wirus

**Posty:** 77 · przez **WLOCHACZ** 18 Mar 2008, 01:15

Witam nie potrafie wejsc na zadna partycje prosze o sprawdzenie

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:12:12, on 2008-03-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\GG\gg.exe C:\WINDOWS\system32\Lsas.exe C:\WINDOWS\inf\Lsass.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\DOKUMENTY SYSTEMOWE\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing) F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\inf\Lsass.exe O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=050707 serial=DR12WEM-4706028-MSW lang=EN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\GG\gg.exe" /tray O4 - HKCU\..\Run: [SystemFile] C:\WINDOWS\system32\Lsas.exe O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKCU\..\Run: [Star Downloader Free] C:\Program Files\Star Downloader\stardown.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A2B0F95B-8B62-428B-B66E-9697A62F059A}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O24 - Desktop Component 0: (no name) - http://marleymarketplace.netcentrixllc.com/images/products/369_6501219.jpg -- End of file - 7238 bytes

**Posty:** 3854 · przez **Dzi@dek** 18 Mar 2008, 11:29

Usuwasz podane wpisy w hijackthis:

R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing)
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\inf\Lsass.exe
O4 - HKCU\..\Run: [SystemFile] C:\WINDOWS\system32\Lsas.exe
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 77 · przez **WLOCHACZ** 18 Mar 2008, 18:12

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:11:40, on 2008-03-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\GG\gg.exe C:\Program Files\eMule\emule.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\WINDOWS\inf\Lsass.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\DOKUMENTY SYSTEMOWE\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=050707 serial=DR12WEM-4706028-MSW lang=EN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\GG\gg.exe" /tray O4 - HKCU\..\Run: [Star Downloader Free] C:\Program Files\Star Downloader\stardown.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A2B0F95B-8B62-428B-B66E-9697A62F059A}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O24 - Desktop Component 0: (no name) - http://marleymarketplace.netcentrixllc.com/images/products/369_6501219.jpg -- End of file - 6937 bytes

Nie wiem jak sie wkleja z tego drugiego programu loga

**Posty:** 18165 · przez **wojtas** 18 Mar 2008, 18:50

sciagasz właczasz go czekasz i powinien sam log CI wyskoczyc i go wklejasz

jesli nie to szukasz go na dysku C

**Posty:** 77 · przez **WLOCHACZ** 18 Mar 2008, 21:19

Kod: Zaznacz wszystko: ComboFix 08-03-17.1 - STODOLKOWIE 2008-03-18 17:22:32.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.398 [GMT 1:00] Running from: E:\DOKUMENTY SYSTEMOWE\Pulpit\ComboFix.exe Command switches used :: E:\DOKUMENTY SYSTEMOWE\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\oufddh.exe C:\uisvkqr.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo1.dll D:\Autorun.inf E:\Autorun.inf F:\Autorun.inf G:\Autorun.inf H:\Autorun.inf I:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-02-18 to 2008-03-18 ))))))))))))))))))))))))))))))) . 2008-03-18 17:25 . 2008-03-18 17:25 48,309 --a------ C:\catchme.zip 2008-03-17 15:50 . 2008-03-17 15:51 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Mathematica 2008-03-17 15:50 . 2008-03-17 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Mathematica 2008-03-17 15:41 . 2008-03-17 15:49 <DIR> d-------- C:\Program Files\Wolfram Research 2008-03-17 15:33 . 2008-03-17 15:33 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Scilab 2008-03-17 15:09 . 2008-03-17 15:28 <DIR> d-------- C:\Program Files\euklides 2008-03-17 15:08 . 2008-03-17 15:08 286,720 --------- C:\WINDOWS\Setup1.exe 2008-03-17 15:08 . 2008-03-17 15:08 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-03-17 13:34 . 2008-03-18 17:27 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Orbit 2008-03-17 13:33 . 2008-03-17 13:34 <DIR> d-------- C:\Program Files\Orbitdownloader 2008-03-17 07:15 . 2008-03-17 07:15 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Talkback 2008-03-16 21:41 . 2008-03-16 21:41 <DIR> d-------- C:\WINDOWS\Desktop 2008-03-16 21:31 . 2008-03-16 21:31 <DIR> d-------- C:\Program Files\FreshDevices 2008-03-16 21:06 . 2008-03-16 21:10 <DIR> d-------- C:\Download 2008-03-16 20:55 . 2008-03-16 21:35 <DIR> d-------- C:\Program Files\Star Downloader 2008-03-16 08:31 . 2008-03-17 12:30 <DIR> d-------- C:\Program Files\LeechGet 2007 2008-03-16 08:14 . 2008-03-18 01:07 <DIR> d-------- C:\Downloads 2008-03-16 08:07 . 2008-03-16 20:50 <DIR> d-------- C:\Program Files\FlashGet 2008-03-16 07:53 . 2008-03-17 14:55 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-16 00:02 . 2008-03-16 21:36 100,462 -r-hs---- C:\3o.exe 2008-03-15 09:44 . 2008-03-15 09:43 101,166 -r-hs---- C:\cfdflx.com 2008-03-14 14:11 . 2008-03-14 14:11 101,025 -r-hs---- C:\yo2mq6.exe 2008-03-14 14:11 . 2008-03-14 14:11 72,192 -r-hs---- C:\WINDOWS\system32\amvo2.dll 2008-03-13 06:21 . 2008-03-13 06:20 100,791 -r-hs---- C:\v.cmd 2008-03-01 14:19 . 2008-03-01 14:19 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\HEXelon 2008-02-27 17:01 . 2008-02-27 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IM 2008-02-27 16:59 . 2008-03-18 00:07 <DIR> d-------- C:\Program Files\IncrediMail 2008-02-27 16:59 . 2008-02-27 16:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IncrediMail 2008-02-24 12:25 . 2008-02-24 12:30 <DIR> d-------- C:\Program Files\ABBYY PDF Transformer 1.0 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-18 16:27 --------- d-----w C:\Program Files\eMule 2008-03-18 16:02 --------- d-----w C:\Program Files\Neostrada TP 2008-03-15 08:45 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\uTorrent 2008-03-14 19:41 --------- d-----w C:\Program Files\Audacity 2008-03-05 12:59 --------- d-----w C:\Program Files\Java 2008-02-25 19:50 --------- d-----w C:\Program Files\TransAng2 2008-02-24 11:36 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-23 10:21 --------- d-----w C:\Program Files\GG 2008-02-19 09:02 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Skype 2008-02-12 23:06 --------- d-----w C:\Program Files\eToro 2008-02-08 10:06 --------- d-----w C:\Program Files\MIKSOFT 2008-02-08 09:57 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\foobar2000 2008-01-31 09:05 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\EBookSys 2008-01-24 21:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-24 14:32 --------- d-----w C:\Program Files\TomTom HOME 2 2008-01-24 14:32 --------- d-----w C:\Program Files\TomTom HOME 2008-01-24 14:32 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\TomTom 2008-01-24 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TomTom 2008-01-23 09:27 --------- d-----w C:\Program Files\uTorrent 2008-01-22 20:23 --------- d-----w C:\Program Files\TomTom DesktopSuite 2008-01-20 11:55 --------- d-----w C:\Program Files\MarBit 2008-01-20 11:29 --------- d-----w C:\Program Files\SubEdit-Player 2008-01-20 11:06 --------- d-----w C:\Program Files\Real Alternative 2007-11-09 08:46 24,496 ----a-w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-04-20 13:09 316 ----a-w C:\Program Files\INSTALL.LOG 2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe 2004-09-06 11:22 826,880 ----a-w C:\Program Files\WAV C60Convert.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\GG\gg.exe" [2007-01-30 15:58 1716224] "Star Downloader Free"="C:\Program Files\Star Downloader\stardown.exe" [ ] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2006-01-26 17:21 4857856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 09:42 69632] "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-29 21:29 196608] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 17:07 24576] "autoclk"="autoclk.exe" [] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 17:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 17:07 53248] "adiras"="adiras.exe" [] "SoundMan"="SOUNDMAN.EXE" [2006-06-21 04:42 577536 C:\WINDOWS\soundman.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 18:42 32768] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [ ] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-12 15:52 282624] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "AtiPTA"="atiptaxx.exe" [2005-03-23 02:05 339968 C:\WINDOWS\system32\atiptaxx.exe] "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 10:19 378784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 06:05:26 29696] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-09-26 19:20:56 962661] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360] Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-03-17 13:33:58 1674440] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{35B2861B-2B26-4691-9FF0-09083722C736}"= C:\WINDOWS\system32\RadExe.dll [2005-04-28 00:30 188416] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GG\\gg.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "C:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\Mathematica.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\MathKernel.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\math.exe"= S1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.sys [] S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-01-24 14:38] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-01-24 14:38] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-01-24 14:38] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{822e91a8-e641-11dc-8a45-4d6564696130}] \Shell\AutoRun\command - M:\yo2mq6.exe \Shell\explore\Command - M:\yo2mq6.exe \Shell\open\Command - M:\yo2mq6.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a71ce1ae-d9c7-11db-bc79-4d6564696130}] \Shell\AutoRun\command - Q:\v.cmd \Shell\explore\Command - Q:\v.cmd \Shell\open\Command - Q:\v.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a71ce1af-d9c7-11db-bc79-4d6564696130}] \Shell\AutoRun\command - R:\v.cmd \Shell\explore\Command - R:\v.cmd \Shell\open\Command - R:\v.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da030bd4-c927-11dc-8861-4d6564696130}] \Shell\AutoRun\command - M:\InstallTomTomHOME.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{z6B2445-1963-9142-A0DB-DBDB9E15FB9z;] Lsas.exe AutoRun . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-18 17:27:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Orbitdownloader\orbitnet.exe . ************************************************************************** . Completion time: 2008-03-18 17:29:37 - machine was rebooted [STODOLKOWIE] ComboFix-quarantined-files.txt 2008-03-18 16:29:33 . 2008-03-12 12:20:19 --- E O F ---

Zrobiłemn cos co wycztalem w innych postach i zadziałało mam juz dostep do partycji ale prosze jeszcze o sprawdzenie

[ Dodano: Dzisiaj o 20:21 ]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:19:41, on 2008-03-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\GG\gg.exe C:\Program Files\eMule\emule.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE E:\DOKUMENTY SYSTEMOWE\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=050707 serial=DR12WEM-4706028-MSW lang=EN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\GG\gg.exe" /tray O4 - HKCU\..\Run: [Star Downloader Free] C:\Program Files\Star Downloader\stardown.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A2B0F95B-8B62-428B-B66E-9697A62F059A}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O24 - Desktop Component 0: (no name) - http://marleymarketplace.netcentrixllc.com/images/products/369_6501219.jpg -- End of file - 7211 bytes

**Posty:** 18165 · przez **wojtas** 18 Mar 2008, 22:27

Otworz notatnik i wklej w nim to:

File::
C:\3o.exe
C:\cfdflx.com
C:\yo2mq6.exe
C:\WINDOWS\system32\amvo2.dll
C:\v.cmd

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{822e91a8-e641-11dc-8a45-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a71ce1ae-d9c7-11db-bc79-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a71ce1af-d9c7-11db-bc79-4d6564696130}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 77 · przez **WLOCHACZ** 18 Mar 2008, 23:33

Kod: Zaznacz wszystko: ComboFix 08-03-17.1 - STODOLKOWIE 2008-03-18 21:59:19.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.353 [GMT 1:00] Running from: E:\DOKUMENTY SYSTEMOWE\Pulpit\ComboFix.exe Command switches used :: E:\DOKUMENTY SYSTEMOWE\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-18 to 2008-03-18 ))))))))))))))))))))))))))))))) . 2008-03-17 15:50 . 2008-03-17 15:51 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Mathematica 2008-03-17 15:50 . 2008-03-17 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Mathematica 2008-03-17 15:41 . 2008-03-17 15:49 <DIR> d-------- C:\Program Files\Wolfram Research 2008-03-17 15:33 . 2008-03-17 15:33 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Scilab 2008-03-17 15:09 . 2008-03-17 15:28 <DIR> d-------- C:\Program Files\euklides 2008-03-17 15:08 . 2008-03-17 15:08 286,720 --------- C:\WINDOWS\Setup1.exe 2008-03-17 15:08 . 2008-03-17 15:08 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-03-17 13:34 . 2008-03-18 21:58 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Orbit 2008-03-17 13:33 . 2008-03-17 13:34 <DIR> d-------- C:\Program Files\Orbitdownloader 2008-03-17 07:15 . 2008-03-17 07:15 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Talkback 2008-03-16 21:41 . 2008-03-16 21:41 <DIR> d-------- C:\WINDOWS\Desktop 2008-03-16 21:31 . 2008-03-16 21:31 <DIR> d-------- C:\Program Files\FreshDevices 2008-03-16 21:06 . 2008-03-16 21:10 <DIR> d-------- C:\Download 2008-03-16 20:55 . 2008-03-16 21:35 <DIR> d-------- C:\Program Files\Star Downloader 2008-03-16 08:31 . 2008-03-17 12:30 <DIR> d-------- C:\Program Files\LeechGet 2007 2008-03-16 08:14 . 2008-03-18 21:58 <DIR> d-------- C:\Downloads 2008-03-16 08:07 . 2008-03-16 20:50 <DIR> d-------- C:\Program Files\FlashGet 2008-03-16 07:53 . 2008-03-17 14:55 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-16 00:02 . 2008-03-16 21:36 100,462 -r-hs---- C:\3o.exe 2008-03-15 09:44 . 2008-03-15 09:43 101,166 -r-hs---- C:\cfdflx.com 2008-03-14 14:11 . 2008-03-14 14:11 101,025 -r-hs---- C:\yo2mq6.exe 2008-03-14 14:11 . 2008-03-14 14:11 72,192 -r-hs---- C:\WINDOWS\system32\amvo2.dll 2008-03-13 06:21 . 2008-03-13 06:20 100,791 -r-hs---- C:\v.cmd 2008-03-01 14:19 . 2008-03-01 14:19 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\HEXelon 2008-02-27 17:01 . 2008-02-27 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IM 2008-02-27 16:59 . 2008-03-18 00:07 <DIR> d-------- C:\Program Files\IncrediMail 2008-02-27 16:59 . 2008-02-27 16:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IncrediMail 2008-02-24 12:25 . 2008-02-24 12:30 <DIR> d-------- C:\Program Files\ABBYY PDF Transformer 1.0 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-18 19:06 --------- d-----w C:\Program Files\Neostrada TP 2008-03-18 19:05 --------- d-----w C:\Program Files\eMule 2008-03-15 08:45 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\uTorrent 2008-03-14 19:41 --------- d-----w C:\Program Files\Audacity 2008-03-05 12:59 --------- d-----w C:\Program Files\Java 2008-02-25 19:50 --------- d-----w C:\Program Files\TransAng2 2008-02-24 11:36 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-23 10:21 --------- d-----w C:\Program Files\GG 2008-02-19 09:02 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Skype 2008-02-12 23:06 --------- d-----w C:\Program Files\eToro 2008-02-08 18:58 204,994 ----a-w C:\WINDOWS\system32\svshoct.exe 2008-02-08 18:58 204,994 ----a-w C:\WINDOWS\system32\Lsas.exe 2008-02-08 18:58 204,994 ----a-w C:\WINDOWS\inf\Lsass.exe 2008-02-08 10:06 --------- d-----w C:\Program Files\MIKSOFT 2008-02-08 09:57 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\foobar2000 2008-01-31 09:05 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\EBookSys 2008-01-24 21:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-24 14:32 --------- d-----w C:\Program Files\TomTom HOME 2 2008-01-24 14:32 --------- d-----w C:\Program Files\TomTom HOME 2008-01-24 14:32 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\TomTom 2008-01-24 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TomTom 2008-01-23 09:27 --------- d-----w C:\Program Files\uTorrent 2008-01-22 20:23 --------- d-----w C:\Program Files\TomTom DesktopSuite 2008-01-20 11:55 --------- d-----w C:\Program Files\MarBit 2008-01-20 11:29 --------- d-----w C:\Program Files\SubEdit-Player 2008-01-20 11:06 --------- d-----w C:\Program Files\Real Alternative 2007-11-09 08:46 24,496 ----a-w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-04-20 13:09 316 ----a-w C:\Program Files\INSTALL.LOG 2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe 2004-09-06 11:22 826,880 ----a-w C:\Program Files\WAV C60Convert.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\GG\gg.exe" [2007-01-30 15:58 1716224] "Star Downloader Free"="C:\Program Files\Star Downloader\stardown.exe" [ ] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2006-01-26 17:21 4857856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 09:42 69632] "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-29 21:29 196608] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 17:07 24576] "autoclk"="autoclk.exe" [] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 17:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 17:07 53248] "adiras"="adiras.exe" [] "SoundMan"="SOUNDMAN.EXE" [2006-06-21 04:42 577536 C:\WINDOWS\soundman.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 18:42 32768] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [ ] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-12 15:52 282624] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "AtiPTA"="atiptaxx.exe" [2005-03-23 02:05 339968 C:\WINDOWS\system32\atiptaxx.exe] "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 10:19 378784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 06:05:26 29696] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-09-26 19:20:56 962661] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360] Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-03-17 13:33:58 1674440] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{35B2861B-2B26-4691-9FF0-09083722C736}"= C:\WINDOWS\system32\RadExe.dll [2005-04-28 00:30 188416] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GG\\gg.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "C:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\Mathematica.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\MathKernel.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\math.exe"= S1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.sys [] S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-01-24 14:38] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-01-24 14:38] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-01-24 14:38] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da030bd4-c927-11dc-8861-4d6564696130}] \Shell\AutoRun\command - M:\InstallTomTomHOME.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{z6B2445-1963-9142-A0DB-DBDB9E15FB9z;] Lsas.exe AutoRun . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-18 22:02:10 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-18 22:03:29 . 2008-03-12 12:20:19 --- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 19 Mar 2008, 00:15

Nie wykonałes poprawnie usuwania wpisów:
Wklej do notatnika:

File::
C:\3o.exe
C:\cfdflx.com
C:\yo2mq6.exe
C:\WINDOWS\system32\amvo2.dll
C:\v.cmd

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da030bd4-c927-11dc-8861-4d6564696130}]

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w
takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zresetuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 77 · przez **WLOCHACZ** 19 Mar 2008, 09:06

Kod: Zaznacz wszystko: ComboFix 08-03-17.1 - STODOLKOWIE 2008-03-19 7:52:57.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.430 [GMT 1:00] Running from: E:\DOKUMENTY SYSTEMOWE\Pulpit\ComboFix.exe Command switches used :: E:\DOKUMENTY SYSTEMOWE\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\3o.exe C:\cfdflx.com C:\v.cmd C:\WINDOWS\system32\amvo2.dll C:\yo2mq6.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\3o.exe C:\cfdflx.com C:\v.cmd C:\WINDOWS\system32\amvo2.dll C:\yo2mq6.exe . ((((((((((((((((((((((((( Files Created from 2008-02-19 to 2008-03-19 ))))))))))))))))))))))))))))))) . 2008-03-19 07:54 . 2008-03-19 07:54 48,391 --a------ C:\catchme.zip 2008-03-17 15:50 . 2008-03-17 15:51 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Mathematica 2008-03-17 15:50 . 2008-03-17 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Mathematica 2008-03-17 15:41 . 2008-03-17 15:49 <DIR> d-------- C:\Program Files\Wolfram Research 2008-03-17 15:33 . 2008-03-17 15:33 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Scilab 2008-03-17 15:09 . 2008-03-17 15:28 <DIR> d-------- C:\Program Files\euklides 2008-03-17 15:08 . 2008-03-17 15:08 286,720 --------- C:\WINDOWS\Setup1.exe 2008-03-17 15:08 . 2008-03-17 15:08 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-03-17 13:34 . 2008-03-19 07:56 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Orbit 2008-03-17 13:33 . 2008-03-17 13:34 <DIR> d-------- C:\Program Files\Orbitdownloader 2008-03-17 07:15 . 2008-03-17 07:15 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Talkback 2008-03-16 21:41 . 2008-03-16 21:41 <DIR> d-------- C:\WINDOWS\Desktop 2008-03-16 21:31 . 2008-03-16 21:31 <DIR> d-------- C:\Program Files\FreshDevices 2008-03-16 21:06 . 2008-03-16 21:10 <DIR> d-------- C:\Download 2008-03-16 20:55 . 2008-03-16 21:35 <DIR> d-------- C:\Program Files\Star Downloader 2008-03-16 08:31 . 2008-03-17 12:30 <DIR> d-------- C:\Program Files\LeechGet 2007 2008-03-16 08:14 . 2008-03-19 07:46 <DIR> d-------- C:\Downloads 2008-03-16 08:07 . 2008-03-16 20:50 <DIR> d-------- C:\Program Files\FlashGet 2008-03-16 07:53 . 2008-03-17 14:55 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-01 14:19 . 2008-03-01 14:19 <DIR> d-------- C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\HEXelon 2008-02-27 17:01 . 2008-02-27 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IM 2008-02-27 16:59 . 2008-03-18 00:07 <DIR> d-------- C:\Program Files\IncrediMail 2008-02-27 16:59 . 2008-02-27 16:59 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\IncrediMail 2008-02-24 12:25 . 2008-02-24 12:30 <DIR> d-------- C:\Program Files\ABBYY PDF Transformer 1.0 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-19 06:56 --------- d-----w C:\Program Files\eMule 2008-03-19 06:46 --------- d-----w C:\Program Files\Neostrada TP 2008-03-15 08:45 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\uTorrent 2008-03-14 19:41 --------- d-----w C:\Program Files\Audacity 2008-03-05 12:59 --------- d-----w C:\Program Files\Java 2008-02-25 19:50 --------- d-----w C:\Program Files\TransAng2 2008-02-24 11:36 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-23 10:21 --------- d-----w C:\Program Files\GG 2008-02-19 09:02 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\Skype 2008-02-12 23:06 --------- d-----w C:\Program Files\eToro 2008-02-08 10:06 --------- d-----w C:\Program Files\MIKSOFT 2008-02-08 09:57 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\foobar2000 2008-01-31 09:05 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\EBookSys 2008-01-24 21:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-24 14:32 --------- d-----w C:\Program Files\TomTom HOME 2 2008-01-24 14:32 --------- d-----w C:\Program Files\TomTom HOME 2008-01-24 14:32 --------- d-----w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\TomTom 2008-01-24 14:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TomTom 2008-01-23 09:27 --------- d-----w C:\Program Files\uTorrent 2008-01-22 20:23 --------- d-----w C:\Program Files\TomTom DesktopSuite 2008-01-20 11:55 --------- d-----w C:\Program Files\MarBit 2008-01-20 11:29 --------- d-----w C:\Program Files\SubEdit-Player 2008-01-20 11:06 --------- d-----w C:\Program Files\Real Alternative 2007-11-09 08:46 24,496 ----a-w C:\Documents and Settings\STODOLKOWIE\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-04-20 13:09 316 ----a-w C:\Program Files\INSTALL.LOG 2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe 2004-09-06 11:22 826,880 ----a-w C:\Program Files\WAV C60Convert.exe . ((((((((((((((((((((((((((((( snapshot@2008-03-18_22.02.49,21 ))))))))))))))))))))))))))))))))))))))))) . + 2008-03-19 06:56:25 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_470.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\GG\gg.exe" [2007-01-30 15:58 1716224] "Star Downloader Free"="C:\Program Files\Star Downloader\stardown.exe" [ ] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2006-01-26 17:21 4857856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 09:42 69632] "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-29 21:29 196608] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 17:07 24576] "autoclk"="autoclk.exe" [] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 17:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 17:07 53248] "adiras"="adiras.exe" [] "SoundMan"="SOUNDMAN.EXE" [2006-06-21 04:42 577536 C:\WINDOWS\soundman.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 18:42 32768] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [ ] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-12 15:52 282624] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "AtiPTA"="atiptaxx.exe" [2005-03-23 02:05 339968 C:\WINDOWS\system32\atiptaxx.exe] "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 10:19 378784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 06:05:26 29696] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-09-26 19:20:56 962661] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360] Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-03-17 13:33:58 1674440] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{35B2861B-2B26-4691-9FF0-09083722C736}"= C:\WINDOWS\system32\RadExe.dll [2005-04-28 00:30 188416] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GG\\gg.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= "C:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "C:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\Mathematica.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\MathKernel.exe"= "C:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\math.exe"= S1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.421\ATI Tray Tools\atitray.sys [] S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-01-24 14:38] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-01-24 14:38] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-01-24 14:38] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{z6B2445-1963-9142-A0DB-DBDB9E15FB9z;] Lsas.exe AutoRun . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-19 07:56:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe . ************************************************************************** . Completion time: 2008-03-19 7:58:57 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-19 06:58:52 ComboFix2.txt 2008-03-18 21:03:30 . 2008-03-12 12:20:19 --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:05:40, on 2008-03-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\GG\gg.exe C:\Program Files\eMule\emule.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE E:\DOKUMENTY SYSTEMOWE\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=050707 serial=DR12WEM-4706028-MSW lang=EN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\GG\gg.exe" /tray O4 - HKCU\..\Run: [Star Downloader Free] C:\Program Files\Star Downloader\stardown.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A2B0F95B-8B62-428B-B66E-9697A62F059A}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O24 - Desktop Component 0: (no name) - http://marleymarketplace.netcentrixllc.com/images/products/369_6501219.jpg -- End of file - 7301 bytes

**Posty:** 18165 · przez **wojtas** 19 Mar 2008, 17:15

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{z6B2445-1963-9142-A0DB-DBDB9E15FB9z]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

wykonaj optymalizację windowsa

**Posty:** 77 · przez **WLOCHACZ** 19 Mar 2008, 21:35

Jakie z tych uruchomien moge zatrzymac

[ Dodano: Dzisiaj o 20:38 ]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:38:06, on 2008-03-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\GG\gg.exe C:\Program Files\eMule\emule.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Orbitdownloader\orbitdm.exe C:\Program Files\Orbitdownloader\orbitnet.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\DOKUMENTY SYSTEMOWE\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [autoclk] autoclk.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=050707 serial=DR12WEM-4706028-MSW lang=EN O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\GG\gg.exe" /tray O4 - HKCU\..\Run: [Star Downloader Free] C:\Program Files\Star Downloader\stardown.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A2B0F95B-8B62-428B-B66E-9697A62F059A}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O24 - Desktop Component 0: (no name) - http://marleymarketplace.netcentrixllc.com/images/products/369_6501219.jpg -- End of file - 7178 bytes

I ktore ze wpisów jeszcze

**Posty:** 18165 · przez **wojtas** 19 Mar 2008, 21:44

z pierwszego screena mozesz odchaczyc 2,3,8,10,11,12 a z z drugiego screena 1,2,4,6,7,8,9

wirus

Wirus

Kto jest na forum