Winfile

**Posty:** 7 · przez **r0tfl** 30 Sie 2008, 13:34

Od pewnego czasu w każdym folderze tworzy sie plik winfile i nie da się go usunąć.

Oto logi:

Kod: Zaznacz wszystko: [quote]ComboFix 08-08-29.02 - rotfl 2008-08-30 13:03:55.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.106 [GMT 2:00] Running from: C:\Documents and Settings\rotfl\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\bin.clearspring.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\bin.clearspring.com\clearspring.sol C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\interclick.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\interclick.com\ud.sol C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\system\J.exe . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))) . 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\WINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 ---h----- C:\Program Files\Program Files.exe 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\rafWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\NewWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\LqkWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\ICQWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\GoDWINFILE.EXE 2008-08-30 12:55 . 2008-08-30 12:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-30 12:49 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-30 12:48 . 2008-08-30 12:48 <DIR> d-------- C:\Program Files\Panda Security 2008-08-30 12:43 . 2008-08-30 12:43 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Ahead 2008-08-30 12:40 . 2008-08-30 12:40 116 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-30 11:16 . 2005-04-20 13:32 2,916,352 --------- C:\WINDOWS\UNNMP.exe 2008-08-30 11:16 . 2006-05-23 18:30 47,894 --------- C:\WINDOWS\UNNMP.cfg 2008-08-30 11:15 . 2008-08-30 11:18 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-08-30 11:14 . 2008-08-30 11:14 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-08-30 11:14 . 2006-01-12 16:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-08-30 11:12 . 2008-08-30 11:12 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-08-30 11:12 . 2008-08-30 11:15 <DIR> d-------- C:\Program Files\Ahead 2008-08-30 11:12 . 2008-08-30 11:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-08-30 11:12 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-08-30 11:12 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-08-30 11:12 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-08-30 11:12 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-08-30 11:12 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-08-30 11:12 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-08-30 11:12 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll 2008-08-28 08:50 . 2008-08-28 08:50 94,208 --a------ C:\WINDOWS\system32\dxe.exe 2008-08-27 22:20 . 2008-08-27 22:20 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2008-08-26 14:41 . 2008-08-28 15:42 <DIR> d-------- C:\Program Files\KnightsAndMerchants 2008-08-25 19:48 . 2008-08-25 19:48 <DIR> d-------- C:\Program Files\Ganymede 2008-08-25 19:48 . 2008-08-30 10:51 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\GanymedeNet 2008-08-25 10:47 . 2008-08-25 10:47 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-08-25 10:45 . 2008-08-25 10:45 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-25 10:37 . 2008-08-25 10:37 <DIR> d-------- C:\Program Files\Global Graphics 2008-08-25 10:37 . 2008-06-27 22:28 2,256,896 --a------ C:\WINDOWS\system32\PDFCreatorSV.exe 2008-08-25 10:37 . 2008-06-27 22:28 598,016 --a------ C:\WINDOWS\system32\PDFCreator.cpl 2008-08-25 10:37 . 2008-06-27 22:26 466,944 --a------ C:\WINDOWS\system32\EventConsumer.dll 2008-08-25 10:37 . 2008-06-27 22:28 319,488 --a------ C:\WINDOWS\system32\PDFCreator.dll 2008-08-25 10:37 . 2008-06-27 22:20 282,624 --a------ C:\WINDOWS\system32\niknakXML.dll 2008-08-25 10:37 . 2008-06-27 22:25 143,360 --a------ C:\WINDOWS\system32\PDFCreatorMessages.exe 2008-08-25 10:37 . 2007-07-06 06:37 135,168 --a------ C:\WINDOWS\system32\expat.dll 2008-08-25 10:37 . 2006-05-03 22:24 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll 2008-08-25 10:37 . 2006-09-18 15:50 28,672 --a------ C:\WINDOWS\system32\JawsMacroUtils.dll 2008-08-25 09:26 . 2001-10-26 17:29 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-08-25 09:26 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-08-25 09:26 . 2001-08-17 21:53 13,824 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-08-25 09:26 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-08-24 22:45 . 2008-08-24 22:45 697 ---hs---- C:\comment.htt 2008-08-24 22:45 . 2008-08-24 22:45 72 ---hs---- C:\desktop.ini 2008-08-22 10:24 . 2008-08-22 10:24 <DIR> d-------- C:\Temp\cool 2008-08-22 10:22 . 2008-08-22 10:22 <DIR> d-------- C:\Program Files\Cool CD Burner 2008-08-22 10:22 . 2003-12-17 15:00 1,208,320 --a------ C:\WINDOWS\system32\PTxSCP.ocx 2008-08-22 10:22 . 2007-07-31 11:57 1,164,728 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2008-08-22 10:22 . 2000-05-22 21:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-08-22 10:22 . 1998-06-17 23:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2008-08-22 10:01 . 2008-08-22 10:01 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-08-22 09:58 . 2008-08-22 09:58 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-17 21:52 . 2008-08-17 21:52 <DIR> d-------- C:\Program Files\BearShare Applications 2008-08-17 21:52 . 2008-08-28 10:47 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\BearShare 2008-08-17 21:52 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-08-11 00:09 . 2008-08-11 00:09 1,694,728 --a------ C:\Program Files\dsetup32.dll 2008-08-11 00:09 . 2008-08-11 00:09 528,392 --a------ C:\Program Files\DXSETUP.exe 2008-08-11 00:09 . 2008-08-11 00:09 97,288 --a------ C:\Program Files\DSETUP.dll 2008-07-30 23:03 . 2008-07-31 11:24 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Azureus 2008-07-30 23:03 . 2008-07-30 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2008-07-30 23:01 . 2008-07-31 11:25 <DIR> d-------- C:\Program Files\Azureus 2008-07-28 10:48 . 2008-07-28 10:48 <DIR> d-------- C:\Program Files\VirtualDJ 2008-07-26 20:35 . 2008-07-26 20:35 <DIR> d-------- C:\Program Files\DirectVobSub 2008-07-26 20:29 . 2008-07-28 12:44 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-07-26 08:49 . 2008-07-26 08:49 <DIR> d-------- C:\Program Files\Real Alternative 2008-07-26 08:49 . 2008-07-26 08:49 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Media Player Classic 2008-07-24 22:21 . 2008-07-24 22:21 <DIR> d-------- C:\Program Files\LimeWire 2008-07-24 22:21 . 2008-07-24 22:37 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\LimeWire 2008-07-24 22:11 . 2008-07-24 22:11 <DIR> d-------- C:\Downloads 2008-07-24 22:10 . 2008-08-25 13:33 <DIR> d-------- C:\Program Files\BitSpirit 2008-07-24 22:10 . 2008-07-24 22:10 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\BitSpirit 2008-07-24 22:01 . 2008-07-24 22:01 <DIR> d-------- C:\Program Files\uTorrent 2008-07-24 22:01 . 2008-08-30 13:04 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\uTorrent 2008-07-20 11:02 . 2008-07-20 11:07 <DIR> d-------- C:\Program Files\PhotoFiltre Studio 2008-07-20 11:02 . 2008-07-20 11:02 45 ---h----- C:\WINDOWS\dsez4142.dat 2008-07-20 10:33 . 2001-08-17 22:03 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-07-17 10:37 . 2008-07-17 10:38 <DIR> d-------- C:\Documents and Settings\rotfl\.SunDownloadManager 2008-07-14 13:30 . 2008-07-29 21:25 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Nowe Gadu-Gadu 2008-07-14 13:29 . 2008-07-14 13:30 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-07-05 19:31 . 2008-08-16 20:07 <DIR> d-------- C:\Program Files\Opera 2008-07-03 11:06 . 2008-07-17 23:15 3,580 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-07-03 11:05 . 2008-07-17 23:15 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-07-02 23:35 . 2008-07-02 23:36 <DIR> d-------- C:\Program Files\RSDemon 2008-07-02 16:26 . 2008-07-02 16:27 <DIR> d-------- C:\Program Files\Maxis 2008-07-01 23:15 . 2008-07-01 23:15 <DIR> d-------- C:\Program Files\FM Modifier 2.2 2008-07-01 22:58 . 2008-07-01 22:58 <DIR> d-------- C:\Program Files\ffdshow 2008-07-01 22:58 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-07-01 22:58 . 2006-12-10 23:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-07-01 22:58 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-07-01 22:58 . 2008-06-12 20:36 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-07-01 22:58 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-07-01 22:35 . 2008-07-06 15:17 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Sports Interactive 2008-07-01 22:32 . 2008-07-01 22:32 <DIR> dr-h----- C:\Documents and Settings\rotfl\Dane aplikacji\SecuROM 2008-07-01 22:32 . 2008-07-01 22:32 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-07-01 21:56 . 2008-07-01 22:31 <DIR> d--h----- C:\Program Files\Zero G Registry 2008-07-01 21:56 . 2008-07-01 21:56 <DIR> d-------- C:\Program Files\Sports Interactive 2008-07-01 21:55 . 2008-07-01 21:55 <DIR> d--h----- C:\Documents and Settings\rotfl\InstallAnywhere 2008-07-01 21:50 . 2008-07-01 21:50 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-07-01 21:50 . 2008-07-01 21:50 <DIR> d-------- C:\Program Files\D-Tools 2008-07-01 21:50 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-07-01 21:50 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-07-01 14:26 . 2008-08-29 12:01 23 --a------ C:\Documents and Settings\rotfl\jagex_runescape_preferences.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-30 11:07 --------- d-----w C:\Documents and Settings\rotfl\Dane aplikacji\Skype 2008-08-30 09:08 --------- d-----w C:\Documents and Settings\rotfl\Dane aplikacji\skypePM 2008-08-28 09:42 --------- d-----w C:\Program Files\SwiftKit 2008-08-28 06:50 --------- d-----w C:\Program Files\ICQ6 2008-08-25 08:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-10 22:08 978,396 ----a-w C:\Program Files\BDAXP.cab[/quote]

Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:33:33, on 2008-08-30 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\PDFCreatorMessages.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PDFCreatorClient] "C:\Program Files\Global Graphics\Jaws PDF Creator 5\PDFClient.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd. - C:\WINDOWS\system32\PDFCreatorMessages.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 99 · przez **alamakota** 30 Sie 2008, 13:39

Witaj,log z combofix nie jest pełny.
w hijack usun wpis:

R3 - URLSearchHook: (no name) - - (no file)

Warto przeskanować kompa tym:
http://www.ewido.net/
Usuniesz wszystko co znajdzie.
C:\WINFILE.EXE masz w wielu lokalizacjach więc najlepiej będzie zadziałać ewido.

Autor postu otrzymał pochwałę

**Posty:** 7 · przez **r0tfl** 30 Sie 2008, 13:42

Teraz log powinien być pełny.

Kod: Zaznacz wszystko
ComboFix 08-08-29.02 - rotfl 2008-08-30 13:03:55.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.106 [GMT 2:00] Running from: C:\Documents and Settings\rotfl\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\bin.clearspring.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\bin.clearspring.com\clearspring.sol C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\interclick.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\#SharedObjects\8NMQWF5H\interclick.com\ud.sol C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\rotfl\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\system\J.exe . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))) . 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\WINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 ---h----- C:\Program Files\Program Files.exe 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\rafWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\NewWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\LqkWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\ICQWINFILE.EXE 2013-11-24 17:24 . 2013-11-24 17:24 53,765 --a------ C:\Documents and Settings\rotfl\GoDWINFILE.EXE 2008-08-30 12:55 . 2008-08-30 12:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-30 12:49 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-30 12:48 . 2008-08-30 12:48 <DIR> d-------- C:\Program Files\Panda Security 2008-08-30 12:43 . 2008-08-30 12:43 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Ahead 2008-08-30 12:40 . 2008-08-30 12:40 116 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-30 11:16 . 2005-04-20 13:32 2,916,352 --------- C:\WINDOWS\UNNMP.exe 2008-08-30 11:16 . 2006-05-23 18:30 47,894 --------- C:\WINDOWS\UNNMP.cfg 2008-08-30 11:15 . 2008-08-30 11:18 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-08-30 11:14 . 2008-08-30 11:14 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-08-30 11:14 . 2006-01-12 16:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-08-30 11:12 . 2008-08-30 11:12 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-08-30 11:12 . 2008-08-30 11:15 <DIR> d-------- C:\Program Files\Ahead 2008-08-30 11:12 . 2008-08-30 11:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-08-30 11:12 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-08-30 11:12 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-08-30 11:12 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-08-30 11:12 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-08-30 11:12 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-08-30 11:12 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-08-30 11:12 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll 2008-08-28 08:50 . 2008-08-28 08:50 94,208 --a------ C:\WINDOWS\system32\dxe.exe 2008-08-27 22:20 . 2008-08-27 22:20 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2008-08-26 14:41 . 2008-08-28 15:42 <DIR> d-------- C:\Program Files\KnightsAndMerchants 2008-08-25 19:48 . 2008-08-25 19:48 <DIR> d-------- C:\Program Files\Ganymede 2008-08-25 19:48 . 2008-08-30 10:51 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\GanymedeNet 2008-08-25 10:47 . 2008-08-25 10:47 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-08-25 10:45 . 2008-08-25 10:45 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-25 10:37 . 2008-08-25 10:37 <DIR> d-------- C:\Program Files\Global Graphics 2008-08-25 10:37 . 2008-06-27 22:28 2,256,896 --a------ C:\WINDOWS\system32\PDFCreatorSV.exe 2008-08-25 10:37 . 2008-06-27 22:28 598,016 --a------ C:\WINDOWS\system32\PDFCreator.cpl 2008-08-25 10:37 . 2008-06-27 22:26 466,944 --a------ C:\WINDOWS\system32\EventConsumer.dll 2008-08-25 10:37 . 2008-06-27 22:28 319,488 --a------ C:\WINDOWS\system32\PDFCreator.dll 2008-08-25 10:37 . 2008-06-27 22:20 282,624 --a------ C:\WINDOWS\system32\niknakXML.dll 2008-08-25 10:37 . 2008-06-27 22:25 143,360 --a------ C:\WINDOWS\system32\PDFCreatorMessages.exe 2008-08-25 10:37 . 2007-07-06 06:37 135,168 --a------ C:\WINDOWS\system32\expat.dll 2008-08-25 10:37 . 2006-05-03 22:24 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll 2008-08-25 10:37 . 2006-09-18 15:50 28,672 --a------ C:\WINDOWS\system32\JawsMacroUtils.dll 2008-08-25 09:26 . 2001-10-26 17:29 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-08-25 09:26 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-08-25 09:26 . 2001-08-17 21:53 13,824 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-08-25 09:26 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-08-24 22:45 . 2008-08-24 22:45 697 ---hs---- C:\comment.htt 2008-08-24 22:45 . 2008-08-24 22:45 72 ---hs---- C:\desktop.ini 2008-08-22 10:24 . 2008-08-22 10:24 <DIR> d-------- C:\Temp\cool 2008-08-22 10:22 . 2008-08-22 10:22 <DIR> d-------- C:\Program Files\Cool CD Burner 2008-08-22 10:22 . 2003-12-17 15:00 1,208,320 --a------ C:\WINDOWS\system32\PTxSCP.ocx 2008-08-22 10:22 . 2007-07-31 11:57 1,164,728 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2008-08-22 10:22 . 2000-05-22 21:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-08-22 10:22 . 1998-06-17 23:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2008-08-22 10:01 . 2008-08-22 10:01 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-08-22 09:58 . 2008-08-22 09:58 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-17 21:52 . 2008-08-17 21:52 <DIR> d-------- C:\Program Files\BearShare Applications 2008-08-17 21:52 . 2008-08-28 10:47 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\BearShare 2008-08-17 21:52 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-08-11 00:09 . 2008-08-11 00:09 1,694,728 --a------ C:\Program Files\dsetup32.dll 2008-08-11 00:09 . 2008-08-11 00:09 528,392 --a------ C:\Program Files\DXSETUP.exe 2008-08-11 00:09 . 2008-08-11 00:09 97,288 --a------ C:\Program Files\DSETUP.dll 2008-07-30 23:03 . 2008-07-31 11:24 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Azureus 2008-07-30 23:03 . 2008-07-30 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2008-07-30 23:01 . 2008-07-31 11:25 <DIR> d-------- C:\Program Files\Azureus 2008-07-28 10:48 . 2008-07-28 10:48 <DIR> d-------- C:\Program Files\VirtualDJ 2008-07-26 20:35 . 2008-07-26 20:35 <DIR> d-------- C:\Program Files\DirectVobSub 2008-07-26 20:29 . 2008-07-28 12:44 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-07-26 08:49 . 2008-07-26 08:49 <DIR> d-------- C:\Program Files\Real Alternative 2008-07-26 08:49 . 2008-07-26 08:49 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Media Player Classic 2008-07-24 22:21 . 2008-07-24 22:21 <DIR> d-------- C:\Program Files\LimeWire 2008-07-24 22:21 . 2008-07-24 22:37 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\LimeWire 2008-07-24 22:11 . 2008-07-24 22:11 <DIR> d-------- C:\Downloads 2008-07-24 22:10 . 2008-08-25 13:33 <DIR> d-------- C:\Program Files\BitSpirit 2008-07-24 22:10 . 2008-07-24 22:10 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\BitSpirit 2008-07-24 22:01 . 2008-07-24 22:01 <DIR> d-------- C:\Program Files\uTorrent 2008-07-24 22:01 . 2008-08-30 13:04 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\uTorrent 2008-07-20 11:02 . 2008-07-20 11:07 <DIR> d-------- C:\Program Files\PhotoFiltre Studio 2008-07-20 11:02 . 2008-07-20 11:02 45 ---h----- C:\WINDOWS\dsez4142.dat 2008-07-20 10:33 . 2001-08-17 22:03 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-07-17 10:37 . 2008-07-17 10:38 <DIR> d-------- C:\Documents and Settings\rotfl\.SunDownloadManager 2008-07-14 13:30 . 2008-07-29 21:25 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Nowe Gadu-Gadu 2008-07-14 13:29 . 2008-07-14 13:30 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-07-05 19:31 . 2008-08-16 20:07 <DIR> d-------- C:\Program Files\Opera 2008-07-03 11:06 . 2008-07-17 23:15 3,580 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-07-03 11:05 . 2008-07-17 23:15 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-07-02 23:35 . 2008-07-02 23:36 <DIR> d-------- C:\Program Files\RSDemon 2008-07-02 16:26 . 2008-07-02 16:27 <DIR> d-------- C:\Program Files\Maxis 2008-07-01 23:15 . 2008-07-01 23:15 <DIR> d-------- C:\Program Files\FM Modifier 2.2 2008-07-01 22:58 . 2008-07-01 22:58 <DIR> d-------- C:\Program Files\ffdshow 2008-07-01 22:58 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-07-01 22:58 . 2006-12-10 23:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-07-01 22:58 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-07-01 22:58 . 2008-06-12 20:36 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-07-01 22:58 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-07-01 22:35 . 2008-07-06 15:17 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Sports Interactive 2008-07-01 22:32 . 2008-07-01 22:32 <DIR> dr-h----- C:\Documents and Settings\rotfl\Dane aplikacji\SecuROM 2008-07-01 22:32 . 2008-07-01 22:32 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-07-01 21:56 . 2008-07-01 22:31 <DIR> d--h----- C:\Program Files\Zero G Registry 2008-07-01 21:56 . 2008-07-01 21:56 <DIR> d-------- C:\Program Files\Sports Interactive 2008-07-01 21:55 . 2008-07-01 21:55 <DIR> d--h----- C:\Documents and Settings\rotfl\InstallAnywhere 2008-07-01 21:50 . 2008-07-01 21:50 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-07-01 21:50 . 2008-07-01 21:50 <DIR> d-------- C:\Program Files\D-Tools 2008-07-01 21:50 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-07-01 21:50 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-07-01 14:26 . 2008-08-29 12:01 23 --a------ C:\Documents and Settings\rotfl\jagex_runescape_preferences.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-30 11:07 --------- d-----w C:\Documents and Settings\rotfl\Dane aplikacji\Skype 2008-08-30 09:08 --------- d-----w C:\Documents and Settings\rotfl\Dane aplikacji\skypePM 2008-08-28 09:42 --------- d-----w C:\Program Files\SwiftKit 2008-08-28 06:50 --------- d-----w C:\Program Files\ICQ6 2008-08-25 08:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-10 22:08 978,396 ----a-w C:\Program Files\BDAXP.cab 2008-07-29 22:16 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29 13312] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14 1077277] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-06-03 15:08 21718312] "Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-06-27 10:28 8798816] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-08-29 21:40 267056] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 13:30 217544] "ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2008-08-24 17:14 173304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 21:10 335872] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "PDFCreatorClient"="C:\Program Files\Global Graphics\Jaws PDF Creator 5\PDFClient.exe" [2008-06-27 22:28 471040] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 19:29 13312] R0 pavboot;pavboot;C:\WINDOWS\System32\drivers\pavboot.sys [2008-06-19 17:24] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a2bb10a-47a7-11dd-9d4c-806d6172696f}] \Shell\AutoRun\command - G:\autorun.exe *Newly Created Service* - CATCHME *Newly Created Service* - PAVBOOT *Newly Created Service* - PROCEXP90 . - - - - ORPHANS REMOVED - - - - HKLM-Run-Cmaudio - cmicnfg.cpl . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\rotfl\Dane aplikacji\Mozilla\Firefox\Profiles\mxvl885c.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://search.bearshare.com/pl/ FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPPOKER.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPSNOOKER.dll FF -: plugin - C:\Program Files\Opera\program\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-30 13:07:27 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\Ati2evxx.dll . Completion time: 2008-08-30 13:10:03 ComboFix-quarantined-files.txt 2008-08-30 11:09:59 Pre-Run: 28,658,991,104 bajtów wolnych Post-Run: 29,547,823,104 bajtów wolnych 202

**Posty:** 99 · przez **alamakota** 30 Sie 2008, 13:53

Wkle w notatniku:

Folder::

C:\WINFILE.EXE
C:\Program Files\Program Files.exe
C:\Documents and Settings\rotfl\rafWINFILE.EXE
C:\Documents and Settings\rotfl\NewWINFILE.EXE
C:\Documents and Settings\rotfl\LqkWINFILE.EXE
C:\Documents and Settings\rotfl\ICQWINFILE.EXE
C:\Documents and Settings\rotfl\GoDWINFILE.EXE

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a2bb10a-47a7-11dd-9d4c-806d6172696f}]

Plik > zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa.
Tak jak tutaj:
http://img124.imageshack.us/img124/8204/wykonajxz5.gif
Wstaw log który się wygeneruje.Pamiętaj też o ewido.

Autor postu otrzymał pochwałę

**Posty:** 7 · przez **r0tfl** 30 Sie 2008, 15:05

Ten log mi się wygenerował i przeskanowałem ewido.

Kod: Zaznacz wszystko
ComboFix 08-08-29.02 - rotfl 2008-08-30 14:59:12.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.74 [GMT 2:00] Running from: C:\Documents and Settings\rotfl\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\rotfl\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))) . 2008-08-30 14:14 . 2008-08-30 14:31 <DIR> d-------- C:\Program Files\ewido anti-spyware 4.0 2008-08-30 12:55 . 2008-08-30 12:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-30 12:49 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-30 12:48 . 2008-08-30 12:48 <DIR> d-------- C:\Program Files\Panda Security 2008-08-30 12:43 . 2008-08-30 12:43 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Ahead 2008-08-30 12:40 . 2008-08-30 12:40 116 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-30 11:16 . 2005-04-20 13:32 2,916,352 --------- C:\WINDOWS\UNNMP.exe 2008-08-30 11:16 . 2006-05-23 18:30 47,894 --------- C:\WINDOWS\UNNMP.cfg 2008-08-30 11:15 . 2008-08-30 11:18 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-08-30 11:14 . 2008-08-30 11:14 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-08-30 11:14 . 2006-01-12 16:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-08-30 11:12 . 2008-08-30 11:12 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-08-30 11:12 . 2008-08-30 11:15 <DIR> d-------- C:\Program Files\Ahead 2008-08-30 11:12 . 2008-08-30 11:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-08-30 11:12 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-08-30 11:12 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-08-30 11:12 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-08-30 11:12 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-08-30 11:12 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-08-30 11:12 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-08-30 11:12 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll 2008-08-28 08:50 . 2008-08-28 08:50 94,208 --a------ C:\WINDOWS\system32\dxe.exe 2008-08-27 22:20 . 2008-08-27 22:20 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2008-08-26 14:41 . 2008-08-30 14:11 <DIR> d-------- C:\Program Files\KnightsAndMerchants 2008-08-25 19:48 . 2008-08-25 19:48 <DIR> d-------- C:\Program Files\Ganymede 2008-08-25 19:48 . 2008-08-30 10:51 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\GanymedeNet 2008-08-25 10:47 . 2008-08-25 10:47 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-08-25 10:45 . 2008-08-25 10:45 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-25 10:37 . 2008-08-25 10:37 <DIR> d-------- C:\Program Files\Global Graphics 2008-08-25 10:37 . 2008-06-27 22:28 2,256,896 --a------ C:\WINDOWS\system32\PDFCreatorSV.exe 2008-08-25 10:37 . 2008-06-27 22:28 598,016 --a------ C:\WINDOWS\system32\PDFCreator.cpl 2008-08-25 10:37 . 2008-06-27 22:26 466,944 --a------ C:\WINDOWS\system32\EventConsumer.dll 2008-08-25 10:37 . 2008-06-27 22:28 319,488 --a------ C:\WINDOWS\system32\PDFCreator.dll 2008-08-25 10:37 . 2008-06-27 22:20 282,624 --a------ C:\WINDOWS\system32\niknakXML.dll 2008-08-25 10:37 . 2008-06-27 22:25 143,360 --a------ C:\WINDOWS\system32\PDFCreatorMessages.exe 2008-08-25 10:37 . 2007-07-06 06:37 135,168 --a------ C:\WINDOWS\system32\expat.dll 2008-08-25 10:37 . 2006-05-03 22:24 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll 2008-08-25 10:37 . 2006-09-18 15:50 28,672 --a------ C:\WINDOWS\system32\JawsMacroUtils.dll 2008-08-25 09:26 . 2001-10-26 17:29 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-08-25 09:26 . 2001-08-17 21:53 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-08-25 09:26 . 2001-08-17 21:53 13,824 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-08-25 09:26 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-08-24 22:45 . 2008-08-24 22:45 72 ---hs---- C:\desktop.ini 2008-08-22 10:24 . 2008-08-22 10:24 <DIR> d-------- C:\Temp\cool 2008-08-22 10:22 . 2008-08-22 10:22 <DIR> d-------- C:\Program Files\Cool CD Burner 2008-08-22 10:22 . 2003-12-17 15:00 1,208,320 --a------ C:\WINDOWS\system32\PTxSCP.ocx 2008-08-22 10:22 . 2007-07-31 11:57 1,164,728 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2008-08-22 10:22 . 2000-05-22 21:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-08-22 10:22 . 1998-06-17 23:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2008-08-22 10:01 . 2008-08-22 10:01 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-08-22 09:58 . 2008-08-22 09:58 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-17 21:52 . 2008-08-17 21:52 <DIR> d-------- C:\Program Files\BearShare Applications 2008-08-17 21:52 . 2008-08-28 10:47 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\BearShare 2008-08-17 21:52 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-08-11 00:09 . 2008-08-11 00:09 1,694,728 --a------ C:\Program Files\dsetup32.dll 2008-08-11 00:09 . 2008-08-11 00:09 528,392 --a------ C:\Program Files\DXSETUP.exe 2008-08-11 00:09 . 2008-08-11 00:09 97,288 --a------ C:\Program Files\DSETUP.dll 2008-07-30 23:03 . 2008-07-31 11:24 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Azureus 2008-07-30 23:03 . 2008-07-30 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2008-07-30 23:01 . 2008-07-31 11:25 <DIR> d-------- C:\Program Files\Azureus 2008-07-28 10:48 . 2008-07-28 10:48 <DIR> d-------- C:\Program Files\VirtualDJ 2008-07-26 20:35 . 2008-07-26 20:35 <DIR> d-------- C:\Program Files\DirectVobSub 2008-07-26 20:29 . 2008-07-28 12:44 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-07-26 08:49 . 2008-07-26 08:49 <DIR> d-------- C:\Program Files\Real Alternative 2008-07-26 08:49 . 2008-07-26 08:49 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Media Player Classic 2008-07-24 22:21 . 2008-07-24 22:21 <DIR> d-------- C:\Program Files\LimeWire 2008-07-24 22:21 . 2008-07-24 22:37 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\LimeWire 2008-07-24 22:11 . 2008-07-24 22:11 <DIR> d-------- C:\Downloads 2008-07-24 22:10 . 2008-08-25 13:33 <DIR> d-------- C:\Program Files\BitSpirit 2008-07-24 22:10 . 2008-07-24 22:10 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\BitSpirit 2008-07-24 22:01 . 2008-07-24 22:01 <DIR> d-------- C:\Program Files\uTorrent 2008-07-24 22:01 . 2008-08-30 14:59 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\uTorrent 2008-07-20 11:02 . 2008-07-20 11:07 <DIR> d-------- C:\Program Files\PhotoFiltre Studio 2008-07-20 11:02 . 2008-07-20 11:02 45 ---h----- C:\WINDOWS\dsez4142.dat 2008-07-20 10:33 . 2001-08-17 22:03 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-07-17 10:37 . 2008-07-17 10:38 <DIR> d-------- C:\Documents and Settings\rotfl\.SunDownloadManager 2008-07-14 13:30 . 2008-07-29 21:25 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Nowe Gadu-Gadu 2008-07-14 13:29 . 2008-07-14 13:30 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-07-05 19:31 . 2008-08-16 20:07 <DIR> d-------- C:\Program Files\Opera 2008-07-03 11:06 . 2008-07-17 23:15 3,580 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-07-03 11:05 . 2008-07-17 23:15 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-07-02 23:35 . 2008-07-02 23:36 <DIR> d-------- C:\Program Files\RSDemon 2008-07-02 16:26 . 2008-07-02 16:27 <DIR> d-------- C:\Program Files\Maxis 2008-07-01 23:15 . 2008-07-01 23:15 <DIR> d-------- C:\Program Files\FM Modifier 2.2 2008-07-01 22:58 . 2008-07-01 22:58 <DIR> d-------- C:\Program Files\ffdshow 2008-07-01 22:58 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-07-01 22:58 . 2006-12-10 23:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-07-01 22:58 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-07-01 22:58 . 2008-06-12 20:36 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-07-01 22:58 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-07-01 22:35 . 2008-07-06 15:17 <DIR> d-------- C:\Documents and Settings\rotfl\Dane aplikacji\Sports Interactive 2008-07-01 22:32 . 2008-07-01 22:32 <DIR> dr-h----- C:\Documents and Settings\rotfl\Dane aplikacji\SecuROM 2008-07-01 22:32 . 2008-07-01 22:32 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-07-01 21:56 . 2008-07-01 22:31 <DIR> d--h----- C:\Program Files\Zero G Registry 2008-07-01 21:56 . 2008-07-01 21:56 <DIR> d-------- C:\Program Files\Sports Interactive 2008-07-01 21:55 . 2008-07-01 21:55 <DIR> d--h----- C:\Documents and Settings\rotfl\InstallAnywhere 2008-07-01 21:50 . 2008-07-01 21:50 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-07-01 21:50 . 2008-07-01 21:50 <DIR> d-------- C:\Program Files\D-Tools 2008-07-01 21:50 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-07-01 21:50 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-07-01 14:26 . 2008-08-29 12:01 23 --a------ C:\Documents and Settings\rotfl\jagex_runescape_preferences.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-30 12:25 --------- d-----w C:\Documents and Settings\rotfl\Dane aplikacji\Skype 2008-08-30 09:08 --------- d-----w C:\Documents and Settings\rotfl\Dane aplikacji\skypePM 2008-08-28 09:42 --------- d-----w C:\Program Files\SwiftKit 2008-08-28 06:50 --------- d-----w C:\Program Files\ICQ6 2008-08-25 08:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-10 22:08 978,396 ----a-w C:\Program Files\BDAXP.cab 2008-07-29 22:16 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . ((((((((((((((((((((((((((((( snapshot@2008-08-30_13.09.35.49 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-30 11:02:58 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-30 12:28:13 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-08-30 11:02:58 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-08-30 12:28:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-08-30 11:02:58 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-08-30 12:28:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29 13312] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14 1077277] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-06-03 15:08 21718312] "Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-06-27 10:28 8798816] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-08-29 21:40 267056] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 13:30 217544] "ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2008-08-24 17:14 173304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 21:10 335872] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "PDFCreatorClient"="C:\Program Files\Global Graphics\Jaws PDF Creator 5\PDFClient.exe" [2008-06-27 22:28 471040] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648] "!ewido"="C:\Program Files\ewido anti-spyware 4.0\ewido.exe" [2008-08-30 14:19 6283264] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 19:29 13312] R0 pavboot;pavboot;C:\WINDOWS\System32\drivers\pavboot.sys [2008-06-19 17:24] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-30 15:01:06 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\Ati2evxx.dll . Completion time: 2008-08-30 15:03:51 ComboFix-quarantined-files.txt 2008-08-30 13:03:46 ComboFix2.txt 2008-08-30 11:10:04 Pre-Run: 33,449,140,224 bajtów wolnych Post-Run: 33,477,513,216 bajtów wolnych 176

**Posty:** 99 · przez **alamakota** 30 Sie 2008, 15:27

Ja już nic więcej nie widzę.Jak sytuacja u ciebie teraz na kompie?

**Posty:** 7 · przez **r0tfl** 30 Sie 2008, 17:26

Już winfile się nie pojawia ale teraz tak muli pc, że nie da się nic robić.
Jak znalazłbyś coś w logu żeby go odmulić to byłbym wdzięczny.

**Posty:** 99 · przez **alamakota** 30 Sie 2008, 18:04

Zrób dekragmentację dysków.
Poczytaj:
optymalizacja-windowsa-xp-vt89133.html

Winfile

Winfile

Winfile

Re: winfile

Winfile

Winfile

Winfile

Re: winfile

Winfile

Kto jest na forum