wirusy???

**Posty:** 204 · przez **Poldek** 02 Cze 2008, 16:00

Byl u mnie kumpel z dyskiem i plakal ze mu kompa zawirusowalem chodz mi sie tak nie wydaje..
Log z Hj....

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:58:53, on 2008-06-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\spoolsv.exe C:\windows\Explorer.EXE C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE C:\windows\system32\RUNDLL32.EXE C:\windows\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Poldek\Menu Start\Programy\Autostart\ctfmon.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\windows\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\UltraVNC\vncviewer.exe C:\windows\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [amva] C:\windows\system32\amvo.exe O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [GoD] "C:\Program Files\GoD\GoD.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: ctfmon.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9AB90189-3D8D-4ECF-91E1-11C3E40DCC60}: NameServer = 212.85.112.32 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb) (pr2aq6eb) - Techland Sp.z o.o. - C:\windows\system32\pr2aq6eb.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6227 bytes

**Posty:** 7956 · przez **Magik** 02 Cze 2008, 16:09

witam

tryb awaryjny i usuwacie

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [amva] C:\windows\system32\amvo.exe O4 - HKCU\..\Run: [GoD] "C:\Program Files\GoD\GoD.exe" /tray O4 - Startup: ctfmon.exe

jet tego badziewia troche :arrow:

log z combofix'a :!:

**Posty:** 204 · przez **Poldek** 02 Cze 2008, 16:58

Kod: Zaznacz wszystko: ComboFix 08-06-01.6 - Poldek 2008-06-02 16:53:28.12 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1685 [GMT 2:00] Running from: C:\Documents and Settings\Poldek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Documents and Settings\Poldek\Menu Start\Programy\Autostart\ctfmon.exe C:\Recycled\Recycled C:\Recycled\Recycled\ctfmon.exe C:\windows\system32\amvo.exe C:\windows\system32\amvo0.dll C:\windows\system32\tmp56.tmp . ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 ))))))))))))))))))))))))))))))) . 2008-06-02 15:37 . 2008-06-02 15:37 <DIR> d-------- C:\Downloaded 2008-06-02 12:29 . 2008-06-02 12:29 <DIR> d-------- C:\WINDOWS\Sun 2008-06-02 12:29 . 2008-06-02 12:29 <DIR> d-------- C:\Program Files\Sun 2008-06-02 12:28 . 2008-06-02 12:28 <DIR> d-------- C:\Program Files\Java 2008-06-02 12:28 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-02 12:26 . 2008-06-02 12:26 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-01 23:30 . 2008-06-02 15:37 <DIR> d-------- C:\Program Files\GoD 2008-06-01 22:55 . 2008-06-01 22:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Codemasters 2008-06-01 22:33 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll 2008-06-01 22:33 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll 2008-06-01 22:33 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp2D4.tmp 2008-06-01 22:33 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp2D3.tmp 2008-06-01 22:33 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll 2008-06-01 22:33 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll 2008-06-01 22:33 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll 2008-06-01 22:33 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll 2008-06-01 22:13 . 2008-06-01 22:13 <DIR> d-------- C:\Program Files\Codemasters 2008-05-29 16:54 . 2008-05-29 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NFS Underground 2008-05-29 16:51 . 2008-05-29 16:51 <DIR> d-------- C:\Program Files\EA GAMES 2008-05-26 19:15 . 2008-05-26 19:15 <DIR> d-------- C:\Program Files\Smart Projects 2008-05-22 16:18 . 2008-05-22 16:18 <DIR> d-------- C:\Documents and Settings\Poldek\Dane aplikacji\THQ 2008-05-22 16:15 . 2008-05-22 16:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-05-22 13:16 . 2008-05-22 13:16 <DIR> d-------- C:\Program Files\Ubisoft 2008-05-20 16:18 . 2008-05-20 16:18 <DIR> d-------- C:\Program Files\Bohemia Interactive 2008-05-20 13:49 . 2008-05-20 13:49 <DIR> d-------- C:\Documents and Settings\Poldek\Dane aplikacji\Sierra Entertainment 2008-05-20 13:48 . 2008-05-20 13:48 <DIR> d-------- C:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP 2008-05-19 15:14 . 2008-05-19 15:14 <DIR> d-------- C:\Program Files\Activision Value 2008-05-19 14:13 . 2008-05-22 16:16 <DIR> d-------- C:\Program Files\THQ 2008-05-19 14:05 . 2008-05-19 14:05 <DIR> d-------- C:\Program Files\UltraISO 2008-05-19 14:05 . 2008-05-19 14:05 <DIR> d-------- C:\Program Files\Common Files\EZB Systems 2008-05-03 19:42 . 2008-05-03 19:42 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-03 11:48 . 2008-05-03 11:48 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-05-03 11:48 . 2008-05-03 11:48 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-05-03 11:43 . 2008-05-19 13:36 <DIR> d-------- C:\Program Files\Gothic III 2008-05-02 00:09 . 2008-05-02 00:10 <DIR> d-------- C:\Program Files\MyProduct . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-02 13:40 --------- d-----w C:\Program Files\FlashGet 2008-06-02 13:40 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\uTorrent 2008-06-01 21:37 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\FileZilla 2008-06-01 20:33 444,952 ----a-w C:\windows\system32\wrap_oal.dll 2008-06-01 20:33 109,080 ----a-w C:\windows\system32\OpenAL32.dll 2008-06-01 20:33 --------- d-----w C:\Program Files\OpenAL 2008-06-01 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-29 14:53 12,400 ----a-w C:\windows\system32\drivers\secdrv.sys 2008-05-24 12:52 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Winamp 2008-05-23 11:42 --------- d-----w C:\Program Files\EA Sports 2008-05-22 14:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-20 11:48 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-05-17 22:07 --------- d-----w C:\Program Files\Real Alternative 2008-04-30 10:50 107,888 ----a-w C:\windows\system32\CmdLineExt.dll 2008-04-24 19:26 --------- d-----w C:\Program Files\FileZilla FTP Client 2008-04-21 21:32 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\DNA 2008-04-21 17:34 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Ubisoft 2008-04-21 17:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft 2008-04-20 21:34 --------- d-----w C:\Program Files\Easy Uploader 2008-04-18 19:08 --------- d-----w C:\Program Files\Winamp 2008-04-16 22:31 90,112 ----a-w C:\windows\DUMP827e.tmp 2008-04-16 21:07 --------- d-----w C:\Program Files\UltraVNC 2008-04-13 09:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microgaming 2008-04-13 09:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MGS 2008-04-12 15:38 --------- d-----w C:\Program Files\BarreDeSurf 2008-04-09 17:32 --------- d-----w C:\Program Files\Common Files\DirectX 2008-04-06 08:54 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\BitTorrent 2008-04-03 07:37 415,104 ----a-w C:\windows\system32\pr2aq6eb.exe 2008-04-03 07:36 69,248 ----a-w C:\windows\system32\drivers\pe3aq6eb.sys 2008-04-03 07:35 68,744 ----a-w C:\windows\system32\drivers\ps7aq6eb.sys 2008-04-02 18:59 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Sports Interactive . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "wsctf.exe"="wsctf.exe" [] "EXPLORER.EXE"="EXPLORER.EXE" [2007-03-10 03:31 1033728 C:\WINDOWS\explorer.exe] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-03-24 16:06 219952] "GoD"="C:\Program Files\GoD\GoD.exe" [2008-05-17 17:11 2502144] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iKeyWorks"="C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" [2006-09-07 10:21 65536] "LWBMOUSE"="C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE" [2004-11-24 11:02 365568] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 15:43 86016] "SoundMan"="SOUNDMAN.EXE" [2005-10-24 08:45 90112 C:\WINDOWS\soundman.exe] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 17:16 37376] "Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-09-25 10:10 2007088] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Poldek^Menu Start^Programy^Autostart^ctfmon.exe] path=C:\Documents and Settings\Poldek\Menu Start\Programy\Autostart\ctfmon.exe backup=C:\WINDOWS\pss\ctfmon.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 18:04 3313664 C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-12-23 19:05 143360 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-04-11 06:06 288576 C:\Program Files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\windows\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] C:\WINDOWS\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-08-11 15:43 7630848 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] --a------ 2007-10-07 20:51 171008 D:\Instalki\Rapget\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] --a------ 2008-03-24 16:06 219952 C:\Program Files\uTorrent\uTorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"= R0 pe3aq6eb;FIM Speedway GP3 Environment Driver (pe3aq6eb);C:\windows\system32\drivers\pe3aq6eb.sys [2008-04-03 09:36] R0 ps7aq6eb;FIM Speedway GP3 Synchronization Driver (ps7aq6eb);C:\windows\system32\drivers\ps7aq6eb.sys [2008-04-03 09:35] S2 pr2aq6eb;FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb);C:\windows\system32\pr2aq6eb.exe svc [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\windows\system32\DRIVERS\k510bus.sys [2008-04-01 22:56] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\windows\system32\DRIVERS\k510mdfl.sys [2008-04-01 22:56] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\windows\system32\DRIVERS\k510mdm.sys [2008-04-01 22:56] S3 USBSTOR;Sterownik magazynu masowego USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c496b9a6-0e20-11dd-a45a-0019213a2950}] \Shell\AutoRun\command - I:\jfvkcsy.bat \Shell\explore\Command - I:\jfvkcsy.bat \Shell\open\Command - I:\jfvkcsy.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f35ad304-0acb-11dd-b8de-0019213a2950}] \Shell\AutoRun\command - F:\EXPLORER.EXE \Shell\explore\Command - F:\EXPLORER.EXE \Shell\open\Command - F:\EXPLORER.EXE . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-02 16:54:55 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-02 16:55:31 ComboFix-quarantined-files.txt 2008-06-02 14:55:29 Pre-Run: 7,909,101,568 bajtów wolnych Post-Run: 8,066,269,184 bajtów wolnych 186

**Posty:** 8001 · przez **Okocza** 02 Cze 2008, 17:02

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\tmp2D4.tmp C:\WINDOWS\system32\tmp2D3.tmp C:\windows\DUMP827e.tmp Folder:: C:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GoD"=- "EXPLORER.EXE"=- "wsctf.exe"=- [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] [-HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Poldek^Menu Start^Programy^Autostart^ctfmon.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c496b9a6-0e20-11dd-a45a-0019213a2950}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f35ad304-0acb-11dd-b8de-0019213a2950}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 204 · przez **Poldek** 02 Cze 2008, 17:09

Kod: Zaznacz wszystko: ComboFix 08-06-01.6 - Poldek 2008-06-02 17:07:20.13 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1650 [GMT 2:00] Running from: C:\Documents and Settings\Poldek\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 ))))))))))))))))))))))))))))))) . 2008-06-02 15:37 . 2008-06-02 15:37 <DIR> d-------- C:\Downloaded 2008-06-02 12:29 . 2008-06-02 12:29 <DIR> d-------- C:\WINDOWS\Sun 2008-06-02 12:29 . 2008-06-02 12:29 <DIR> d-------- C:\Program Files\Sun 2008-06-02 12:28 . 2008-06-02 12:28 <DIR> d-------- C:\Program Files\Java 2008-06-02 12:28 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-02 12:26 . 2008-06-02 12:26 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-01 23:30 . 2008-06-02 16:56 <DIR> d-------- C:\Program Files\GoD 2008-06-01 22:55 . 2008-06-01 22:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Codemasters 2008-06-01 22:33 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll 2008-06-01 22:33 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll 2008-06-01 22:33 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp2D4.tmp 2008-06-01 22:33 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp2D3.tmp 2008-06-01 22:33 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll 2008-06-01 22:33 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll 2008-06-01 22:33 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll 2008-06-01 22:33 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll 2008-06-01 22:13 . 2008-06-01 22:13 <DIR> d-------- C:\Program Files\Codemasters 2008-05-29 16:54 . 2008-05-29 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NFS Underground 2008-05-29 16:51 . 2008-05-29 16:51 <DIR> d-------- C:\Program Files\EA GAMES 2008-05-26 19:15 . 2008-05-26 19:15 <DIR> d-------- C:\Program Files\Smart Projects 2008-05-22 16:18 . 2008-05-22 16:18 <DIR> d-------- C:\Documents and Settings\Poldek\Dane aplikacji\THQ 2008-05-22 16:15 . 2008-05-22 16:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-05-22 13:16 . 2008-05-22 13:16 <DIR> d-------- C:\Program Files\Ubisoft 2008-05-20 16:18 . 2008-05-20 16:18 <DIR> d-------- C:\Program Files\Bohemia Interactive 2008-05-20 13:49 . 2008-05-20 13:49 <DIR> d-------- C:\Documents and Settings\Poldek\Dane aplikacji\Sierra Entertainment 2008-05-20 13:48 . 2008-05-20 13:48 <DIR> d-------- C:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP 2008-05-19 15:14 . 2008-05-19 15:14 <DIR> d-------- C:\Program Files\Activision Value 2008-05-19 14:13 . 2008-05-22 16:16 <DIR> d-------- C:\Program Files\THQ 2008-05-19 14:05 . 2008-05-19 14:05 <DIR> d-------- C:\Program Files\UltraISO 2008-05-19 14:05 . 2008-05-19 14:05 <DIR> d-------- C:\Program Files\Common Files\EZB Systems 2008-05-03 19:42 . 2008-05-03 19:42 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-03 11:48 . 2008-05-03 11:48 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-05-03 11:48 . 2008-05-03 11:48 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-05-03 11:43 . 2008-05-19 13:36 <DIR> d-------- C:\Program Files\Gothic III 2008-05-02 00:09 . 2008-05-02 00:10 <DIR> d-------- C:\Program Files\MyProduct . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-02 14:57 --------- d-----w C:\Program Files\FlashGet 2008-06-02 14:57 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\uTorrent 2008-06-01 21:37 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\FileZilla 2008-06-01 20:33 444,952 ----a-w C:\windows\system32\wrap_oal.dll 2008-06-01 20:33 109,080 ----a-w C:\windows\system32\OpenAL32.dll 2008-06-01 20:33 --------- d-----w C:\Program Files\OpenAL 2008-06-01 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-29 14:53 12,400 ----a-w C:\windows\system32\drivers\secdrv.sys 2008-05-24 12:52 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Winamp 2008-05-23 11:42 --------- d-----w C:\Program Files\EA Sports 2008-05-22 14:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-20 11:48 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-05-17 22:07 --------- d-----w C:\Program Files\Real Alternative 2008-04-30 10:50 107,888 ----a-w C:\windows\system32\CmdLineExt.dll 2008-04-24 19:26 --------- d-----w C:\Program Files\FileZilla FTP Client 2008-04-21 21:32 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\DNA 2008-04-21 17:34 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Ubisoft 2008-04-21 17:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft 2008-04-20 21:34 --------- d-----w C:\Program Files\Easy Uploader 2008-04-18 19:08 --------- d-----w C:\Program Files\Winamp 2008-04-16 22:31 90,112 ----a-w C:\windows\DUMP827e.tmp 2008-04-16 21:07 --------- d-----w C:\Program Files\UltraVNC 2008-04-13 09:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microgaming 2008-04-13 09:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MGS 2008-04-12 15:38 --------- d-----w C:\Program Files\BarreDeSurf 2008-04-09 17:32 --------- d-----w C:\Program Files\Common Files\DirectX 2008-04-06 08:54 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\BitTorrent 2008-04-03 07:37 415,104 ----a-w C:\windows\system32\pr2aq6eb.exe 2008-04-03 07:36 69,248 ----a-w C:\windows\system32\drivers\pe3aq6eb.sys 2008-04-03 07:35 68,744 ----a-w C:\windows\system32\drivers\ps7aq6eb.sys 2008-04-02 18:59 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Sports Interactive . ((((((((((((((((((((((((((((( snapshot@2008-06-02_16.55.25,42 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-02 13:37:50 2,048 --s-a-w C:\windows\bootstat.dat + 2008-06-02 14:56:53 2,048 --s-a-w C:\windows\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "wsctf.exe"="wsctf.exe" [] "EXPLORER.EXE"="EXPLORER.EXE" [2007-03-10 03:31 1033728 C:\WINDOWS\explorer.exe] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-03-24 16:06 219952] "GoD"="C:\Program Files\GoD\GoD.exe" [2008-05-17 17:11 2502144] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iKeyWorks"="C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" [2006-09-07 10:21 65536] "LWBMOUSE"="C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE" [2004-11-24 11:02 365568] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 15:43 86016] "SoundMan"="SOUNDMAN.EXE" [2005-10-24 08:45 90112 C:\WINDOWS\soundman.exe] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 17:16 37376] "Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-09-25 10:10 2007088] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Poldek^Menu Start^Programy^Autostart^ctfmon.exe] path=C:\Documents and Settings\Poldek\Menu Start\Programy\Autostart\ctfmon.exe backup=C:\WINDOWS\pss\ctfmon.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 18:04 3313664 C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-12-23 19:05 143360 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-04-11 06:06 288576 C:\Program Files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] C:\WINDOWS\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-08-11 15:43 7630848 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] --a------ 2007-10-07 20:51 171008 D:\Instalki\Rapget\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] --a------ 2008-03-24 16:06 219952 C:\Program Files\uTorrent\uTorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"= R0 pe3aq6eb;FIM Speedway GP3 Environment Driver (pe3aq6eb);C:\windows\system32\drivers\pe3aq6eb.sys [2008-04-03 09:36] R0 ps7aq6eb;FIM Speedway GP3 Synchronization Driver (ps7aq6eb);C:\windows\system32\drivers\ps7aq6eb.sys [2008-04-03 09:35] S2 pr2aq6eb;FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb);C:\windows\system32\pr2aq6eb.exe svc [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\windows\system32\DRIVERS\k510bus.sys [2008-04-01 22:56] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\windows\system32\DRIVERS\k510mdfl.sys [2008-04-01 22:56] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\windows\system32\DRIVERS\k510mdm.sys [2008-04-01 22:56] S3 USBSTOR;Sterownik magazynu masowego USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-02 17:08:29 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-02 17:09:07 ComboFix-quarantined-files.txt 2008-06-02 15:09:05 ComboFix2.txt 2008-06-02 14:55:32 Pre-Run: 8,522,416,128 bajtów wolnych Post-Run: 8,511,541,248 bajtów wolnych 171

**Posty:** 18165 · przez **wojtas** 02 Cze 2008, 17:12

otwórz notatnik i wklej w nim:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\tmp2D4.tmp C:\WINDOWS\system32\tmp2D3.tmp C:\windows\DUMP827e.tmp Folder:: C:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GoD"=- "EXPLORER.EXE"=- "wsctf.exe"=- [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] [-HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Poldek^Menu Start^Programy^Autostart^ctfmon.exe]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 204 · przez **Poldek** 02 Cze 2008, 17:16

Kod: Zaznacz wszystko: ComboFix 08-06-01.6 - Poldek 2008-06-02 17:14:59.14 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1621 [GMT 2:00] Running from: C:\Documents and Settings\Poldek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Poldek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\windows\DUMP827e.tmp C:\WINDOWS\system32\tmp2D3.tmp C:\WINDOWS\system32\tmp2D4.tmp . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP C:\WINDOWS\85EBB28365AF4C539EBE7C0A232762F7.TMP\WiseCustomCalla.dll C:\windows\DUMP827e.tmp C:\WINDOWS\system32\tmp2D3.tmp C:\WINDOWS\system32\tmp2D4.tmp D:\Autorun.inf E:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 ))))))))))))))))))))))))))))))) . 2008-06-02 15:37 . 2008-06-02 15:37 <DIR> d-------- C:\Downloaded 2008-06-02 12:29 . 2008-06-02 12:29 <DIR> d-------- C:\WINDOWS\Sun 2008-06-02 12:29 . 2008-06-02 12:29 <DIR> d-------- C:\Program Files\Sun 2008-06-02 12:28 . 2008-06-02 12:28 <DIR> d-------- C:\Program Files\Java 2008-06-02 12:28 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-02 12:26 . 2008-06-02 12:26 <DIR> d-------- C:\Program Files\Common Files\Java 2008-06-01 23:30 . 2008-06-02 16:56 <DIR> d-------- C:\Program Files\GoD 2008-06-01 22:55 . 2008-06-01 22:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Codemasters 2008-06-01 22:33 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll 2008-06-01 22:33 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll 2008-06-01 22:33 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll 2008-06-01 22:33 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll 2008-06-01 22:33 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll 2008-06-01 22:33 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll 2008-06-01 22:13 . 2008-06-01 22:13 <DIR> d-------- C:\Program Files\Codemasters 2008-05-29 16:54 . 2008-05-29 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NFS Underground 2008-05-29 16:51 . 2008-05-29 16:51 <DIR> d-------- C:\Program Files\EA GAMES 2008-05-26 19:15 . 2008-05-26 19:15 <DIR> d-------- C:\Program Files\Smart Projects 2008-05-22 16:18 . 2008-05-22 16:18 <DIR> d-------- C:\Documents and Settings\Poldek\Dane aplikacji\THQ 2008-05-22 16:15 . 2008-05-22 16:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-05-22 13:16 . 2008-05-22 13:16 <DIR> d-------- C:\Program Files\Ubisoft 2008-05-20 16:18 . 2008-05-20 16:18 <DIR> d-------- C:\Program Files\Bohemia Interactive 2008-05-20 13:49 . 2008-05-20 13:49 <DIR> d-------- C:\Documents and Settings\Poldek\Dane aplikacji\Sierra Entertainment 2008-05-19 15:14 . 2008-05-19 15:14 <DIR> d-------- C:\Program Files\Activision Value 2008-05-19 14:13 . 2008-05-22 16:16 <DIR> d-------- C:\Program Files\THQ 2008-05-19 14:05 . 2008-05-19 14:05 <DIR> d-------- C:\Program Files\UltraISO 2008-05-19 14:05 . 2008-05-19 14:05 <DIR> d-------- C:\Program Files\Common Files\EZB Systems 2008-05-03 19:42 . 2008-05-03 19:42 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2008-05-03 11:48 . 2008-05-03 11:48 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2008-05-03 11:48 . 2008-05-03 11:48 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2008-05-03 11:43 . 2008-05-19 13:36 <DIR> d-------- C:\Program Files\Gothic III 2008-05-02 00:09 . 2008-05-02 00:10 <DIR> d-------- C:\Program Files\MyProduct . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-02 14:57 --------- d-----w C:\Program Files\FlashGet 2008-06-02 14:57 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\uTorrent 2008-06-01 21:37 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\FileZilla 2008-06-01 20:33 444,952 ----a-w C:\windows\system32\wrap_oal.dll 2008-06-01 20:33 109,080 ----a-w C:\windows\system32\OpenAL32.dll 2008-06-01 20:33 --------- d-----w C:\Program Files\OpenAL 2008-06-01 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-29 14:53 12,400 ----a-w C:\windows\system32\drivers\secdrv.sys 2008-05-24 12:52 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Winamp 2008-05-23 11:42 --------- d-----w C:\Program Files\EA Sports 2008-05-22 14:03 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-20 11:48 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-05-17 22:07 --------- d-----w C:\Program Files\Real Alternative 2008-04-30 10:50 107,888 ----a-w C:\windows\system32\CmdLineExt.dll 2008-04-24 19:26 --------- d-----w C:\Program Files\FileZilla FTP Client 2008-04-21 21:32 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\DNA 2008-04-21 17:34 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Ubisoft 2008-04-21 17:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft 2008-04-20 21:34 --------- d-----w C:\Program Files\Easy Uploader 2008-04-18 19:08 --------- d-----w C:\Program Files\Winamp 2008-04-16 21:07 --------- d-----w C:\Program Files\UltraVNC 2008-04-13 09:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microgaming 2008-04-13 09:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MGS 2008-04-12 15:38 --------- d-----w C:\Program Files\BarreDeSurf 2008-04-09 17:32 --------- d-----w C:\Program Files\Common Files\DirectX 2008-04-06 08:54 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\BitTorrent 2008-04-03 07:37 415,104 ----a-w C:\windows\system32\pr2aq6eb.exe 2008-04-03 07:36 69,248 ----a-w C:\windows\system32\drivers\pe3aq6eb.sys 2008-04-03 07:35 68,744 ----a-w C:\windows\system32\drivers\ps7aq6eb.sys 2008-04-02 18:59 --------- d-----w C:\Documents and Settings\Poldek\Dane aplikacji\Sports Interactive . ((((((((((((((((((((((((((((( snapshot@2008-06-02_16.55.25,42 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-02 13:37:50 2,048 --s-a-w C:\windows\bootstat.dat + 2008-06-02 14:56:53 2,048 --s-a-w C:\windows\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-03-24 16:06 219952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iKeyWorks"="C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" [2006-09-07 10:21 65536] "LWBMOUSE"="C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE" [2004-11-24 11:02 365568] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 15:43 86016] "SoundMan"="SOUNDMAN.EXE" [2005-10-24 08:45 90112 C:\WINDOWS\soundman.exe] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 17:16 37376] "Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-09-25 10:10 2007088] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43 7630848] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Poldek^Menu Start^Programy^Autostart^ctfmon.exe] path=C:\Documents and Settings\Poldek\Menu Start\Programy\Autostart\ctfmon.exe backup=C:\WINDOWS\pss\ctfmon.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 18:04 3313664 C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-12-23 19:05 143360 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-04-11 06:06 288576 C:\Program Files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 16:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-08-11 15:43 7630848 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2006-08-11 15:43 1519616 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] --a------ 2007-10-07 20:51 171008 D:\Instalki\Rapget\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] --a------ 2008-03-24 16:06 219952 C:\Program Files\uTorrent\uTorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"= R0 pe3aq6eb;FIM Speedway GP3 Environment Driver (pe3aq6eb);C:\windows\system32\drivers\pe3aq6eb.sys [2008-04-03 09:36] R0 ps7aq6eb;FIM Speedway GP3 Synchronization Driver (ps7aq6eb);C:\windows\system32\drivers\ps7aq6eb.sys [2008-04-03 09:35] S2 pr2aq6eb;FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb);C:\windows\system32\pr2aq6eb.exe svc [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\windows\system32\DRIVERS\k510bus.sys [2008-04-01 22:56] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\windows\system32\DRIVERS\k510mdfl.sys [2008-04-01 22:56] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\windows\system32\DRIVERS\k510mdm.sys [2008-04-01 22:56] S3 USBSTOR;Sterownik magazynu masowego USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-02 17:15:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-02 17:16:03 ComboFix-quarantined-files.txt 2008-06-02 15:16:01 ComboFix2.txt 2008-06-02 15:09:08 ComboFix3.txt 2008-06-02 14:55:32 Pre-Run: 8,504,905,728 bajtów wolnych Post-Run: 8,492,421,120 bajtów wolnych 179

**Posty:** 7956 · przez **Magik** 02 Cze 2008, 17:50

Do tego usuwasz z dysku plik c:\Qoobox
+ standardowe czyszczenie wg okoczy.....i powinno byc gut

**Posty:** 204 · przez **Poldek** 03 Cze 2008, 12:17

Magik
Dla Pewności...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:16:43, on 2008-06-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\spoolsv.exe C:\windows\Explorer.EXE C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE C:\windows\system32\RUNDLL32.EXE C:\windows\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\windows\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\windows\system32\wscntfy.exe C:\Program Files\UltraVNC\vncviewer.exe C:\Program Files\FlashGet\flashget.exe C:\Program Files\UltraVNC\vncviewer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\MULTI-MEDIA OPTICAL MOUSE\MULTI-MEDIA OPTICAL MOUSE\1.4\MOUSE32A.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9AB90189-3D8D-4ECF-91E1-11C3E40DCC60}: NameServer = 212.85.112.32 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb) (pr2aq6eb) - Techland Sp.z o.o. - C:\windows\system32\pr2aq6eb.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6002 bytes

Ostateczny Log z Hijack....

**Posty:** 8001 · przez **Okocza** 03 Cze 2008, 12:20

jest ok.

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

wirusy???

Wirusy???

Kto jest na forum