Trojan mnie dopadł

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 13:07

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe

fix w hj

gdzie jest sdfix :?:

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 13:22

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:18, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6313 bytes

Kod: Zaznacz wszystko: [b]SDFix: Version 1.215 [/b] Run by Administrator on 2008-08-12 at 13:14 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\kdxqf.exe - Deleted C:\WINDOWS\system32\10.tmp - Deleted C:\WINDOWS\system32\11.tmp - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-12 13:16:32 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] "OODEFRAG10.00.00.01WORKSTATION"="BE210913AD7E079E8D82052A008CD8844B6CED3653CEFA0D74F0877F85777151648E9DCED0B3292C76D6142B732E5EB333E00BFCE7F3FAF10F13116E2A9E9878B9AC64278ECA0B40FD37495525EEF35BAAB2E786B66E77F1981BC1CC450C6C97B140B1BA2624B0E99766022CA6BA797EC93D8CDAC154492668256BC96BA5DD7D053F3F7F5E9145CB7D5701888DF073B5E81462D890B1EBBA9A80416932C40009B0D72ABAFED7969BAB346C197363852B26FCBAB02D07006F8EACDC81B5B50E31F266F30AD3B11623E457CFDBF5DA7D1F66FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667BA7FD869164D6794A6A0AC4980AC79332775EE4B453EA0559883CD0E6B49937D530C028FEA274DA3EA125AE1104E4B375F1AB142413B001387F9767CC91108E7C040095EF4BCA63C77A1DFC37AB399FD787F7E2ABFBD381D1876C257DA5062B9A3067A8EFA75C5E42A3D4ADC0ACBE7F10A01E9E6B10E89CBDF5D2B541F29DBECAF69D1492A6FF7D9EF383CE4374E362E605A5B60FC194C3DA6F2FCAE88633EC147D9E2B6206A1D186DCB2D97EE149A92F9AE8E047BF2E8D16863D8A17E69E7B787AA5305744929E47914E73512173F448A8192C3FCD0DE2F56BC3271DA4A4D973B131DE82B9424C59C910B00F47A60AB7A3E4C11C10CBE3FD5EF5362EEB8F569E5AF8D98C377AB0716A90AC061024EF3E4B1F2680123B12D7F55583DFB0CFBFB3BFD454DABC2EEB6D8A22AC21597F00E188C924364B7EEEB1D2633513ABF90E1A5E1BC46C8E9B3A80B2B0755BF483F2D98640BA3098FC6AF328127EFD2F0F47143A43BC77105CFF487D18F4C07C3C7CA1F330F8E01951BF1F1694D6EE6E481C3E4EEDF95F34FB0F45C8C070004602BA115D5A80CD3D5E16F45C39226097F21388F521B7D0EA95748CCB183CBC3951FB21C0E3129FA03252AC7DBB7F43ECED36F7E41B44CF498D6D2CE00EE8E47816DC2068059F5647404664CE052BC84FEAB519D12C45450C159BB0D17892C836471D85AB7A48770A1302E5462CA62C9E451068E823A6DBB73196E6679E68D61A29EC155216C7677296F4E9A595CD06FF6FEFD273056F1C81B6797EB926A9CBD46F88CE68C5A5F434F9C578A9F9AF5CECF046A719FAEBF7A4F27ADE62D52CAEAFB1A0F32B1EEE21077A69F4572E741B1AEC4C0AAB72EBA484653E5CEF92C092C14AEDF8D27FEA6122B8EBE1FF5FDAAD775363C45C390C71F5BF53B540DD9523B04795C076D31D16D9A6C13A0AEE92AF32CE6D9E4F2E8D3DD10AF6FD85F1320C4644EA4DBE202903E16E83D86890B3E2C7D73DCE3599C4BDA87B581734CE272EAF1971C00CFBF95909342A241D198689C38104A4F6D66A25B0ACFBBEE96274EC10ED1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Fri 8 Aug 2008 5 A.SH. --- "C:\WINDOWS\system32\acae9_s.dll" Thu 7 Aug 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Thu 7 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3dbc83ff5f16e1a91f17471a2831f4be\BITB.tmp" [b]Finished![/b]

I jak teraz sytuacja wygląda? Ta chora ikonka nadal jest

**Posty:** 684 · przez **djarta** 12 Sie 2008, 13:25

Gdzie znajduję się ta ikonka?Spróbuj dać log z ComboFixa ( http://www.forum.idg.pl/lofiversion/index.php/t118804.html ) , sorry za linkowanie ale na tej stronce znajduję się najnowsza wersja ComboFixa z lwem,jeszcze raz sorry.

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 13:26

djarta, przy robieniu loga CF mam jaja typu niebieski czyściutki ekran.
Acha, a ikonka siedzi sobie na pulpicie.

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 13:30

w awaryjnym fixujesz to:

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

wracasz z cf (z awaryjnego powinien pojsc) albo z dss'em jesli nie pojdzie combo

**Posty:** 684 · przez **djarta** 12 Sie 2008, 13:31

A jaką masz wersję ComboFixa?Z lwem czy krzyżykiem?

Muszę coś i gdzieś dodać. Przestańcie wypisywać. Ja widzę że kolega się nie zna i jest mu trudno a tu ciągle coś piszecie. Niech "1 OSOBA" zajmie się pomocą bo wg mnie w tym temacie już się zrobił taki mętlik że mało to pomaga osobie poszkodowanej

EDIT by ToServeAndProtect

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 13:59

No i znów jaja. CF zrobił mi czysty ekran, podpoarłem się przywracaniem systemu i d... blada. Całe g.. pewnie znów mam.
Niestety teraz muszę wyjść i będę ok 18-ej. Czy mogę liczxyć na pomoc?
djarta, CF mam z lwem. Z krzyżykiem mam DSS.

**Posty:** 684 · przez **djarta** 12 Sie 2008, 14:01

Zapisz go tak:
Combo-Fix.exe z kreseczką pomiędzy,wyłącz wszystkie programy,zmień datę o parę miesięcy,jeśli to nie pomoże to dasz znowu log z DSS i będziemy myśleli. :wink:

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 14:02

djarta, będę po 18-ej. szczerze mówiąc jednak mam już dość CF-a. tyle roboty okoczy poszło się walić. aż mi głupio

Dodano 12.08.2008 16:20:25:
Udało mi się wcześniej wrócić. Może mi ktoś pomóc w usuwaniu syfu? Oto log :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:19, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6587 bytes

**Posty:** 684 · przez **djarta** 12 Sie 2008, 18:24

Daj log z DSS.Spróbuj uruchomić ComboFixa,napisałem na górze co masz zrobić.Cały czas jest ten wpis. :3:

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 18:34

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by darek on 2008-08-12 18:29:29 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 8: 2008-08-12 16:29:34 UTC - RP8 - Deckard's System Scanner Restore Point 7: 2008-08-12 15:40:15 UTC - RP7 - Zainstalowany Kaspersky Internet Security 2009. 6: 2008-08-12 11:50:43 UTC - RP6 - Operacja przywracania 5: 2008-08-12 10:34:55 UTC - RP5 - Deckard's System Scanner Restore Point 4: 2008-08-12 10:18:18 UTC - RP4 - Operacja przywracania -- First Restore Point -- 1: 2008-08-12 09:47:38 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as darek.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:30, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe E:\POBIERANIE PLIKÓW\dss.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\darek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe (file missing) O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 7088 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080812-112609-232 O4 - HKLM\..\Run: [SMrhcjj0j0ecep] C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe backup-20080812-112609-315 O4 - HKLM\..\Run: [lphcnj0j0ecep] C:\WINDOWS\system32\lphcnj0j0ecep.exe backup-20080812-112609-407 O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe backup-20080812-122704-563 O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe backup-20080812-125116-532 O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe backup-20080812-132428-169 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k backup-20080812-132428-252 O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe backup-20080812-175953-798 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 CX23880 (WinFast CX2388x WDM Video Capture.) - c:\windows\system32\drivers\cx88vid.sys <Not Verified; Leadtek Research Inc.; CX2388x Video Capture Driver> R2 CXAVXBAR (WinFast CX2388x WDM Crossbar.) - c:\windows\system32\drivers\cxavxbar.sys <Not Verified; Leadtek Research Inc.; CX2388x AVStream Crossbar Driver> R2 CXTUNE (WinFast CX2388x WDM TVTuner.) - c:\windows\system32\drivers\cx88tune.sys <Not Verified; Leadtek Research Inc.; CX2388x Tuner Driver> R2 TopWinPoETDriver (WinPoET PPPoE Optimized Driver) - c:\windows\system32\drivers\wrkpoet2000.sys R3 FPD (Fine Point Packet Service) - c:\windows\system32\drivers\fpd.sys <Not Verified; Politecnico di Torino; NPF Driver> R3 WrKPoET2000 - c:\program files\dialnet\wrkpoet2000.sys S3 WFIOCTL - c:\program files\winfast\wftvfm\wfioctl.sys <Not Verified; Leadtek Research Inc.; WinFast MultiMedia Device Driver (Windows 2000/XP)> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 WinPPPoverEthernet - c:\program files\dialnet\wros.exe <Not Verified; Fine Point Technologies, Inc.; Fine Point WROS> S2 avast! Antivirus - "c:\program files\alwil software\avast4\ashserv.exe" (file missing) S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia E65 Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia E65 PNP Device ID: ROOT\WPD\0000 Service: WUDFRd -- Files created between 2008-07-12 and 2008-08-12 ----------------------------- 2008-08-12 17:58:07 0 d-------- C:\WINDOWS\LastGood 2008-08-12 17:40:47 96976 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-08-12 17:40:47 87855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-08-12 17:40:24 204832 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-12 17:40:24 1078816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-12 17:40:24 0 d-------- C:\Program Files\Kaspersky Lab 2008-08-12 13:51:12 0 d-------- C:\Program Files\rhcjj0j0ecep 2008-08-12 13:51:12 0 d-------- C:\ComboFix(2) 2008-08-12 13:13:24 0 d-------- C:\WINDOWS\ERUNT 2008-08-12 09:40:18 0 d-------- C:\Program Files\Trend Micro 2008-08-12 09:05:40 0 d-------- C:\Nod32 v2.5 2008-08-11 23:14:33 14336 --a------ C:\WINDOWS\system32\el32.dll 2008-08-11 10:49:28 0 d-------- C:\Program Files\Common Files\PCSuite 2008-08-11 10:49:27 0 d-------- C:\Program Files\Common Files\Nokia 2008-08-11 10:49:13 0 d-------- C:\Program Files\PC Connectivity Solution 2008-08-10 21:25:12 0 d-------- C:\WINDOWS\system32\oodag 2008-08-08 20:57:11 0 d-------- C:\WINDOWS\Sun 2008-08-08 18:13:19 5 --ahs---- C:\WINDOWS\system32\acae9_s.dll 2008-08-08 17:35:23 210032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL 2008-08-07 20:17:32 0 d-------- C:\WINDOWS\pss 2008-08-07 19:08:22 86016 --a------ C:\WINDOWS\system32\CNMCP66.exe <Not Verified; CANON INC.; Canon BJ Raster Printer Driver Installer> 2008-08-07 19:08:18 0 d--h----- C:\BJPrinter 2008-08-07 15:10:04 0 d-------- C:\Program Files\Common Files\Ulead Systems 2008-08-07 15:09:35 49152 --a------ C:\WINDOWS\system32\TempDel.EXE <Not Verified; Leadtek Research Inc.; Leadtek Research Inc. TempDel> 2008-08-07 15:09:33 9446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys <Not Verified; Leadtek Research Inc.; WinFast MultiMedia Device Driver (Windows 2000/XP)> 2008-08-07 15:09:30 0 d-------- C:\Program Files\WinFast 2008-08-07 15:06:50 0 d-------- C:\WINDOWS\system32\WinFast 2008-08-07 15:06:50 9728 --a------ C:\WINDOWS\system32\drivers\cxavxbar.sys <Not Verified; Leadtek Research Inc.; CX2388x AVStream Crossbar Driver> 2008-08-07 15:06:50 162944 --a------ C:\WINDOWS\system32\drivers\cx88vid.sys <Not Verified; Leadtek Research Inc.; CX2388x Video Capture Driver> 2008-08-07 15:06:50 50816 --a------ C:\WINDOWS\system32\drivers\cx88tune.sys <Not Verified; Leadtek Research Inc.; CX2388x Tuner Driver> 2008-08-07 15:06:49 0 d-------- C:\Program Files\Leadtek Research Inc 2008-08-07 14:40:03 0 d--hs---- C:\WINDOWS\Installer 2008-08-07 14:40:02 0 d-------- C:\Program Files\Common Files\ODBC 2008-08-07 14:40:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-08-07 14:40:00 0 dr------- C:\Program Files 2008-08-07 14:40:00 0 d-------- C:\Program Files\Common Files 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot 2008-08-07 14:37:31 0 d--hs---- C:\System Volume Information 2008-08-07 14:37:31 0 d-------- C:\Documents and Settings 2008-08-07 14:34:20 0 d-------- C:\WINDOWS 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\WinSxS 2008-08-07 14:34:20 0 dr------- C:\WINDOWS\Web 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\twain_32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wins 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wbem 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\usmt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\spool 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ShellExt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\Setup 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ras 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\oobe 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\npp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\inetsrv 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\IME 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\icsxml 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ias 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\export 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-08-07 14:34:20 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\dhcp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3076 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\2052 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1054 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1045 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1042 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1041 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1037 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1033 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1031 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1028 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1025 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\security 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Resources 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\repair 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Provisioning 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\PeerNet 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\pchealth 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msapps 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msagent 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Media 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\java 2008-08-07 14:34:20 0 d--h----- C:\WINDOWS\inf 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ime 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Help 2008-08-07 14:34:20 0 dr--s---- C:\WINDOWS\Fonts 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ehome 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Driver Cache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Debug 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Cursors 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Connection Wizard 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\AppPatch 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\addins 2008-08-07 14:03:51 0 d-------- C:\Program Files\Microsoft Works 2008-08-07 14:03:45 0 d-------- C:\Program Files\MSBuild 2008-08-07 14:00:58 0 d-------- C:\WINDOWS\SHELLNEW 2008-08-07 14:00:23 0 dr-h----- C:\MSOCache 2008-08-07 13:54:04 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-07 13:50:54 0 d-------- C:\Program Files\Opera 2008-08-07 13:39:52 0 d-------- C:\WINDOWS\Prefetch 2008-08-07 13:38:15 0 d-------- C:\WINDOWS\system32\PreInstall 2008-08-07 13:38:14 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-08-07 13:35:39 0 d-------- C:\WINDOWS\system32\pl-pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\bits 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\l2schemas 2008-08-07 13:33:55 0 d-------- C:\WINDOWS\ServicePackFiles 2008-08-07 13:32:18 0 d-------- C:\WINDOWS\network diagnostic 2008-08-07 13:27:24 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-08-07 13:24:03 30336 --a------ C:\WINDOWS\system32\drivers\fpd.sys <Not Verified; Politecnico di Torino; NPF Driver> 2008-08-07 13:23:55 1056768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL <Not Verified; Blue Sky Software Corporation.; RoboHELP Classic 2000> 2008-08-07 13:23:55 52214 --a------ C:\WINDOWS\system32\drivers\WrKPoET2000.sys 2008-08-07 13:23:53 0 d-------- C:\Program Files\DialNet 2008-08-07 13:19:47 0 d-------- C:\Program Files\Windows Media Connect 2 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\LogFiles 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-08-07 13:16:21 0 d-------- C:\Program Files\Common Files\Adobe 2008-08-07 13:14:46 364544 -----n--- C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4> 2008-08-07 13:14:46 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2008-08-07 13:14:45 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2008-08-07 13:14:45 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:44 0 d-------- C:\Program Files\Common Files\Ahead 2008-08-07 13:14:43 0 d-------- C:\Program Files\Ahead 2008-08-07 13:11:39 0 d-------- C:\Program Files\Java 2008-08-07 13:11:38 0 d-------- C:\Program Files\Common Files\Java 2008-08-07 13:11:00 0 d-------- C:\Program Files\IrfanView 2008-08-07 13:09:14 0 d-------- C:\Program Files\Google 2008-08-07 13:09:04 0 d-------- C:\Program Files\Skype 2008-08-07 13:09:04 0 d-------- C:\Program Files\Common Files\Skype 2008-08-07 13:08:15 0 d-------- C:\Program Files\Gadu-Gadu 2008-08-07 13:04:46 0 d-------- C:\Program Files\Alwil Software 2008-08-07 13:04:21 0 d-------- C:\Program Files\MarBit 2008-08-07 13:02:10 0 d-------- C:\Program Files\My Company Name 2008-08-07 13:01:15 0 d-------- C:\WINDOWS\nview 2008-08-07 12:59:16 0 d-------- C:\Program Files\XP Codec Pack 2008-08-07 12:53:09 0 d-------- C:\WINDOWS\system32\Lang 2008-08-07 12:52:13 49152 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-08-07 12:52:02 0 d-------- C:\WINDOWS\system32\RTCOM 2008-08-07 12:51:44 0 d-------- C:\Program Files\Realtek 2008-08-07 12:51:43 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-08-07 12:51:42 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-08-07 12:51:41 520192 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-08-07 12:51:38 0 d-------- C:\Program Files\Common Files\InstallShield 2008-08-07 12:51:18 0 d-------- C:\Program Files\DIFX 2008-08-07 12:51:17 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-08-07 12:51:15 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-08-07 12:50:53 1732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin 2008-08-07 12:48:38 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-08-07 12:48:35 0 d---s---- C:\WINDOWS\system32\Microsoft 2008-08-07 12:46:28 0 d-------- C:\WINDOWS\system32\xircom 2008-08-07 12:46:28 0 d-------- C:\Program Files\microsoft frontpage 2008-08-07 12:46:09 0 -rahs---- C:\MSDOS.SYS 2008-08-07 12:46:09 0 -rahs---- C:\IO.SYS 2008-08-07 12:46:09 0 --a------ C:\CONFIG.SYS 2008-08-07 12:46:09 0 --a------ C:\AUTOEXEC.BAT 2008-08-07 12:45:20 0 dr------- C:\WINDOWS\Offline Web Pages 2008-08-07 12:45:20 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-08-07 12:45:12 0 d--h----- C:\Program Files\WindowsUpdate 2008-08-07 12:45:10 0 d-------- C:\Program Files\Usługi online 2008-08-07 12:44:59 0 d-------- C:\WINDOWS\system32\DirectX 2008-08-07 12:44:35 0 d---s---- C:\WINDOWS\Tasks 2008-08-07 12:44:34 0 d-------- C:\Program Files\Common Files\MSSoap 2008-08-07 12:44:32 0 d-------- C:\WINDOWS\srchasst 2008-08-07 12:44:31 0 d-------- C:\WINDOWS\system32\Macromed 2008-08-07 12:44:26 0 d-------- C:\Program Files\Movie Maker 2008-08-07 12:44:21 0 d-------- C:\WINDOWS\system32\Restore 2008-08-07 12:43:53 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-08-07 12:43:40 0 d-------- C:\WINDOWS\Registration 2008-08-07 12:43:30 0 d-------- C:\Program Files\Messenger 2008-08-07 12:43:27 0 d-------- C:\Program Files\MSN Gaming Zone 2008-08-07 12:43:07 0 d-------- C:\Program Files\Windows NT 2008-08-07 12:43:05 0 d-------- C:\WINDOWS\system32\MsDtc 2008-08-07 12:43:04 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2008-08-12 17:45:57 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Skype 2008-08-11 12:35:49 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Corel 2008-08-11 10:52:29 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Nokia 2008-08-11 10:52:27 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\PC Suite 2008-08-08 17:24:20 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\AdobeUM 2008-08-07 23:20:24 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Media Player Classic 2008-08-07 23:20:12 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Adobe 2008-08-07 14:39:37 62 --ahs---- C:\Documents and Settings\darek\Dane aplikacji\desktop.ini 2008-08-07 14:28:41 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\WinRAR 2008-08-07 14:05:24 359178 --a------ C:\WINDOWS\system32\perfh015.dat 2008-08-07 14:05:24 50968 --a------ C:\WINDOWS\system32\perfc015.dat 2008-08-07 14:04:30 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Macromedia 2008-08-07 13:54:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Mozilla 2008-08-07 13:50:59 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Opera 2008-08-07 13:48:50 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Gadu-Gadu 2008-08-07 13:42:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Google 2008-08-07 13:11:45 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Sun 2008-08-07 12:50:48 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\InstallShield 2008-08-07 12:49:19 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Identities -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] 2008-08-12 17:49 62728 --a------ C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 09:52 C:\WINDOWS\RTHDCPL.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 12:43 C:\WINDOWS\Alcmtr.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-04-11 11:33] "nwiz"="nwiz.exe" [2008-04-11 11:33 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-04-11 11:33] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 22:05] "a-winpoet-service"="C:\Program Files\DialNet\winpppoverethernet.exe" [2007-07-06 08:40] "@"="C:\PROGRA~1\DialNet\FPLICE~1.exe" [2007-07-04 16:27] "z-WrDialer"="C:\Program Files\DialNet\wrdialer.exe" [2007-07-11 17:11] "C:\WINDOWS\system32\kdxqf.exe"="C:\WINDOWS\system32\kdxqf.exe" [2008-04-14 22:51] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 22:51] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-31 17:40] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=1 (0x1) "NoDispScrSavPage"=1 (0x1) "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="kdxqf.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-08-12 18:32:13 ------------

Oto log. Z CF są przeboje, bo po każdej próbie skanowania czyści mi pulpit.Zeby go odzyskać posiłkuję się przywracaniem systemu. A jedyny punkt przywracania mam z syfem. I tak do śmierci się można bujać

**Posty:** 684 · przez **djarta** 12 Sie 2008, 18:42

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\system32\kdxqf.exe C:\WINDOWS\system32\acae9_s.dll Folders to delete: C:\Program Files\rhcjj0j0ecep

Kopiujesz - klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

Potem:

Wklej do notatnika:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C:\WINDOWS\system32\kdxqf.exe"=-

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: "Wszystkie pliki" >>> Zapisz jako FIX.REG>>>
plik uruchom (dwuklik i OK- zgódź się na dodanie do Rejestru).
Zrestartuj komputer.

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 19:18

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\zip.exe" deleted successfully. File "C:\WINDOWS\swreg.exe" deleted successfully. File "C:\WINDOWS\grep.exe" deleted successfully. File "C:\WINDOWS\VFind.exe" deleted successfully. File "C:\WINDOWS\swxcacls.exe" deleted successfully. File "C:\WINDOWS\swsc.exe" deleted successfully. File "C:\WINDOWS\sed.exe" deleted successfully. File "C:\WINDOWS\fdsv.exe" deleted successfully. File "C:\WINDOWS\system32\pphcnj0j0ecep.exe" deleted successfully. File "C:\WINDOWS\system32\blphcnj0j0ecep.scr" deleted successfully. File "C:\WINDOWS\system32\lphcnj0j0ecep.exe" deleted successfully. Error: folder "C:\Program Files\rhcjj0j0ecep" not found! Deletion of folder "C:\Program Files\rhcjj0j0ecep" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Folder "C:\Documents and Settings\darek\Dane aplikacji\rhcjj0j0ecep" deleted successfully. Completed script processing. ******************* Finished! Terminate. Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Error: Script file not found! Could not open script file! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Abort! Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\system32\kdxqf.exe" deleted successfully. File "C:\WINDOWS\system32\acae9_s.dll" deleted successfully. Folder "C:\Program Files\rhcjj0j0ecep" deleted successfully. Completed script processing. ******************* Finished! Terminate.

**Posty:** 684 · przez **djarta** 12 Sie 2008, 19:19

Daj nowego loga z DSS.

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 19:28

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by darek on 2008-08-12 19:26:07 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as darek.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:26, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\POBIERANIE PLIKÓW\dss.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\darek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe (file missing) O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6951 bytes -- Files created between 2008-07-12 and 2008-08-12 ----------------------------- 2008-08-12 17:40:47 96976 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-08-12 17:40:47 87855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-08-12 17:40:24 237600 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-12 17:40:24 1953312 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-12 17:40:24 0 d-------- C:\Program Files\Kaspersky Lab 2008-08-12 13:51:12 0 d-------- C:\ComboFix(2) 2008-08-12 13:13:24 0 d-------- C:\WINDOWS\ERUNT 2008-08-12 09:40:18 0 d-------- C:\Program Files\Trend Micro 2008-08-12 09:05:40 0 d-------- C:\Nod32 v2.5 2008-08-11 23:14:33 14336 --a------ C:\WINDOWS\system32\el32.dll 2008-08-11 10:49:28 0 d-------- C:\Program Files\Common Files\PCSuite 2008-08-11 10:49:27 0 d-------- C:\Program Files\Common Files\Nokia 2008-08-11 10:49:13 0 d-------- C:\Program Files\PC Connectivity Solution 2008-08-10 21:25:12 0 d-------- C:\WINDOWS\system32\oodag 2008-08-08 20:57:11 0 d-------- C:\WINDOWS\Sun 2008-08-08 17:35:23 210032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL 2008-08-07 20:17:32 0 d-------- C:\WINDOWS\pss 2008-08-07 19:08:22 86016 --a------ C:\WINDOWS\system32\CNMCP66.exe <Not Verified; CANON INC.; Canon BJ Raster Printer Driver Installer> 2008-08-07 19:08:18 0 d--h----- C:\BJPrinter 2008-08-07 15:10:04 0 d-------- C:\Program Files\Common Files\Ulead Systems 2008-08-07 15:09:35 49152 --a------ C:\WINDOWS\system32\TempDel.EXE <Not Verified; Leadtek Research Inc.; Leadtek Research Inc. TempDel> 2008-08-07 15:09:33 9446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys <Not Verified; Leadtek Research Inc.; WinFast MultiMedia Device Driver (Windows 2000/XP)> 2008-08-07 15:09:30 0 d-------- C:\Program Files\WinFast 2008-08-07 15:06:50 0 d-------- C:\WINDOWS\system32\WinFast 2008-08-07 15:06:50 9728 --a------ C:\WINDOWS\system32\drivers\cxavxbar.sys <Not Verified; Leadtek Research Inc.; CX2388x AVStream Crossbar Driver> 2008-08-07 15:06:50 162944 --a------ C:\WINDOWS\system32\drivers\cx88vid.sys <Not Verified; Leadtek Research Inc.; CX2388x Video Capture Driver> 2008-08-07 15:06:50 50816 --a------ C:\WINDOWS\system32\drivers\cx88tune.sys <Not Verified; Leadtek Research Inc.; CX2388x Tuner Driver> 2008-08-07 15:06:49 0 d-------- C:\Program Files\Leadtek Research Inc 2008-08-07 14:40:03 0 d--hs---- C:\WINDOWS\Installer 2008-08-07 14:40:02 0 d-------- C:\Program Files\Common Files\ODBC 2008-08-07 14:40:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-08-07 14:40:00 0 dr------- C:\Program Files 2008-08-07 14:40:00 0 d-------- C:\Program Files\Common Files 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot 2008-08-07 14:37:31 0 d--hs---- C:\System Volume Information 2008-08-07 14:37:31 0 d-------- C:\Documents and Settings 2008-08-07 14:34:20 0 d-------- C:\WINDOWS 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\WinSxS 2008-08-07 14:34:20 0 dr------- C:\WINDOWS\Web 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\twain_32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wins 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wbem 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\usmt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\spool 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ShellExt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\Setup 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ras 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\oobe 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\npp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\inetsrv 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\IME 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\icsxml 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ias 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\export 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-08-07 14:34:20 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\dhcp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3076 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\2052 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1054 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1045 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1042 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1041 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1037 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1033 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1031 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1028 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1025 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\security 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Resources 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\repair 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Provisioning 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\PeerNet 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\pchealth 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msapps 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msagent 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Media 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\java 2008-08-07 14:34:20 0 d--h----- C:\WINDOWS\inf 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ime 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Help 2008-08-07 14:34:20 0 dr--s---- C:\WINDOWS\Fonts 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ehome 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Driver Cache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Debug 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Cursors 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Connection Wizard 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\AppPatch 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\addins 2008-08-07 14:03:51 0 d-------- C:\Program Files\Microsoft Works 2008-08-07 14:03:45 0 d-------- C:\Program Files\MSBuild 2008-08-07 14:00:58 0 d-------- C:\WINDOWS\SHELLNEW 2008-08-07 14:00:23 0 dr-h----- C:\MSOCache 2008-08-07 13:54:04 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-07 13:50:54 0 d-------- C:\Program Files\Opera 2008-08-07 13:39:52 0 d-------- C:\WINDOWS\Prefetch 2008-08-07 13:38:15 0 d-------- C:\WINDOWS\system32\PreInstall 2008-08-07 13:38:14 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-08-07 13:35:39 0 d-------- C:\WINDOWS\system32\pl-pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\bits 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\l2schemas 2008-08-07 13:33:55 0 d-------- C:\WINDOWS\ServicePackFiles 2008-08-07 13:32:18 0 d-------- C:\WINDOWS\network diagnostic 2008-08-07 13:27:24 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-08-07 13:24:03 30336 --a------ C:\WINDOWS\system32\drivers\fpd.sys <Not Verified; Politecnico di Torino; NPF Driver> 2008-08-07 13:23:55 1056768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL <Not Verified; Blue Sky Software Corporation.; RoboHELP Classic 2000> 2008-08-07 13:23:55 52214 --a------ C:\WINDOWS\system32\drivers\WrKPoET2000.sys 2008-08-07 13:23:53 0 d-------- C:\Program Files\DialNet 2008-08-07 13:19:47 0 d-------- C:\Program Files\Windows Media Connect 2 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\LogFiles 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-08-07 13:16:21 0 d-------- C:\Program Files\Common Files\Adobe 2008-08-07 13:14:46 364544 -----n--- C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4> 2008-08-07 13:14:46 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2008-08-07 13:14:45 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2008-08-07 13:14:45 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:44 0 d-------- C:\Program Files\Common Files\Ahead 2008-08-07 13:14:43 0 d-------- C:\Program Files\Ahead 2008-08-07 13:11:39 0 d-------- C:\Program Files\Java 2008-08-07 13:11:38 0 d-------- C:\Program Files\Common Files\Java 2008-08-07 13:11:00 0 d-------- C:\Program Files\IrfanView 2008-08-07 13:09:14 0 d-------- C:\Program Files\Google 2008-08-07 13:09:04 0 d-------- C:\Program Files\Skype 2008-08-07 13:09:04 0 d-------- C:\Program Files\Common Files\Skype 2008-08-07 13:08:15 0 d-------- C:\Program Files\Gadu-Gadu 2008-08-07 13:04:46 0 d-------- C:\Program Files\Alwil Software 2008-08-07 13:04:21 0 d-------- C:\Program Files\MarBit 2008-08-07 13:02:10 0 d-------- C:\Program Files\My Company Name 2008-08-07 13:01:15 0 d-------- C:\WINDOWS\nview 2008-08-07 12:59:16 0 d-------- C:\Program Files\XP Codec Pack 2008-08-07 12:53:09 0 d-------- C:\WINDOWS\system32\Lang 2008-08-07 12:52:13 49152 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-08-07 12:52:02 0 d-------- C:\WINDOWS\system32\RTCOM 2008-08-07 12:51:44 0 d-------- C:\Program Files\Realtek 2008-08-07 12:51:43 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-08-07 12:51:42 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-08-07 12:51:41 520192 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-08-07 12:51:38 0 d-------- C:\Program Files\Common Files\InstallShield 2008-08-07 12:51:18 0 d-------- C:\Program Files\DIFX 2008-08-07 12:51:17 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-08-07 12:51:15 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-08-07 12:50:53 1732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin 2008-08-07 12:48:38 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-08-07 12:48:35 0 d---s---- C:\WINDOWS\system32\Microsoft 2008-08-07 12:46:28 0 d-------- C:\WINDOWS\system32\xircom 2008-08-07 12:46:28 0 d-------- C:\Program Files\microsoft frontpage 2008-08-07 12:46:09 0 -rahs---- C:\MSDOS.SYS 2008-08-07 12:46:09 0 -rahs---- C:\IO.SYS 2008-08-07 12:46:09 0 --a------ C:\CONFIG.SYS 2008-08-07 12:46:09 0 --a------ C:\AUTOEXEC.BAT 2008-08-07 12:45:20 0 dr------- C:\WINDOWS\Offline Web Pages 2008-08-07 12:45:20 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-08-07 12:45:12 0 d--h----- C:\Program Files\WindowsUpdate 2008-08-07 12:45:10 0 d-------- C:\Program Files\Usługi online 2008-08-07 12:44:59 0 d-------- C:\WINDOWS\system32\DirectX 2008-08-07 12:44:35 0 d---s---- C:\WINDOWS\Tasks 2008-08-07 12:44:34 0 d-------- C:\Program Files\Common Files\MSSoap 2008-08-07 12:44:32 0 d-------- C:\WINDOWS\srchasst 2008-08-07 12:44:31 0 d-------- C:\WINDOWS\system32\Macromed 2008-08-07 12:44:26 0 d-------- C:\Program Files\Movie Maker 2008-08-07 12:44:21 0 d-------- C:\WINDOWS\system32\Restore 2008-08-07 12:43:53 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-08-07 12:43:40 0 d-------- C:\WINDOWS\Registration 2008-08-07 12:43:30 0 d-------- C:\Program Files\Messenger 2008-08-07 12:43:27 0 d-------- C:\Program Files\MSN Gaming Zone 2008-08-07 12:43:07 0 d-------- C:\Program Files\Windows NT 2008-08-07 12:43:05 0 d-------- C:\WINDOWS\system32\MsDtc 2008-08-07 12:43:04 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2008-08-12 19:24:28 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Skype 2008-08-11 12:35:49 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Corel 2008-08-11 10:52:29 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Nokia 2008-08-11 10:52:27 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\PC Suite 2008-08-08 17:24:20 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\AdobeUM 2008-08-07 23:20:24 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Media Player Classic 2008-08-07 23:20:12 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Adobe 2008-08-07 14:39:37 62 --ahs---- C:\Documents and Settings\darek\Dane aplikacji\desktop.ini 2008-08-07 14:28:41 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\WinRAR 2008-08-07 14:05:24 359178 --a------ C:\WINDOWS\system32\perfh015.dat 2008-08-07 14:05:24 50968 --a------ C:\WINDOWS\system32\perfc015.dat 2008-08-07 14:04:30 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Macromedia 2008-08-07 13:54:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Mozilla 2008-08-07 13:50:59 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Opera 2008-08-07 13:48:50 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Gadu-Gadu 2008-08-07 13:42:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Google 2008-08-07 13:11:45 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Sun 2008-08-07 12:50:48 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\InstallShield 2008-08-07 12:49:19 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Identities -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] 2008-08-12 17:49 62728 --a------ C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 09:52 C:\WINDOWS\RTHDCPL.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 12:43 C:\WINDOWS\Alcmtr.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-04-11 11:33] "nwiz"="nwiz.exe" [2008-04-11 11:33 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-04-11 11:33] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 22:05] "a-winpoet-service"="C:\Program Files\DialNet\winpppoverethernet.exe" [2007-07-06 08:40] "@"="C:\PROGRA~1\DialNet\FPLICE~1.exe" [2007-07-04 16:27] "z-WrDialer"="C:\Program Files\DialNet\wrdialer.exe" [2007-07-11 17:11] "C:\WINDOWS\system32\kdxqf.exe"="C:\WINDOWS\system32\kdxqf.exe" [] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 22:51] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-31 17:40] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=1 (0x1) "NoDispScrSavPage"=1 (0x1) "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="kdxqf.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-08-12 19:27:33 ------------

Jest jakaś poprawa?

**Posty:** 684 · przez **djarta** 12 Sie 2008, 19:34

Jest prawie czysto.

Na koniec:

1)

O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe

>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

2)

Wklej do notatnika taki tekst:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C:\WINDOWS\system32\kdxqf.exe"=-

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: "Wszystkie pliki" >>> Zapisz jako FIX.REG>>>
plik uruchom (dwuklik i OK- zgódź się na dodanie do Rejestru).
Zrestartuj komputer.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 20:24

Trochę to potrwa, bo ten Kaspersky powolny jest. W międzyczasie zainstalowałem zamiast Avasta (straciłem zaufanie) KIS trial. On trochę wykrył, ale pousuwał. Potem się odezwę. Acha, przecież jeszcze muszę skanować FixIEDef-em. Póki co dziękuje za cierpliwość.

Dodano 12.08.2008 20:09:58:
djarta,skanowanie trwa. Możesz mi powiedzieć, co to jest za dziadostwo?

Chodzi mi o tę ikonkę UNINSTAL

Dodano 12.08.2008 20:13:19:
Zrobił się raport ze skanowania Kasperskim. Oto on

Kod: Zaznacz wszystko: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 2008-08-12 21:11 System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 3 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.1 Ostatnia aktualizacja Kaspersky Anti-Virus12/08/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus1086550 ------------------------------------------------------------------------------- Ustawienia skanowania: Skanowanie przy użyciu następujących baz danych: rozszerzone Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ Statystyki skanowania: Liczba skanowanych obiektów: 61490 Liczba wykrytych wirusów: 1 Liczba zainfekowanych obiektów: 11 Liczba podejrzanych obiektów: 0 Czas trwania skanowania: 00:48:06 Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Data\avC.tmp Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\00\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\00\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\00\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\00\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\00\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\01\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\01\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\01\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\01\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\01\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\02\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\02\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\02\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\02\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\02\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\03\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\03\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\03\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\03\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\03\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\04\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\04\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\04\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\04\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\04\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\05\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\05\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\05\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\05\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\05\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\06\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\06\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\06\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\06\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\06\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\07\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\07\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\07\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\07\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\07\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\08\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\08\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\08\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\08\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\08\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\09\00000001_events.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\09\00000001_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\09\00000001_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\09\00000001_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\09\segments.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\detected.idx Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\detected.rpt Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\g_objbt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\g_objdt.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\g_objid.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab\AVP8\Report\report.rpt Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat Object is locked pominięty C:\Documents and Settings\darek\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\cert8.db Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\content-prefs.sqlite Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\cookies.sqlite Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\downloads.sqlite Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\formhistory.sqlite Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\key3.db Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\parent.lock Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\permissions.sqlite Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\places.sqlite Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\places.sqlite-journal Object is locked pominięty C:\Documents and Settings\darek\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\search.sqlite Object is locked pominięty C:\Documents and Settings\darek\ntuser.dat Object is locked pominięty C:\Documents and Settings\darek\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\Cache\_CACHE_001_ Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\Cache\_CACHE_002_ Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\Cache\_CACHE_003_ Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\Cache\_CACHE_MAP_ Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\l1374tfb.default\urlclassifier3.sqlite Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\temp\etilqs_T2TKdo8JBfPtzohSarIe Object is locked pominięty C:\Documents and Settings\darek\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Program Files\DialNet\WrOS.EventLog.txt Object is locked pominięty C:\Program Files\DialNet\wrp-tcpip.log Object is locked pominięty C:\QooBox\Quarantine\C\WINDOWS\system32\pphcnj0j0ecep.exe.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty C:\SDFix\backups\backups.zip/backups/10.tmp Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty C:\SDFix\backups\backups.zip/backups/11.tmp Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty C:\SDFix\backups\backups.zip ZIP: zainfekowany - 2 pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\System Volume Information\_restore{C5EBD381-8003-451F-B1BA-7D48162AC11A}\RP9\change.log Object is locked pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\SchedLgU.Txt Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\Sti_Trace.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\edb.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\default Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\ODiag.evt Object is locked pominięty C:\WINDOWS\system32\config\OSession.evt Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\software Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\system Object is locked pominięty C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\drivers\fidbox.dat Object is locked pominięty C:\WINDOWS\system32\drivers\fidbox.idx Object is locked pominięty C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked pominięty C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked pominięty C:\WINDOWS\system32\h323log.txt Object is locked pominięty C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty C:\WINDOWS\wiadebug.log Object is locked pominięty C:\WINDOWS\wiaservc.log Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.2.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.3.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.4.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.5.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.6.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.7.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\Porządkowanie dysku\pphcnj0j0ecep.exe.vir Zainfekowanych: not-a-virus:FraudTool.Win32.MalwareProtector.d pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty Proces skanowania został zakończony.

**Posty:** 684 · przez **djarta** 12 Sie 2008, 21:18

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Folders to delete: C:\QooBox C:\SDFix Files to delete: D:\Porządkowanie dysku\pphcnj0j0ecep.exe.vir

Kopiujesz - klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

Potem zobacz czy cały czas jest to w autostarcie,jeśli jest to usuń go. :wink:

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 21:18

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.3.6081 * * * ******************************************************************************** Created at 21:16:49 on Tuesday, August 12, 2008 Time Zone : Logged On User : darek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 2095596 KB Free Physical Memory : 1547588 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2019936 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\Documents and Settings\darek\Dane aplikacji\Sun\Java\Deployment\cache\javapi\*.* C:\WINDOWS\system32\drv1.dll C:\WINDOWS\system32\drv2.dll C:\WINDOWS\system32\drvc.dll C:\WINDOWS\system32\OODBS.lor -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "NoDispBackgroundPage" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "NoDispScrSavPage" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Następny skan dokonany.

Dodano 12.08.2008 20:36:40:

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Folder "C:\QooBox" deleted successfully. Folder "C:\SDFix" deleted successfully. File "D:\Porządkowanie dysku\pphcnj0j0ecep.exe.vir" deleted successfully. Completed script processing. ******************* Finished! Terminate.

Proszę

Dodano 12.08.2008 20:37:46:
Acha, jak toto wyszukać w autostarcie i jak uunąć? :oops:

Dodano 12.08.2008 20:38:38:
OK, nie ma. Ale ta cholerna ikona jest nadal

Dodano 12.08.2008 21:01:16:

Przy okazji - o co tu chodzi?

**Posty:** 7956 · przez **Magik** 13 Sie 2008, 06:35

kalcyt13 napisał(a):Acha, jak toto wyszukać w autostarcie i jak uunąć?

start-->uruchom-->wpisujesz msonfig
przechodzisz do zakladki autostart i patrzysz czy ten proces tam jest, jesli jest odhaczasz "ptaszka" przy

kalcyt13 napisał(a):Przy okazji - o co tu chodzi?

zwroc uwage czego tyczy sie polwoa alertow-->polowa z nich dotyczy tego syfu od porzadkowania dysku
BTW, rozwin ta galaza dot. obiektu by zobaczyc pelna sciezke do tych plikow i wklej screen

i przelec kompa tym
http://www.programosy.pl/program,avg-anti-spyware.html

Kto jest na forum