Trochę wirusów..

**Posty:** 1850 · przez **Tomaszu** 07 Sty 2009, 15:22

Zachciało mi się ściągnąć pewien program. Tak właśnie zrobiłem, ale w archiwum były podłożone pliczki z syfem.. Co chwilę wyskakuje mi balonik w prawym dolnym rogu z napisem '(..) security problem'. Otwierają mi się strony z rzekomym sprawdzaniem kompa itp. Prośba o pomoc..

Kod: Zaznacz wszystko: ComboFix 09-01-06.02 - Tomek 2009-01-07 14:14:01.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2046.1727 [GMT 1:00] Uruchomiony z: c:\documents and settings\Tomek\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [color=RED][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\documents and settings\Tomek\Dane aplikacji\BITS c:\documents and settings\Tomek\Dane aplikacji\BITS\BITS.ini c:\documents and settings\Tomek\Dane aplikacji\BITS\DHTTable.dat c:\documents and settings\Tomek\Dane aplikacji\BITS\ProxyList.ini c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709141946.torrent c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709141946.torrent.~tmp c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709141946.torrent.bits c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709141946.torrent.filelist c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709141946.torrent.hybridlist c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709141946.torrent.seeds c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709142207.torrent c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709142207.torrent.~tmp c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709142207.torrent.bits c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709142207.torrent.filelist c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709142207.torrent.hybridlist c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080709142207.torrent.seeds c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080929203551.torrent c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080929203551.torrent.~tmp c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080929203551.torrent.bits c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20080929203551.torrent.filelist c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20081003152215.torrent c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20081003152215.torrent.~tmp c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20081003152215.torrent.bits c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20081003152215.torrent.filelist c:\documents and settings\Tomek\Dane aplikacji\BITS\Torrent\20081003152215.torrent.seeds c:\documents and settings\Tomek\Dane aplikacji\BITS\UPnP.ini c:\documents and settings\Tomek\Menu Start\Cheap Pharmacy Online.url c:\documents and settings\Tomek\Menu Start\Search Online.url c:\documents and settings\Tomek\Menu Start\SMS TRAP.url c:\documents and settings\Tomek\Menu Start\VIP Casino.url c:\documents and settings\Tomek\Ulubione\Cheap Pharmacy Online.url c:\documents and settings\Tomek\Ulubione\Search Online.url c:\documents and settings\Tomek\Ulubione\SMS TRAP.url c:\documents and settings\Tomek\Ulubione\VIP Casino.url c:\program files\FlashGet Network c:\program files\FlashGet Network\FlashGet universal\btcore.dll c:\program files\FlashGet Network\FlashGet universal\btwrap.dll c:\program files\FlashGet Network\FlashGet universal\BugReport.dll c:\program files\FlashGet Network\FlashGet universal\BugReport.exe c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm c:\program files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhocfg.ini c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm c:\program files\FlashGet Network\FlashGet universal\ComDlls\ComDlls.ini c:\program files\FlashGet Network\FlashGet universal\ComDlls\flashget.xpi c:\program files\FlashGet Network\FlashGet universal\ComDlls\FlashgetXpi.dll c:\program files\FlashGet Network\FlashGet universal\ComDlls\IFlashgetXpi.xpt c:\program files\FlashGet Network\FlashGet universal\dbghelp.dll c:\program files\FlashGet Network\FlashGet universal\DBTrans.dll c:\program files\FlashGet Network\FlashGet universal\dbtrans_verbose.log c:\program files\FlashGet Network\FlashGet universal\DBTransC.exe c:\program files\FlashGet Network\FlashGet universal\ed2kwrap.dll c:\program files\FlashGet Network\FlashGet universal\explorerbar.dll c:\program files\FlashGet Network\FlashGet universal\fgoption.ini c:\program files\FlashGet Network\FlashGet universal\FGVer.dll c:\program files\FlashGet Network\FlashGet universal\flashget.exe c:\program files\FlashGet Network\FlashGet universal\gt.exe c:\program files\FlashGet Network\FlashGet universal\hashgen.dll c:\program files\FlashGet Network\FlashGet universal\Help\license.txt c:\program files\FlashGet Network\FlashGet universal\Help\Readme.txt c:\program files\FlashGet Network\FlashGet universal\Help\WHATSNEW.TXT c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddBatchLinksDlg.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddBTTask.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\Added.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddEMTask.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddHpFpLink.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddLinksDlg.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddLinksDlgEx.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\AddLinksModern.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\BrowserPlugins.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\BTOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\CategoryView.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\ComfirmWhenExitDialog.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\CommonDlg.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\ConfirmInvalidLinks.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\ContextMenu.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\DefaultDownloadsDialog.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\DeleteFilesDialog.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\DetailStatus.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\EMOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\EMServers.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\ExplorerPane.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\ExtensionRuleDlg.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FG2SearchTopPlugin.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FileListCtrl.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FileRemovedDialog.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FindTaskDialog.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FlashgetAbout.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FlashGetDlg.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\FSUStatusBar.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\GarageLoginDialog.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\GarageView.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\HotResource.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\HpFpOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\Info.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\LogsOutput.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\MACReader.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\MainMenu.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\MainToolbar.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\MonitorOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\NormalOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\NotifyOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\Option.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\P4PPluginMain.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\ProxySetting.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\SearchBar.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\Security.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\SecurityOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\SecurityScan.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\SecurityToolbar.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\Shutdown.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\StatusBar.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\TaskDefOption.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\TaskListView.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\TaskNotify.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\UserListCtrl.ini c:\program files\FlashGet Network\FlashGet universal\Langs\FGXL_ENG\XpEnhance.ini c:\program files\FlashGet Network\FlashGet universal\libupnp.dll c:\program files\FlashGet Network\FlashGet universal\LiveUpdateUI.dll c:\program files\FlashGet Network\FlashGet universal\modules\ComHelper\ComHelper.dll c:\program files\FlashGet Network\FlashGet universal\modules\ComHelper\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\Downstat\Downstat.dll c:\program files\FlashGet Network\FlashGet universal\modules\Downstat\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\P4pclient\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\P4pclient\P4pclient.dll c:\program files\FlashGet Network\FlashGet universal\modules\P4pclient\Thumbs.db c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource.ini c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource\iexplorer.bmp c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource\resource.bmp c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource\resource.xml c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource\search.bmp c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource\subscribe.bmp c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\Resource\Thumbs.db c:\program files\FlashGet Network\FlashGet universal\modules\SearchTop\SearchTop.dll c:\program files\FlashGet Network\FlashGet universal\modules\Security\FunctionalRepair.bmp c:\program files\FlashGet Network\FlashGet universal\modules\Security\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\Security\Scanning.bmp c:\program files\FlashGet Network\FlashGet universal\modules\Security\Security.bmp c:\program files\FlashGet Network\FlashGet universal\modules\Security\SECURITY.dll c:\program files\FlashGet Network\FlashGet universal\modules\Security\Security.xml c:\program files\FlashGet Network\FlashGet universal\modules\Security\SystemFix.bmp c:\program files\FlashGet Network\FlashGet universal\modules\SnapShot\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\SnapShot\SamplerCli.dll c:\program files\FlashGet Network\FlashGet universal\modules\SnapShot\SnapShot.dll c:\program files\FlashGet Network\FlashGet universal\modules\tasknotifier\Info.ini c:\program files\FlashGet Network\FlashGet universal\modules\tasknotifier\tasknotifier.dll c:\program files\FlashGet Network\FlashGet universal\P2PCfg.ini c:\program files\FlashGet Network\FlashGet universal\P2PCore.dll c:\program files\FlashGet Network\FlashGet universal\p2pprot.dll c:\program files\FlashGet Network\FlashGet universal\p2snetio.dll c:\program files\FlashGet Network\FlashGet universal\p2spmgr.dll c:\program files\FlashGet Network\FlashGet universal\p2spmgr.ini c:\program files\FlashGet Network\FlashGet universal\p2sprot.dll c:\program files\FlashGet Network\FlashGet universal\p2spwrap.dll c:\program files\FlashGet Network\FlashGet universal\p4spmgr.ini c:\program files\FlashGet Network\FlashGet universal\Profiles\config.dat c:\program files\FlashGet Network\FlashGet universal\Profiles\tasks.dat c:\program files\FlashGet Network\FlashGet universal\Skins\close_default.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\close_press.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\close_select.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\max_default.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\max_press.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\max_select.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\min_default.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\min_press.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\min_select.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\notify.wav c:\program files\FlashGet Network\FlashGet universal\Skins\notify_board.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\notify_icon.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarCT\Back.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarCT\Backward.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarCT\BrowserBarCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarCT\FlashgetResource.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarCT\Forward.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarCT\Home.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarDisableCT\Backward.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarDisableCT\BrowserBarDisableCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarDisableCT\Forward.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarDisableCT\Home.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\BrowserBarDisableCT\Resource.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Available.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\CategoryTreeCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Downloaded.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Downloading.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Favorite.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Flashget.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Release.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Rubbish.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\CategoryTreeCT\Search.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\ExpBar\Expbar.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\ExpBar\garage.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\ExpBar\resource.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\ExpBar\transfer.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\BT.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\EM.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\GlobalOptionCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\HpFp.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\Monitor.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\Normal.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\Notify.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\Proxy.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\GlobalOptionCT\TaskDef.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\Info.ini c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\About.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\DeleteTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\folder.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\MainMenuCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\MoveDownTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\MoveUpTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\NewTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\open.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\Option.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\PauseTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\Resource.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\StartTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainMenuCT\TaskProperties.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\About.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\DeleteTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\Folder.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\MainToolbarCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\NewTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\Open.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\Option.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\PauseTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\Resource.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\StartTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarCT\TaskProperties.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\About.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\DeleteTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\Folder.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\MainToolbarDisableCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\NewTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\Open.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\Option.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\PauseTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\Resource.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\StartTask.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\MainToolbarDisableCT\TaskProperties.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\Monitor\InfoBkg.Bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\Monitor\MonitorBkg.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\OutpuLogCT\Down.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\OutpuLogCT\Error.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\OutpuLogCT\Normal.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\OutpuLogCT\OutpuLogCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\OutpuLogCT\Up.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\All.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Book.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Bt.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Game.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Movie.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Music.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Phone.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Picture.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\SobarIconCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\SobarIconCT\Software.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Error.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\hashing.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\OK.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Pause.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Pin.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Schedule.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Start.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\TaskListCT.xml c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Upload.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\ShadowGrayBlue\TaskListCT\Wait.bmp c:\program files\FlashGet Network\FlashGet universal\Skins\Thumbs.db c:\program files\FlashGet Network\FlashGet universal\storage.dll c:\program files\FlashGet Network\FlashGet universal\SysOpt.exe c:\program files\FlashGet Network\FlashGet universal\transaction.log c:\program files\FlashGet Network\FlashGet universal\uninst.exe c:\program files\FlashGet Network\FlashGet universal\zlib.dll C:\resycled c:\resycled\boot.com c:\windows\system32\c.ico c:\windows\system32\drivers\msqpdxqroepkeo.sys c:\windows\system32\m.ico c:\windows\system32\msqpdxxxlmnbai.dll c:\windows\system32\p.ico c:\windows\system32\s.ico . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_MSQPDXSERV.SYS ((((((((((((((((((((((((( Pliki utworzone od 2008-12-07 do 2009-01-07 ))))))))))))))))))))))))))))))) . 2009-01-07 14:10 . 2009-01-07 14:10 <DIR> d-------- C:\32788R22FWJFW 2009-01-07 13:04 . 2009-01-07 13:04 <DIR> d-------- c:\program files\extravideo 2009-01-07 13:04 . 2009-01-07 13:04 21,446 --a------ c:\windows\system32\sf.ico 2009-01-07 13:04 . 2009-01-07 13:04 13,942 --a------ c:\windows\system32\m3.ico 2009-01-07 13:04 . 2009-01-07 13:04 3,095 --a------ c:\windows\ios.dat 2009-01-04 13:57 . 2009-01-04 13:59 <DIR> d-------- c:\program files\WinISO 2009-01-04 13:55 . 2009-01-04 13:55 <DIR> d-------- C:\Codemasters 2009-01-04 13:54 . 1998-10-07 12:54 327,168 --a------ c:\windows\IsUn0415.exe 2009-01-03 14:52 . 2009-01-03 14:52 <DIR> d-------- c:\program files\CoreFTP 2009-01-03 14:52 . 2009-01-03 14:54 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\CoreFTP 2009-01-03 14:47 . 2009-01-03 14:47 <DIR> d-------- C:\Downloads 2009-01-03 14:47 . 2009-01-03 14:47 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\GrabPro 2009-01-03 14:46 . 2009-01-03 14:50 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\Orbit 2009-01-03 14:44 . 2009-01-03 14:44 <DIR> d-------- c:\windows\Desktop 2009-01-03 14:44 . 2009-01-03 14:44 <DIR> d-------- C:\FreshDownloaded 2009-01-03 14:43 . 2009-01-03 14:43 <DIR> d-------- c:\program files\FreshDevices 2008-12-31 20:05 . 2008-12-31 20:05 <DIR> d-------- c:\program files\Celestia 2008-12-29 20:05 . 2008-12-29 20:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-29 20:04 . 2008-12-29 20:04 <DIR> d-------- c:\program files\Xilisoft 2008-12-29 20:04 . 2008-12-29 20:04 <DIR> d-------- c:\program files\QuickTime 2008-12-29 20:04 . 2008-12-29 20:04 420 --a------ c:\windows\Konwerter_3GP_Na_AVI.INI 2008-12-29 19:47 . 2008-12-29 19:48 <DIR> d-------- c:\documents and settings\Tomek\Phone Browser 2008-12-29 19:46 . 2008-12-29 19:46 <DIR> d-------- c:\program files\DIFX 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\program files\Nokia 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\program files\Common Files\PCSuite 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\program files\Common Files\Nokia 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Suite 2008-12-29 19:45 . 2006-03-24 08:32 127,488 --a------ c:\windows\system32\drivers\nmwcd.sys 2008-12-29 19:45 . 2006-03-24 08:31 48,128 --a------ c:\windows\system32\nmwcdcls.dll 2008-12-29 19:45 . 2006-03-24 08:32 31,232 --a------ c:\windows\system32\nmwcdcocls.dll 2008-12-29 19:45 . 2006-03-24 08:32 13,312 --a------ c:\windows\system32\drivers\nmwcdcm.sys 2008-12-29 19:45 . 2006-03-24 08:32 13,312 --a------ c:\windows\system32\drivers\nmwcdcj.sys 2008-12-29 19:45 . 2006-03-24 08:32 8,704 --a------ c:\windows\system32\drivers\nmwcdc.sys 2008-12-29 19:45 . 2006-03-24 08:31 4,608 --a------ c:\windows\system32\nmwcdlog.dll 2008-12-29 19:44 . 2008-12-29 19:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Downloaded Installations 2008-12-25 16:07 . 2008-12-25 16:07 <DIR> d-------- c:\program files\Codemasters 2008-12-25 14:08 . 2008-12-25 14:25 <DIR> d-------- c:\windows\system32\Adobe 2008-12-24 11:25 . 2008-12-24 11:29 697 --a------ c:\windows\HowardsSpec 2008-12-15 16:52 . 2008-12-15 16:52 <DIR> d---s---- c:\documents and settings\Tomek\UserData 2008-12-15 15:12 . 2008-12-15 15:12 <DIR> d-------- c:\program files\GoldWave 2008-12-12 18:37 . 2008-12-12 18:37 <DIR> d-------- c:\program files\Piechnat Soft 2008-12-12 18:37 . 2008-12-12 18:37 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\Piechnat Soft 2008-12-09 17:28 . 2008-12-09 17:28 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP 2008-12-09 17:27 . 2008-12-09 17:28 <DIR> d-------- c:\program files\Common Files\HP 2008-12-09 17:25 . 2008-12-09 17:25 <DIR> d-------- c:\program files\Hewlett-Packard 2008-12-09 17:24 . 2008-12-09 17:24 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard 2008-12-09 17:23 . 2005-03-08 05:43 51,120 -ra------ c:\windows\system32\drivers\HPZid412.sys 2008-12-09 17:23 . 2005-03-08 05:43 21,744 -ra------ c:\windows\system32\drivers\HPZius12.sys 2008-12-09 17:23 . 2005-03-08 05:43 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys 2008-12-09 17:23 . 2006-09-13 18:19 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-12-09 17:22 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe 2008-12-09 17:22 . 2004-09-29 12:12 278,584 --a------ c:\windows\system32\HPZidr12.dll 2008-12-09 17:22 . 2004-09-29 12:15 204,800 --a------ c:\windows\system32\HPZipr12.dll 2008-12-09 17:22 . 2004-09-29 12:09 94,208 --a------ c:\windows\system32\HPZipt12.dll 2008-12-09 17:22 . 2004-09-29 12:14 69,632 --a------ c:\windows\system32\HPZipm12.exe 2008-12-09 17:22 . 2004-09-29 12:08 61,440 --a------ c:\windows\system32\HPZinw12.exe 2008-12-09 17:22 . 2004-09-29 12:09 57,344 --a------ c:\windows\system32\HPZisn12.dll 2008-12-09 17:20 . 2008-12-09 17:27 <DIR> d-------- c:\program files\HP 2008-12-09 17:13 . 2008-12-09 17:29 113,574 --a------ c:\windows\hpoins07.dat 2008-12-09 17:13 . 2005-05-24 09:22 21,124 --------- c:\windows\hpomdl07.dat 2008-12-09 17:11 . 2006-09-13 18:18 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-12-09 17:11 . 2006-09-13 18:18 25,856 --a------ c:\windows\system32\drivers\usbprint.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-06 15:56 --------- d-----w c:\documents and settings\Tomek\Dane aplikacji\Tlen.pl 2008-12-30 19:57 --------- d-----w c:\program files\Soulseek 2008-12-30 19:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania 2008-12-25 15:07 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-15 16:54 --------- d-----w c:\documents and settings\Tomek\Dane aplikacji\Image Zone Express 2008-12-02 16:12 --------- d-----w c:\program files\Gadu-Gadu 2008-11-28 13:48 --------- d-----w c:\program files\Tlen.pl 2008-11-27 20:31 --------- d-----w c:\program files\CCleaner 2008-11-22 11:08 --------- d-----w c:\program files\Avira 2008-11-22 11:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Avira 2008-11-22 10:33 685,576 ----a-w c:\windows\unins001.exe 2008-11-21 10:32 --------- d-----w c:\program files\WinHTTrack 2008-11-21 10:13 --------- d-----w c:\program files\FlashFXP 2008-11-21 10:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FlashFXP 2008-11-20 18:29 --------- d-----w c:\program files\Microsoft ActiveSync 2008-11-18 14:52 --------- d-----w c:\program files\Audacity 2008-11-17 18:52 --------- d-----w c:\program files\Winamp 2008-11-17 16:27 --------- d-----w c:\program files\Vimicro 2008-11-17 16:27 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-11 07:31 --------- d-----w c:\documents and settings\Tomek\Dane aplikacji\uTorrent 2008-11-10 12:57 --------- d-----w c:\program files\PopCap Games 2008-11-10 09:57 --------- d-----w c:\program files\VstPlugins 2008-11-10 09:56 695,642 ----a-w c:\windows\unins000.exe 2008-11-10 09:39 --------- d-----w c:\program files\uTorrent 2008-11-09 16:13 --------- d-----w c:\program files\Google 2008-11-04 16:40 16,376 ----a-w c:\windows\gdrv.sys 2008-11-04 16:37 315,392 ----a-w c:\windows\HideWin.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000] "PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 1409024] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016] "WinampAgent"="c:\program files\Winamp\Winampa.exe" [2001-01-11 7680] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920] "BigDog303"="c:\windows\VM303_STI.EXE" [2005-06-23 61440] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152] "PCSuiteTrayApplication"="c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 237568] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-04-19 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\TmUnitedForever\\TmForever.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Soulseek\\slsk.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\\Program Files\\FlashFXP\\FlashFXP.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5af0479a-aa93-11dd-8dff-806d6172696f}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com c: \Shell\Open\command - c:\resycled\boot.com c: [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6525677c-ab57-11dd-a92b-806d6172696f}] \Shell\AutoRun\command - E:\PrawkoB.exe . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{D804F606-DC8A-4ECD-9FF7-10390305239B} - c:\windows\system32\fkinjzg.dll . ------- Skan uzupełniający ------- . IE: &Download All by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm IE: &Download by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm IE: {{A80E3187-D679-4EBF-9CD6-317DB95F1485} - c:\program files\FreshDevices\FreshDownload\fd.exe . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-07 14:16:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog303 = c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@?????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-07 14:17:13 ComboFix-quarantined-files.txt 2009-01-07 13:17:12 Przed: 12,926,783,488 bajtów wolnych Po: 12,907,954,176 bajtów wolnych 472

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:25:05, on 2009-01-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Opera\opera.exe C:\Documents and Settings\Tomek\Pulpit\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (file missing) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll (file missing) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: FreshDownload - {A80E3187-D679-4EBF-9CD6-317DB95F1485} - C:\Program Files\FreshDevices\FreshDownload\fd.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.45,85.255.112.172 O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- End of file - 5250 bytes

**Posty:** 18165 · przez **wojtas** 07 Sty 2009, 17:01

skasuj:

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.45,85.255.112.172

Ściągnij program Fixwareout i zastosuj go

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\sf.ico
c:\windows\system32\m3.ico

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5af0479a-aa93-11dd-8dff-806d6172696f}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 1850 · przez **Tomaszu** 07 Sty 2009, 18:03

Ok, zrobione co napisałeś. Log po:

Kod: Zaznacz wszystko: ComboFix 09-01-06.02 - Tomek 2009-01-07 16:59:28.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2046.1620 [GMT 1:00] Uruchomiony z: c:\documents and settings\Tomek\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Tomek\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: c:\windows\system32\m3.ico c:\windows\system32\sf.ico . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\m3.ico c:\windows\system32\sf.ico . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-07 do 2009-01-07 ))))))))))))))))))))))))))))))) . 2009-01-07 16:55 . 2009-01-07 16:55 <DIR> d-------- c:\windows\system32\xircom 2009-01-07 16:55 . 2009-01-07 16:57 <DIR> d--hs---- c:\windows\system32\dllcache 2009-01-07 16:55 . 2009-01-07 16:55 <DIR> d-------- c:\program files\microsoft frontpage 2009-01-07 16:54 . 2009-01-07 16:56 <DIR> d-------- C:\fixwareout 2009-01-07 13:04 . 2009-01-07 13:04 <DIR> d-------- c:\program files\extravideo 2009-01-07 13:04 . 2009-01-07 13:04 3,095 --a------ c:\windows\ios.dat 2009-01-04 13:57 . 2009-01-04 13:59 <DIR> d-------- c:\program files\WinISO 2009-01-04 13:55 . 2009-01-04 13:55 <DIR> d-------- C:\Codemasters 2009-01-04 13:54 . 1998-10-07 12:54 327,168 --a------ c:\windows\IsUn0415.exe 2009-01-03 14:52 . 2009-01-03 14:52 <DIR> d-------- c:\program files\CoreFTP 2009-01-03 14:52 . 2009-01-03 14:54 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\CoreFTP 2009-01-03 14:47 . 2009-01-03 14:47 <DIR> d-------- C:\Downloads 2009-01-03 14:47 . 2009-01-03 14:47 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\GrabPro 2009-01-03 14:46 . 2009-01-03 14:50 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\Orbit 2009-01-03 14:44 . 2009-01-03 14:44 <DIR> d-------- c:\windows\Desktop 2009-01-03 14:44 . 2009-01-03 14:44 <DIR> d-------- C:\FreshDownloaded 2009-01-03 14:43 . 2009-01-03 14:43 <DIR> d-------- c:\program files\FreshDevices 2008-12-31 20:05 . 2008-12-31 20:05 <DIR> d-------- c:\program files\Celestia 2008-12-29 20:05 . 2008-12-29 20:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-29 20:04 . 2008-12-29 20:04 <DIR> d-------- c:\program files\Xilisoft 2008-12-29 20:04 . 2008-12-29 20:04 <DIR> d-------- c:\program files\QuickTime 2008-12-29 20:04 . 2008-12-29 20:04 420 --a------ c:\windows\Konwerter_3GP_Na_AVI.INI 2008-12-29 19:47 . 2008-12-29 19:48 <DIR> d-------- c:\documents and settings\Tomek\Phone Browser 2008-12-29 19:46 . 2008-12-29 19:46 <DIR> d-------- c:\program files\DIFX 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\program files\Nokia 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\program files\Common Files\PCSuite 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\program files\Common Files\Nokia 2008-12-29 19:45 . 2008-12-29 19:45 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Suite 2008-12-29 19:45 . 2006-03-24 08:32 127,488 --a------ c:\windows\system32\drivers\nmwcd.sys 2008-12-29 19:45 . 2006-03-24 08:31 48,128 --a------ c:\windows\system32\nmwcdcls.dll 2008-12-29 19:45 . 2006-03-24 08:32 31,232 --a------ c:\windows\system32\nmwcdcocls.dll 2008-12-29 19:45 . 2006-03-24 08:32 13,312 --a------ c:\windows\system32\drivers\nmwcdcm.sys 2008-12-29 19:45 . 2006-03-24 08:32 13,312 --a------ c:\windows\system32\drivers\nmwcdcj.sys 2008-12-29 19:45 . 2006-03-24 08:32 8,704 --a------ c:\windows\system32\drivers\nmwcdc.sys 2008-12-29 19:45 . 2006-03-24 08:31 4,608 --a------ c:\windows\system32\nmwcdlog.dll 2008-12-29 19:44 . 2008-12-29 19:44 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Downloaded Installations 2008-12-25 16:07 . 2008-12-25 16:07 <DIR> d-------- c:\program files\Codemasters 2008-12-25 14:08 . 2008-12-25 14:25 <DIR> d-------- c:\windows\system32\Adobe 2008-12-24 11:25 . 2008-12-24 11:29 697 --a------ c:\windows\HowardsSpec 2008-12-15 16:52 . 2008-12-15 16:52 <DIR> d---s---- c:\documents and settings\Tomek\UserData 2008-12-15 15:12 . 2008-12-15 15:12 <DIR> d-------- c:\program files\GoldWave 2008-12-12 18:37 . 2008-12-12 18:37 <DIR> d-------- c:\program files\Piechnat Soft 2008-12-12 18:37 . 2008-12-12 18:37 <DIR> d-------- c:\documents and settings\Tomek\Dane aplikacji\Piechnat Soft 2008-12-09 17:28 . 2008-12-09 17:28 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP 2008-12-09 17:27 . 2008-12-09 17:28 <DIR> d-------- c:\program files\Common Files\HP 2008-12-09 17:25 . 2008-12-09 17:25 <DIR> d-------- c:\program files\Hewlett-Packard 2008-12-09 17:24 . 2008-12-09 17:24 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard 2008-12-09 17:23 . 2005-03-08 05:43 51,120 -ra------ c:\windows\system32\drivers\HPZid412.sys 2008-12-09 17:23 . 2005-03-08 05:43 21,744 -ra------ c:\windows\system32\drivers\HPZius12.sys 2008-12-09 17:23 . 2005-03-08 05:43 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys 2008-12-09 17:23 . 2006-09-13 18:19 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-12-09 17:22 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe 2008-12-09 17:22 . 2004-09-29 12:12 278,584 --a------ c:\windows\system32\HPZidr12.dll 2008-12-09 17:22 . 2004-09-29 12:15 204,800 --a------ c:\windows\system32\HPZipr12.dll 2008-12-09 17:22 . 2004-09-29 12:09 94,208 --a------ c:\windows\system32\HPZipt12.dll 2008-12-09 17:22 . 2004-09-29 12:14 69,632 --a------ c:\windows\system32\HPZipm12.exe 2008-12-09 17:22 . 2004-09-29 12:08 61,440 --a------ c:\windows\system32\HPZinw12.exe 2008-12-09 17:22 . 2004-09-29 12:09 57,344 --a------ c:\windows\system32\HPZisn12.dll 2008-12-09 17:20 . 2008-12-09 17:27 <DIR> d-------- c:\program files\HP 2008-12-09 17:13 . 2008-12-09 17:29 113,574 --a------ c:\windows\hpoins07.dat 2008-12-09 17:13 . 2005-05-24 09:22 21,124 --------- c:\windows\hpomdl07.dat 2008-12-09 17:11 . 2006-09-13 18:18 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-12-09 17:11 . 2006-09-13 18:18 25,856 --a------ c:\windows\system32\drivers\usbprint.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-06 15:56 --------- d-----w c:\documents and settings\Tomek\Dane aplikacji\Tlen.pl 2008-12-30 19:57 --------- d-----w c:\program files\Soulseek 2008-12-30 19:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania 2008-12-25 15:07 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-15 16:54 --------- d-----w c:\documents and settings\Tomek\Dane aplikacji\Image Zone Express 2008-12-02 16:12 --------- d-----w c:\program files\Gadu-Gadu 2008-11-28 13:48 --------- d-----w c:\program files\Tlen.pl 2008-11-27 20:31 --------- d-----w c:\program files\CCleaner 2008-11-22 11:08 --------- d-----w c:\program files\Avira 2008-11-22 11:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Avira 2008-11-22 10:33 685,576 ----a-w c:\windows\unins001.exe 2008-11-21 10:32 --------- d-----w c:\program files\WinHTTrack 2008-11-21 10:13 --------- d-----w c:\program files\FlashFXP 2008-11-21 10:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FlashFXP 2008-11-20 18:29 --------- d-----w c:\program files\Microsoft ActiveSync 2008-11-18 14:52 --------- d-----w c:\program files\Audacity 2008-11-17 18:52 --------- d-----w c:\program files\Winamp 2008-11-17 16:27 --------- d-----w c:\program files\Vimicro 2008-11-17 16:27 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-11 07:31 --------- d-----w c:\documents and settings\Tomek\Dane aplikacji\uTorrent 2008-11-10 12:57 --------- d-----w c:\program files\PopCap Games 2008-11-10 09:57 --------- d-----w c:\program files\VstPlugins 2008-11-10 09:56 695,642 ----a-w c:\windows\unins000.exe 2008-11-10 09:39 --------- d-----w c:\program files\uTorrent 2008-11-09 16:13 --------- d-----w c:\program files\Google 2008-11-04 16:40 16,376 ----a-w c:\windows\gdrv.sys 2008-11-04 16:37 315,392 ----a-w c:\windows\HideWin.exe . ((((((((((((((((((((((((((((( snapshot@2009-01-07_14.16.40.67 ))))))))))))))))))))))))))))))))))))))))) . + 2006-09-13 16:19:38 1,852,928 ----a-w c:\windows\system32\dllcache\acgenral.dll + 2004-08-04 00:43:52 450,048 ----a-w c:\windows\system32\dllcache\aclayers.dll + 2004-08-04 00:43:52 244,736 ----a-w c:\windows\system32\dllcache\acspecfc.dll + 2004-08-04 00:43:52 116,224 ----a-w c:\windows\system32\dllcache\acxtrnal.dll + 2004-08-04 00:44:18 98,304 ----a-w c:\windows\system32\dllcache\ahui.exe + 2004-08-04 00:43:54 126,976 ----a-w c:\windows\system32\dllcache\apphelp.dll + 2004-08-04 00:43:54 65,024 ----a-w c:\windows\system32\dllcache\asycfilt.dll + 2004-08-04 00:43:54 30,208 ----a-w c:\windows\system32\dllcache\atmlib.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000] "PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 1409024] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016] "WinampAgent"="c:\program files\Winamp\Winampa.exe" [2001-01-11 7680] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920] "BigDog303"="c:\windows\VM303_STI.EXE" [2005-06-23 61440] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152] "PCSuiteTrayApplication"="c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 237568] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-04-19 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\TmUnitedForever\\TmForever.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Soulseek\\slsk.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\\Program Files\\FlashFXP\\FlashFXP.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service . . ------- Skan uzupełniający ------- . IE: &Download All by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm IE: &Download by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm IE: {{A80E3187-D679-4EBF-9CD6-317DB95F1485} - c:\program files\FreshDevices\FreshDownload\fd.exe . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-07 17:01:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog303 = c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@?????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-07 17:02:23 ComboFix-quarantined-files.txt 2009-01-07 16:02:18 ComboFix2.txt 2009-01-07 13:17:14 Przed: 12 879 474 688 bajtów wolnych Po: 12,871,229,440 bajtów wolnych 200

**Posty:** 18165 · przez **wojtas** 07 Sty 2009, 22:58

to na kasacje:

c:\windows\ios.dat

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.