Wirusy z pendrive ? logi

**Posty:** 183 · przez **damiano25** 23 Sty 2009, 17:18

Proszę o sprawdzenie następujących logów

ComboFix

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - Optimus Prime 2009-01-22 20:24:49.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2046.1524 [GMT 1:00] Uruchomiony z: f:\programosy\Bezpieczeństwo\ComboFix\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) FW: COMODO Firewall Pro *disabled* FW: Kaspersky Internet Security *disabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\amvo.exe c:\windows\system32\amvo0.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-22 do 2009-01-22 ))))))))))))))))))))))))))))))) . 2009-01-18 20:23 . 2009-01-18 20:23 <DIR> d-------- c:\program files\Debugging Tools for Windows (x86) 2009-01-18 15:32 . 2009-01-18 19:10 <DIR> d-------- c:\program files\Prime95 2009-01-18 14:20 . 2009-01-18 14:20 <DIR> d-------- c:\program files\SEC 2009-01-18 14:20 . 2006-08-28 17:12 13,312 --a------ c:\windows\system32\drivers\MTictwl.sys 2009-01-17 09:40 . 2009-01-22 16:24 <DIR> d-------- c:\program files\SpeedFan 2009-01-17 09:38 . 2009-01-17 09:40 45 --a------ c:\windows\system32\initdebug.nfo 2009-01-15 16:45 . 2009-01-15 16:45 <DIR> d-------- c:\program files\MagicRotation 2009-01-15 16:45 . 2008-02-13 15:37 80,000 --a------ c:\windows\system32\sam_nv4_disp.dll 2009-01-15 16:45 . 2008-02-13 15:37 80,000 --a------ c:\windows\system32\magicpvt.dll 2009-01-15 16:45 . 2005-12-05 12:24 77,824 --a------ c:\windows\system32\MagicPvtUser.exe 2009-01-15 16:45 . 2005-11-14 03:27 61,440 --a------ c:\windows\system32\mpvthook.dll 2009-01-15 16:45 . 2005-11-14 03:26 9,728 -ra------ c:\windows\system32\drivers\magicpvt.sys 2009-01-15 16:45 . 2009-01-22 16:19 32 --a------ c:\windows\system32\driver.dat 2009-01-15 16:45 . 2009-01-22 20:22 16 --a------ c:\windows\system32\magicpvt.dat 2009-01-13 16:03 . 2009-01-13 16:03 <DIR> d-------- c:\program files\Winamp 2009-01-13 16:03 . 2009-01-13 17:10 <DIR> d-------- c:\documents and settings\Optimus Prime\Dane aplikacji\Winamp 2008-12-30 09:36 . 2008-12-30 09:36 <DIR> d-------- c:\program files\Windows Sidebar 2008-12-29 17:30 . 2008-09-19 16:53 129,560 --a------ c:\windows\system32\drivers\InCDFs.sys 2008-12-29 17:30 . 2008-09-19 16:53 41,752 --a------ c:\windows\system32\drivers\InCDRm.sys 2008-12-29 17:30 . 2008-09-19 16:53 40,216 --a------ c:\windows\system32\drivers\InCDPass.sys 2008-12-29 17:30 . 2008-09-19 16:53 19,352 --a------ c:\windows\system32\drivers\InCDRec.sys 2008-12-29 16:22 . 2008-12-30 09:37 4,767 --a------ c:\windows\Irremote.ini 2008-12-29 16:08 . 2008-12-30 09:31 <DIR> d-------- c:\program files\Common Files\Nero 2008-12-26 11:52 . 2008-12-26 11:52 <DIR> d-------- c:\program files\TechSmith 2008-12-26 11:52 . 2008-12-26 11:52 <DIR> d-------- c:\program files\Common Files\TechSmith Shared 2008-12-26 11:52 . 2008-12-26 11:52 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\TechSmith 2008-12-26 11:52 . 2008-03-12 02:37 107,864 --a------ c:\windows\system32\tsccvid.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-22 18:39 202,000 ----a-w c:\windows\system32\PnkBstrB.exe 2009-01-22 18:39 139,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-01-22 16:50 4,433,440 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-01-22 16:50 38,860 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-01-22 15:22 --------- d-----w c:\program files\AutoConnect 2009-01-22 15:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-01-22 15:18 7,892 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-01-22 15:18 1,073,184 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-01-22 11:09 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-22 11:09 --------- d-----w c:\program files\SpywareBlaster 2009-01-21 16:27 --------- d-----w c:\documents and settings\Optimus Prime\Dane aplikacji\uTorrent 2009-01-20 13:55 --------- d-----w c:\program files\eMule 2009-01-17 20:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-01-15 15:45 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-14 15:58 --------- d-----w c:\program files\BitComet 2009-01-14 10:21 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-01-12 20:51 --------- d-----w c:\program files\FlashGet 2009-01-07 13:47 --------- d-----w c:\program files\Common Files\Adobe 2009-01-03 11:39 --------- d-----w c:\documents and settings\Optimus Prime\Dane aplikacji\Azureus 2008-12-30 08:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-29 15:50 --------- d-----w c:\documents and settings\Optimus Prime\Dane aplikacji\Nero 2008-12-29 15:21 --------- d-----w c:\program files\Nero 2008-12-29 14:57 --------- d-----w c:\program files\Driver Cleaner 2008-12-29 12:46 --------- d-----w c:\documents and settings\Optimus Prime\Dane aplikacji\Image Zone Express 2008-12-24 17:34 --------- d-----w c:\program files\JetAudio 2008-12-19 12:13 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-12-17 08:41 --------- d-----w c:\program files\CCleaner 2008-12-16 19:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-12-14 10:21 --------- d-----w c:\program files\K-Lite Codec Pack 2008-12-14 10:19 413,696 ----a-w c:\windows\system32\wrap_oal.dll 2008-12-14 10:19 110,592 ----a-w c:\windows\system32\OpenAL32.dll 2008-12-14 10:19 --------- d-----w c:\program files\OpenAL 2008-12-14 09:02 --------- d-----w c:\program files\ASUS Xonar DX Audio 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-07 13:04 --------- d-----w c:\program files\Fraps 2008-11-27 19:26 163 ----a-w c:\documents and settings\Optimus Prime\FIX.REG 2008-11-27 07:46 --------- d-----w c:\program files\Bonjour 2008-11-27 07:37 --------- d-----w c:\program files\Common Files\Macrovision Shared 2008-11-24 14:32 57,344 ----a-w c:\windows\system32\ff_vfw.dll 2008-11-24 08:40 --------- d-----w c:\program files\Lavasoft 2008-11-24 08:40 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-24 08:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2008-11-23 12:35 --------- d-----w c:\program files\Opera 2008-11-23 10:59 --------- d-----w c:\program files\The All-Seeing Eye 2008-11-05 15:34 48,396 ----a-w c:\windows\UninstVeetleTVPlayer.exe 2008-10-28 22:35 684,032 ----a-w c:\windows\system32\divx.dll 2008-10-27 09:04 70,992 ----a-w c:\windows\system32\XAPOFX1_2.dll 2008-10-27 09:04 514,384 ----a-w c:\windows\system32\XAudio2_3.dll 2008-10-27 09:04 235,856 ----a-w c:\windows\system32\xactengine3_3.dll 2008-10-27 09:04 23,376 ----a-w c:\windows\system32\X3DAudio1_5.dll 2008-10-26 12:01 1,847,168 ----a-w c:\windows\system32\win32k.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-09-29 16:12 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008092920080930\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt] @="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}" [HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}] 2008-09-19 16:53 98328 --a------ c:\program files\Nero\Nero 9\InCD\NBHshx.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "ABIT uGuruIII"="c:\program files\ABIT\uGuru\uGuru.exe" [2006-07-24 417792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-04-25 385024] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992] "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240] "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472] "BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-03-21 91432] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-13 185872] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "Cmaudio8788GX"="c:\windows\system\HsMgr.exe" [2008-05-05 200704] "InCD"="c:\program files\Nero\Nero 9\InCD\InCD.exe" [2008-09-19 1111064] "NBHGui"="c:\program files\Nero\Nero 9\InCD\NBHGui.exe" [2008-09-19 2079256] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NCProTray.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\NCProTray.lnk backup=c:\windows\pss\NCProTray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicRotation] --a------ 2008-02-11 12:07 1097728 c:\program files\MagicRotation\MagicPvt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-08-27 14:59 98304 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] --------- 2008-09-16 11:16 1833296 c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-09-12 17:45 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI.SP4a\\Win32\\RpcDataSrv.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI.SP4a\\RpcSandraSrv.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\Azureus\\Azureus.exe"= "c:\\Program Files\\Opera\\Opera.exe"= "d:\\Gry\\Age_of_Empires_III\\age3y.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\The All-Seeing Eye\\eye.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\sopvod.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"= "c:\\Program Files\\River Past\\Video Cleaner\\VideoCleaner.exe"= "d:\\Gry\\CompanyOfHeroes\\RelicCOH.exe"= "d:\\Gry\\Age_of_Empires_III\\age3x.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "d:\\Gry\\Call_of_Duty_-_World_at_War\\CoDWaW.exe"= "d:\\Gry\\Call_of_Duty_-_World_at_War\\CoDWaWmp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "13030:TCP"= 13030:TCP:BitComet 13030 TCP "13030:UDP"= 13030:UDP:BitComet 13030 UDP R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 UGURU;UGURU;c:\windows\system32\drivers\uGuru.sys [2007-08-03 14592] R1 magicpvt;magicpvt;c:\windows\system32\drivers\magicpvt.sys [2009-01-15 9728] R3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2008-12-14 2019456] R3 FT2593;FT2593 Filter;c:\windows\system32\drivers\FT2593.sys [2007-08-11 51915] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592] R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2008-06-08 418832] R4 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [2008-02-01 16:24:04 41456] R4 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe [2008-09-19 108568] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [2007-08-29 58288] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [2007-08-29 8336] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [2007-08-29 94064] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [2007-08-29 85408] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [2007-08-29 83344] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - PNKBSTRB *NewlyCreated* - PNKBSTRK . Zawartość folderu 'Zaplanowane zadania' 2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-SkyTel - SkyTel.EXE HKLM-Run-Cmaudio8788 - cmicnfgp.cpl MSConfigStartUp-Flircik - c:\program files\Onet\Flircik\Flircik.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = about:blank uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Download All by FlashGet IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm IE: &Download by FlashGet IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm IE: &Ściągnij przy pomocy FlashGet'a IE: &Ściągnij wszystko przy pomocy FlashGet'a IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Optimus Prime\Dane aplikacji\Mozilla\Firefox\Profiles\0u6z1643.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-22 20:27:00 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1060284298-926492609-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID] @Denied: (Full) (LocalSystem) [HKEY_USERS\S-1-5-21-1060284298-926492609-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{70327EB4-F335-9306-ABEB-66EE49B16D59}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "palghgnmekbhifgabacppopmlagcddod"=hex:6a,61,69,6c,61,6e,6f,6c,70,6c,6d,6d,6e, 6a,68,63,6b,6e,6a,66,00,00 "oafhjlecfhheonjnddgdafbnpjnodf"=hex:6a,61,68,6c,68,6e,64,62,70,6b,6b,70,67,6f, 62,62,6f,6a,66,6f,00,00 [HKEY_USERS\S-1-5-21-1060284298-926492609-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:a1,7b,06,a6,11,7e,11,6f,25,98,87,fc,de,6c,6a,86,9a,ad,a8,11,ce,05,7f, ea,be,63,4d,3f,4b,9f,6d,e2,6b,ba,a9,63,3d,05,3e,92,bb,a5,6d,15,e0,cb,90,fa,\ "??"=hex:a0,5a,ee,98,56,17,54,cc,cd,bf,74,65,52,7c,9d,0b [HKEY_USERS\S-1-5-21-1060284298-926492609-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:33,cd,f5,aa,7b,6c,c7,07,22,22,55,f6,50,a7,4e,b7,76,5d,ad,75,fe, bf,4c,8d,7a,8a,0d,48,77,20,79,32,01,64,b3,22,2f,0e,fe,11,35,a1,76,57,4a,83,\ "rkeysecu"=hex:1b,a7,ed,90,b8,ba,33,81,d9,b8,57,f6,18,5f,73,ad . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1064) c:\windows\system32\klogon.dll c:\program files\common files\logitech\bluetooth\LBTWlgn.dll c:\program files\common files\logitech\bluetooth\LBTServ.dll . Czas ukończenia: 2009-01-22 20:28:41 ComboFix-quarantined-files.txt 2009-01-22 19:28:39 Przed: 9 798 103 040 bajtów wolnych Po: 10,662,391,808 bajtów wolnych 286 --- E O F --- 2009-01-15 15:29:37

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:00:05, on 2009-01-22 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero 9\InCD\InCDSrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe C:\Program Files\Cyberlink\Shared Files\brs.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system\HsMgr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\SpeedFan\speedfan.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\IrfanView\i_view32.exe C:\WINDOWS\system32\PnkBstrB.exe F:\Pliki\RS_Downloader.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - (no file) O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Cmaudio8788GX] C:\WINDOWS\system\HsMgr.exe Envoke O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 9\InCD\InCD.exe O4 - HKLM\..\Run: [NBHGui] C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ABIT uGuruIII] C:\Program Files\ABIT\uGuru\uGuru.exe O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{79475F0B-EBF3-4367-9CBB-8E8C33C3C877}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\InCDSrv.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP4a\Win32\RpcDataSrv.exe O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP4a\RpcSandraSrv.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 10627 bytes

**Posty:** 1903 · przez **MichuPower** 23 Sty 2009, 19:33

Logi wstaw w tagi [code] bo raczej nikt Ci tego nie sprawdzi

**Posty:** 183 · przez **damiano25** 23 Sty 2009, 20:22

ok już

i sorry proszę o pomoc

**Posty:** 18165 · przez **wojtas** 24 Sty 2009, 18:48

Wylecz pendriva
Perlovga Removal Tool
Flash Disinfector
lub format

te plik/i :

c:\windows\system32\MagicPvtUser.exe
c:\windows\system32\driver.dat
c:\windows\system32\magicpvt.dat

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 183 · przez **damiano25** 25 Sty 2009, 17:24

Pendrive'a mam wyleczyć tylko ?
Komputer jest czysty ?

**Posty:** 18165 · przez **wojtas** 25 Sty 2009, 18:00

zrób co kazałem...

**Posty:** 183 · przez **damiano25** 25 Sty 2009, 20:20

Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp oraz skasuj folder C:\Qoobox

Po skanowaniu nie mam tego programu już na dysku gdzie on jest ? folderu C:\Qoobox nie mam wogóle.

**Posty:** 300 · przez **sgsman** 25 Sty 2009, 23:06

W porządku, ten program automatycznie usuwa Qooboxa tudzież sam siebie. Podaj raporty ze skanów o które prosił Wojtas, jak je wykonasz

.