Wirus z autorunem na każdej partycji

**Posty:** 41 · przez **Cineq112** 30 Gru 2008, 22:15

Witam! Mam problem z upierdliwym wirusem. Tworzy na każdej partycji autoruna, który odpala boot.com, z folderu resycled. Kasuje go normalnie, jednak znów powraca po paru chwilach. Przy okazji unieszkodliwienia wirusa proszę o info czy jakieś syfy są i czy je skasować.

Tutaj opis "rysunkowy"

Kod: Zaznacz wszystko: Partycja C: autorun.ini resycled Folder Resycled: boot.com

Kod: Zaznacz wszystko: Autorun.ini: [autorun] ;wbmgiplkpnfapnftrrevh shellexecute="resycled\boot.com d:" ;komaqchytelpudisecatygtrfwzhqcteafdjik shell\Open\command="resycled\boot.com d:" ;qlfonibkxzzy shell=Open ;hdxwvpvfglqerwdkwgodmbfdvhupnowqyqnnqbzhplmck

Skan wirusa: http://www.virustotal.com/pl/analisis/ca4a47b3027ff12d31be3fffea459e2c

Logi:
HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:06:56, on 2008-12-30 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Rohos\welcome.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe c:\xampp\apache\bin\apache.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\xampp\mysql\bin\mysqld-nt.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\xampp\apache\bin\apache.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\GIGABYTE\GEST\GEST.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\GIGABYTE\GEST\GSvr.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Gadu-Gadu\gg.exe D:\steam\steam.exe C:\Program Files\4t Tray Minimizer\4t-min.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\RegCleaner\RegCleanr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{85800616-18E3-46E6-8315-217B6B77D569}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apache2.2 - Apache Software Foundation - c:\xampp\apache\bin\apache.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - c:\xampp\FileZillaFTP\FileZillaServer.exe O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: XAMPP Service (XAMPP) - Unknown owner - c:\xampp\service.exe -- End of file - 9189 bytes

SilentRun:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "ASUS SmartDoctor" = "C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start" ["ASUSTeK Inc."] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "GEST" = "C:\Program Files\GIGABYTE\GEST\RUN.exe" [empty string] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"" ["Kaspersky Lab"] "StartCCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun" ["Advanced Micro Devices, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)" -> {HKLM...CLSID} = "Skype add-on (mastermind)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar Loader" -> {HKLM...CLSID} = "Winamp Toolbar Loader" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\(Default) = "IEVkbdBHO" -> {HKLM...CLSID} = "IEVkbdBHO Class" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll" ["Kaspersky Lab"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {bf00e119-21a3-4fd1-b178-3b8537e75c92}\(Default) = "MegaIEMn" -> {HKLM...CLSID} = "IeMonitorBho Class" \InProcServer32\(Default) = "C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll" ["Megaupload Limited"] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{CAE3251E-9B15-4810-B268-852AD9792A59}" = "InCDShellExt extension" -> {HKLM...CLSID} = "InCDShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\InCD\InCDshx.dll" ["Nero AG"] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] "{B3D9AEDE-B2C3-406d-A254-6BE07767B08B}" = "InCDUdfPerm extension" -> {HKLM...CLSID} = "InCDUdfPerm Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\InCD\InCDUP.dll" ["Nero AG"] "{39DD67E0-73B6-4a11-AF55-49E1EBBF72BE}" = "SmartFTP Favorites Namespace" -> {HKLM...CLSID} = "SmartFTP FavoritesShellFolder Class" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFavoritesShellExtension.dll" ["SmartSoft Ltd."] "{2ED7FD81-CBA6-45E5-A49A-5E84889A94E2}" = "SmartFTP Drop Handler" -> {HKLM...CLSID} = "ShellFolderDragDropHandler Class" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll" ["SmartSoft Ltd."] "{EB5EE1F3-041A-4c03-9D51-2BEC6715FB00}" = "SmartFTP Search Shell Namespace Extension" -> {HKLM...CLSID} = "ShellFolderSearchRoot Class" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll" ["SmartSoft Ltd."] "{82AA9188-44E0-40B9-B956-43A10C315B4F}" = "SmartFTP Shell Namespace Extension" -> {HKLM...CLSID} = "RootShellFolder Class" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll" ["SmartSoft Ltd."] "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}" = "SmartFTP ContextMenu" -> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"] "{40FDFA48-5F4E-4627-A78E-6A49A3D4492F}" = "SmartFTP ShellDropHandler" -> {HKLM...CLSID} = "SmartFTP ShellDropHandler Class" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"] "{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}" = "SmartFTP Drop ShellIconOverlayHandler" -> {HKLM...CLSID} = "SmartFTP Drop ShellIconOverlayHandler" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki ochrony WWW" -> {HKLM...CLSID} = "Statystyki ochrony WWW" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll" ["Kaspersky Lab"] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{FED7043D-346A-414D-ACD7-550D052499A7}" = "dBpowerAMP Music Converter 1" -> {HKLM...CLSID} = "dBpShell Class" \InProcServer32\(Default) = "C:\Program Files\Illustrate\dBpowerAMP\dBShell.dll" [empty string] "{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}" = "dBpowerAMP Music Converter" -> {HKLM...CLSID} = "dMCIShell Class" \InProcServer32\(Default) = "C:\Program Files\Illustrate\dBpowerAMP\dMCShell.dll" [empty string] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" ["Advanced Micro Devices, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\SOFTWA RE\Microsoft\Windows NT\CurrentVersion\Winlogon\ <<!>> "GinaDLL" = "rohos_ui.dll" ["Tesline-Service SRL"] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] InCDShellExt\(Default) = "{CAE3251E-9B15-4810-B268-852AD9792A59}" -> {HKLM...CLSID} = "InCDShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\InCD\InCDshx.dll" ["Nero AG"] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll" ["Kaspersky Lab"] KGBShellEx\(Default) = "{0E3EB241-8420-4ab3-97DE-9B8EC429CCC0}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\KGB Archiver 2\shellext.dll" ["Tomasz Pawlak"] SmartFTP\(Default) = "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}" -> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ InCDShellExt\(Default) = "{CAE3251E-9B15-4810-B268-852AD9792A59}" -> {HKLM...CLSID} = "InCDShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\InCD\InCDshx.dll" ["Nero AG"] KGBShellEx\(Default) = "{0E3EB241-8420-4ab3-97DE-9B8EC429CCC0}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\KGB Archiver 2\shellext.dll" ["Tomasz Pawlak"] SmartFTP\(Default) = "{F87DED31-303F-4ED1-9BCE-D360FBC74E0A}" -> {HKLM...CLSID} = "SmartFTP ContextMenu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\SmartFTP Client\sfShellTools.dll" ["SmartSoft Ltd"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ InCDShellExt\(Default) = "{CAE3251E-9B15-4810-B268-852AD9792A59}" -> {HKLM...CLSID} = "InCDShellExt Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\InCD\InCDshx.dll" ["Nero AG"] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Autostart via AUTORUN.INF on local fixed drives: ------------------------------------------------ C:\ <<!>> C:\AUTORUN.INF -> "shellexecute="resycled\boot.com c:"" [file not found] D:\ <<!>> D:\AUTORUN.INF -> "shellexecute="resycled\boot.com d:"" [file not found] E:\ <<!>> E:\AUTORUN.INF -> "shellexecute="resycled\boot.com e:"" [file not found] G:\ <<!>> G:\AUTORUN.INF -> "shellexecute="resycled\boot.com g:"" [file not found] H:\ <<!>> H:\AUTORUN.INF -> "shellexecute="resycled\boot.com h:"" [file not found] I:\ <<!>> I:\AUTORUN.INF -> "shellexecute="resycled\boot.com i:"" [file not found] J:\ <<!>> J:\AUTORUN.INF -> "shellexecute="resycled\boot.com j:"" [file not found] Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ AlcoholAutoPlayV2.BurnDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "BurnDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\BurnDisc\command\(Default) = ""C:\Program Files\Alcohol Soft\Alcohol 120\alcohol.exe" %1" ["Alcohol Soft Development Team"] AlcoholAutoPlayV2.ReadDisc\ "Provider" = "Alcohol 120%" "InvokeProgID" = "AlcoholAutoPlayV2" "InvokeVerb" = "BurnDisc" HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\BurnDisc\command\(Default) = ""C:\Program Files\Alcohol Soft\Alcohol 120\alcohol.exe" %1" ["Alcohol Soft Development Team"] dMCAudioCDInput\ "Provider" = "dMC Audio CD Input" "InvokeProgID" = "dMC.AudioCD.Autorun" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\dMC.AudioCD.Autorun\shell\open\command\(Default) = ""C:\Program Files\Illustrate\dBpowerAMP\CDGrab.exe"" ["Illustrate"] FunMultiMediaHandler\ "Provider" = "MultiMedia Manager" "ProgID" = "FUNBOX.Autoplay" HKLM\SOFTWARE\Classes\FUNBOX.Autoplay\CLSID\(Default) = "{DF866F1F-10DF-4694-94A9-7F526FC8800A}" -> {HKLM...CLSID} = "FUNBOX Autoplay Sample 2" \LocalServer32\(Default) = "C:\Program Files\Samsung\Samsung PC Studio 3\Share_autoplay.exe" ["TODO: <** **>" (unwritable string)] LightScribeOnArrivalAP\ "Provider" = "LightScribe Direct Disc Labeling" "InvokeProgID" = "LightScribe.AutoPlayHandler" "InvokeVerb" = "LabelLightScribeDisc" HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "C:\Program Files\Common Files\LightScribe\LsLauncher.exe" ["Hewlett-Packard Company"] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] NeroAutoPlay7AudioToNeroDigital\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay7" "InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe /Dialog:SaveTracks %L" ["Nero AG"] NeroAutoPlay7CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay7" "InvokeVerb" = "CDAudio_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /New:AudioCD" ["Nero AG"] NeroAutoPlay7CopyCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay7" "InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe /Dialog:DiscCopy %L" ["Nero AG"] NeroAutoPlay7DataDisc\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay7" "InvokeVerb" = "DataDisc_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\DataDisc_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /New:ISODisc" ["Nero AG"] NeroAutoPlay7LaunchNeroStartSmart\ "Provider" = "Nero StartSmart" "InvokeProgID" = "Nero.AutoPlay7" "InvokeVerb" = "LaunchNeroStartSmart_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\LaunchNeroStartSmart_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe /AutoPlay" ["Nero AG"] NeroAutoPlay7RipCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay7" "InvokeVerb" = "RipCD_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe /Dialog:SaveTracks %L" ["Nero AG"] PDVDPlayCDAudioOnArrival\ "Provider" = "PowerDVD" "InvokeProgID" = "AudioCD" "InvokeVerb" = "PlayWithPowerDVD" HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."] PDVDPlayDVDMovieOnArrival\ "Provider" = "PowerDVD" "InvokeProgID" = "DVD" "InvokeVerb" = "PlayWithPowerDVD" HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."] PDVDPlayVCDMovieOnArrival\ "Provider" = "PowerDVD" "InvokeProgID" = "VCD" "InvokeVerb" = "PlayWithPowerDVD" HKLM\SOFTWARE\Classes\VCD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."] PPCDBurningOnArrival\ "Provider" = "PowerProducer" "InvokeProgID" = "Picture" "InvokeVerb" = "OpenWithPowerProducer" HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerProducer\Command\(Default) = ""C:\Program Files\CyberLink\PowerProducer\Producer.exe"" ["CyberLink"] PPDCameraArrival\ "Provider" = "PowerProducer" "InvokeProgID" = "Picture" "InvokeVerb" = "OpenWithPowerProducer" HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerProducer\Command\(Default) = ""C:\Program Files\CyberLink\PowerProducer\Producer.exe"" ["CyberLink"] PPDVArrival\ "Provider" = "PowerProducer" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = ""C:\Program Files\CyberLink\PowerProducer\Producer.exe"" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] PStarterBlankCDArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "BlankCD" "InvokeVerb" = "OpenWithPowerStarter" HKLM\SOFTWARE\Classes\BlankCD\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"] PStarterDVDBurningOnArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "BlankDVD" "InvokeVerb" = "OpenWithPowerStarter" HKLM\SOFTWARE\Classes\BlankDVD\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"] PStarterMixedCDArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "MixedContent" "InvokeVerb" = "OpenWithPowerStarter" HKLM\SOFTWARE\Classes\MixedContent\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"] PStarterMusicFilesArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "MusicFiles" "InvokeVerb" = "OpenWithPowerStarter" HKLM\SOFTWARE\Classes\MusicFiles\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"] PStarterPicturesArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "Picture" "InvokeVerb" = "OpenWithPowerStarter" HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"] PStarterPlayCDAudioOnArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "AudioCD" "InvokeVerb" = "PlayWithPowerStarter" HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe" "%L"" ["CyberLink"] PStarterPlayDVDMovieOnArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "DVD" "InvokeVerb" = "PlayWithPowerStarter" HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe" "%L"" ["CyberLink"] PStarterVideoFilesArrival\ "Provider" = "DVD Suite" "InvokeProgID" = "VideoFiles" "InvokeVerb" = "OpenWithPowerStarter" HKLM\SOFTWARE\Classes\VideoFiles\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Startup items in "Marcin" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart "4t Tray Minimizer" -> shortcut to: "C:\Program Files\4t Tray Minimizer\4t-min.exe -tray" ["4t Niagara Software"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{32099AAC-C132-4136-9E9A-4E364A424E17}" -> {HKLM...CLSID} = "DAEMON Tools Toolbar" \InProcServer32\(Default) = "C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll" [null data] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{32099AAC-C132-4136-9E9A-4E364A424E17}" = (no title provided) -> {HKLM...CLSID} = "DAEMON Tools Toolbar" \InProcServer32\(Default) = "C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll" [null data] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki ochrony WWW" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll" ["Kaspersky Lab"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_04" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_04" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll" ["Sun Microsystems, Inc."] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ "ButtonText" = "Statystyki ochrony WWW" {77BF5300-1474-4EC7-9980-D32B190E9B07}\ "ButtonText" = "Skype" "CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}" -> {HKLM...CLSID} = "Skype add-on (button)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AOL Connectivity Service, AOL ACS, ""C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe"" ["AOL LLC"] Apache2.2, Apache2.2, ""c:\xampp\apache\bin\apache.exe" -k runservice" ["Apache Software Foundation"] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] ATK Keyboard Service, ATKKeyboardService, "C:\WINDOWS\ATKKBService.exe" ["ASUSTeK COMPUTER INC."] Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared Files\RichVideo.exe"" [empty string] GEST Service for program management., GEST Service, ""C:\Program Files\GIGABYTE\GEST\GSvr.exe"" [null data] InCD Helper, InCDsrv, "C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe" ["Nero AG"] Kaspersky Anti-Virus, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" -r" ["Kaspersky Lab"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] mysql, mysql, "C:\xampp\mysql\bin\mysqld-nt.exe --defaults-file=c:\xampp\mysql\bin\my.cnf mysql" [null data] StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] ---------- (launch time: 2008-12-30 21:08:56) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 294 seconds. ---------- (total run time: 335 seconds)

**Posty:** 8001 · przez **Okocza** 30 Gru 2008, 22:18

Cineq112, wstaw log z combofixa

**Posty:** 41 · przez **Cineq112** 30 Gru 2008, 22:40

Log z ComboFixa daje tutaj bo tam jest ponad 60k znaków :O
Zrobiłem chyba za duże show bo wykryło mi rookita (combofix), i skasowało odrazu. Ale log dla sprawdzenia.
ComboFiX:

Kod: Zaznacz wszystko: ComboFix 08-12-29.02 - Marcin 2008-12-30 21:30:06.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2046.1565 [GMT 1:00] Uruchomiony z: c:\documents and settings\Marcin\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\program files\Mozilla Firefox\components\iamfamous.dll C:\resycled c:\resycled\boot.com c:\windows\system32\drivers\msqpdxrqmjovmy.sys c:\windows\system32\drivers\msqpdxserv.sys c:\windows\system32\iexplorer.exe c:\windows\system32\msqpdxvkrskcbo.dll D:\Autorun.inf D:\resycled d:\resycled\boot.com E:\Autorun.inf E:\resycled e:\resycled\boot.com G:\Autorun.inf G:\resycled g:\resycled\boot.com H:\Autorun.inf H:\resycled h:\resycled\boot.com I:\Autorun.inf I:\resycled i:\resycled\boot.com J:\Autorun.inf J:\resycled j:\resycled\boot.com . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_MSQPDXSERV.SYS ((((((((((((((((((((((((( Pliki utworzone od 2008-11-28 do 2008-12-30 ))))))))))))))))))))))))))))))) . 2008-12-30 20:59 . 2008-12-30 20:59 <DIR> d-------- c:\program files\Trend Micro 2008-12-30 20:52 . 2008-12-30 20:52 <DIR> d--h----- c:\windows\PIF 2008-12-30 19:29 . 2008-12-30 19:36 <DIR> d-------- c:\program files\RegCleaner 2008-12-30 11:55 . 2008-12-30 11:55 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Leadertech 2008-12-29 16:41 . 2008-12-29 16:41 <DIR> d-------- c:\program files\KGB Archiver 2 2008-12-28 18:42 . 2008-12-28 18:42 <DIR> d-------- c:\program files\Rohos 2008-12-28 18:42 . 2008-10-10 09:40 849,216 --a------ c:\windows\system32\rohos_ui.dll 2008-12-28 18:42 . 2008-08-18 14:40 722,240 --a------ c:\windows\system32\rohos_cp.dll 2008-12-28 18:42 . 2006-04-12 09:40 270,336 --a------ c:\windows\system32\cximagecrt.dll 2008-12-28 18:42 . 2008-06-23 12:47 124,224 --a------ c:\windows\system32\rohos_btkey.dll 2008-12-28 18:42 . 2008-05-06 17:20 110,592 --a------ c:\windows\system32\rohos_obj.dll 2008-12-28 18:42 . 2008-05-15 08:38 99,648 --a------ c:\windows\system32\rohos_pkcs.dll 2008-12-28 18:42 . 2008-08-06 09:42 75,072 --a------ c:\windows\system32\rohos_ybk.dll 2008-12-27 18:34 . 2008-12-27 18:53 <DIR> d-------- C:\xampp 2008-12-27 18:31 . 2008-12-27 18:31 58 --a------ c:\windows\my.ini 2008-12-27 00:26 . 2008-12-27 00:26 <DIR> d-------- c:\program files\Megaupload 2008-12-25 16:32 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-12-25 16:31 . 2008-12-25 16:31 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers 2008-12-25 16:31 . 2008-12-25 16:31 <DIR> d-------- c:\program files\Samsung 2008-12-25 16:31 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-12-25 16:31 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-12-22 16:20 . 2008-12-22 16:20 <DIR> d-------- C:\DriveKey 2008-12-21 18:56 . 2008-12-21 18:57 <DIR> d-------- c:\program files\RivaTuner v2.21 2008-12-20 18:58 . 2008-12-20 18:58 <DIR> d-------- C:\VideoSec 2008-12-20 16:01 . 2008-12-20 16:01 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\U3 2008-12-20 15:41 . 2008-12-20 15:41 <DIR> d--h----- C:\My Drive Data 2008-12-20 15:41 . 2008-12-20 15:41 221,252 --a------ c:\windows\system32\maskDll.dll 2008-12-20 15:41 . 2008-12-20 15:41 200,776 --a------ c:\windows\system32\unMaskDLL.dll 2008-12-14 17:15 . 2008-12-14 17:15 <DIR> d-------- c:\documents and settings\Marta\Dane aplikacji\Corel 2008-12-14 13:23 . 2008-12-14 13:29 <DIR> d-------- c:\program files\IrfanView 2008-12-13 16:35 . 2008-12-13 16:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ATI 2008-12-13 16:30 . 2008-12-13 16:35 <DIR> d-------- c:\program files\ATI 2008-12-13 16:29 . 2008-10-28 21:05 593,920 --------- c:\windows\system32\ati2sgag.exe 2008-12-13 16:28 . 2008-12-13 16:30 <DIR> d-------- c:\program files\ATI Technologies 2008-12-13 16:25 . 2008-12-13 16:25 10 --a------ c:\windows\WININIT.INI 2008-12-12 16:34 . 2008-12-23 16:35 664 --a------ c:\windows\system32\d3d9caps.dat 2008-12-12 12:37 . 2008-12-12 12:38 <DIR> d-------- c:\windows\system32\drivers\umdf 2008-12-12 12:36 . 2008-12-12 12:36 <DIR> d-------- c:\windows\system32\xlive 2008-12-12 12:36 . 2008-12-12 12:36 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE 2008-12-12 12:18 . 2008-12-12 12:18 <DIR> d-------- c:\program files\MSBuild 2008-12-12 12:15 . 2008-12-12 12:15 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-12 12:15 . 2008-12-12 12:15 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-12 12:14 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-03 21:04 . 2008-12-15 16:58 <DIR> d-------- c:\program files\uTorrent 2008-12-03 21:04 . 2008-12-26 21:40 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\uTorrent 2008-12-01 21:46 . 2008-12-01 22:04 367 --a------ c:\windows\wcx_ftp.ini 2008-12-01 20:53 . 2008-12-01 20:53 45,056 --a------ c:\windows\system32\amdcalrt.dll 2008-12-01 20:53 . 2008-12-01 20:53 45,056 --a------ c:\windows\system32\amdcalcl.dll 2008-12-01 20:50 . 2008-12-01 20:50 3,252,224 --a------ c:\windows\system32\Amdcaldd.dll 2008-11-30 19:21 . 2008-11-30 19:21 <DIR> d---s---- c:\program files\HLSW 2008-11-30 19:21 . 2008-12-28 21:49 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\HLSW 2008-11-23 13:57 . 2008-12-22 18:29 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\U3 2008-11-21 16:05 . 2008-11-21 16:05 <DIR> d-------- c:\program files\Robster Productions 2008-11-20 20:03 . 2008-11-20 20:03 <DIR> d-------- C:\Eli2M 2008-11-18 20:25 . 2008-11-18 20:25 <DIR> d-------- C:\ATI 2008-11-17 20:05 . 2008-11-17 20:11 <DIR> d-------- c:\program files\DC++ 2008-11-12 21:09 . 2008-11-12 21:09 <DIR> d-------- c:\program files\directx 2008-11-12 14:55 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-09 16:40 . 2008-11-09 16:40 <DIR> d-------- c:\windows\system32\wdrivers 2008-11-09 16:40 . 2008-11-09 16:40 126 --a------ c:\windows\w3winxp.ini 2008-11-06 17:57 . 2008-11-06 17:57 <DIR> d-------- c:\program files\Illustrate 2008-11-06 17:57 . 2008-11-06 17:57 164,352 --a------ c:\windows\system32\SpoonUninstall.exe 2008-11-06 17:57 . 2008-11-06 17:57 27,958 --a------ c:\windows\system32\SpoonUninstall-dBpowerAMP Music Converter.bmp 2008-11-06 17:57 . 2008-11-06 17:57 20,898 --a------ c:\windows\system32\SpoonUninstall-dBpowerAMP Music Converter.dat 2008-11-04 20:51 . 2008-11-04 20:51 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Thinstall 2008-11-04 20:51 . 2008-11-20 18:59 156 --a------ c:\windows\Twunk001.MTX 2008-11-04 20:51 . 2008-11-20 18:59 3 --a------ c:\windows\Twain001.Mtx 2008-11-04 20:51 . 2008-11-04 20:51 0 --a------ c:\windows\Twunk002.MTX 2008-11-02 15:33 . 2008-11-02 16:01 <DIR> d-------- c:\program files\4t Tray Minimizer . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-30 20:36 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-30 20:32 6,393,888 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-12-30 20:32 59,416 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-12-30 20:32 11,232 --sha-w c:\windows\system32\drivers\fidbox2.idx 2008-12-30 20:32 1,130,528 --sha-w c:\windows\system32\drivers\fidbox2.dat 2008-12-30 20:25 16,608 ----a-w c:\windows\gdrv.sys 2008-12-30 20:24 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Skype 2008-12-30 20:24 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\foobar2000 2008-12-30 18:21 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\skypePM 2008-12-30 10:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited 2008-12-27 16:03 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Tibia 2008-12-26 23:26 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-26 16:00 --------- d-----w c:\program files\sXe Injected 2008-12-21 16:38 --------- d-----w c:\program files\Google 2008-12-20 17:46 12,288 ----a-w c:\windows\system32\drivers\EIO64_xp.sys 2008-12-15 20:43 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\gtk-2.0 2008-12-08 16:30 --------- d-----w c:\program files\FlashGet 2008-11-28 19:19 --------- d-----w c:\program files\NAPI-PROJEKT 2008-11-24 19:47 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-15 18:21 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\DNA 2008-11-15 12:10 --------- d-----w c:\program files\DNA 2008-11-10 13:49 --------- d-----w c:\program files\AMX Mod X 2008-11-07 15:46 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\OpenOffice.org2 2008-10-28 15:59 --------- d-----w c:\program files\Photo Viewer 2008-10-19 17:03 10,920 ----a-w C:\aolconnfix.exe 2008-09-05 17:43 315,392 ----a-w c:\windows\HideWin.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{32099AAC-C132-4136-9E9A-4E364A424E17}"= "c:\program files\DAEMON Tools Toolbar\DTToolbar.dll" [2008-07-08 683464] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{32099AAC-C132-4136-9E9A-4E364A424E17}"= "c:\program files\DAEMON Tools Toolbar\DTToolbar.dll" [2008-07-08 683464] [HKEY_CLASSES_ROOT\clsid\{32099aac-c132-4136-9e9a-4e364a424e17}] [HKEY_CLASSES_ROOT\DTToolbar.ToolBandObj.1] [HKEY_CLASSES_ROOT\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}] [HKEY_CLASSES_ROOT\DTToolbar.ToolBandObj] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360] "ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-11-16 1171456] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360] c:\documents and settings\Marcin\Menu Start\Programy\Autostart\ 4t Tray Minimizer.lnk - c:\program files\4t Tray Minimizer\4t-min.exe [2008-11-02 1091584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.asv2"= asusasv2.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Marcin^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=c:\documents and settings\Marcin\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Marcin^Menu Start^Programy^Autostart^OpenOffice.org 2.4.lnk] path=c:\documents and settings\Marcin\Menu Start\Programy\Autostart\OpenOffice.org 2.4.lnk backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] --a------ 2008-03-20 17:46 217544 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD] --a------ 2008-06-26 10:51 380928 c:\program files\ASUS\GamerOSD\GamerOSD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-11-12 14:53 342336 c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-04 16:01 486856 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] --a------ 2006-09-26 01:52 50736 c:\program files\Common Files\aol\1222010602\ee\aolsoftware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2007-01-08 21:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 13:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --------- 2007-03-14 20:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\ASUS\\GamerOSD\\SBS.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "d:\\Gry\\Test Drive Unlimited\\TestDriveUnlimited.exe"= "h:\\Counter-Strike 1.6\\hl.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "h:\\Counter-Strike 1.6\\hlds.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"= "c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"= "c:\\Program Files\\Common Files\\aol\\1222010602\\ee\\aolsoftware.exe"= "c:\\Program Files\\AOL 9.0\\waol.exe"= "c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "d:\\Steam\\SteamApps\\cineq112\\counter-strike\\hl.exe"= "d:\\Steam\\SteamApps\\cineq112\\condition zero\\hl.exe"= "d:\\Gry\\Fifa 2008\\FIFA08.exe"= "d:\\Steam\\SteamApps\\cineq112\\day of defeat\\hl.exe"= "c:\\Documents and Settings\\Marcin\\Dane aplikacji\\Thinstall\\APCS3E\\4000005700003i\\mDNSResponder.exe"= "d:\\Steam\\SteamApps\\cineq112\\counter-strike beta\\hl.exe"= "d:\\Steam\\SteamApps\\cineq112\\condition zero deleted scenes\\hl.exe"= "h:\\Medal of Honor\\Honor_pol\\MOHAA.EXE"= "d:\\Gry\\Emergency 4\\Em4.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\HLSW\\hlsw.exe"= "e:\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "h:\\Counter-Strike 1.6\\hltv.exe"= "d:\\Gry\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe"= "d:\\Gry\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "d:\\Gry\\GTA IV\\Grand Theft Auto IV\\GTAIV.exe"= "c:\\xampp\\mysql\\bin\\mysqld.exe"= "d:\\Gry\\Fifa 2009\\FIFA09.exe"= "c:\\Program Files\\GIGABYTE\\GEST\\run.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R1 EIO_XP;EIO_XP;\??\c:\windows\system32\drivers\EIO_XP.sys [2008-09-05 12288] R2 Apache2.2;Apache2.2;"c:\xampp\apache\bin\apache.exe" -k runservice [2008-06-14 17408] R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2008-09-05 89600] R3 GEST Service;GEST Service for program management.;"c:\program files\GIGABYTE\GEST\GSvr.exe" [2008-09-05 47624] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592] R3 Video3D;ASUS Video3D Service;c:\windows\system32\Drivers\Video3D32.sys [2008-09-05 10752] S2 XAMPP;XAMPP Service;c:\xampp\service.exe [2007-12-21 60928] S3 FT2593;FT2593 Filter;c:\windows\system32\DRIVERS\FT2593.sys [2008-09-26 51915] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\DRIVERS\P1130Vid.sys [2008-10-19 90229] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d4f4481-b3ce-11dd-9e0d-00038a000015}] \Shell\AutoRun\command - Q:\USBNB.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) SafeBoot-Rohos MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . ------- Skan uzupełniający ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm TCP: {85800616-18E3-46E6-8315-217B6B77D569} = 194.204.159.1,194.204.152.34 c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.srtest.com/srl_bin/sysreqlab3.cab c:\windows\Downloaded Program Files\SysReqLab3.osd FF - ProfilePath - c:\documents and settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]3kw0cz9.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-30 21:35:57 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1244) c:\windows\system32\rohos_ui.dll c:\windows\system32\cximagecrt.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\klogon.dll - - - - - - - > 'Explorer.exe'(3212) c:\program files\4t Tray Minimizer\ShellEh440.dll c:\windows\system32\wpdshext.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\Audiodev.dll c:\windows\system32\WMVCore.DLL c:\windows\system32\WMASF.DLL . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Rohos\welcome.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Common Files\aol\acs\AOLacsd.exe c:\windows\ATKKBService.exe c:\program files\Nero\Nero 7\InCD\InCDsrv.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\xampp\mysql\bin\mysqld-nt.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\program files\GIGABYTE\GEST\gest.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\verclsid.exe . ************************************************************************** . Czas ukończenia: 2008-12-30 21:38:14 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-30 20:38:09 Przed: 3,088,814,080 bajtów wolnych Po: 3,500,003,328 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 332 --- E O F --- 2008-12-18 21:12:27

**Posty:** 3 · przez **Quindy** 30 Gru 2008, 22:53

ComboFix powinien sobie z tym poradzić. To jest tak zwana infekcja z pendriva. Więcej przeczytaj sobie tutaj:

http://www.searchengines.pl/Infekcje-z-pendrivemediow-przenosnych-t94761.html

**Posty:** 300 · przez **sgsman** 30 Gru 2008, 23:29

A tym programem "przejedź" swoje pendrive'y, coby więcej nie zarażały.

**Posty:** 8001 · przez **Okocza** 31 Gru 2008, 11:30

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.