win32/pacex.gen

**Posty:** 749 · przez **dresik** 19 Maj 2008, 13:14

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:13:45, on 2008-05-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\RUNDLL32.EXE F:\Program Files\ESET\ESET Smart Security\egui.exe F:\Program Files\Analog Devices\Core\smax4pnp.exe F:\WINDOWS\system32\rundll32.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe F:\Program Files\ESET\ESET Smart Security\ekrn.exe F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\system32\PnkBstrA.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe F:\Program Files\Canon\CAL\CALMAIN.exe F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe F:\WINDOWS\system32\wscntfy.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Gadu-Gadu\gg.exe F:\Program Files\Opera\Opera.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\Documents and Settings\doemk\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.youtube.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SoundMAXPnP] F:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "F:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [amva] F:\WINDOWS\system32\amvo.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Ściągnij przez IDM - F:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - F:\Program Files\Internet Download Manager\IEGetAll.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206390783171 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - F:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - F:\WINDOWS\system32\pr2ah4nc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 13:35

Witam

wklej jeszcze log z combofix'a
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

co do loga z HJT:

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [amva] F:\WINDOWS\system32\amvo.exe

w trybie awaryjny usuwasz ten wpis....dodatkowo made by okocza

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 749 · przez **dresik** 19 Maj 2008, 13:39

Kod: Zaznacz wszystko: ComboFix 08-05-15.3 - doemk 2008-05-19 13:35:44.3 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1785 [GMT 2:00] Running from: F:\Documents and Settings\doemk\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML F:\WINDOWS\system32\Dvbpws.dll . ---- Previous Run ------- . F:\autorun.inf F:\Recycled\Recycled F:\Recycled\Recycled\ctfmon.exe . ((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 ))))))))))))))))))))))))))))))) . 2008-05-18 10:45 . 2008-05-18 10:44 <DIR> d-------- F:\Program Files\AviSynth 2.5 2008-05-18 10:45 . 2004-02-22 10:11 719,872 --a------ F:\WINDOWS\system32\devil.dll 2008-05-18 10:38 . 2008-05-18 10:38 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\ArcSoft 2008-05-18 10:08 . 2008-05-19 09:27 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-05-18 10:08 . 2008-05-18 10:08 1,409 --a------ F:\WINDOWS\QTFont.for 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Program Files\QuickTime 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Program Files\Apple Software Update 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\Apple Computer 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-05-15 20:30 . 2008-05-15 20:30 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\Panasonic 2008-05-15 20:29 . 2008-05-15 20:29 <DIR> d-------- F:\Program Files\Common Files\ArcSoft 2008-05-15 20:29 . 2005-02-23 14:58 11,776 --a------ F:\WINDOWS\system32\drivers\afc.sys 2008-05-15 20:28 . 2008-05-15 20:28 <DIR> d-------- F:\Program Files\ArcSoft 2008-05-15 20:28 . 2004-05-04 11:53 1,645,320 --a------ F:\WINDOWS\system32\gdiplus.dll 2008-05-15 20:28 . 1995-08-01 04:44 212,480 --a------ F:\WINDOWS\PCDLIB32.DLL 2008-05-15 20:28 . 2006-12-18 15:43 147,456 --a------ F:\WINDOWS\system32\PhotoBase Screen Saver.scr 2008-05-15 20:28 . 2003-09-20 08:45 21,248 --a------ F:\WINDOWS\system32\drivers\pfc.sys 2008-05-15 20:22 . 2008-05-15 20:24 <DIR> d-------- F:\Program Files\Panasonic 2008-05-10 23:47 . 2008-05-10 23:47 <DIR> d-------- F:\WINDOWS\system32\AGEIA 2008-05-10 23:47 . 2008-05-10 23:47 <DIR> d-------- F:\Program Files\Common Files\Wise Installation Wizard 2008-05-10 23:47 . 2008-05-10 23:47 <DIR> d-------- F:\Program Files\AGEIA Technologies 2008-05-09 23:15 . 2008-05-09 23:41 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited 2008-05-05 17:57 . 2008-05-05 17:57 2,337,865 --a------ F:\WINDOWS\system32\pbsvc.exe 2008-05-04 17:57 . 2008-03-05 15:56 3,786,760 --a------ F:\WINDOWS\system32\D3DX9_37.dll 2008-05-04 17:57 . 2008-03-05 15:56 1,420,824 --a------ F:\WINDOWS\system32\D3DCompiler_37.dll 2008-05-04 17:57 . 2008-03-05 16:03 479,752 --a------ F:\WINDOWS\system32\XAudio2_0.dll 2008-05-04 17:57 . 2008-02-05 23:07 462,864 --a------ F:\WINDOWS\system32\d3dx10_37.dll 2008-05-04 17:57 . 2008-03-05 16:03 238,088 --a------ F:\WINDOWS\system32\xactengine3_0.dll 2008-05-04 17:57 . 2008-03-05 16:00 25,608 --a------ F:\WINDOWS\system32\X3DAudio1_3.dll 2008-05-03 23:47 . 2005-06-24 16:24 438,272 -ra------ F:\WINDOWS\system32\vp6vfw.dll 2008-05-03 23:47 . 2004-12-10 09:06 327,680 --a------ F:\WINDOWS\system32\vp6dec.ax 2008-05-01 10:24 . 2008-05-02 13:43 <DIR> d-------- F:\Program Files\FlashGet 2008-05-01 10:24 . 2004-08-03 23:14 359,040 --a------ F:\WINDOWS\system32\drivers\tcpip.sys.flg 2008-04-27 17:51 . 2008-04-27 17:51 <DIR> d-------- F:\Program Files\MGrenda 2008-04-27 17:46 . 2008-04-27 17:46 <DIR> d-------- F:\Program Files\GoldWave 2008-04-26 19:05 . 2008-05-01 13:00 <DIR> d-------- F:\Program Files\Internet Download Manager 2008-04-26 19:05 . 2008-05-19 13:19 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\IDM 2008-04-26 19:05 . 2008-05-19 13:19 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\DMCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-18 15:08 22,328 ----a-w F:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-18 15:08 107,832 ----a-w F:\WINDOWS\system32\PnkBstrB.exe 2008-05-18 09:35 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\MyPhoneExplorer 2008-05-18 08:45 408,576 ----a-w F:\WINDOWS\system32\Smab.dll 2008-05-15 18:28 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-05-14 16:26 --------- d-----w F:\Program Files\SpeedFan 2008-05-12 13:26 --------- d-----w F:\Program Files\Gadu-Gadu 2008-05-06 09:59 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\uTorrent 2008-05-05 15:58 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Ubisoft 2008-05-05 15:57 66,872 ----a-w F:\WINDOWS\system32\PnkBstrA.exe 2008-05-05 15:57 22,328 ----a-w F:\Documents and Settings\doemk\Dane aplikacji\PnkBstrK.sys 2008-05-02 11:46 --------- d-----w F:\Program Files\DivX 2008-04-27 00:13 --------- d-----w F:\Program Files\Screamer Radio 2008-04-16 21:27 --------- d---a-w F:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-04-13 13:53 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\Ubisoft 2008-04-12 16:04 --------- d-----w F:\Program Files\Analog Devices 2008-04-09 13:38 --------- d-----w F:\Program Files\Canon 2008-04-09 11:45 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\Logitech 2008-04-09 11:44 --------- d-----w F:\Program Files\Logitech 2008-04-09 11:44 --------- d-----w F:\Program Files\Common Files\Logitech 2008-04-09 11:44 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Logitech 2008-04-08 15:18 --------- d-----w F:\Program Files\SystemRequirementsLab 2008-04-07 13:46 --------- d-----w F:\Program Files\virtuladub 2008-04-07 09:51 --------- d-----w F:\Program Files\Ultra Video Converter 2008-04-05 17:35 219,648 ----a-w F:\WINDOWS\system32\uxtheme.dll 2008-04-03 19:14 --------- d-----w F:\Program Files\ESET 2008-04-03 18:14 --------- d-----w F:\Documents and Settings\Administrator\Dane aplikacji\ESET 2008-04-02 17:20 --------- d-----w F:\Program Files\neostrada tp 2008-03-26 21:58 163,644 ----a-w F:\WINDOWS\system32\drivers\secdrv.sys 2008-03-26 08:35 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\Hamachi 2008-03-24 21:09 25,280 ----a-w F:\WINDOWS\system32\drivers\hamachi.sys 2008-03-23 15:28 --------- d-----w F:\Program Files\Common Files\BinarySense 2008-03-23 13:06 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\BinarySense 2008-03-23 11:50 --------- d-----w F:\Program Files\WinFast 2008-03-22 13:35 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-03-22 13:09 --------- d-----w F:\Program Files\Common Files\Ulead Systems 2008-03-19 16:19 --------- d-----w F:\Program Files\SkanerOnline 2008-03-19 16:08 --------- d-----w F:\Program Files\MadOnion.com 2008-03-12 18:35 737,280 ----a-w F:\WINDOWS\iun6002.exe . ------- Sigcheck ------- 2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c F:\WINDOWS\system32\dllcache\tcpip.sys 2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 20:10 1688872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-11-13 23:26 8523776] "nwiz"="nwiz.exe" [2007-11-13 23:27 1626112 F:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="F:\WINDOWS\system32\NvMcTray.dll" [2007-11-13 23:26 81920] "egui"="F:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 F:\WINDOWS\KHALMNPR.Exe] "SoundMAXPnP"="F:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 21:34 868352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 03:48:00 40048] Adobe Reader Synchronizer.lnk - F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 02:01:00 734872] Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "vidc.xvid"= xvid.dll "vidc.yv12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech SetPoint.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk backup=F:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^LUMIX Simple Viewer.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\LUMIX Simple Viewer.lnk backup=F:\WINDOWS\pss\LUMIX Simple Viewer.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^doemk^Menu Start^Programy^Autostart^HDDlife.lnk] path=F:\Documents and Settings\doemk\Menu Start\Programy\Autostart\HDDlife.lnk backup=F:\WINDOWS\pss\HDDlife.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-12-03 15:21 2213160 F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 F:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-09-01 15:57 282624 F:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 18:17 159744 F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-04-02 20:16 1271032 g:\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 05:25 144784 F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] F:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule] --a------ 2007-02-12 17:22 397312 F:\Program Files\WinFast\WFDTV\WFWIZ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV] --a------ 2007-02-12 19:16 69632 F:\Program Files\WinFast\WFDTV\DTVSchdl.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "F:\\Program Files\\Gadu-Gadu\\gg.exe"= "F:\\Program Files\\uTorrent\\uTorrent.exe"= "G:\\steam\\Steam.exe"= "F:\\WINDOWS\\system32\\sessmgr.exe"= "F:\\WINDOWS\\system32\\PnkBstrA.exe"= "F:\\WINDOWS\\system32\\PnkBstrB.exe"= "F:\\Program Files\\The All-Seeing Eye\\eye.exe"= "G:\\steam\\steamapps\\speed0050\\counter-strike\\hl.exe"= "G:\\steam\\steamapps\\aaa69\\counter-strike source\\hl2.exe"= "I:\\eMule\\emule.exe"= "G:\\steam\\steamapps\\aaa69\\day of defeat source\\hl2.exe"= "F:\\Program Files\\SystemRequirementsLab\\Uninstall.exe"= "G:\\call of duty 4\\iw3mp.exe"= "G:\\rainbox six\\Binaries\\R6Vegas2_Game.exe"= "G:\\rainbox six\\Binaries\\R6Vegas2_Launcher.exe"= R0 mv61xx;mv61xx;F:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-06-15 09:52] R0 nvgts;nvgts;F:\WINDOWS\system32\DRIVERS\nvgts.sys [2007-08-09 05:11] R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);F:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 21:53] R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);F:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 21:52] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);F:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 12:07] S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);F:\WINDOWS\system32\pr2ah4nc.exe svc [] S3 e4usbaw;USB ADSL2 WAN Adapter;F:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 12:03] S3 WFIOCTL;WFIOCTL;F:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 17:55] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3cd-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - E:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3ce-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3cf-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d4-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d6-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d7-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3bcd24b-f5b5-11dc-9c7c-4d6564696130}] \Shell\AutoRun\command - K:\rgjkmy3p.exe \Shell\explore\Command - K:\rgjkmy3p.exe \Shell\open\Command - K:\rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb1b17e1-22ab-11dd-b3c0-001e8c7f5525}] \Shell\AutoRun\command - K:\rgjkmy3p.exe \Shell\explore\Command - K:\rgjkmy3p.exe \Shell\open\Command - K:\rgjkmy3p.exe . Contents of the 'Scheduled Tasks' folder "2008-05-15 18:32:04 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - F:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-19 13:36:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-19 13:37:10 ComboFix-quarantined-files.txt 2008-05-19 11:37:06 Pre-Run: 3,470,569,472 bajtów wolnych Post-Run: 4,713,431,040 bajtów wolnych 253

[ Dodano: Dzisiaj o 13:05 ]
zrobilem i nic

nadal nie moge otworzyc partycji

wyskauje mi jakim programem otworzyc pomocy

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 14:14

Rozumiem ze z HiJack'a usunalem tamten wpis :!:

Skasuj kwarantanne C:\Qoobox
i powinno buc gut

**Posty:** 749 · przez **dresik** 19 Maj 2008, 14:18

nowy log

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:18, on 2008-05-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\RUNDLL32.EXE F:\Program Files\ESET\ESET Smart Security\egui.exe F:\Program Files\Analog Devices\Core\smax4pnp.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe F:\WINDOWS\system32\rundll32.exe F:\Program Files\ESET\ESET Smart Security\ekrn.exe F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\system32\PnkBstrA.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe F:\Program Files\Canon\CAL\CALMAIN.exe F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe F:\WINDOWS\system32\wscntfy.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Gadu-Gadu\gg.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\Documents and Settings\doemk\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.youtube.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SoundMAXPnP] F:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "F:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Ściągnij przez IDM - F:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - F:\Program Files\Internet Download Manager\IEGetAll.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206390783171 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - F:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - F:\WINDOWS\system32\pr2ah4nc.exe O23 - Service: PsExec (PSEXESVC) - Unknown owner - F:\WINDOWS\PSEXESVC.EXE (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

i tego floderu nie mam

albo jest ukryty a dokladnie gdzie sie znajduje?? na partycji gdzie jest system??

**Posty:** 8001 · przez **Okocza** 19 Maj 2008, 14:37

dresik napisał(a):O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O23 - Service: PsExec (PSEXESVC) - Unknown owner - F:\WINDOWS\PSEXESVC.EXE (file missing)

i dodatkowo log z combofixa

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 14:45

okocza napisał(a):i dodatkowo log z combofixa
_________________

o Pan zdolny sie pojawil:)

Fixsnij sobie explorer'a

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{410dd332-0a40-11dd-9304-101111111111}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7f89781-1a0a-11dd-9359-101111111111}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9e2eba0-0e9d-11dd-9316-101111111111}]

Plik zapisz jako FIX.REG, odpal i restart

**Posty:** 749 · przez **dresik** 19 Maj 2008, 14:56

wiec oczko usunełem te 2 wpisy o to log !!combo

Kod: Zaznacz wszystko: ComboFix 08-05-15.3 - doemk 2008-05-19 14:47:06.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1642 [GMT 2:00] Running from: F:\Documents and Settings\doemk\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . Magik odrazu pojawil sie folder C:\Qoobox usunełem go i moge wejsc teraz na partycje :) o to log ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf D:\Autorun.inf G:\Autorun.inf H:\Autorun.inf I:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 ))))))))))))))))))))))))))))))) . 2008-05-19 14:00 . 2008-05-19 14:00 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\ArcaBit 2008-05-18 10:45 . 2008-05-18 10:44 <DIR> d-------- F:\Program Files\AviSynth 2.5 2008-05-18 10:38 . 2008-05-18 10:38 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\ArcSoft 2008-05-18 10:08 . 2008-05-19 09:27 54,156 --ah----- F:\WINDOWS\QTFont.qfn 2008-05-18 10:08 . 2008-05-18 10:08 1,409 --a------ F:\WINDOWS\QTFont.for 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Program Files\QuickTime 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Program Files\Apple Software Update 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\Apple Computer 2008-05-15 20:32 . 2008-05-15 20:32 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-05-15 20:30 . 2008-05-15 20:30 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\Panasonic 2008-05-15 20:29 . 2008-05-15 20:29 <DIR> d-------- F:\Program Files\Common Files\ArcSoft 2008-05-15 20:29 . 2005-02-23 14:58 11,776 --a------ F:\WINDOWS\system32\drivers\afc.sys 2008-05-15 20:28 . 2008-05-15 20:28 <DIR> d-------- F:\Program Files\ArcSoft 2008-05-15 20:28 . 2004-05-04 11:53 1,645,320 --a------ F:\WINDOWS\system32\gdiplus.dll 2008-05-15 20:28 . 1995-08-01 04:44 212,480 --a------ F:\WINDOWS\PCDLIB32.DLL 2008-05-15 20:28 . 2006-12-18 15:43 147,456 --a------ F:\WINDOWS\system32\PhotoBase Screen Saver.scr 2008-05-15 20:28 . 2003-09-20 08:45 21,248 --a------ F:\WINDOWS\system32\drivers\pfc.sys 2008-05-15 20:22 . 2008-05-15 20:24 <DIR> d-------- F:\Program Files\Panasonic 2008-05-10 23:47 . 2008-05-10 23:47 <DIR> d-------- F:\WINDOWS\system32\AGEIA 2008-05-10 23:47 . 2008-05-10 23:47 <DIR> d-------- F:\Program Files\Common Files\Wise Installation Wizard 2008-05-10 23:47 . 2008-05-10 23:47 <DIR> d-------- F:\Program Files\AGEIA Technologies 2008-05-09 23:15 . 2008-05-09 23:41 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited 2008-05-05 17:57 . 2008-05-05 17:57 2,337,865 --a------ F:\WINDOWS\system32\pbsvc.exe 2008-05-04 17:57 . 2008-03-05 15:56 3,786,760 --a------ F:\WINDOWS\system32\D3DX9_37.dll 2008-05-04 17:57 . 2008-03-05 15:56 1,420,824 --a------ F:\WINDOWS\system32\D3DCompiler_37.dll 2008-05-04 17:57 . 2008-03-05 16:03 479,752 --a------ F:\WINDOWS\system32\XAudio2_0.dll 2008-05-04 17:57 . 2008-02-05 23:07 462,864 --a------ F:\WINDOWS\system32\d3dx10_37.dll 2008-05-04 17:57 . 2008-03-05 16:03 238,088 --a------ F:\WINDOWS\system32\xactengine3_0.dll 2008-05-04 17:57 . 2008-03-05 16:00 25,608 --a------ F:\WINDOWS\system32\X3DAudio1_3.dll 2008-05-03 23:47 . 2005-06-24 16:24 438,272 -ra------ F:\WINDOWS\system32\vp6vfw.dll 2008-05-03 23:47 . 2004-12-10 09:06 327,680 --a------ F:\WINDOWS\system32\vp6dec.ax 2008-05-01 10:24 . 2008-05-02 13:43 <DIR> d-------- F:\Program Files\FlashGet 2008-05-01 10:24 . 2004-08-03 23:14 359,040 --a------ F:\WINDOWS\system32\drivers\tcpip.sys.flg 2008-04-27 17:51 . 2008-04-27 17:51 <DIR> d-------- F:\Program Files\MGrenda 2008-04-27 17:46 . 2008-04-27 17:46 <DIR> d-------- F:\Program Files\GoldWave 2008-04-26 19:05 . 2008-05-01 13:00 <DIR> d-------- F:\Program Files\Internet Download Manager 2008-04-26 19:05 . 2008-05-19 13:19 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\IDM 2008-04-26 19:05 . 2008-05-19 13:19 <DIR> d-------- F:\Documents and Settings\doemk\Dane aplikacji\DMCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-18 15:08 22,328 ----a-w F:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-18 15:08 107,832 ----a-w F:\WINDOWS\system32\PnkBstrB.exe 2008-05-18 09:35 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\MyPhoneExplorer 2008-05-18 08:45 408,576 ----a-w F:\WINDOWS\system32\Smab.dll 2008-05-15 18:28 --------- d--h--w F:\Program Files\InstallShield Installation Information 2008-05-14 16:26 --------- d-----w F:\Program Files\SpeedFan 2008-05-12 13:26 --------- d-----w F:\Program Files\Gadu-Gadu 2008-05-06 09:59 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\uTorrent 2008-05-05 15:58 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Ubisoft 2008-05-05 15:57 66,872 ----a-w F:\WINDOWS\system32\PnkBstrA.exe 2008-05-05 15:57 22,328 ----a-w F:\Documents and Settings\doemk\Dane aplikacji\PnkBstrK.sys 2008-05-02 11:46 --------- d-----w F:\Program Files\DivX 2008-04-27 00:13 --------- d-----w F:\Program Files\Screamer Radio 2008-04-16 21:27 --------- d---a-w F:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-04-13 13:53 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\Ubisoft 2008-04-12 16:04 --------- d-----w F:\Program Files\Analog Devices 2008-04-09 13:38 --------- d-----w F:\Program Files\Canon 2008-04-09 11:45 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\Logitech 2008-04-09 11:44 --------- d-----w F:\Program Files\Logitech 2008-04-09 11:44 --------- d-----w F:\Program Files\Common Files\Logitech 2008-04-09 11:44 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Logitech 2008-04-08 15:18 --------- d-----w F:\Program Files\SystemRequirementsLab 2008-04-07 13:46 --------- d-----w F:\Program Files\virtuladub 2008-04-07 09:51 --------- d-----w F:\Program Files\Ultra Video Converter 2008-04-05 17:35 219,648 ----a-w F:\WINDOWS\system32\uxtheme.dll 2008-04-03 19:14 --------- d-----w F:\Program Files\ESET 2008-04-03 18:14 --------- d-----w F:\Documents and Settings\Administrator\Dane aplikacji\ESET 2008-04-02 17:20 --------- d-----w F:\Program Files\neostrada tp 2008-03-26 21:58 163,644 ----a-w F:\WINDOWS\system32\drivers\secdrv.sys 2008-03-26 08:35 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\Hamachi 2008-03-24 21:09 25,280 ----a-w F:\WINDOWS\system32\drivers\hamachi.sys 2008-03-23 15:28 --------- d-----w F:\Program Files\Common Files\BinarySense 2008-03-23 13:06 --------- d-----w F:\Documents and Settings\doemk\Dane aplikacji\BinarySense 2008-03-23 11:50 --------- d-----w F:\Program Files\WinFast 2008-03-22 13:35 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-03-22 13:09 --------- d-----w F:\Program Files\Common Files\Ulead Systems 2008-03-19 16:19 --------- d-----w F:\Program Files\SkanerOnline 2008-03-19 16:08 --------- d-----w F:\Program Files\MadOnion.com 2008-03-12 18:35 737,280 ----a-w F:\WINDOWS\iun6002.exe . ------- Sigcheck ------- 2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c F:\WINDOWS\system32\dllcache\tcpip.sys 2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 20:10 1688872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-11-13 23:26 8523776] "nwiz"="nwiz.exe" [2007-11-13 23:27 1626112 F:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="F:\WINDOWS\system32\NvMcTray.dll" [2007-11-13 23:26 81920] "egui"="F:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 F:\WINDOWS\KHALMNPR.Exe] "SoundMAXPnP"="F:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 21:34 868352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 03:48:00 40048] Adobe Reader Synchronizer.lnk - F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 02:01:00 734872] Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "vidc.xvid"= xvid.dll "vidc.yv12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech SetPoint.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk backup=F:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^LUMIX Simple Viewer.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\LUMIX Simple Viewer.lnk backup=F:\WINDOWS\pss\LUMIX Simple Viewer.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^doemk^Menu Start^Programy^Autostart^HDDlife.lnk] path=F:\Documents and Settings\doemk\Menu Start\Programy\Autostart\HDDlife.lnk backup=F:\WINDOWS\pss\HDDlife.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-12-03 15:21 2213160 F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 F:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-09-01 15:57 282624 F:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 18:17 159744 F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-04-02 20:16 1271032 g:\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 05:25 144784 F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] F:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule] --a------ 2007-02-12 17:22 397312 F:\Program Files\WinFast\WFDTV\WFWIZ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV] --a------ 2007-02-12 19:16 69632 F:\Program Files\WinFast\WFDTV\DTVSchdl.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "F:\\Program Files\\Gadu-Gadu\\gg.exe"= "F:\\Program Files\\uTorrent\\uTorrent.exe"= "G:\\steam\\Steam.exe"= "F:\\WINDOWS\\system32\\sessmgr.exe"= "F:\\WINDOWS\\system32\\PnkBstrA.exe"= "F:\\WINDOWS\\system32\\PnkBstrB.exe"= "F:\\Program Files\\The All-Seeing Eye\\eye.exe"= "G:\\steam\\steamapps\\speed0050\\counter-strike\\hl.exe"= "G:\\steam\\steamapps\\aaa69\\counter-strike source\\hl2.exe"= "I:\\eMule\\emule.exe"= "G:\\steam\\steamapps\\aaa69\\day of defeat source\\hl2.exe"= "F:\\Program Files\\SystemRequirementsLab\\Uninstall.exe"= "G:\\call of duty 4\\iw3mp.exe"= "G:\\rainbox six\\Binaries\\R6Vegas2_Game.exe"= "G:\\rainbox six\\Binaries\\R6Vegas2_Launcher.exe"= R0 mv61xx;mv61xx;F:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-06-15 09:52] R0 nvgts;nvgts;F:\WINDOWS\system32\DRIVERS\nvgts.sys [2007-08-09 05:11] R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);F:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 21:53] R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);F:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 21:52] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);F:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 12:07] S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);F:\WINDOWS\system32\pr2ah4nc.exe svc [] S3 e4usbaw;USB ADSL2 WAN Adapter;F:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 12:03] S3 WFIOCTL;WFIOCTL;F:\Program Files\WinFast\WFDTV\WFIOCTL.SYS [2005-01-06 17:55] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3cd-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - E:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3ce-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3cf-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d4-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d6-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d7-ef0b-11dc-b8e0-806d6172696f}] \Shell\AutoRun\command - rgjkmy3p.exe \Shell\explore\Command - rgjkmy3p.exe \Shell\open\Command - rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3bcd24b-f5b5-11dc-9c7c-4d6564696130}] \Shell\AutoRun\command - K:\rgjkmy3p.exe \Shell\explore\Command - K:\rgjkmy3p.exe \Shell\open\Command - K:\rgjkmy3p.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb1b17e1-22ab-11dd-b3c0-001e8c7f5525}] \Shell\AutoRun\command - K:\rgjkmy3p.exe \Shell\explore\Command - K:\rgjkmy3p.exe \Shell\open\Command - K:\rgjkmy3p.exe *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-05-15 18:32:04 F:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - F:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-19 14:48:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-19 14:48:40 ComboFix-quarantined-files.txt 2008-05-19 12:48:29 Pre-Run: 8,554,790,912 bajtów wolnych Post-Run: 8,544,296,960 bajtów wolnych 252

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:55:56, on 2008-05-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\savedump.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\RUNDLL32.EXE F:\Program Files\ESET\ESET Smart Security\egui.exe F:\Program Files\Analog Devices\Core\smax4pnp.exe F:\WINDOWS\system32\rundll32.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe F:\Program Files\ESET\ESET Smart Security\ekrn.exe F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\system32\PnkBstrA.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe F:\Program Files\Canon\CAL\CALMAIN.exe F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe F:\WINDOWS\system32\wscntfy.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\WINDOWS\system32\wuauclt.exe F:\WINDOWS\system32\NOTEPAD.EXE F:\Documents and Settings\doemk\Pulpit\HijackThis.exe F:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.youtube.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SoundMAXPnP] F:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Ściągnij przez IDM - F:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - F:\Program Files\Internet Download Manager\IEGetAll.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206390783171 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - F:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - F:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - F:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - F:\WINDOWS\system32\pr2ah4nc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

jak moge sprawdzic czy juz jest czysty komputer od wirusow??

[ Dodano: Dzisiaj o 13:57 ]
magik odrazu znalazl sie ten folder!! C:\Qoobox usunelem go i moge wejsc juz na partycje! jak moge sprawdzic czy komputer jest czysty??

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 15:02

dresik napisał(a):magik odrazu znalazl sie ten folder!! C:\Qoobox usunelem go i moge wejsc juz na partycje! jak moge sprawdzic czy komputer jest czysty??

Sie ciesze :wink:

dresik napisał(a):jak moge sprawdzic czy juz jest czysty komputer od wirusow??

od tego by sprawdzic sa te logi, ktore podales. HJT jest czysty :wink:

**Posty:** 749 · przez **dresik** 19 Maj 2008, 15:05

ale sam sie zastanawiam jakim cudem dostal sie ten wirus

mam nod 32 najnowsza wersje i wszystko mi łapał a tu taki myk

dzieki wielkie za pomoc

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 15:06

dresik napisał(a):ale sam sie zastanawiam jakim cudem dostal sie ten wirus Sad mam nod 32 najnowsza wersje i wszystko mi łapał a tu taki myk :-/ dzieki wielkie za pomoc

ten wirus najczesciej wlatuje przez pendrive'a.....

**Posty:** 749 · przez **dresik** 19 Maj 2008, 15:10

hm.. przeciez mam swojego i mam tam instalki i nigdy nie pokazywal mi sie ze wirus!! a jak moge sprawdzic czy na pendriverze mam wirusa??

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 15:14

hm.. przeciez mam swojego i mam tam instalki i nigdy nie pokazywal mi sie ze wirus!! a jak moge sprawdzic czy na pendriverze mam wirusa??

ten wirek jest "pendrive'owy"

Infekcja moze wrcoic jak bedziesz uzywal zarazonego pen'a....

utworz na pulpicie plik CFScript.txt, wklej do niego:

Kod: Zaznacz wszystko: File:: x:\m9j.com x:\m9j.com x:\autorun.inf x:\gy.cmd x:\gy.cmd x:\m9j.com x:\autorun.inf Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bf62c18-c1fa-11dc-bba9-0060b33dc842}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66259e5a-03a0-11dd-bc7d-0060b33dc842}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{937b7d8c-fdb0-11dc-bc6c-0060b33dc842}]

Zapisz i przeciagnij go na ikone combofix.exe. gdzie x to litera dysku

**Posty:** 8001 · przez **Okocza** 19 Maj 2008, 15:23

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3cd-ef0b-11dc-b8e0-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3ce-ef0b-11dc-b8e0-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3cf-ef0b-11dc-b8e0-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d4-ef0b-11dc-b8e0-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d6-ef0b-11dc-b8e0-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a070a3d7-ef0b-11dc-b8e0-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3bcd24b-f5b5-11dc-9c7c-4d6564696130}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb1b17e1-22ab-11dd-b3c0-001e8c7f5525}]

zapisujesz jak fix.reg - klikasz 2 razy i dodajesz do rejestru, potem restart kompa

**Posty:** 749 · przez **dresik** 19 Maj 2008, 15:27

litera dysku to ta gdzie system czy jak???

**Posty:** 8001 · przez **Okocza** 19 Maj 2008, 15:29

nie koniecznie, ale również.

**Posty:** 749 · przez **dresik** 19 Maj 2008, 15:30

okocza napisał(a):nie koniecznie, ale również.

to mam dac literki moich 6 partycji ??:Dbo juz nie wiem

**Posty:** 7956 · przez **Magik** 19 Maj 2008, 15:39

dresik napisał(a):itera dysku to ta gdzie system czy jak???

dresik mam na mysli litere dysku, ktora otrzymuje pendrive.......Ten skrypcik sluzy do oczyszczenia Twego pen'a

**Posty:** 749 · przez **dresik** 19 Maj 2008, 15:58

AHA no wiec wlozylem pendriva

Kod: Zaznacz wszystko: File:: K:\m9j.com K:\m9j.com K:\autorun.inf K:\gy.cmd K:\gy.cmd K:\m9j.com K:\autorun.inf Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bf62c18-c1fa-11dc-bba9-0060b33dc842}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66259e5a-03a0-11dd-bc7d-0060b33dc842}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{937b7d8c-fdb0-11dc-bc6c-0060b33dc842}]

przenioslem na ikonke combo i zaczal mi skanowac

i pozniej pojawil mi sie log i to wszystko:) jak bedzie np.skarzony to skakuje mi plik???

**Posty:** 8001 · przez **Okocza** 19 Maj 2008, 15:59

dresik napisał(a):File::
K:\m9j.com
K:\m9j.com
K:\autorun.inf
K:\gy.cmd
K:\gy.cmd
K:\m9j.com
K:\autorun.inf

skasuje Ci konkretnie te pliki.

dodałeś do rejestru to co ja Ci dałem :?:

win32/pacex.gen

win32/pacex.gen

Kto jest na forum