rookit po instalacji karty sieciowej?

**Posty:** 2008 · przez **fibi07** 11 Kwi 2008, 23:18

zainstalowałem kartę sieciową D-Linka i zaczęły się problemy. avast co restart wykrywa jakiegoś rookita. później skanuje około 30 minut przed restartem. i tak co restart. przy tym co restart Outlock wywala komunikat żeby był głównym komunikatem pocztowym, a jak się go zrobi to i tak wywala taki komunikat. odinstalowałem ją (poprzez menadżer urządzeń) i wezmę aby szukał sterowników poprzez stronę windowsa. bo się dziwię żeby w sterownikach z płyty D-Linka był tam wirus....

oto logi:

HJT

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:01:56, on 2008-04-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\logi\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wiadomosci.wp.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Pobierz z &BitSpirit - C:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe -- End of file - 4858 bytes

SR

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "internat.exe" = "internat.exe" [file not found] "Zasobnik systemowy" = "SysTray.Exe" [MS] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {E5A1691B-D188-4419-AD02-90002030B8EE}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashFXP Helper for Internet Explorer" \InProcServer32\(Default) = "C:\PROGRA~1\FlashFXP\IEFlash.dll" ["IniCom Networks, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0E5CBF21-D15F-11d0-8301-00AA005B4383}" = "&Łącza" -> {HKLM...CLSID} = "&Łącza" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{7487cd30-f71a-11d0-9ea7-00805f714772}" = "Obraz miniatury" -> {HKLM...CLSID} = "Obraz miniatury" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}" = "Pasek pulpitu menu" -> {HKLM...CLSID} = "Pasek pulpitu menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}" = "Lokacja menu" -> {HKLM...CLSID} = "Lokacja menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}" = "IPasek folderów powłoki" -> {HKLM...CLSID} = "IPasek folderów powłoki" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{5b4dae26-b807-11d0-9815-00c04fd91972}" = "Pasek menu" -> {HKLM...CLSID} = "Pasek menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{8278F931-2A3E-11d2-838F-00C04FD918D0}" = "Menu powłoki śledzenia" -> {HKLM...CLSID} = "Menu powłoki śledzenia" \InProcServer32\(Default) = "C:\WINDOWS\system32\SHELL32.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW" -> {HKLM...CLSID} = "Shell Extension for CDRW" \InProcServer32\(Default) = "C:\Program Files\Ahead\InCD\incdshx.dll" ["Nero AG"] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "SimpleShlExt extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\Spik\shellext_wpmsg.dll" [file not found] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" [file not found] "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" = "PowerISO" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WPKontakt\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\Spik\shellext_wpmsg.dll" [file not found] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Scheduled Tasks: ------------------------ "Uruchomienie aplikacji dostrajania" -> launches: "walign" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <<H>> "Tabs" = "res://ieframe.dll/tabswelcome.htm" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] InCD Helper, InCDsrv, "C:\Program Files\Ahead\InCD\InCDsrv.exe" ["Nero AG"] MSSQL$AUTODESKVAULT, MSSQL$AUTODESKVAULT, ""C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT" [MS] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] STI Simulator, STI Simulator, "C:\WINDOWS\System32\PAStiSvc.exe" [null data] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt09\Driver = "hpzsnt09.dll" ["HP"] ---------- (launch time: 2008-04-11 23:02:03) <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 120 seconds, including 3 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 12 Kwi 2008, 00:16

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 13:56

SFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.169 [/b] Run by Admin on 2008-04-12 at 13:12 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\smdat32a.sys - Deleted C:\WINDOWS\Temp\bca4e2da.$$$ - Deleted [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use [url=http://www.gmer.net/gmer.zip]Gmer[/url] or [url=http://www.freedrweb.com/cureit]Dr.Web CureIt[/url][/color] Could Not Remove C:\WINDOWS\Temp\fa56d7ec.$$$ Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 13:22:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:a5781990 "s2"=dword:b1f861b3 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:3d,cf,d8,2f,86,94,2c,87,fa,c3,fa,b9,78,67,dc,02,07,54,a0,41,83,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:3c,31,71,51,fa,f4,00,bc,c1,41,37,99,06,5f,30,e6,a5,aa,db,bb,16,.. "a0"=hex:20,01,00,00,e6,39,57,c2,6f,10,c7,72,52,ec,18,0b,76,2f,8a,07,88,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d5,75,6c,ad,5a,6d,9d,42,08,48,59,9d,79,85,f3,7d,25,73,cd,03,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:13,4d,63,a4,27,cd,59,26,df,57,a2,f3,28,12,1d,27,63,5f,1d,21,a1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:3d,cf,d8,2f,86,94,2c,87,fa,c3,fa,b9,78,67,dc,02,07,54,a0,41,83,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:3c,31,71,51,fa,f4,00,bc,c1,41,37,99,06,5f,30,e6,a5,aa,db,bb,16,.. "a0"=hex:20,01,00,00,e6,39,57,c2,6f,10,c7,72,52,ec,18,0b,76,2f,8a,07,88,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d5,75,6c,ad,5a,6d,9d,42,08,48,59,9d,79,85,f3,7d,25,73,cd,03,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:13,4d,63,a4,27,cd,59,26,df,57,a2,f3,28,12,1d,27,63,5f,1d,21,a1,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe"="C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\Konnekt\\konnekt.exe"="C:\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core" "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3" "C:\\Documents and Settings\\Admin\\Pulpit\\Age Of Empires 2 & The Conquerors Expansion - Full Game - [HUSSEY]\\age2_x1.exe"="C:\\Documents and Settings\\Admin\\Pulpit\\Age Of Empires 2 & The Conquerors Expansion - Full Game - [HUSSEY]\\age2_x1.exe:*:Enabled:Age of Empires II Expansion" "C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe"="C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe:*:Enabled:Age of Empires II Expansion" "C:\\Gadu-Gadu 6.1\\gg.exe"="C:\\Gadu-Gadu 6.1\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3" [b]Remaining Files [/b]: C:\WINDOWS\Temp\fa56d7ec.$$$ Found File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Fri 13 May 2005 217,073 A.SHR --- "C:\WINDOWS\meta4.exe" Mon 24 Oct 2005 66,560 A.SHR --- "C:\WINDOWS\MOTA113.exe" Thu 13 Oct 2005 422,400 A.SHR --- "C:\WINDOWS\x2.64.exe" Fri 7 Oct 2005 308,224 A.SHR --- "C:\WINDOWS\SYSTEM32\avisynth.dll" Thu 14 Jul 2005 27,648 A.SHR --- "C:\WINDOWS\SYSTEM32\AVSredirect.dll" Sun 26 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\SYSTEM32\cygwin1.dll" Tue 21 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\SYSTEM32\cygz.dll" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\SYSTEM32\i420vfw.dll" Thu 27 Apr 2006 2,945,024 A.SHR --- "C:\WINDOWS\SYSTEM32\Smab.dll" Mon 28 Feb 2005 240,128 A.SHR --- "C:\WINDOWS\SYSTEM32\x.264.exe" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\SYSTEM32\yv12vfw.dll" Thu 26 Jul 2007 921,600 A..H. --- "C:\WINDOWS\Temporary Internet Files\ijjistarter2FxB.exe" Thu 22 Dec 2005 4,348 ..SH. --- "C:\WINDOWS\All Users\DRM\DRMv1.bak" Sun 12 Feb 2006 400 ..SH. --- "C:\WINDOWS\All Users\DRM\v2ks.bla.bak" Sun 12 Feb 2006 48 ..SH. --- "C:\WINDOWS\All Users\DRM\v2ks.sec.bak" Sat 9 Jun 2007 888 A..HR --- "C:\Documents and Settings\Admin\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Tue 30 Mar 2004 80,384 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL0003.tmp" Thu 27 Jan 2005 28,672 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL0004.tmp" Tue 30 Mar 2004 82,432 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL3011.tmp" Tue 30 Mar 2004 48,640 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL3720.tmp" Sun 23 Apr 2006 20,480 A..H. --- "C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\!matura\~WRL0001.tmp" Sat 25 Mar 2006 26,112 A..H. --- "C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\!matura\~WRL0003.tmp" [b]Finished![/b]

Combofix

Kod: Zaznacz wszystko: ComboFix 08-04-11.8 - Admin 2008-04-12 13:42:49.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.28 [GMT 2:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 ))))))))))))))))))))))))))))))) . 2008-04-12 13:09 . 2008-04-12 13:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-12 13:09 . 2008-04-12 13:09 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-04-12 13:08 . 2008-04-12 13:38 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-04-12 13:04 . 2008-04-12 13:27 <DIR> d-------- C:\SDFix 2008-04-11 16:35 . 2005-08-10 12:43 41,984 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\dlkfet5b.sys 2008-04-06 17:17 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswSP.sys 2008-04-06 17:17 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswFsBlk.sys 2008-04-04 18:22 . 2008-04-11 16:57 <DIR> d-------- C:\Netgear 2008-04-02 17:09 . 2008-04-02 17:09 <DIR> d-------- C:\Free YouTube to Mp3 Converter 2008-04-02 17:09 . 2008-04-02 17:10 <DIR> d-------- C:\DVDVideoSoft 2008-04-02 16:56 . 2008-04-02 16:56 <DIR> d-------- C:\Temp 2008-04-02 16:55 . 2008-04-02 17:09 <DIR> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT 2008-03-29 22:29 . 2007-10-07 17:08 2,728 --a------ C:\WINDOWS\SYSTEM32\mini_spectrum2.swf 2008-03-29 22:26 . 2008-04-10 00:40 <DIR> d-------- C:\iriver plus 3 2008-03-22 17:44 . 2008-03-22 17:46 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\SecondLife . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 11:27 --------- d-----w C:\Program Files\AutoConnect 2008-04-11 19:37 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype 2008-04-09 15:40 --------- d-----w C:\Program Files\Winamp 2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2008-03-20 16:23 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2008-02-28 17:51 --------- d-----w C:\Program Files\MOBILedit! 2008-02-28 17:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-27 19:17 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\fretsonfire 2008-02-23 09:32 --------- d-----w C:\Program Files\GoldWave 2008-02-19 11:16 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Gadu-Gadu 2008-02-15 19:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2005-12-17 17:42 266 --sha-w C:\Program Files\desktop.ini 2005-12-17 17:42 11,232 ---ha-w C:\Program Files\folder.htt 2005-05-13 16:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 10:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 20:27 422,400 --sha-r C:\WINDOWS\x2.64.exe 2005-10-07 18:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll 2005-07-14 11:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll 2005-06-26 14:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll 2005-06-21 21:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll 2006-04-27 09:24 2,945,024 --sha-r C:\WINDOWS\SYSTEM32\Smab.dll 2005-02-28 12:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-12_13.37.33,09 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-12 11:20:49 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat + 2008-04-12 11:42:01 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay] @={7D688A77-C613-11D0-999B-00C04FD655E1} [HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}] 2006-03-17 07:08 8480768 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14 310784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" [] "Zasobnik systemowy"="SysTray.Exe" [2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-09 21:32 98304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programs^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programs\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] C:\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2003-12-22 09:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2003-08-04 18:28 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2005-06-10 16:20 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaFinderK] C:\Program Files\INSTAFINK\InstaFinderK_inst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-08-11 15:43 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2006-01-31 15:20 180224 C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-05-09 21:32 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-12-08 18:35 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-11-11 15:07 90112 C:\WINDOWS\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spik] C:\Program Files\Spik\Spik.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] --a------ 2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NvCpl.dll,NvStartup "nwiz"=nwiz.exe /install "WinampAgent"=C:\Program Files\Winamp\winampa.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "LoadQM"=loadqm.exe "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "SoundMan"=SOUNDMAN.EXE "autoclk"=autoclk.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.EXE "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Konnekt\\konnekt.exe"= "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= "C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe"= "C:\\Gadu-Gadu 6.1\\gg.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-09-09 14:17] R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS [2001-12-18 14:45] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT [] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2003-04-15 19:07] S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys [] S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINDOWS\TEMP\5.tmp [] S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 13:29] S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT [] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28239b20-457b-11db-89ed-4d6564696130}] \Shell\AutoRun\command - I:\EXPLORER.EXE \Shell\explore\Command - I:\EXPLORER.EXE \Shell\open\Command - I:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d73800-4739-11db-89f6-4d6564696130}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5dd3d9b0-812f-11da-86cb-fea6786649f8}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e2abb494-5a00-11dc-8e03-4d6564696130}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE . Contents of the 'Scheduled Tasks' folder "2008-04-02 21:00:00 C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 13:45:41 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}] "ImagePath"="\??\C:\WINDOWS\TEMP\5.tmp" . Completion time: 2008-04-12 13:47:20 ComboFix-quarantined-files.txt 2008-04-12 11:47:11 ComboFix2.txt 2008-04-12 11:37:57 ComboFix3.txt 2007-10-07 12:35:01 Pre-Run: 16,220,724,736 bajtów wolnych Post-Run: 16,211,177,984 bajtów wolnych

HJT

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:53, on 2008-04-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Admin\Pulpit\HiJackThis.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wiadomosci.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Pobierz z &BitSpirit - C:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\WINDOWS\PSEXESVC.EXE O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe -- End of file - 5351 bytes

a i jeszcze zauważyłem że nie działa internet przez IE. a info o rookicie nadal występuje. i nie wiem czy robić znowu (po raz 3) ten scan avastowy...

**Posty:** 7838 · przez **Lukesh** 12 Kwi 2008, 14:00

Osobiscie polecam wymiane Avasta na np Noda, a znikna Twoje problemy. Bo to taki dziwny zbieg okolicznosci, ze w dziale 'Bezpieczenstwo' ciagle pojawiaja sie tematy z logami komputerow, ktore chroni ten wlasnie 'anty'wirus

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 14:10

mhm. i myślisz że to rozwiąże ten problem? bo w przyszłości to wiem że tak

;p wymienić i zeskanować Nodem?
a wymienić tj. usunąć Avasta + wszystkie klucze w rejestrze itp i zainstalować noda?

**Posty:** 3854 · przez **Dzi@dek** 12 Kwi 2008, 14:29

usunąć Avasta + wszystkie klucze w rejestrze itp i zainstalować noda?

Tak jak piszesz.

**Posty:** 18165 · przez **wojtas** 12 Kwi 2008, 15:09

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28239b20-457b-11db-89ed-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d73800-4739-11db-89f6-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e2abb494-5a00-11dc-8e03-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5dd3d9b0-812f-11da-86cb-fea6786649f8}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe
3. dajesz loga z combofixa

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 16:16

wojtas napisał(a):Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

dodane.

wojtas napisał(a):1. Wykonaj skan Dr. Web CureIt

wykonany

wojtas napisał(a):2. Robisz loga z mbr.exe

log:

Kod: Zaznacz wszystko: Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: error reading MBR

3. dajesz loga z combofixa

log:

Kod: Zaznacz wszystko: ComboFix 08-04-11.8 - Admin 2008-04-12 16:10:53.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.39 [GMT 2:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 ))))))))))))))))))))))))))))))) . 2008-04-12 15:30 . 2008-04-12 15:30 <DIR> d-------- C:\Documents and Settings\Admin\DoctorWeb 2008-04-12 15:07 . 2008-04-12 15:10 <DIR> d-------- C:\Program Files\ESET 2008-04-12 15:07 . 2008-04-12 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-04-12 13:09 . 2008-04-12 13:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-12 13:09 . 2008-04-12 13:09 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-04-12 13:08 . 2008-04-12 13:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-04-12 13:04 . 2008-04-12 13:27 <DIR> d-------- C:\SDFix 2008-04-11 16:35 . 2005-08-10 12:43 41,984 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\dlkfet5b.sys 2008-04-04 18:22 . 2008-04-11 16:57 <DIR> d-------- C:\Netgear 2008-04-02 17:09 . 2008-04-02 17:09 <DIR> d-------- C:\Free YouTube to Mp3 Converter 2008-04-02 17:09 . 2008-04-02 17:10 <DIR> d-------- C:\DVDVideoSoft 2008-04-02 16:56 . 2008-04-02 16:56 <DIR> d-------- C:\Temp 2008-04-02 16:55 . 2008-04-02 17:09 <DIR> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT 2008-03-29 22:29 . 2007-10-07 17:08 2,728 --a------ C:\WINDOWS\SYSTEM32\mini_spectrum2.swf 2008-03-29 22:26 . 2008-04-10 00:40 <DIR> d-------- C:\iriver plus 3 2008-03-22 17:44 . 2008-03-22 17:46 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\SecondLife . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 14:03 --------- d-----w C:\Program Files\AutoConnect 2008-04-12 12:25 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2008-04-11 19:37 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype 2008-04-09 15:40 --------- d-----w C:\Program Files\Winamp 2008-02-28 17:51 --------- d-----w C:\Program Files\MOBILedit! 2008-02-28 17:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-27 19:17 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\fretsonfire 2008-02-23 09:32 --------- d-----w C:\Program Files\GoldWave 2008-02-20 09:11 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys 2008-02-20 09:02 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys 2008-02-20 09:01 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys 2008-02-19 11:16 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Gadu-Gadu 2008-02-15 19:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2005-12-17 17:42 266 --sha-w C:\Program Files\desktop.ini 2005-12-17 17:42 11,232 ---ha-w C:\Program Files\folder.htt 2005-05-13 16:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 10:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 20:27 422,400 --sha-r C:\WINDOWS\x2.64.exe 2005-10-07 18:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll 2005-07-14 11:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll 2005-06-26 14:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll 2005-06-21 21:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll 2006-04-27 09:24 2,945,024 --sha-r C:\WINDOWS\SYSTEM32\Smab.dll 2005-02-28 12:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-12_13.37.33,09 ))))))))))))))))))))))))))))))))))))))))) . + 2008-04-12 13:08:29 10,134 ----a-r C:\WINDOWS\Installer\{17026F9A-0826-4F3B-AF90-BA59C8B12435}\callmsi.exe + 2008-04-12 13:08:29 136,448 ----a-r C:\WINDOWS\Installer\{17026F9A-0826-4F3B-AF90-BA59C8B12435}\egui.exe + 2008-04-12 14:03:56 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5fc.dat - 2008-04-12 11:20:49 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat + 2008-04-12 14:03:49 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay] @={7D688A77-C613-11D0-999B-00C04FD655E1} [HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}] 2006-03-17 07:08 8480768 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14 310784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" [] "Zasobnik systemowy"="SysTray.Exe" [2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-09 21:32 98304] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programs^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programs\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] C:\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2003-12-22 09:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2003-08-04 18:28 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2005-06-10 16:20 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaFinderK] C:\Program Files\INSTAFINK\InstaFinderK_inst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-08-11 15:43 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2006-01-31 15:20 180224 C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-05-09 21:32 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-12-08 18:35 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-11-11 15:07 90112 C:\WINDOWS\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spik] C:\Program Files\Spik\Spik.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] --a------ 2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NvCpl.dll,NvStartup "nwiz"=nwiz.exe /install "WinampAgent"=C:\Program Files\Winamp\winampa.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "LoadQM"=loadqm.exe "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "SoundMan"=SOUNDMAN.EXE "autoclk"=autoclk.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.EXE "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Konnekt\\konnekt.exe"= "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= "C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe"= "C:\\Gadu-Gadu 6.1\\gg.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11] R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-09-09 14:17] R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS [2001-12-18 14:45] R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT [] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2003-04-15 19:07] S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys [] S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINDOWS\TEMP\5.tmp [] S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 13:29] S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT [] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-04-02 21:00:00 C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 16:14:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}] "ImagePath"="\??\C:\WINDOWS\TEMP\5.tmp" . Completion time: 2008-04-12 16:16:01 ComboFix-quarantined-files.txt 2008-04-12 14:15:53 ComboFix2.txt 2008-04-12 11:37:57 ComboFix3.txt 2007-10-07 12:35:01 Pre-Run: 16,145,759,232 bajtów wolnych Post-Run: 16,153,747,968 bajtów wolnych

**Posty:** 18165 · przez **wojtas** 12 Kwi 2008, 17:08

czy plik mbr.exe umiesciłes na dysku C bo cos log sie nie udał

sprobuj jeszcze raz i daj loga

u mnie tak wygląda:

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 17:35

na dysku C? miałem na pulpicie

Kod: Zaznacz wszystko: Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK malicious code @ sector 0x98a7fec size 0x1ca ! copy of MBR has been found in sector 62 !

**Posty:** 18165 · przez **wojtas** 12 Kwi 2008, 17:46

przejdz do trybu awaryjnego z z obsługą linii komend
w linii komend wpisz polecenie C:\mbr.exe -f (tam jest spacja między mbr.exe a -f) i ENTER
Reset komputera do trybu normalnego i robisz nowy log z mbr.exe oraz z combofixa i sdfixa ( w tej kolejnosci)

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 18:43

wojtas napisał(a):C:\mbr.exe -f

wpisałem

mbr.exe

Kod: Zaznacz wszystko: Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK malicious code @ sector 0x98a7fec size 0x1ca ! copy of MBR has been found in sector 62 !

combofix

Kod: Zaznacz wszystko: ComboFix 08-04-11.8 - Admin 2008-04-12 18:33:57.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.50 [GMT 2:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 ))))))))))))))))))))))))))))))) . 2008-04-12 15:30 . 2008-04-12 15:30 <DIR> d-------- C:\Documents and Settings\Admin\DoctorWeb 2008-04-12 15:27 . 2008-04-12 15:27 66,048 --a------ C:\mbr.exe 2008-04-12 15:07 . 2008-04-12 15:10 <DIR> d-------- C:\Program Files\ESET 2008-04-12 15:07 . 2008-04-12 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-04-12 13:09 . 2008-04-12 13:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-12 13:09 . 2008-04-12 17:59 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-04-12 13:08 . 2008-04-12 16:16 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-04-12 13:04 . 2008-04-12 13:27 <DIR> d-------- C:\SDFix 2008-04-11 16:35 . 2005-08-10 12:43 41,984 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\dlkfet5b.sys 2008-04-04 18:22 . 2008-04-11 16:57 <DIR> d-------- C:\Netgear 2008-04-02 17:09 . 2008-04-02 17:09 <DIR> d-------- C:\Free YouTube to Mp3 Converter 2008-04-02 17:09 . 2008-04-02 17:10 <DIR> d-------- C:\DVDVideoSoft 2008-04-02 16:56 . 2008-04-02 16:56 <DIR> d-------- C:\Temp 2008-04-02 16:55 . 2008-04-02 17:09 <DIR> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT 2008-03-29 22:29 . 2007-10-07 17:08 2,728 --a------ C:\WINDOWS\SYSTEM32\mini_spectrum2.swf 2008-03-29 22:26 . 2008-04-10 00:40 <DIR> d-------- C:\iriver plus 3 2008-03-22 17:44 . 2008-03-22 17:46 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\SecondLife . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 16:29 --------- d-----w C:\Program Files\AutoConnect 2008-04-12 12:25 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2008-04-11 19:37 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype 2008-04-09 15:40 --------- d-----w C:\Program Files\Winamp 2008-02-28 17:51 --------- d-----w C:\Program Files\MOBILedit! 2008-02-28 17:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-27 19:17 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\fretsonfire 2008-02-23 09:32 --------- d-----w C:\Program Files\GoldWave 2008-02-20 09:11 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys 2008-02-20 09:02 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys 2008-02-20 09:01 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys 2008-02-19 11:16 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Gadu-Gadu 2008-02-15 19:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2005-12-17 17:42 266 --sha-w C:\Program Files\desktop.ini 2005-12-17 17:42 11,232 ---ha-w C:\Program Files\folder.htt 2005-05-13 16:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 10:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 20:27 422,400 --sha-r C:\WINDOWS\x2.64.exe 2005-10-07 18:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll 2005-07-14 11:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll 2005-06-26 14:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll 2005-06-21 21:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll 2006-04-27 09:24 2,945,024 --sha-r C:\WINDOWS\SYSTEM32\Smab.dll 2005-02-28 12:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-12_13.37.33,09 ))))))))))))))))))))))))))))))))))))))))) . + 2008-04-12 13:08:29 10,134 ----a-r C:\WINDOWS\Installer\{17026F9A-0826-4F3B-AF90-BA59C8B12435}\callmsi.exe + 2008-04-12 13:08:29 136,448 ----a-r C:\WINDOWS\Installer\{17026F9A-0826-4F3B-AF90-BA59C8B12435}\egui.exe + 2008-04-12 16:29:32 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_610.dat - 2008-04-12 11:20:49 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat + 2008-04-12 16:34:32 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay] @={7D688A77-C613-11D0-999B-00C04FD655E1} [HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}] 2006-03-17 07:08 8480768 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14 310784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" [] "Zasobnik systemowy"="SysTray.Exe" [2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-09 21:32 98304] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programs^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programs\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] C:\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2003-12-22 09:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2003-08-04 18:28 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2005-06-10 16:20 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaFinderK] C:\Program Files\INSTAFINK\InstaFinderK_inst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-08-11 15:43 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2006-01-31 15:20 180224 C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-05-09 21:32 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-12-08 18:35 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-11-11 15:07 90112 C:\WINDOWS\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spik] C:\Program Files\Spik\Spik.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] --a------ 2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NvCpl.dll,NvStartup "nwiz"=nwiz.exe /install "WinampAgent"=C:\Program Files\Winamp\winampa.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "LoadQM"=loadqm.exe "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "SoundMan"=SOUNDMAN.EXE "autoclk"=autoclk.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.EXE "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Konnekt\\konnekt.exe"= "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= "C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe"= "C:\\Gadu-Gadu 6.1\\gg.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11] R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-09-09 14:17] R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS [2001-12-18 14:45] R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT [] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2003-04-15 19:07] S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys [] S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINDOWS\TEMP\5.tmp [] S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 13:29] S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT [] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-04-02 21:00:00 C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 18:37:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}] "ImagePath"="\??\C:\WINDOWS\TEMP\5.tmp" . Completion time: 2008-04-12 18:39:16 ComboFix-quarantined-files.txt 2008-04-12 16:39:07 ComboFix2.txt 2008-04-12 11:37:57 ComboFix3.txt 2007-10-07 12:35:01 Pre-Run: 16,060,790,272 bajtów wolnych Post-Run: 16,049,602,560 bajtów wolnych

SDFix

Kod: Zaznacz wszystko: [b]System Report[/b] ************* Run on 2008-04-12 at 18:41 Microsoft Windows XP [Wersja 5.1.2600] Current user is an administrator [b]Running Processes[/b]: \SystemRoot\System32\smss.exe [456] \??\C:\WINDOWS\system32\csrss.exe [508] \??\C:\WINDOWS\system32\winlogon.exe [532] C:\WINDOWS\system32\services.exe [576] C:\WINDOWS\system32\lsass.exe [588] C:\WINDOWS\system32\svchost.exe [724] C:\WINDOWS\system32\svchost.exe [792] C:\WINDOWS\System32\svchost.exe [820] C:\Program Files\Ahead\InCD\InCDsrv.exe [852] C:\WINDOWS\System32\svchost.exe [1116] C:\WINDOWS\system32\svchost.exe [1160] C:\WINDOWS\system32\spoolsv.exe [1308] C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1456] C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe [1552] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [1624] C:\Program Files\AutoConnect\AutoConnect.exe [1632] C:\WINDOWS\system32\nvsvc32.exe [1696] C:\WINDOWS\System32\PAStiSvc.exe [1728] C:\WINDOWS\System32\svchost.exe [1752] C:\WINDOWS\system32\wdfmgr.exe [1768] C:\WINDOWS\system32\wscntfy.exe [980] C:\WINDOWS\System32\alg.exe [1016] C:\Program Files\Mozilla Firefox\firefox.exe [2252] C:\WINDOWS\explorer.exe [4080] [b]Drivers - Running[/b]: ACPI adiusbaw AFD ALCXWDM AmdK7 atapi audstub Beep catchme Cdfs Cdrom Disk dmio dmload eamon easdrv epfwtdir Fastfat Fdc FETNDISB Fips Flpydisk FltMgr Ftdisk gameenum Gpc i8042prt Imapi InCDfs InCDPass incdrm IpNat IPSec isapnp Kbdclass KSecDD mbr mnmdd Mouclass MountMgr MRxDAV MRxSmb Msfs mssmbios ms_mpu401 Mup NDIS NdisTapi Ndisuio NdisWan NDProxy NetBIOS NetBT Npfs Ntfs Null nv oreans32 Parport PartMgr ParVdm PCI pfc PptpMiniport Ptilink PxHelp20 RasAcd Rasl2tp RasPppoe Raspti Rdbss RDPCDD rdpdr redbook SCDEmu Secdrv serenum Serial sptd sr Srv swenum sysaudio Tcpip TermDD Update usbhub usbuhci Vcs VgaSave viaagp viaagp1 ViaIde VIAPFD VolSnap Wanarp wdmaud [b]Drivers - Stopped[/b]: Abiosdsk abp480n5 ACPIEC ADILOADER adpu160m aec Aha154x aic78u2 aic78xx AliIde amsint asc asc3350p asc3550 AsyncMac Atdisk Atmarpc cbidf2k CCDECODE cd20xrnt Cdaudio Changer CmdIde Cpqarray dac960nt dmboot DMusic dpti2o drmkaud dtscsi hamachi hpn HPZid412 HPZipr12 HPZius12 HTTP i2omgmt i2omp ini910u IntelIde ip6fw IpFilterDriver IpInIp IRENUM kmixer lbrtfdc LMImirr Modem mraid35x MSKSSRV MSPCLOCK MSPQM MSTEE NABTSFEC NdisIP npkcrypt nvtvSND NwlnkFlt NwlnkFwd PAC207 PCANDIS5 PCIDump PCIIde Pcmcia PDCOMP PDFRAME PDRELI PDRFRAME perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 RDPWD rtl8139 Ser2pl sermouse Sfloppy Simbad SLIP SONYPVU1 Sparrow splitter streamip swmidi symc810 symc8xx sym_hi sym_u3 TDPIPE TDTCP TosIde Udfs ultra usbccgp usbprint usbscan USBSTOR USB_RNDIS Wdenaucpn WDICA WS2IFSL WSTCODEC XTrapD12 ZDCndis5 {DEF85C80-216A-43ab-AF70-1665EDBE2780} [b]Services - Running[/b]: ALG AudioSrv Browser CryptSvc DcomLaunch Dhcp dmserver Dnscache ekrn ERSvc Eventlog EventSystem FastUserSwitchingCompatibility helpsvc InCDsrv lanmanserver lanmanworkstation LmHosts MSSQL$AUTODESKVAULT Netman Nla NVSvc PlugPlay ProtectedStorage RasMan RpcSs SamSs Schedule seclogon SENS SharedAccess ShellHWDetection Spooler srservice STI stisvc TapiSrv TermService Themes TrkWks UMWdf W32Time WebClient winmgmt wscsvc wuauserv WZCSVC [b]Services - Stopped[/b]: Adobe Alerter AppMgmt aspnet_state BITS CiSvc ClipSrv clr_optimization_v2.0.50727_32 COMSysApp dmadmin EhttpSrv HidServ HTTPFilter IDriverT ImapiService Macromedia Messenger mnmsrvc MSDTC MSIServer MSSQLServerADHelper MySql NetDDE NetDDEdsdm Netlogon NtLmSsp NtmsSvc Pml PolicyAgent RasAuto RDSessMgr RemoteAccess RemoteRegistry RpcLocator RSVP SCardSvr SQLAgent$AUTODESKVAULT SSDPSRV SwPrv SysmonLog TlntSvr upnphost UPS usprserv VSS WmdmPmSN Wmi WmiApSrv xmlprov [b]Files Created/Modified - 60 Days[/b]: C:\ 2008-04-12 15:17:20 217 A.SHR "C:\boot.ini" 2008-04-12 18:39:18 14 202 A.... "C:\ComboFix.txt" 2008-04-12 18:29:14 267 964 416 A.SH. "C:\hiberfil.sys" 2008-04-12 15:27:48 66 048 A.... "C:\mbr.exe" 2008-04-12 18:31:08 270 A.... "C:\mbr.log" 2008-04-12 18:29:14 402 653 184 A.SH. "C:\pagefile.sys" C:\WINDOWS\ 2008-04-12 18:29:42 0 A.... "C:\WINDOWS\0.log" 2008-02-18 12:34:38 83 A.... "C:\WINDOWS\0x.ini" 2008-04-12 18:29:18 2 048 A.S.. "C:\WINDOWS\bootstat.dat" 2008-02-20 15:12:44 341 222 A.... "C:\WINDOWS\DirectX.log" 2008-03-04 14:04:44 452 A..H. "C:\WINDOWS\Fix.reg" 2008-04-12 18:27:58 601 658 A.... "C:\WINDOWS\ntbtlog.txt" 2008-04-06 0:25:46 54 156 A..H. "C:\WINDOWS\QTFont.qfn" 2008-04-12 18:26:04 31 952 A.... "C:\WINDOWS\SchedLog.Txt" 2008-04-12 15:08:24 832 796 A.... "C:\WINDOWS\setupapi.log" 2008-04-12 18:37:34 621 A.... "C:\WINDOWS\system.ini" 2008-04-12 17:59:38 7 680 A.SH. "C:\WINDOWS\Thumbs.db" 2008-04-12 18:29:34 159 A.... "C:\WINDOWS\wiadebug.log" 2008-04-12 18:29:34 50 A.... "C:\WINDOWS\wiaservc.log" 2008-04-12 15:17:20 1 936 A.... "C:\WINDOWS\win.ini" 2008-04-12 18:29:38 1 511 922 A.... "C:\WINDOWS\WindowsUpdate.log" 2008-03-31 21:08:08 102 117 A.... "C:\WINDOWS\wmsetup.log" 2008-04-12 18:29:18 0 A.... "C:\WINDOWS\Debug\PASSWD.LOG" 2008-04-04 18:18:36 6 480 A.... "C:\WINDOWS\INF\B10USBDMB.PNF" 2008-04-04 18:18:36 6 408 A.... "C:\WINDOWS\INF\B20USBDMB.PNF" 2008-04-12 11:05:52 1 463 176 A.... "C:\WINDOWS\INF\INFCACHE.1" 2008-03-01 19:18:06 454 136 A.... "C:\WINDOWS\INF\intl.PNF" 2008-03-22 17:44:34 1 041 552 A.... "C:\WINDOWS\INF\LAYOUT.PNF" 2008-04-04 18:19:18 13 592 A.... "C:\WINDOWS\INF\oem23.PNF" 2008-04-11 16:35:54 23 138 A.... "C:\WINDOWS\INF\oem24.PNF" 2008-03-29 22:29:12 1 946 A.... "C:\WINDOWS\INF\U25USBDMB.Inf" 2008-04-04 18:18:36 6 392 A.... "C:\WINDOWS\INF\U25USBDMB.PNF" 2008-03-29 22:26:54 6 362 A.... "C:\WINDOWS\INF\WMDMDist.PNF" 2008-04-12 13:48:58 90 112 A.... "C:\WINDOWS\Minidump\Mini041208-01.dmp" 2008-04-12 15:16:02 217 ..... "C:\WINDOWS\pss\boot.ini.backup" 2008-04-12 15:03:48 2 925 A.... "C:\WINDOWS\SYSTEM32\CONFIG.NT" 2008-02-18 11:53:32 165 912 A.... "C:\WINDOWS\SYSTEM32\FNTCACHE.DAT" 2008-04-12 18:29:36 81 191 A.... "C:\WINDOWS\SYSTEM32\nvapps.xml" 2008-03-31 11:42:54 64 184 A.... "C:\WINDOWS\SYSTEM32\perfc009.dat" 2008-03-31 11:42:54 79 398 A.... "C:\WINDOWS\SYSTEM32\perfc015.dat" 2008-03-31 11:42:54 403 976 A.... "C:\WINDOWS\SYSTEM32\perfh009.dat" 2008-03-31 11:42:54 460 146 A.... "C:\WINDOWS\SYSTEM32\perfh015.dat" 2008-03-31 11:42:54 1 019 346 A.... "C:\WINDOWS\SYSTEM32\PerfStringBackup.INI" 2008-04-11 10:23:30 2 206 A.... "C:\WINDOWS\SYSTEM32\wpa.dbl" 2008-04-12 18:29:24 6 A..H. "C:\WINDOWS\Tasks\SA.DAT" 2008-04-02 23:00:02 502 A.... "C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" 2008-04-12 18:41:12 2 144 A.... "C:\WINDOWS\TEMP\scs22.tmp" 2008-03-07 10:46:54 233 472 ..SH. "C:\WINDOWS\All Users\DRM\drmstore.hds" 2008-04-04 18:16:50 310 962 A.... "C:\WINDOWS\Debug\UserMode\userenv.bak" 2008-04-12 18:29:24 221 666 A.... "C:\WINDOWS\Debug\UserMode\userenv.log" 2008-04-12 18:33:50 573 440 A.... "C:\WINDOWS\erdnt\Hiv-backup\DEFAULT" 2008-04-12 18:33:50 673 A.... "C:\WINDOWS\erdnt\Hiv-backup\ERDNT.CON" 2008-04-12 18:33:50 1 241 A.... "C:\WINDOWS\erdnt\Hiv-backup\ERDNT.INF" 2008-04-12 18:33:50 28 672 A.... "C:\WINDOWS\erdnt\Hiv-backup\SAM" 2008-04-12 18:33:48 53 248 A.... "C:\WINDOWS\erdnt\Hiv-backup\SECURITY" 2008-04-12 18:33:50 33 083 392 A.... "C:\WINDOWS\erdnt\Hiv-backup\SOFTWARE" 2008-04-12 18:33:50 4 165 632 A.... "C:\WINDOWS\erdnt\Hiv-backup\SYSTEM" 2008-02-20 11:01:30 39 944 A.... "C:\WINDOWS\SYSTEM32\DRIVERS\eamon.sys" 2008-02-20 11:02:22 29 704 A.... "C:\WINDOWS\SYSTEM32\DRIVERS\easdrv.sys" 2008-02-20 11:11:16 33 800 A.... "C:\WINDOWS\SYSTEM32\DRIVERS\epfwtdir.sys" 2008-04-12 13:49:28 78 A.... "C:\WINDOWS\SYSTEM32\Restore\MachineGuid.txt" 2008-04-12 18:39:12 3 735 552 A.... "C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat" 2008-04-12 15:08:24 8 A.... "C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\TimeStamp" 2008-04-12 13:13:34 686 A.... "C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS" 2008-04-12 18:33:50 811 008 A.... "C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat" 2008-04-12 18:33:50 8 192 A.... "C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat" 2008-04-12 18:33:50 11 300 864 A.... "C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT" 2008-04-12 18:33:50 172 032 A.... "C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat" 2008-04-12 18:33:50 811 008 A.... "C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat" 2008-04-12 18:33:50 8 192 A.... "C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat" C:\Program Files\ 2008-04-12 18:39:52 4 032 A.... "C:\Program Files\AutoConnect\acstat.dat" 2008-04-08 16:33:32 8 784 A.... "C:\Program Files\BearShare\BearShare.dat" 2008-04-12 15:10:24 173 056 A.... "C:\Program Files\ESET\uninstall.exe" 2008-03-27 18:42:40 13 952 A.... "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll" 2008-03-27 18:42:56 7 660 656 A.... "C:\Program Files\Mozilla Firefox\firefox.exe" 2008-03-27 18:42:58 200 829 A.... "C:\Program Files\Mozilla Firefox\freebl3.dll" 2008-03-27 18:43:00 458 856 A.... "C:\Program Files\Mozilla Firefox\js3250.dll" 2008-03-27 18:43:00 161 392 A.... "C:\Program Files\Mozilla Firefox\nspr4.dll" 2008-03-27 18:43:02 378 472 A.... "C:\Program Files\Mozilla Firefox\nss3.dll" 2008-03-27 18:43:02 276 080 A.... "C:\Program Files\Mozilla Firefox\nssckbi.dll" 2008-03-27 18:43:02 34 424 A.... "C:\Program Files\Mozilla Firefox\plc4.dll" 2008-03-27 18:43:02 30 320 A.... "C:\Program Files\Mozilla Firefox\plds4.dll" 2008-03-27 18:43:02 112 232 A.... "C:\Program Files\Mozilla Firefox\smime3.dll" 2008-03-27 18:43:02 254 060 A.... "C:\Program Files\Mozilla Firefox\softokn3.dll" 2008-03-27 18:43:02 132 712 A.... "C:\Program Files\Mozilla Firefox\ssl3.dll" 2008-03-27 18:43:02 132 232 A.... "C:\Program Files\Mozilla Firefox\updater.exe" 2008-03-27 18:43:04 13 416 A.... "C:\Program Files\Mozilla Firefox\xpcom.dll" 2008-03-27 18:43:02 73 848 A.... "C:\Program Files\Mozilla Firefox\xpcom_compat.dll" 2008-03-27 18:43:02 422 000 A.... "C:\Program Files\Mozilla Firefox\xpcom_core.dll" 2008-03-27 18:43:04 73 336 A.... "C:\Program Files\Mozilla Firefox\xpicleanup.exe" 2008-03-27 18:43:04 12 400 A.... "C:\Program Files\Mozilla Firefox\xpistub.dll" 2008-04-01 20:37:42 84 480 A.... "C:\Program Files\Winamp\burnlib.dll" 2008-04-01 20:39:32 136 704 A.... "C:\Program Files\Winamp\libFLAC.dll" 2008-04-01 20:38:08 181 760 A.... "C:\Program Files\Winamp\libmp4v2.dll" 2008-04-01 20:38:26 201 728 A.... "C:\Program Files\Winamp\libsndfile.dll" 2008-04-01 20:38:32 88 064 A.... "C:\Program Files\Winamp\nde.dll" 2008-04-01 20:39:18 65 024 A.... "C:\Program Files\Winamp\tataki.dll" 2008-04-09 17:40:12 137 064 A.... "C:\Program Files\Winamp\UninstWA.exe" 2008-04-01 20:50:32 1 307 648 A.... "C:\Program Files\Winamp\winamp.exe" 2008-04-01 20:37:50 46 592 A.... "C:\Program Files\Winamp\zlib.dll" 2008-04-03 11:54:12 515 A.... "C:\Program Files\BearShare\db\gwebcache.dat" 2008-03-03 20:28:42 1 584 640 A.... "C:\Program Files\Common Files\DVDVIDEOSOFT\FreeStudioManager.exe" 2008-04-02 17:09:42 1 907 A.... "C:\Program Files\Common Files\DVDVIDEOSOFT\unins000.dat" 2008-04-02 17:09:38 640 965 A.... "C:\Program Files\Common Files\DVDVIDEOSOFT\unins000.exe" 2008-02-20 11:01:34 66 816 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\callmsi.exe" 2008-02-20 11:03:08 226 560 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ecls.exe" 2008-02-20 11:02:46 17 664 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eclsLang.dll" 2008-02-20 11:03:56 39 680 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ecmd.exe" 2008-02-20 11:06:58 1 443 072 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" 2008-02-20 11:02:14 99 584 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiAmon.dll" 2008-02-20 11:01:56 13 568 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiAmonLang.dll" 2008-02-20 11:05:38 107 776 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEmon.dll" 2008-02-20 11:04:42 14 080 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEmonLang.dll" 2008-02-20 11:10:54 771 328 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEpfw.dll" 2008-02-20 11:10:14 169 216 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEpfwLang.dll" 2008-02-20 11:06:10 136 448 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiLang.dll" 2008-02-20 11:17:56 87 296 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiMailPlugins.dll" 2008-02-20 11:16:32 10 496 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiMailPluginsLang.dll" 2008-02-20 11:06:36 247 040 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiProduct.dll" 2008-02-20 11:11:40 279 808 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiScan.dll" 2008-02-20 11:07:26 23 296 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiScanLang.dll" 2008-02-20 11:20:44 230 656 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiUpdate.dll" 2008-02-20 11:19:46 39 168 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eguiUpdateLang.dll" 2008-02-20 11:14:52 19 200 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe" 2008-02-20 11:08:46 472 320 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe" 2008-02-20 11:02:16 120 064 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnAmon.dll" 2008-02-20 11:05:40 99 584 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEmon.dll" 2008-02-20 11:10:56 255 232 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll" 2008-02-20 11:10:16 18 176 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEpfwLang.dll" 2008-02-20 11:08:20 26 368 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnLang.dll" 2008-02-20 11:17:58 99 584 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnMailPlugins.dll" 2008-02-20 11:16:32 10 496 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnMailPluginsLang.dll" 2008-02-20 11:11:42 156 928 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnScan.dll" 2008-02-20 11:09:08 9 472 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnScanLang.dll" 2008-02-20 11:20:46 132 352 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnUpdate.dll" 2008-02-20 11:19:52 42 240 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnUpdateLang.dll" 2008-04-12 15:20:32 49 304 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\em000_32.dat" 2008-04-12 15:20:50 307 566 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\em001_32.dat" 2008-04-12 15:20:46 9 095 879 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\em002_32.dat" 2008-04-12 15:20:50 215 701 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\em003_32.dat" 2008-04-12 15:08:12 431 539 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\em004_32.dat" 2008-04-12 15:20:50 39 021 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\em005_32.dat" 2008-02-20 11:17:58 10 496 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgHooks.dll" 2008-02-20 11:18:00 247 040 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOE.dll" 2008-02-20 11:05:42 185 600 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOEEmon.dll" 2008-02-20 11:16:34 14 080 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOELang.dll" 2008-02-20 11:18:02 259 328 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOutlook.dll" 2008-02-20 11:05:42 161 024 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOutlookEmon.dll" 2008-02-20 11:04:44 17 664 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOutlookEmonLang.dll" 2008-02-20 11:16:36 14 080 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\eplgOutlookLang.dll" 2008-02-20 11:14:52 66 816 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\http_dll.dll" 2008-02-20 11:18:52 169 216 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll" 2008-02-20 11:18:34 28 928 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\ShellExtLang.dll" 2008-02-20 11:20:48 177 408 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\updater.dll" 2008-03-06 21:03:08 109 712 A.... "C:\Program Files\InstallShield Installation Information\{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}\setup.exe" 2008-02-28 19:50:38 2 560 A.... "C:\Program Files\MOBILedit!\Data Files\0000000C.dat" 2008-02-28 19:50:38 3 584 A.... "C:\Program Files\MOBILedit!\Data Files\0000000D.dat" 2008-02-28 19:50:38 8 324 096 A.... "C:\Program Files\MOBILedit!\Data Files\0000000E.dat" 2008-02-28 19:50:38 2 560 A.... "C:\Program Files\MOBILedit!\Data Files\0000000F.dat" 2008-02-28 19:50:38 8 A.... "C:\Program Files\MOBILedit!\Mobile Applications\PlugChess.dat" 2008-03-27 18:42:42 67 696 A.... "C:\Program Files\Mozilla Firefox\components\jar50.dll" 2008-03-27 18:42:42 54 376 A.... "C:\Program Files\Mozilla Firefox\components\jsd3250.dll" 2008-03-27 18:42:42 34 952 A.... "C:\Program Files\Mozilla Firefox\components\myspell.dll" 2008-03-27 18:42:42 46 720 A.... "C:\Program Files\Mozilla Firefox\components\spellchk.dll" 2008-03-27 18:42:42 172 144 A.... "C:\Program Files\Mozilla Firefox\components\xpinstal.dll" 2008-03-27 18:43:02 22 664 A.... "C:\Program Files\Mozilla Firefox\plugins\npnul32.dll" 2008-03-27 18:43:02 451 496 A.... "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" 2008-04-01 20:49:40 567 296 A.... "C:\Program Files\Winamp\Plugins\enc_aacplus.dll" 2008-04-01 20:41:14 33 280 A.... "C:\Program Files\Winamp\Plugins\enc_flac.dll" 2008-04-01 20:49:36 12 800 A.... "C:\Program Files\Winamp\Plugins\enc_lame.dll" 2008-04-01 20:39:52 10 240 A.... "C:\Program Files\Winamp\Plugins\enc_wav.dll" 2008-04-01 20:49:32 17 920 A.... "C:\Program Files\Winamp\Plugins\enc_wma.dll" 2008-04-01 20:49:20 1 528 320 A.... "C:\Program Files\Winamp\Plugins\gen_ff.dll" 2008-04-01 20:47:48 25 600 A.... "C:\Program Files\Winamp\Plugins\gen_hotkeys.dll" 2008-04-01 20:47:44 263 680 A.... "C:\Program Files\Winamp\Plugins\gen_ml.dll" 2008-04-01 20:47:20 25 088 A.... "C:\Program Files\Winamp\Plugins\gen_tray.dll" 2008-04-01 20:47:18 109 056 A.... "C:\Program Files\Winamp\Plugins\in_cdda.dll" 2008-04-01 20:44:26 71 680 A.... "C:\Program Files\Winamp\Plugins\in_dshow.dll" 2008-04-01 20:39:40 38 400 A.... "C:\Program Files\Winamp\Plugins\in_flac.dll" 2008-04-01 20:46:34 19 456 A.... "C:\Program Files\Winamp\Plugins\in_flv.dll" 2008-04-01 20:46:54 6 656 A.... "C:\Program Files\Winamp\Plugins\in_linein.dll" 2008-04-01 20:46:52 98 304 A.... "C:\Program Files\Winamp\Plugins\in_midi.dll" 2008-04-01 20:46:44 160 768 A.... "C:\Program Files\Winamp\Plugins\in_mod.dll" 2008-04-01 20:46:28 381 440 A.... "C:\Program Files\Winamp\Plugins\in_mp3.dll" 2008-04-01 20:45:50 35 328 A.... "C:\Program Files\Winamp\Plugins\in_mp4.dll" 2008-04-01 20:45:38 171 008 A.... "C:\Program Files\Winamp\Plugins\in_nsv.dll" 2008-04-01 20:45:32 220 672 A.... "C:\Program Files\Winamp\Plugins\in_vorbis.dll" 2008-04-01 20:43:22 13 824 A.... "C:\Program Files\Winamp\Plugins\in_wave.dll" 2008-04-01 20:44:00 297 472 A.... "C:\Program Files\Winamp\Plugins\in_wm.dll" 2008-04-01 20:45:18 26 112 A.... "C:\Program Files\Winamp\Plugins\ml_autotag.dll" 2008-04-01 20:41:58 19 968 A.... "C:\Program Files\Winamp\Plugins\ml_bookmarks.dll" 2008-04-01 20:40:22 40 960 A.... "C:\Program Files\Winamp\Plugins\ml_dash.dll" 2008-04-01 20:41:52 191 488 A.... "C:\Program Files\Winamp\Plugins\ml_disc.dll" 2008-04-01 20:41:38 37 376 A.... "C:\Program Files\Winamp\Plugins\ml_history.dll" 2008-04-01 20:41:22 271 872 A.... "C:\Program Files\Winamp\Plugins\ml_local.dll" 2008-04-01 20:41:30 19 456 A.... "C:\Program Files\Winamp\Plugins\ml_nowplaying.dll" 2008-04-01 20:42:24 98 304 A.... "C:\Program Files\Winamp\Plugins\ml_online.dll" 2008-04-01 20:40:52 72 704 A.... "C:\Program Files\Winamp\Plugins\ml_orb.dll" 2008-04-01 20:46:38 72 192 A.... "C:\Program Files\Winamp\Plugins\ml_playlists.dll" 2008-04-01 20:45:12 57 856 A.... "C:\Program Files\Winamp\Plugins\ml_plg.dll" 2008-04-01 20:43:10 199 168 A.... "C:\Program Files\Winamp\Plugins\ml_pmp.dll" 2008-04-01 20:40:28 25 600 A.... "C:\Program Files\Winamp\Plugins\ml_rg.dll" 2008-04-01 20:39:56 26 624 A.... "C:\Program Files\Winamp\Plugins\ml_transcode.dll" 2008-04-01 20:45:00 184 832 A.... "C:\Program Files\Winamp\Plugins\ml_wire.dll" 2008-04-01 20:44:30 180 224 A.... "C:\Program Files\Winamp\Plugins\nsvdec_vp5.dll" 2008-04-01 20:44:28 194 048 A.... "C:\Program Files\Winamp\Plugins\nsvdec_vp6.dll" 2008-04-01 20:43:28 19 456 A.... "C:\Program Files\Winamp\Plugins\out_disk.dll" 2008-04-01 20:44:42 47 104 A.... "C:\Program Files\Winamp\Plugins\out_ds.dll" 2008-04-01 20:44:38 18 432 A.... "C:\Program Files\Winamp\Plugins\out_wave.dll" 2008-04-01 20:40:00 25 600 A.... "C:\Program Files\Winamp\Plugins\pmp_activesync.dll" 2008-04-01 20:42:50 212 480 A.... "C:\Program Files\Winamp\Plugins\pmp_ipod.dll" 2008-04-01 20:42:36 17 920 A.... "C:\Program Files\Winamp\Plugins\pmp_njb.dll" 2008-04-01 20:42:32 114 176 A.... "C:\Program Files\Winamp\Plugins\pmp_p4s.dll" 2008-04-01 20:40:36 40 448 A.... "C:\Program Files\Winamp\Plugins\pmp_usb.dll" 2008-04-01 20:40:28 8 704 A.... "C:\Program Files\Winamp\Plugins\ReplayGainAnalysis.dll" 2008-04-01 20:39:18 65 024 A.... "C:\Program Files\Winamp\Plugins\tataki.dll" 2008-04-10 22:16:56 3 414 A.... "C:\Program Files\Winamp\Plugins\vis_avs.dat" 2008-04-01 20:46:16 1 220 608 A.... "C:\Program Files\Winamp\Plugins\vis_milk2.dll" 2008-04-01 20:44:36 29 184 A.... "C:\Program Files\Winamp\Plugins\vis_nsfs.dll" 2008-03-03 23:40:50 275 696 A.... "C:\Program Files\Winamp\Plugins\Gracenote\CddbAFX3.dll" 2008-03-03 23:40:50 107 760 A.... "C:\Program Files\Winamp\Plugins\Gracenote\CddbCMSig_1_3.dll" 2008-03-03 23:40:50 652 528 A.... "C:\Program Files\Winamp\Plugins\Gracenote\CddbFEX.dll" 2008-03-03 23:40:50 505 072 A.... "C:\Program Files\Winamp\Plugins\Gracenote\CddbFPX1.dll" 2008-03-03 23:40:50 382 192 A.... "C:\Program Files\Winamp\Plugins\Gracenote\CddbS12T.dll" 2008-04-10 22:31:40 112 A.... "C:\Program Files\Winamp\Plugins\ml\art.dat" 2008-04-12 17:06:18 1 419 A.... "C:\Program Files\Winamp\Plugins\ml\main.dat" 2008-04-12 17:06:18 62 685 A.... "C:\Program Files\Winamp\Plugins\ml\recent.dat" 2008-02-20 11:01:30 39 944 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\Drivers\eamon\eamon.sys" 2008-02-20 11:02:22 29 704 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\Drivers\easdrv\easdrv.sys" 2008-02-20 11:11:16 33 800 A.... "C:\Program Files\ESET\ESET NOD32 Antivirus\Drivers\epfwtdir\epfwtdir.sys" 2008-03-27 18:42:42 99 840 A.... "C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\BrandRes.dll" 2008-03-27 18:42:42 156 544 A.... "C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\fullsoft.dll" 2008-03-27 18:42:42 14 456 A.... "C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll" 2008-03-27 18:42:42 407 040 A.... "C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org\components\talkback.exe" 2008-03-06 18:12:48 184 452 A.... "C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\00\Intel32\iGdi.dll" 2008-03-06 18:12:48 311 428 A.... "C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\00\Intel32\Setup.dll" [b]Files with hidden attributes[/b]: Tue 4 Mar 2008 452 A..H. --- "C:\WINDOWS\Fix.reg" Fri 13 May 2005 217,073 A.SHR --- "C:\WINDOWS\meta4.exe" Mon 24 Oct 2005 66,560 A.SHR --- "C:\WINDOWS\MOTA113.exe" Thu 13 Oct 2005 422,400 A.SHR --- "C:\WINDOWS\x2.64.exe" Fri 7 Oct 2005 308,224 A.SHR --- "C:\WINDOWS\SYSTEM32\avisynth.dll" Thu 14 Jul 2005 27,648 A.SHR --- "C:\WINDOWS\SYSTEM32\AVSredirect.dll" Sun 26 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\SYSTEM32\cygwin1.dll" Tue 21 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\SYSTEM32\cygz.dll" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\SYSTEM32\i420vfw.dll" Thu 27 Apr 2006 2,945,024 A.SHR --- "C:\WINDOWS\SYSTEM32\Smab.dll" Mon 28 Feb 2005 240,128 A.SHR --- "C:\WINDOWS\SYSTEM32\x.264.exe" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\SYSTEM32\yv12vfw.dll" Thu 22 Dec 2005 4,348 ..SH. --- "C:\WINDOWS\All Users\DRM\DRMv1.bak" Sun 12 Feb 2006 400 ..SH. --- "C:\WINDOWS\All Users\DRM\v2ks.bla.bak" Sun 12 Feb 2006 48 ..SH. --- "C:\WINDOWS\All Users\DRM\v2ks.sec.bak" Sat 9 Jun 2007 888 A..HR --- "C:\Documents and Settings\Admin\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Tue 30 Mar 2004 80,384 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL0003.tmp" Thu 27 Jan 2005 28,672 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL0004.tmp" Tue 30 Mar 2004 82,432 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL3011.tmp" Tue 30 Mar 2004 48,640 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL3720.tmp" Sun 23 Apr 2006 20,480 A..H. --- "C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\!matura\~WRL0001.tmp" Sat 25 Mar 2006 26,112 A..H. --- "C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\!matura\~WRL0003.tmp" [b]Program Folders[/b]: C:\Program Files\ Accessories Adobe Ahead AIMP2 Alwil Software ArcSoft Audio Phonics, Inc AutoConnect AvRack BearShare C-Media Audio Common Files Creative CyberLink CyberLink DVD Solution DAEMON Tools DIFX Divxpack DVD Shrink ESET FlashFXP FlashGet FrontPage Express Gadu-Gadu GanymedeNet GoldWave Gronzo Guitar Pro 5 Hamachi Hewlett Packard HP InstallShield Installation Information Internet Explorer IrfanView Java K-Lite Codec Pack Linren CD Ripper Macromedia Media Player Classic Messenger Microsoft FrontPage Microsoft Office Microsoft SQL Server Microsoft Visual Studio Microsoft WSE MIKSOFT MOBILedit! Movie Maker Mozilla Firefox Mozilla Thunderbird Mp3 Knife MSN MSN Gaming Zone MSN Messenger Negative Neostrada TP NetMeeting Outlook Express PLUS! podatki.pl PowerISO PowerMenu Publikacje sieci Web QuickTime Realtek AC97 SAGEM Skype SystemRequirementsLab Tlen.pl Trust Uninstall Information Usˆugi online VisualTooltip Winamp Windows Media Player Windows NT WinRAR xerox C:\Program Files\Common Files\ Adobe Adobe Systems Shared Ahead Autodesk Shared Blizzard Entertainment Designer DVDVIDEOSOFT Hewlett-Packard HP InstallShield Java LogoManager Macromedia Macromedia Shared MAGIX Shared Microsoft Shared mozilla.org MSSoap NSV ODBC PCCamera Real SERVICES Skype SpeechEngines SWF Studio Symantec Shared SYSTEM SystemRequirementsLab Wise Installation Wizard [b]Add/Remove Programs[/b]: Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player Plugin Adobe Photoshop CS2 Adobe Shockwave Player AP Guitar Tuner 1.02 AutoConnect v0.1.3.1 BearShare C-Media Audio Creative MuVo N200 Media Explorer Divxpack (remove only) DVD Shrink 3.2 Eset Fix v3 hasta el 2029 x Dasumo EVEREST Home Edition v2.20 FIFA 2001 FIFA 2001 (PL) Free YouTube to Mp3 Converter version 2.5 Gadu-Gadu 7.7 GoldWave v5.22 Gronzo ver 1.02 Guitar Pro 5.2 Hamachi 1.0.2.2 Heroes of Might and Magic II HighGrow 4.2 Polish Version - www.highgrow.prv.pl HijackThis 2.0.2 HP Image Zone 3.5 InCD Trust WB-1200p Mini Webcam IrfanView (remove only) iriver plus 3 (remove only) Poprawka systemu Windows XP - KB873339 Poprawka systemu Windows XP - KB885250 Poprawka systemu Windows XP - KB885835 Poprawka systemu Windows XP - KB885836 Poprawka systemu Windows XP - KB886185 Poprawka systemu Windows XP - KB887472 Poprawka systemu Windows XP - KB887742 Poprawka systemu Windows XP - KB888113 Poprawka systemu Windows XP - KB888302 Aktualizacja zabezpieczeń dla systemu Windows XP (KB890046) Poprawka systemu Windows XP - KB890859 Poprawka systemu Windows XP - KB891781 Aktualizacja zabezpieczeń dla systemu Windows XP (KB893066) Aktualizacja zabezpieczeń dla systemu Windows XP (KB893756) Windows Installer 3.1 (KB893803) Aktualizacja dla systemu Windows XP (KB894391) Aktualizacja zabezpieczeń dla systemu Windows XP (KB896358) Aktualizacja zabezpieczeń dla systemu Windows XP (KB896422) Aktualizacja zabezpieczeń dla systemu Windows XP (KB896423) Aktualizacja zabezpieczeń dla systemu Windows XP (KB896424) Aktualizacja zabezpieczeń dla systemu Windows XP (KB896428) Aktualizacja dla systemu Windows XP (KB898461) Aktualizacja zabezpieczeń dla systemu Windows XP (KB899587) Aktualizacja zabezpieczeń dla systemu Windows XP (KB899589) Aktualizacja zabezpieczeń dla systemu Windows XP (KB899591) Aktualizacja dla systemu Windows XP (KB900485) Aktualizacja zabezpieczeń dla systemu Windows XP (KB900725) Aktualizacja zabezpieczeń dla systemu Windows XP (KB901017) Aktualizacja zabezpieczeń dla systemu Windows XP (KB901190) Aktualizacja zabezpieczeń dla systemu Windows XP (KB901214) Aktualizacja zabezpieczeń dla systemu Windows XP (KB902400) Aktualizacja zabezpieczeń dla systemu Windows XP (KB904706) Aktualizacja zabezpieczeń dla systemu Windows XP (KB905414) Aktualizacja zabezpieczeń dla systemu Windows XP (KB905749) Aktualizacja zabezpieczeń dla systemu Windows XP (KB905915) Aktualizacja zabezpieczeń dla systemu Windows XP (KB908519) Aktualizacja zabezpieczeń dla systemu Windows XP (KB908531) Aktualizacja dla systemu Windows XP (KB910437) Aktualizacja zabezpieczeń dla systemu Windows XP (KB911562) Aktualizacja zabezpieczeń dla programu Windows Media Player (KB911564) Aktualizacja zabezpieczeń dla programu Windows Media Player 9 (KB911565) Aktualizacja zabezpieczeń dla systemu Windows XP (KB911567) Aktualizacja zabezpieczeń dla systemu Windows XP (KB911927) Aktualizacja zabezpieczeń dla systemu Windows XP (KB912812) Aktualizacja zabezpieczeń dla systemu Windows XP (KB912919) Aktualizacja zabezpieczeń dla systemu Windows XP (KB913446) Aktualizacja zabezpieczeń dla systemu Windows XP (KB913580) Aktualizacja zabezpieczeń dla systemu Windows XP (KB921883) K-Lite Codec Pack 2.71 Standard Konnekt Lame ACM MP3 Codec Linren CD Ripper Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft .NET Framework 2.0 — pakiet języka polskiego Mozilla Firefox (2.0.0.13) Mozilla Thunderbird (1.0.7) Mp3 Knife 3.0 MuVo Driver NAPIPROJEKT 1.0.6.1 Nero OEM NVIDIA Drivers PowerISO PowerMenu 1.51 QuickTime Real Alternative 1.52 SecondLife (remove only) Macromedia Flash Player 8 SHOUTcast Source DSP 1.8.2 (remove only) Onet.pl - Skype 3.0 Spybot - Search & Destroy 1.4 SubEdit-Player System Requirements Lab Tibia 7.6 Tlen.pl Uninstall 1.0.0.0 Winamp Windows Media Format Runtime Windows XP Service Pack 2 Archiwizator WinRAR Microsoft Office 2000 Premium MSN Messenger 7.5 HP PSC & OfficeJet 3.5 ESET NOD32 Antivirus DocProc Adobe Photoshop CS2 AiO_Scan Scan SkinsHP1 Macromedia Flash 8 Memories Disc Creator 2.0 Macromedia Flash MX 2004 AIOMinimal J2SE Runtime Environment 5.0 Update 6 DigiTech X-Edit 2.3 HP Software Update HPSystemDiagnostics Skype Plugin Manager Unload Copy SAGEM F@st 800-840 Macromedia Extension Manager PrintScreen RGSS-RTP Standard Microsoft .NET Framework 2.0 Language Pack - PLK Sony USB Driver AiOSoftware Microsoft .NET Framework 1.1 Polish Language Pack PowerDVD Microsoft .NET Framework 2.0 Director InstantShare Adobe Stock Photos 1.0 1300Tour Microsoft XML Parser Zune Desktop Theme TrayApp QFolder Macromedia Flash 8 Video Encoder Adobe Common File Installer Odkryj fotografię cyfrową HP Macromedia Flash Player 8 FlashFXP v3 1300Trb Counter-Strike 1.6 CreativeProjects ArcSoft VideoImpression 1.6 Readme 1300 Fax NVIDIA WDM Drivers Adobe Bridge 1.0 PowerProducer DVD Solution SkinsHP2 Trust WB-1200p Mini Webcam Microsoft XML Parser Microsoft .NET Framework 1.1 1300_Help QuickProjects Overland Microsoft SQL Server Desktop Engine (AUTODESKVAULT) Stronghold PhotoGallery Adobe Help Center 1.0 PL-2303 USB-to-Serial Microsoft WSE 2.0 SP3 Runtime Realtek AC'97 Audio WebReg WinFast(R) Display Driver hpmdtab µTorrent [b]Run Values[/b]: [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" "Zasobnik systemowy"="SysTray.Exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "QuickTime Task"=""C:\\Program Files\\QuickTime\\qttask.exe" -atboottime" "egui"=""C:\\Program Files\\ESET\\ESET NOD32 Antivirus\\egui.exe" /hide /waitservice" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe" [b]Bot Check[/b]: SERVICE_NAME: wscsvc DISPLAY_NAME : Centrum zabezpiecze START_TYPE : 2 AUTO_START SERVICE_NAME: sharedaccess DISPLAY_NAME : Zapora systemu Windows/Udost START_TYPE : 2 AUTO_START SERVICE_NAME: wuauserv DISPLAY_NAME : Aktualizacje automatyczne START_TYPE : 2 AUTO_START SERVICE_NAME: srservice DISPLAY_NAME : Us START_TYPE : 2 AUTO_START [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole] "EnableDCOM"="Y" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "restrictanonymous"=dword:00000000 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update] "AUOptions"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000000 "FirewallOverride"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "WaitToKillServiceTimeout"="20000" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "SFCDisable"=dword:00000000 "Shell"="Explorer.exe" "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters] "TransportBindName"="\\Device\" [b]ShellExecuteHooks[/b]: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [b]Environment[/b]: HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\environment ComSpec REG_EXPAND_SZ %SystemRoot%\system32\cmd.exe Path REG_EXPAND_SZ %systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\Microsoft SQL Server\80\Tools\Binn windir REG_EXPAND_SZ C:\WINDOWS OS REG_SZ Windows_NT PATHEXT REG_SZ .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH TEMP REG_EXPAND_SZ C:\WINDOWS\TEMP TMP REG_EXPAND_SZ C:\WINDOWS\TEMP PROMPT REG_EXPAND_SZ $p$g winbootdir REG_EXPAND_SZ C:\WINDOWS [b]SecurityProviders[/b]: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders SecurityProviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll [b]Authentication Packages[/b]: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 [b]Subsystem Startup[/b]: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems] "Windows"="%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16" [b]Midi Drivers[/b]: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] "midi"="wdmaud.drv" [b]Non-Default IFEO Debugger[/b]: [b]Non-Default Installed Components[/b]: HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ca0a4247-44be-11d1-a005-00805f8abe06} <NO NAME> REG_SZ Ustawienia założeń wykorzystywania energii Version REG_SZ 4,10,0,7 Local REG_SZ EN StubPath REG_SZ RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf [b]Non-Default Safeboot Minimal[/b]: [b]File Associations[/b]: [HKEY_CLASSES_ROOT\batfile\shell\open\command] @=""%1" %*" [HKEY_CLASSES_ROOT\comfile\shell\ope

**Posty:** 18165 · przez **wojtas** 12 Kwi 2008, 19:03

wklej do notatnika:

Driver::
{DEF85C80-216A-43ab-AF70-1665EDBE2780}

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go zapisz sobie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt oraz tamten log z combo

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 20:10

SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.169 [/b] Run by Admin on 2008-04-12 at 19:50 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 19:59:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:a5781990 "s2"=dword:b1f861b3 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:3d,cf,d8,2f,86,94,2c,87,fa,c3,fa,b9,78,67,dc,02,07,54,a0,41,83,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:3c,31,71,51,fa,f4,00,bc,c1,41,37,99,06,5f,30,e6,a5,aa,db,bb,16,.. "a0"=hex:20,01,00,00,e6,39,57,c2,6f,10,c7,72,52,ec,18,0b,76,2f,8a,07,88,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d5,75,6c,ad,5a,6d,9d,42,08,48,59,9d,79,85,f3,7d,25,73,cd,03,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:13,4d,63,a4,27,cd,59,26,df,57,a2,f3,28,12,1d,27,63,5f,1d,21,a1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:3d,cf,d8,2f,86,94,2c,87,fa,c3,fa,b9,78,67,dc,02,07,54,a0,41,83,.. "p0"="C:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:3c,31,71,51,fa,f4,00,bc,c1,41,37,99,06,5f,30,e6,a5,aa,db,bb,16,.. "a0"=hex:20,01,00,00,e6,39,57,c2,6f,10,c7,72,52,ec,18,0b,76,2f,8a,07,88,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d5,75,6c,ad,5a,6d,9d,42,08,48,59,9d,79,85,f3,7d,25,73,cd,03,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:13,4d,63,a4,27,cd,59,26,df,57,a2,f3,28,12,1d,27,63,5f,1d,21,a1,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe"="C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\Konnekt\\konnekt.exe"="C:\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core" "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3" "C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe"="C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe:*:Enabled:Age of Empires II Expansion" "C:\\Gadu-Gadu 6.1\\gg.exe"="C:\\Gadu-Gadu 6.1\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Tue 4 Mar 2008 452 A..H. --- "C:\WINDOWS\Fix.reg" Fri 13 May 2005 217,073 A.SHR --- "C:\WINDOWS\meta4.exe" Mon 24 Oct 2005 66,560 A.SHR --- "C:\WINDOWS\MOTA113.exe" Thu 13 Oct 2005 422,400 A.SHR --- "C:\WINDOWS\x2.64.exe" Fri 7 Oct 2005 308,224 A.SHR --- "C:\WINDOWS\SYSTEM32\avisynth.dll" Thu 14 Jul 2005 27,648 A.SHR --- "C:\WINDOWS\SYSTEM32\AVSredirect.dll" Sun 26 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\SYSTEM32\cygwin1.dll" Tue 21 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\SYSTEM32\cygz.dll" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\SYSTEM32\i420vfw.dll" Thu 27 Apr 2006 2,945,024 A.SHR --- "C:\WINDOWS\SYSTEM32\Smab.dll" Mon 28 Feb 2005 240,128 A.SHR --- "C:\WINDOWS\SYSTEM32\x.264.exe" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\SYSTEM32\yv12vfw.dll" Thu 22 Dec 2005 4,348 ..SH. --- "C:\WINDOWS\All Users\DRM\DRMv1.bak" Sun 12 Feb 2006 400 ..SH. --- "C:\WINDOWS\All Users\DRM\v2ks.bla.bak" Sun 12 Feb 2006 48 ..SH. --- "C:\WINDOWS\All Users\DRM\v2ks.sec.bak" Sat 9 Jun 2007 888 A..HR --- "C:\Documents and Settings\Admin\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Tue 30 Mar 2004 80,384 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL0003.tmp" Thu 27 Jan 2005 28,672 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL0004.tmp" Tue 30 Mar 2004 82,432 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL3011.tmp" Tue 30 Mar 2004 48,640 A..H. --- "C:\Documents and Settings\Admin\Moje dokumenty\Txt'y\Teksty\~WRL3720.tmp" Sun 23 Apr 2006 20,480 A..H. --- "C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\!matura\~WRL0001.tmp" Sat 25 Mar 2006 26,112 A..H. --- "C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\!matura\~WRL0003.tmp" [b]Finished![/b]

Comboscan

Kod: Zaznacz wszystko: ComboFix 08-04-11.8 - Admin 2008-04-12 19:33:06.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.85 [GMT 2:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Admin\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_{DEF85C80-216A-43AB-AF70-1665EDBE2780} -------\Service_{DEF85C80-216A-43ab-AF70-1665EDBE2780} ((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 ))))))))))))))))))))))))))))))) . 2008-04-12 15:30 . 2008-04-12 15:30 <DIR> d-------- C:\Documents and Settings\Admin\DoctorWeb 2008-04-12 15:27 . 2008-04-12 15:27 66,048 --a------ C:\mbr.exe 2008-04-12 15:07 . 2008-04-12 15:10 <DIR> d-------- C:\Program Files\ESET 2008-04-12 15:07 . 2008-04-12 15:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-04-12 13:09 . 2008-04-12 13:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-12 13:09 . 2008-04-12 17:59 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-04-12 13:08 . 2008-04-12 18:39 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-04-12 13:08 . 2005-12-29 21:57 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-04-12 13:04 . 2008-04-12 18:41 <DIR> d-------- C:\SDFix 2008-04-11 16:35 . 2005-08-10 12:43 41,984 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\dlkfet5b.sys 2008-04-04 18:22 . 2008-04-11 16:57 <DIR> d-------- C:\Netgear 2008-04-02 17:09 . 2008-04-02 17:09 <DIR> d-------- C:\Free YouTube to Mp3 Converter 2008-04-02 17:09 . 2008-04-02 17:10 <DIR> d-------- C:\DVDVideoSoft 2008-04-02 16:56 . 2008-04-02 16:56 <DIR> d-------- C:\Temp 2008-04-02 16:55 . 2008-04-02 17:09 <DIR> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT 2008-03-29 22:29 . 2007-10-07 17:08 2,728 --a------ C:\WINDOWS\SYSTEM32\mini_spectrum2.swf 2008-03-29 22:26 . 2008-04-10 00:40 <DIR> d-------- C:\iriver plus 3 2008-03-22 17:44 . 2008-03-22 17:46 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\SecondLife . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 17:39 --------- d-----w C:\Program Files\AutoConnect 2008-04-12 12:25 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2008-04-11 19:37 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Skype 2008-04-09 15:40 --------- d-----w C:\Program Files\Winamp 2008-02-28 17:51 --------- d-----w C:\Program Files\MOBILedit! 2008-02-28 17:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-27 19:17 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\fretsonfire 2008-02-23 09:32 --------- d-----w C:\Program Files\GoldWave 2008-02-20 09:11 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys 2008-02-20 09:02 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys 2008-02-20 09:01 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys 2008-02-19 11:16 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Gadu-Gadu 2008-02-15 19:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2005-12-17 17:42 266 --sha-w C:\Program Files\desktop.ini 2005-12-17 17:42 11,232 ---ha-w C:\Program Files\folder.htt 2005-05-13 16:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 10:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 20:27 422,400 --sha-r C:\WINDOWS\x2.64.exe 2005-10-07 18:14 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll 2005-07-14 11:31 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll 2005-06-26 14:32 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll 2005-06-21 21:37 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll 2006-04-27 09:24 2,945,024 --sha-r C:\WINDOWS\SYSTEM32\Smab.dll 2005-02-28 12:16 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe 2004-01-24 23:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-12_13.37.33,09 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE + 2008-04-12 13:08:29 10,134 ----a-r C:\WINDOWS\Installer\{17026F9A-0826-4F3B-AF90-BA59C8B12435}\callmsi.exe + 2008-04-12 13:08:29 136,448 ----a-r C:\WINDOWS\Installer\{17026F9A-0826-4F3B-AF90-BA59C8B12435}\egui.exe + 2008-04-12 17:38:35 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_6b0.dat - 2008-04-12 11:20:49 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat + 2008-04-12 17:38:59 3,735,552 ----a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay] @={7D688A77-C613-11D0-999B-00C04FD655E1} [HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}] 2006-03-17 07:08 8480768 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14 310784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" [] "Zasobnik systemowy"="SysTray.Exe" [2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-09 21:32 98304] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programs^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programs\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] C:\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2003-12-22 09:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2003-08-04 18:28 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2005-06-10 16:20 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaFinderK] C:\Program Files\INSTAFINK\InstaFinderK_inst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-08-11 15:43 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2006-01-31 15:20 180224 C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-05-09 21:32 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-12-08 18:35 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-11-11 15:07 90112 C:\WINDOWS\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spik] C:\Program Files\Spik\Spik.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] --a------ 2001-10-26 19:30 3072 C:\WINDOWS\SYSTEM32\systray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NvCpl.dll,NvStartup "nwiz"=nwiz.exe /install "WinampAgent"=C:\Program Files\Winamp\winampa.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "LoadQM"=loadqm.exe "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "SoundMan"=SOUNDMAN.EXE "autoclk"=autoclk.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.EXE "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Documents and Settings\\Admin\\Pulpit\\Fibi\\uTorrent.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Konnekt\\konnekt.exe"= "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= "C:\\Age Of Empires 2 & The Conquerors\\age2_x1.exe"= "C:\\Gadu-Gadu 6.1\\gg.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11] R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-09-09 14:17] R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS [2001-12-18 14:45] R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT [] R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2003-04-15 19:07] S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys [] S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 13:29] S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT [] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . Contents of the 'Scheduled Tasks' folder "2008-04-02 21:00:00 C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-12 19:39:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\SYSTEM32\nvsvc32.exe C:\WINDOWS\SYSTEM32\PAStiSvc.exe C:\WINDOWS\SYSTEM32\wdfmgr.exe C:\WINDOWS\SYSTEM32\wscntfy.exe . ************************************************************************** . Completion time: 2008-04-12 19:41:30 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-12 17:41:21 ComboFix2.txt 2008-04-12 16:39:17 ComboFix3.txt 2008-04-12 11:37:57 ComboFix4.txt 2007-10-07 12:35:01 Pre-Run: 16,023,934,464 bajtów wolnych Post-Run: 15,938,499,072 bajt˘w wolnych

**Posty:** 18165 · przez **wojtas** 12 Kwi 2008, 22:51

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

**Posty:** 2008 · przez **fibi07** 12 Kwi 2008, 23:50

dzięki wielkie!

rookit po instalacji karty sieciowej?

rookit po instalacji karty sieciowej?

Kto jest na forum