Wirus patrron - activebugger.exe etc - log

**Posty:** 2042 · przez **Wojtaz** 19 Sie 2008, 15:55

Kolega ma problem, ponieważ ma wymienione wyżej wirusy. Tutaj wklejam logi z Hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:53:40, on 2008-08-19 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\activexdebugger32.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\VM_STI.EXE C:\WINDOWS\system32\RunDLL32.exe D:\Program Files\Vista Drive Icon\DrvIcon.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe D:\Program Files\WFlip050\WinFlip.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Opera\opera.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll F2 - REG:system.ini: Shell=Explorer.exe activexdebugger32.exe O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DrvIcon] D:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [LogonStudio] "D:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Skrót do WinFlip.lnk = D:\Program Files\WFlip050\WinFlip.exe O4 - Global Startup: TrayMin200.exe.lnk = ? O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 3905 bytes

Za chwilke wrzuce z Combofixa.

Edit:
Combofix:

Kod: Zaznacz wszystko: ComboFix 08-08-18.04 - Krzysiek 2008-08-19 15:57:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.105 [GMT 2:00] Running from: C:\Documents and Settings\Krzysiek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Krzysiek\UserData C:\Documents and Settings\Krzysiek\UserData\index.dat . ((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))) . 2008-08-17 21:37 . 2008-08-18 13:07 <DIR> d-------- C:\Program Files\WinAce 2008-08-17 21:14 . 2000-10-10 13:01 198,656 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-08-17 21:14 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll 2008-08-17 21:14 . 2008-08-19 14:26 24 --a------ C:\WINDOWS\LogonStudio.ini 2008-08-17 21:10 . 2000-05-22 03:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-08-17 20:53 . 2008-08-17 20:53 <DIR> d-------- C:\Program Files\Common Files\Stardock 2008-08-17 20:53 . 2008-08-17 21:34 162,432 --a------ C:\WINDOWS\system32\drivers\vidstub.sys 2008-08-12 20:14 . 2008-08-12 20:14 <DIR> d-------- C:\Documents and Settings\Halina\Dane aplikacji\ICQ Toolbar 2008-08-08 20:47 . 2008-08-08 20:54 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\GetRightToGo 2008-07-22 00:20 . 2008-07-22 00:20 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\ICQ Toolbar 2008-07-21 15:47 . 2008-08-06 19:23 <DIR> d-------- C:\Program Files\ICQToolbar 2008-07-21 15:46 . 2008-07-21 15:47 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\ICQ 2008-07-21 15:45 . 2008-07-21 15:47 <DIR> d-------- C:\Program Files\ICQ6 2008-07-19 05:03 . 2008-07-19 05:03 <DIR> d-------- C:\Program Files\Acclaim Entertainment . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-18 20:39 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype 2008-08-17 19:15 21,590,528 ----a-w C:\WINDOWS\system32\logonuiX.exe 2008-08-08 18:53 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-18 20:26 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Media Player Classic 2008-07-18 20:25 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-07-15 14:27 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\InstallShield 2008-07-11 21:14 --------- d-----w C:\Program Files\Google 2008-07-09 23:47 --------- d-----w C:\Program Files\Opera 2008-07-09 17:53 --------- d-----w C:\Documents and Settings\Halina\Dane aplikacji\Skype 2008-07-06 20:59 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-06-19 16:36 --------- d-----w C:\Program Files\Common Files\DirectX 2007-05-22 12:53 376,832 --sh--w C:\WINDOWS\system32\activexdebugger32.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2004-06-09 15:37 40960] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-18 23:35 7606272] "DrvIcon"="D:\Program Files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 14:39 49152] "LogonStudio"="D:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38 987187] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 22:51 171520] "SoundMan"="SOUNDMAN.EXE" [2002-09-11 04:57 46592 C:\WINDOWS\SOUNDMAN.EXE] "NvMediaCenter"="NvMCTray.dll" [2006-05-18 23:35 86016 C:\WINDOWS\system32\nvmctray.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 22:51 15360] C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\ Skr˘t do WinFlip.lnk - D:\Program Files\WFlip050\WinFlip.exe [2008-07-05 15:03:35 483328] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ TrayMin200.exe.lnk - C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2008-06-17 23:26:24 278528] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 22:51 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-14 22:51 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-05-18 23:35 1519616 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"= "D:\\ \\mp#\\fovnfs01\\fovnfsu2\\speed2.exe"= "C:\\Program Files\\Opera\\opera.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 00:15] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76a522b3-429f-11dd-8749-00001cd8ba0c}] \Shell\Auto\command - E:\activexdebugger32.exe f \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - E:\activexdebugger32.exe f \Shell\open\Command - E:\activexdebugger32.exe f [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5f43132-4934-11dd-875a-00001cd8ba0c}] \Shell\Auto\command - E:\activexdebugger32.exe f \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f \Shell\explore\Command - E:\activexdebugger32.exe f \Shell\open\Command - E:\activexdebugger32.exe f *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://start.icq.com/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-19 15:59:02 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-19 16:00:27 ComboFix-quarantined-files.txt 2008-08-19 14:00:14 Pre-Run: 12,913,545,216 bajtów wolnych Post-Run: 12,906,840,064 bajtów wolnych 118

**Posty:** 8001 · przez **Okocza** 19 Sie 2008, 16:20

F2 - REG:system.ini: Shell=Explorer.exe activexdebugger32.exe

fix w hj

otwierasz notatnik i wklejasz

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.0 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76a522b3-429f-11dd-8749-00001cd8ba0c}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5f43132-4934-11dd-875a-00001cd8ba0c}]

zapisujesz jako fix.reg i odpalasz

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

do tego format WSZYSTKICH pendrive'ów

**Posty:** 18165 · przez **wojtas** 19 Sie 2008, 16:21

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\activexdebugger32.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76a522b3-429f-11dd-8749-00001cd8ba0c}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5f43132-4934-11dd-875a-00001cd8ba0c}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 2042 · przez **Wojtaz** 19 Sie 2008, 16:39

SDfix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.218 [/b] Run by Krzysiek on 2008-08-19 at 16:28 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-19 16:37:08 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Program Files\\Gadu-Gadu\\gg.exe"="D:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"="C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe:*:Enabled:SIPPS" "D:\\˙\\mp#\\fovnfs01\\fovnfsu2\\speed2.exe"="D:\\˙\\mp#\\fovnfs01\\fovnfsu2\\speed2.exe:*:Enabled:speed2" "C:\\Program Files\\Opera\\opera.exe"="C:\\Program Files\\Opera\\opera.exe:*:Enabled:Opera Internet Browser" "C:\\Program Files\\ICQ6\\ICQ.exe"="C:\\Program Files\\ICQ6\\ICQ.exe:*:Enabled:ICQ6" "D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"="D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe:*:Enabled:Tony Hawk's American Wasteland" "D:\\Program Files\\Skype\\Phone\\Skype.exe"="D:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Tue 22 May 2007 376,832 ..SH. --- "C:\WINDOWS\system32\activexdebugger32.exe" [b]Finished![/b]

Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:38:58, on 2008-08-19 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\VM_STI.EXE C:\WINDOWS\system32\RunDLL32.exe D:\Program Files\Vista Drive Icon\DrvIcon.exe C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe D:\Program Files\WFlip050\WinFlip.exe C:\Program Files\Opera\opera.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DrvIcon] D:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [LogonStudio] "D:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Skrót do WinFlip.lnk = D:\Program Files\WFlip050\WinFlip.exe O4 - Global Startup: TrayMin200.exe.lnk = ? O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4027 bytes

Combofix oraz fixreg;

**Posty:** 8001 · przez **Okocza** 19 Sie 2008, 16:43

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

sformatowałeś wszystkie pendrive'y :?:

**Posty:** 2042 · przez **Wojtaz** 19 Sie 2008, 16:49

Kod: Zaznacz wszystko: ComboFix 08-08-18.04 - Krzysiek 2008-08-19 16:42:12.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.82 [GMT 2:00] Running from: C:\Documents and Settings\Krzysiek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Krzysiek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\activexdebugger32.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\activexdebugger32.exe . ((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))) . 2008-08-19 16:27 . 2008-08-19 16:27 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-19 16:24 . 2008-08-19 16:37 <DIR> d-------- C:\SDFix 2008-08-17 21:37 . 2008-08-18 13:07 <DIR> d-------- C:\Program Files\WinAce 2008-08-17 21:14 . 2000-10-10 13:01 198,656 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-08-17 21:14 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll 2008-08-17 21:14 . 2008-08-19 16:37 24 --a------ C:\WINDOWS\LogonStudio.ini 2008-08-17 21:10 . 2000-05-22 03:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-08-17 20:53 . 2008-08-17 20:53 <DIR> d-------- C:\Program Files\Common Files\Stardock 2008-08-17 20:53 . 2008-08-17 21:34 162,432 --a------ C:\WINDOWS\system32\drivers\vidstub.sys 2008-08-12 20:14 . 2008-08-12 20:14 <DIR> d-------- C:\Documents and Settings\Halina\Dane aplikacji\ICQ Toolbar 2008-08-08 20:47 . 2008-08-08 20:54 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\GetRightToGo 2008-07-22 00:20 . 2008-07-22 00:20 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\ICQ Toolbar 2008-07-21 15:47 . 2008-08-06 19:23 <DIR> d-------- C:\Program Files\ICQToolbar 2008-07-21 15:46 . 2008-07-21 15:47 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\ICQ 2008-07-21 15:45 . 2008-07-21 15:47 <DIR> d-------- C:\Program Files\ICQ6 2008-07-19 05:03 . 2008-07-19 05:03 <DIR> d-------- C:\Program Files\Acclaim Entertainment . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-18 20:39 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype 2008-08-17 19:15 21,590,528 ----a-w C:\WINDOWS\system32\logonuiX.exe 2008-08-08 18:53 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-18 20:26 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Media Player Classic 2008-07-18 20:25 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-07-15 14:27 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\InstallShield 2008-07-11 21:14 --------- d-----w C:\Program Files\Google 2008-07-09 23:47 --------- d-----w C:\Program Files\Opera 2008-07-09 17:53 --------- d-----w C:\Documents and Settings\Halina\Dane aplikacji\Skype 2008-07-06 20:59 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-06-19 16:36 --------- d-----w C:\Program Files\Common Files\DirectX . ((((((((((((((((((((((((((((( snapshot@2008-08-19_15.59.58.64 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-19 14:27:16 2,932,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-19 14:27:16 36,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-19 14:27:11 2,932,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-19 14:27:11 36,864 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2004-06-09 15:37 40960] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-18 23:35 7606272] "DrvIcon"="D:\Program Files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 14:39 49152] "LogonStudio"="D:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38 987187] "SoundMan"="SOUNDMAN.EXE" [2002-09-11 04:57 46592 C:\WINDOWS\SOUNDMAN.EXE] "NvMediaCenter"="NvMCTray.dll" [2006-05-18 23:35 86016 C:\WINDOWS\system32\nvmctray.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 22:51 15360] C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\ Skr˘t do WinFlip.lnk - D:\Program Files\WFlip050\WinFlip.exe [2008-07-05 15:03:35 483328] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ TrayMin200.exe.lnk - C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2008-06-17 23:26:24 278528] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 22:51 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-14 22:51 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-05-18 23:35 1519616 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"= "D:\\ \\mp#\\fovnfs01\\fovnfsu2\\speed2.exe"= "C:\\Program Files\\Opera\\opera.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 00:15] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-19 16:43:26 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-19 16:44:47 ComboFix-quarantined-files.txt 2008-08-19 14:44:21 ComboFix2.txt 2008-08-19 14:00:28 Pre-Run: 12,846,428,160 bajtów wolnych Post-Run: 12,843,839,488 bajtów wolnych 113

To z CFScripta.txt po wykonaniu.
Optymalizacja etc wykonane, screen z M<Sconfig:

Pendrive już sformatowany, teraz tylko telefon został...

Edit: nie mogę sformatowac pendive'a, bo wyskakuje, że ktoś używa to activebugger32.exe, wrzucić logi?
Edit2: już sobie poradziłem, Combofix:

Kod: Zaznacz wszystko: ComboFix 08-08-18.04 - Krzysiek 2008-08-19 16:53:19.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.115 [GMT 2:00] Running from: C:\Documents and Settings\Krzysiek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Krzysiek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\activexdebugger32.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\activexdebugger32.exe E:\AUTORUN.INF . ((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))) . 2008-08-19 16:27 . 2008-08-19 16:27 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-19 16:24 . 2008-08-19 16:37 <DIR> d-------- C:\SDFix 2008-08-17 21:37 . 2008-08-18 13:07 <DIR> d-------- C:\Program Files\WinAce 2008-08-17 21:14 . 2000-10-10 13:01 198,656 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-08-17 21:14 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll 2008-08-17 21:14 . 2008-08-19 16:37 24 --a------ C:\WINDOWS\LogonStudio.ini 2008-08-17 21:10 . 2000-05-22 03:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-08-17 20:53 . 2008-08-17 20:53 <DIR> d-------- C:\Program Files\Common Files\Stardock 2008-08-17 20:53 . 2008-08-17 21:34 162,432 --a------ C:\WINDOWS\system32\drivers\vidstub.sys 2008-08-12 20:14 . 2008-08-12 20:14 <DIR> d-------- C:\Documents and Settings\Halina\Dane aplikacji\ICQ Toolbar 2008-08-08 20:47 . 2008-08-08 20:54 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\GetRightToGo 2008-07-22 00:20 . 2008-07-22 00:20 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\ICQ Toolbar 2008-07-21 15:47 . 2008-08-06 19:23 <DIR> d-------- C:\Program Files\ICQToolbar 2008-07-21 15:46 . 2008-07-21 15:47 <DIR> d-------- C:\Documents and Settings\Krzysiek\Dane aplikacji\ICQ 2008-07-21 15:45 . 2008-07-21 15:47 <DIR> d-------- C:\Program Files\ICQ6 2008-07-19 05:03 . 2008-07-19 05:03 <DIR> d-------- C:\Program Files\Acclaim Entertainment . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-18 20:39 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Skype 2008-08-17 19:15 21,590,528 ----a-w C:\WINDOWS\system32\logonuiX.exe 2008-08-08 18:53 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-18 20:26 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\Media Player Classic 2008-07-18 20:25 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-07-15 14:27 --------- d-----w C:\Documents and Settings\Krzysiek\Dane aplikacji\InstallShield 2008-07-11 21:14 --------- d-----w C:\Program Files\Google 2008-07-09 23:47 --------- d-----w C:\Program Files\Opera 2008-07-09 17:53 --------- d-----w C:\Documents and Settings\Halina\Dane aplikacji\Skype 2008-07-06 20:59 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-06-19 16:36 --------- d-----w C:\Program Files\Common Files\DirectX . ((((((((((((((((((((((((((((( snapshot@2008-08-19_15.59.58.64 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-19 14:27:16 2,932,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-19 14:27:16 36,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-19 14:27:11 2,932,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-19 14:27:11 36,864 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BigDogPath"="C:\WINDOWS\VM_STI.EXE" [2004-06-09 15:37 40960] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-18 23:35 7606272] "DrvIcon"="D:\Program Files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 14:39 49152] "LogonStudio"="D:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38 987187] "SoundMan"="SOUNDMAN.EXE" [2002-09-11 04:57 46592 C:\WINDOWS\SOUNDMAN.EXE] "NvMediaCenter"="NvMCTray.dll" [2006-05-18 23:35 86016 C:\WINDOWS\system32\nvmctray.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 22:51 15360] C:\Documents and Settings\Krzysiek\Menu Start\Programy\Autostart\ Skr˘t do WinFlip.lnk - D:\Program Files\WFlip050\WinFlip.exe [2008-07-05 15:03:35 483328] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ TrayMin200.exe.lnk - C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2008-06-17 23:26:24 278528] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 22:51 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-14 22:51 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-05-18 23:35 1519616 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Ahead\\SIPPS\\SIPPS.exe"= "D:\\ \\mp#\\fovnfs01\\fovnfsu2\\speed2.exe"= "C:\\Program Files\\Opera\\opera.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "D:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 00:15] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-19 16:54:40 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-19 16:55:53 ComboFix-quarantined-files.txt 2008-08-19 14:55:27 ComboFix2.txt 2008-08-19 14:44:48 ComboFix3.txt 2008-08-19 14:00:28 Pre-Run: 12,650,614,784 bajtów wolnych Post-Run: 12,654,587,904 bajtów wolnych 116

**Posty:** 8001 · przez **Okocza** 19 Sie 2008, 17:06

spoko - czysto jest

Autor postu otrzymał pochwałę

Kto jest na forum