec Endpoint Protection\License.rtf C:\Program Files\Symantec\Symantec Endpoint Protection\LuAuth.dll C:\Program Files\Symantec\Symantec Endpoint Protection\LuaWrap.exe C:\Program Files\Symantec\Symantec Endpoint Protection\LuHstEdt.dll C:\Program Files\Symantec\Symantec Endpoint Protection\LuMan.plg C:\Program Files\Symantec\Symantec Endpoint Protection\moniker.dat C:\Program Files\Symantec\Symantec Endpoint Protection\NacManager.plg C:\Program Files\Symantec\Symantec Endpoint Protection\NAVAPI32.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\NAVNTUTL.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\nlnhook.exe C:\Program Files\Symantec\Symantec Endpoint Protection\nnewdefs.dll C:\Program Files\Symantec\Symantec Endpoint Protection\OEHeur.dll C:\Program Files\Symantec\Symantec Endpoint Protection\patch25d.dll C:\Program Files\Symantec\Symantec Endpoint Protection\PATCH32I.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\PatchWrap.exe C:\Program Files\Symantec\Symantec Endpoint Protection\PatchWrapPS.dll C:\Program Files\Symantec\Symantec Endpoint Protection\PLATFORM.DAT C:\Program Files\Symantec\Symantec Endpoint Protection\ProtectionProviderPS.dll C:\Program Files\Symantec\Symantec Endpoint Protection\ProtectionUtil.dll C:\Program Files\Symantec\Symantec Endpoint Protection\qscomm32.dll C:\Program Files\Symantec\Symantec Endpoint Protection\QsInfo.dll C:\Program Files\Symantec\Symantec Endpoint Protection\qspak32.dll C:\Program Files\Symantec\Symantec Endpoint Protection\RasSymEap.dll C:\Program Files\Symantec\Symantec Endpoint Protection\Readme.txt C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\LDDateTmRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\LDVPCtlsRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\LDVPDlgsRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\LDVPUIRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\LotNtsUIRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\LUManRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\NetportRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\notesextRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\ProtectionUtilRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\PScanRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SavMainUIRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SAVSubmitterRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\ScanDlgsRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\sfmanRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SgHIRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\smcGuiRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SmcRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SpNetRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SSHelperRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SUBRES.loc C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SyLinkRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SymCorpUIRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SymProtectStorageRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\SymProtectUIRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\tseRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\vpmseceRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\VpshellRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\WebShellRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\res\1045\WSCSavNotifierRes.dll C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe C:\Program Files\Symantec\Symantec Endpoint Protection\RTVScanPS.dll C:\Program Files\Symantec\Symantec Endpoint Protection\RtvStart.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SAVCProd.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SavEmail.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SavMainUI.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SAVSesHlp.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SAVSubmitter.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SavUI.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SCANCFG.DAT C:\Program Files\Symantec\Symantec Endpoint Protection\scandlgs.dll C:\Program Files\Symantec\Symantec Endpoint Protection\ScsComms_VC8.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SDPCK32I.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SDSNAPSX.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SepLuCallback.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SerState.dat C:\Program Files\Symantec\Symantec Endpoint Protection\SerState.dat.bak C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SescLUPS.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SgHI.dll C:\Program Files\Symantec\Symantec Endpoint Protection\smcinst.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE C:\Program Files\Symantec\Symantec Endpoint Protection\SnacNp.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SSSensor.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SyLink.bak C:\Program Files\Symantec\Symantec Endpoint Protection\SymCorpUI.exe C:\Program Files\Symantec\Symantec Endpoint Protection\SymProtectStorage.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SymProtectUI.ocx C:\Program Files\Symantec\Symantec Endpoint Protection\SymRasMan.dll C:\Program Files\Symantec\Symantec Endpoint Protection\SysPlant.Inf C:\Program Files\Symantec\Symantec Endpoint Protection\SysPlant.sys C:\Program Files\Symantec\Symantec Endpoint Protection\SystemSnapshotRules.bin C:\Program Files\Symantec\Symantec Endpoint Protection\Teefer2.cat C:\Program Files\Symantec\Symantec Endpoint Protection\Teefer2.inf C:\Program Files\Symantec\Symantec Endpoint Protection\Teefer2_m.inf C:\Program Files\Symantec\Symantec Endpoint Protection\Teefer2m.cat C:\Program Files\Symantec\Symantec Endpoint Protection\TSysConf.xml.bak C:\Program Files\Symantec\Symantec Endpoint Protection\vpshell2.dll C:\Program Files\Symantec\Symantec Endpoint Protection\webshell.dll C:\Program Files\Symantec\Symantec Endpoint Protection\WGX.SYS C:\Program Files\Symantec\Symantec Endpoint Protection\WGXMAN.DLL C:\Program Files\Symantec\Symantec Endpoint Protection\WSCSAvNotifier.exe C:\Program Files\Symantec\SYMEVENT.CAT C:\Program Files\Symantec\SYMEVENT.INF C:\Program Files\Symantec\SYMEVENT.SYS . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CCEVTMGR -------\LEGACY_CCSETMGR -------\LEGACY_SYMANTEC_ANTIVIRUS -------\ccEvtMgr -------\ccSetMgr -------\SNAC -------\Symantec AntiVirus ((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 ))))))))))))))))))))))))))))))) . 2008-01-25 12:29 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-25 12:15 . 2008-01-25 12:16 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-25 08:12 . 2008-01-25 08:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-25 08:12 . 2008-01-25 08:35 250 --a------ C:\WINDOWS\mgutil_reg.ini 2008-01-25 08:11 . 2008-01-25 08:36 <DIR> d-------- C:\Program Files\Mgutil 2008-01-25 08:11 . 2008-01-25 08:35 72 --a------ C:\WINDOWS\mgutil_win.ini 2008-01-25 07:57 . 2008-01-25 07:59 <DIR> d-------- C:\Program Files\Absolute Uninstaller 2008-01-23 07:57 . 2008-01-23 08:19 <DIR> d-------- C:\Program Files\RegCleaner 2008-01-22 15:05 . 2008-01-22 15:05 136,496 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-01-22 15:05 . 2007-09-07 22:37 87,424 --a------ C:\WINDOWS\system32\drivers\SysPlant.sys 2008-01-22 15:05 . 2008-01-22 15:05 60,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-01-22 15:05 . 2008-01-22 15:05 10,652 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-01-22 15:05 . 2008-01-22 15:05 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-01-20 18:57 . 2008-01-20 18:57 <DIR> d--hs---- C:\found.000 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 11:23 --------- d-----w C:\Program Files\English Translator 3 2007-12-20 06:59 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-13 06:54 --------- d-----w C:\Program Files\Antywirusy 2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll 2007-10-30 23:26 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll . ((((((((((((((((((((((((((((( snapshot@2008-01-25_12.49.58.06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-25 11:30:00 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-28 07:33:30 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-01-25 11:30:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-28 07:33:31 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat - 2008-01-25 11:30:00 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-28 07:33:31 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT - 2008-01-25 11:30:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-28 07:33:31 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat - 2008-01-25 11:30:00 2,138,112 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-28 07:33:31 2,138,112 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT - 2008-01-25 11:30:00 102,400 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2008-01-28 07:33:31 102,400 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-04-25 09:59 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-05 08:03 761946] "PSUtility"="C:\AddOn\Fujitsu\PSUtility\TrayManager.exe" [2006-03-09 09:39 118784] "LoadFUJ02E3"="C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-01-27 20:17 73728] "IndicatorUtility"="C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-09-09 23:12 81920] "LoadFujitsuQuickTouch"="C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe" [2005-07-21 13:21 353792] "LoadBtnHnd"="C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe" [2005-07-21 13:20 61440] "AGRSMMSG"="AGRSMMSG.exe" [2006-03-17 12:22 89541 C:\WINDOWS\AGRSMMSG.exe] "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-18 12:57 188416] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 01:56 36975] "gemstrmw"="C:\WINDOWS\system32\gemstrmw.exe" [2003-08-29 22:35 24576] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-03 13:22 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-03 13:26 118784] "GCXX-Manager-Class"="C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2005-03-12 15:41 811113] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-06 13:58 155648] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "Cobian Backup 7"="C:\Program Files\Cobian Backup 7\CobBU.exe" [2005-10-18 14:10 127488] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] Oprogramowanie Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 04:33:46 282624] Vision Services.lnk - C:\Program Files\Common Files\Vision\vservice.exe [2006-09-07 13:11:06 626688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PSUTY] PSUWNP.dll 2006-03-09 15:58 32768 C:\WINDOWS\system32\PSUWNP.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus] @="Service" R0 SysPlant;SysPlant for NT;C:\WINDOWS\system32\Drivers\SysPlant.sys [2007-09-07 22:37] R1 WPS;WPS;C:\WINDOWS\system32\drivers\wpsdrvnt.sys [2007-09-07 22:34] R2 CCPkiWNT;CryptoCard Service;C:\WINDOWS\system32\CCPkiWNT.exe [2003-12-16 11:21] R2 setrysvc;Sony Ericsson Wireless LAN Tray Service;C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe [] R3 FUJ02E1;%FUJ02E1.DeviceDesc%;C:\WINDOWS\system32\Drivers\FUJ02E1.sys [2004-10-18 22:08] R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 11:15] R3 Teefer2;Teefer2 Miniport;C:\WINDOWS\system32\DRIVERS\teefer2.sys [2007-08-06 16:29] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2007-05-29 13:55] S3 CSRBC01;CSRBC01.Sys CSR test driver;C:\WINDOWS\system32\Drivers\CSRBC01.sys [2005-12-19 14:12] S3 OracleOUIHomeClientCache;OracleOUIHomeClientCache;C:\OraHB\BIN\ONRSD.EXE [2000-10-19 10:55] S3 SCR33x USB Smart Card Reader;SCR33x USB Smart Card Reader;C:\WINDOWS\system32\DRIVERS\SCR33X2K.sys [2005-08-25 15:00] S3 SEM43XX;Sony Ericsson 802.11 sterownik sieciowego adaptera SEM43XX;C:\WINDOWS\system32\DRIVERS\semwl5.sys [2005-01-03 05:05] S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys [2005-01-03 04:32] S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-01-03 04:32] S3 Sony_EricssonWWSC;Sony Ericsson SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GCXXSC.sys [2004-12-21 17:33] S3 WpsHelper;WpsHelper;C:\WINDOWS\system32\drivers\WpsHelper.sys [2007-06-21 18:03] . Contents of the 'Scheduled Tasks' folder "2008-01-21 08:06:02 C:\WINDOWS\Tasks\EasyShare Registration Task.job" - C:\WINDOWS\system32\rundll32.exelC:\DOCUME~1\ALLUSE~1\DANEAP~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.5.30.2.sxt _RegistrationOffer@16 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-28 09:05:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-28 9:09:51 - machine was rebooted [admin] ComboFix-quarantined-files.txt 2008-01-28 08:09:48 ComboFix2.txt 2008-01-25 11:51:42 . 2008-01-09 14:20:03 --- E O F ---

W sumie po wszystkim pozostał folder w Program Files symanteca, ale dał sie usunąć bez problemu.

**Posty:** 3854 · przez **Dzi@dek** 28 Sty 2008, 11:26

Otwórz notatnik i wklej:

File::
C:\WINDOWS\system32\S32EVNT1.DLL
C:\WINDOWS\system32\drivers\SYMEVENT.CAT
C:\WINDOWS\system32\drivers\SYMEVENT.INF
C:\found.000

Folder::
C:\Program Files\Common Files\Symantec Shared

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]
@=-

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix

**Posty:** 112 · przez **dziubek12** 28 Sty 2008, 11:45

Skan z Combofix - przy czym -robi, restartuje, ale nie pyta o wybór 1 or 2.

Kod: Zaznacz wszystko: ComboFix 08-01-23.1C - admin 2008-01-28 10:35:01.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.176 [GMT 1:00] Running from: C:\Install\ComboFix.exe Command switches used :: C:\Install\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE C:\found.000 C:\WINDOWS\system32\drivers\SYMEVENT.CAT C:\WINDOWS\system32\drivers\SYMEVENT.INF C:\WINDOWS\system32\S32EVNT1.DLL . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\SYMEVENT.CAT C:\WINDOWS\system32\drivers\SYMEVENT.INF C:\WINDOWS\system32\S32EVNT1.DLL . ((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 ))))))))))))))))))))))))))))))) . 2008-01-25 12:29 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-25 12:15 . 2008-01-25 12:16 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-25 08:12 . 2008-01-25 08:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-25 08:12 . 2008-01-25 08:35 250 --a------ C:\WINDOWS\mgutil_reg.ini 2008-01-25 08:11 . 2008-01-25 08:36 <DIR> d-------- C:\Program Files\Mgutil 2008-01-25 08:11 . 2008-01-25 08:35 72 --a------ C:\WINDOWS\mgutil_win.ini 2008-01-25 07:57 . 2008-01-25 07:59 <DIR> d-------- C:\Program Files\Absolute Uninstaller 2008-01-23 07:57 . 2008-01-23 08:19 <DIR> d-------- C:\Program Files\RegCleaner 2008-01-22 15:05 . 2008-01-22 15:05 136,496 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-01-22 15:05 . 2007-09-07 22:37 87,424 --a------ C:\WINDOWS\system32\drivers\SysPlant.sys 2008-01-20 18:57 . 2008-01-20 18:57 <DIR> d--hs---- C:\found.000 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 11:23 --------- d-----w C:\Program Files\English Translator 3 2007-12-20 06:59 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-13 06:54 --------- d-----w C:\Program Files\Antywirusy 2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll 2007-10-30 23:26 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll . ((((((((((((((((((((((((((((( snapshot@2008-01-25_12.49.58.06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-25 11:30:00 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-28 09:34:31 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-01-25 11:30:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-28 09:34:31 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat - 2008-01-25 11:30:00 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-28 09:34:31 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT - 2008-01-25 11:30:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-28 09:34:31 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat - 2008-01-25 11:30:00 2,138,112 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-28 09:34:31 2,138,112 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT - 2008-01-25 11:30:00 102,400 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2008-01-28 09:34:31 102,400 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-04-25 09:59 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-05 08:03 761946] "PSUtility"="C:\AddOn\Fujitsu\PSUtility\TrayManager.exe" [2006-03-09 09:39 118784] "LoadFUJ02E3"="C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-01-27 20:17 73728] "IndicatorUtility"="C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-09-09 23:12 81920] "LoadFujitsuQuickTouch"="C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe" [2005-07-21 13:21 353792] "LoadBtnHnd"="C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe" [2005-07-21 13:20 61440] "AGRSMMSG"="AGRSMMSG.exe" [2006-03-17 12:22 89541 C:\WINDOWS\AGRSMMSG.exe] "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-18 12:57 188416] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 01:56 36975] "gemstrmw"="C:\WINDOWS\system32\gemstrmw.exe" [2003-08-29 22:35 24576] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-03 13:22 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-03 13:26 118784] "GCXX-Manager-Class"="C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2005-03-12 15:41 811113] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-06 13:58 155648] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "Cobian Backup 7"="C:\Program Files\Cobian Backup 7\CobBU.exe" [2005-10-18 14:10 127488] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] Oprogramowanie Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 04:33:46 282624] Vision Services.lnk - C:\Program Files\Common Files\Vision\vservice.exe [2006-09-07 13:11:06 626688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PSUTY] PSUWNP.dll 2006-03-09 15:58 32768 C:\WINDOWS\system32\PSUWNP.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus] @="" R0 SysPlant;SysPlant for NT;C:\WINDOWS\system32\Drivers\SysPlant.sys [2007-09-07 22:37] R1 WPS;WPS;C:\WINDOWS\system32\drivers\wpsdrvnt.sys [2007-09-07 22:34] R2 CCPkiWNT;CryptoCard Service;C:\WINDOWS\system32\CCPkiWNT.exe [2003-12-16 11:21] R2 setrysvc;Sony Ericsson Wireless LAN Tray Service;C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe [] R3 FUJ02E1;%FUJ02E1.DeviceDesc%;C:\WINDOWS\system32\Drivers\FUJ02E1.sys [2004-10-18 22:08] R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 11:15] R3 Teefer2;Teefer2 Miniport;C:\WINDOWS\system32\DRIVERS\teefer2.sys [2007-08-06 16:29] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2007-05-29 13:55] S3 CSRBC01;CSRBC01.Sys CSR test driver;C:\WINDOWS\system32\Drivers\CSRBC01.sys [2005-12-19 14:12] S3 OracleOUIHomeClientCache;OracleOUIHomeClientCache;C:\OraHB\BIN\ONRSD.EXE [2000-10-19 10:55] S3 SCR33x USB Smart Card Reader;SCR33x USB Smart Card Reader;C:\WINDOWS\system32\DRIVERS\SCR33X2K.sys [2005-08-25 15:00] S3 SEM43XX;Sony Ericsson 802.11 sterownik sieciowego adaptera SEM43XX;C:\WINDOWS\system32\DRIVERS\semwl5.sys [2005-01-03 05:05] S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys [2005-01-03 04:32] S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-01-03 04:32] S3 Sony_EricssonWWSC;Sony Ericsson SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GCXXSC.sys [2004-12-21 17:33] S3 WpsHelper;WpsHelper;C:\WINDOWS\system32\drivers\WpsHelper.sys [2007-06-21 18:03] . Contents of the 'Scheduled Tasks' folder "2008-01-21 08:06:02 C:\WINDOWS\Tasks\EasyShare Registration Task.job" - C:\WINDOWS\system32\rundll32.exelC:\DOCUME~1\ALLUSE~1\DANEAP~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.5.30.2.sxt _RegistrationOffer@16 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-28 10:39:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-28 10:40:57 ComboFix-quarantined-files.txt 2008-01-28 09:40:51 ComboFix2.txt 2008-01-28 08:09:52 ComboFix3.txt 2008-01-25 11:51:42 . 2008-01-09 14:20:03 --- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 28 Sty 2008, 11:58

Ta sama czynność:

File::
C:\WINDOWS\system32\drivers\SYMEVENT.SYS

Folder::
C:\found.000

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]

**Posty:** 112 · przez **dziubek12** 28 Sty 2008, 12:19

Kod: Zaznacz wszystko: ComboFix 08-01-23.1C - admin 2008-01-28 11:05:14.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.167 [GMT 1:00] Running from: C:\Install\ComboFix.exe Command switches used :: C:\Install\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE C:\WINDOWS\system32\drivers\SYMEVENT.SYS . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\found.000 C:\found.000\file0000.chk C:\WINDOWS\system32\drivers\SYMEVENT.SYS . ((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 ))))))))))))))))))))))))))))))) . 2008-01-25 12:29 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-25 12:15 . 2008-01-25 12:16 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-25 08:12 . 2008-01-25 08:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-25 08:12 . 2008-01-25 08:35 250 --a------ C:\WINDOWS\mgutil_reg.ini 2008-01-25 08:11 . 2008-01-25 08:36 <DIR> d-------- C:\Program Files\Mgutil 2008-01-25 08:11 . 2008-01-25 08:35 72 --a------ C:\WINDOWS\mgutil_win.ini 2008-01-25 07:57 . 2008-01-25 07:59 <DIR> d-------- C:\Program Files\Absolute Uninstaller 2008-01-23 07:57 . 2008-01-23 08:19 <DIR> d-------- C:\Program Files\RegCleaner 2008-01-22 15:05 . 2007-09-07 22:37 87,424 --a------ C:\WINDOWS\system32\drivers\SysPlant.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 11:23 --------- d-----w C:\Program Files\English Translator 3 2007-12-20 06:59 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-13 06:54 --------- d-----w C:\Program Files\Antywirusy 2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-11-07 09:29 723,968 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll 2007-10-30 23:26 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll . ((((((((((((((((((((((((((((( snapshot@2008-01-25_12.49.58.06 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-25 11:30:00 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-28 10:04:46 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-01-25 11:30:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-28 10:04:46 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat - 2008-01-25 11:30:00 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-28 10:04:46 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT - 2008-01-25 11:30:00 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-28 10:04:46 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat - 2008-01-25 11:30:00 2,138,112 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-28 10:04:47 2,138,112 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT - 2008-01-25 11:30:00 102,400 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2008-01-28 10:04:47 102,400 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-04-25 09:59 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-05 08:03 761946] "PSUtility"="C:\AddOn\Fujitsu\PSUtility\TrayManager.exe" [2006-03-09 09:39 118784] "LoadFUJ02E3"="C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-01-27 20:17 73728] "IndicatorUtility"="C:\AddOn\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-09-09 23:12 81920] "LoadFujitsuQuickTouch"="C:\AddOn\Fujitsu\Application Panel\QuickTouch.exe" [2005-07-21 13:21 353792] "LoadBtnHnd"="C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe" [2005-07-21 13:20 61440] "AGRSMMSG"="AGRSMMSG.exe" [2006-03-17 12:22 89541 C:\WINDOWS\AGRSMMSG.exe] "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-18 12:57 188416] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 01:56 36975] "gemstrmw"="C:\WINDOWS\system32\gemstrmw.exe" [2003-08-29 22:35 24576] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-03 13:22 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-03 13:26 118784] "GCXX-Manager-Class"="C:\Program Files\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2005-03-12 15:41 811113] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-06 13:58 155648] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "Cobian Backup 7"="C:\Program Files\Cobian Backup 7\CobBU.exe" [2005-10-18 14:10 127488] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] Oprogramowanie Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 04:33:46 282624] Vision Services.lnk - C:\Program Files\Common Files\Vision\vservice.exe [2006-09-07 13:11:06 626688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PSUTY] PSUWNP.dll 2006-03-09 15:58 32768 C:\WINDOWS\system32\PSUWNP.dll R0 SysPlant;SysPlant for NT;C:\WINDOWS\system32\Drivers\SysPlant.sys [2007-09-07 22:37] R1 WPS;WPS;C:\WINDOWS\system32\drivers\wpsdrvnt.sys [2007-09-07 22:34] R2 CCPkiWNT;CryptoCard Service;C:\WINDOWS\system32\CCPkiWNT.exe [2003-12-16 11:21] R2 setrysvc;Sony Ericsson Wireless LAN Tray Service;C:\WINDOWS\System32\setrysvc.exe C:\WINDOWS\System32\semwltry.exe [] R3 FUJ02E1;%FUJ02E1.DeviceDesc%;C:\WINDOWS\system32\Drivers\FUJ02E1.sys [2004-10-18 22:08] R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 11:15] R3 Teefer2;Teefer2 Miniport;C:\WINDOWS\system32\DRIVERS\teefer2.sys [2007-08-06 16:29] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2007-05-29 13:55] S3 CSRBC01;CSRBC01.Sys CSR test driver;C:\WINDOWS\system32\Drivers\CSRBC01.sys [2005-12-19 14:12] S3 OracleOUIHomeClientCache;OracleOUIHomeClientCache;C:\OraHB\BIN\ONRSD.EXE [2000-10-19 10:55] S3 SCR33x USB Smart Card Reader;SCR33x USB Smart Card Reader;C:\WINDOWS\system32\DRIVERS\SCR33X2K.sys [2005-08-25 15:00] S3 SEM43XX;Sony Ericsson 802.11 sterownik sieciowego adaptera SEM43XX;C:\WINDOWS\system32\DRIVERS\semwl5.sys [2005-01-03 05:05] S3 SEMWModem;Sony Ericsson SEMWModem;C:\WINDOWS\system32\DRIVERS\GCXX.sys [2005-01-03 04:32] S3 SEMWWNIC;Sony Ericsson SEMWWNIC;C:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-01-03 04:32] S3 Sony_EricssonWWSC;Sony Ericsson SIM Card Reader;C:\WINDOWS\system32\DRIVERS\GCXXSC.sys [2004-12-21 17:33] S3 WpsHelper;WpsHelper;C:\WINDOWS\system32\drivers\WpsHelper.sys [2007-06-21 18:03] . Contents of the 'Scheduled Tasks' folder "2008-01-21 08:06:02 C:\WINDOWS\Tasks\EasyShare Registration Task.job" - C:\WINDOWS\system32\rundll32.exelC:\DOCUME~1\ALLUSE~1\DANEAP~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.5.30.2.sxt _RegistrationOffer@16 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-28 11:09:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-28 11:10:28 ComboFix-quarantined-files.txt 2008-01-28 10:10:25 ComboFix2.txt 2008-01-28 09:40:59 ComboFix3.txt 2008-01-28 08:09:52 ComboFix4.txt 2008-01-25 11:51:42 . 2008-01-09 14:20:03 --- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 28 Sty 2008, 12:45

Czysto

Autor postu otrzymał pochwałę

**Posty:** 112 · przez **dziubek12** 28 Sty 2008, 13:48

..hm..Jeszcze coś siedzi chyba - próbowałem zainstalować niższą wersję, która nie robiła do tej pory żadnych kłopotów, ale zgłasza - po pierwsze - że instalacja z innego użytkownika (na kompie są 2 uzytkownicy z prawami administratora) jest w trakcie i trzeba coś z tym zrobić (chyba skonczyć). Po drugie - ta nizsza wersja zainstalowała się bez jakiegoś pliku i każe ze strony producenta ściągnąć SYMFix_1002-1.exe (ale oczywiście strona niedostępna....

**Posty:** 3854 · przez **Dzi@dek** 28 Sty 2008, 14:55

Wejdź na konto administratora-nie użytkownika z prawami.

**Posty:** 112 · przez **dziubek12** 28 Sty 2008, 15:07

Wszystko do tej pory robiłem jako admin

**Posty:** 3854 · przez **Dzi@dek** 28 Sty 2008, 15:24

dziubek12 napisał(a):SYMFix_1002-1.exe

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

To jest program do deinstalacji Nortona.

proszę sprawidzić loga - zamulony komputer

Proszę sprawidzić loga - zamulony komputer

Kto jest na forum