Wirusy,brak paska startowego,brak streowników dzwięku

**Posty:** 13 · przez **NIKI4355** 04 Gru 2008, 13:32

Kod: Zaznacz wszystko: iComboFix 08-12-02.02 - Ewelina 2008-12-04 10:20:20.3 - NTFSx86 Uruchomiony z: c:\documents and settings\Ewelina\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe [color=RED][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat c:\windows\system32\bdxttj.dll c:\windows\system32\bexxajwk.ini c:\windows\system32\cKTEdMoq.ini c:\windows\system32\cKTEdMoq.ini2 c:\windows\system32\cnhxsk.dll c:\windows\system32\cybtslsv.ini c:\windows\system32\dkirmevd.ini c:\windows\system32\dpaukboo.dll c:\windows\system32\dzimui.dll c:\windows\system32\egneonnl.ini c:\windows\system32\eisljhra.ini c:\windows\system32\eivirugk.ini c:\windows\system32\fbygow.dll c:\windows\system32\fgankwdv.ini c:\windows\system32\fLnmVvut.ini c:\windows\system32\fLnmVvut.ini2 c:\windows\system32\fMoWvyay.ini c:\windows\system32\fMoWvyay.ini2 c:\windows\system32\fqytaikq.ini c:\windows\system32\frqyukmf.ini c:\windows\system32\gclwvykx.ini c:\windows\system32\gjmuoegn.ini c:\windows\system32\gyjtflmw.ini c:\windows\system32\hharmopj.ini c:\windows\system32\hikqdtxb.ini c:\windows\system32\hsmmfewy.ini c:\windows\system32\icpabbby.ini c:\windows\system32\igaetjgq.ini c:\windows\system32\iigdtyjy.ini c:\windows\system32\iiswiu.dll c:\windows\system32\ilslxwws.dll c:\windows\system32\imundstn.dll c:\windows\system32\ipumfyaf.ini c:\windows\system32\itxtxhfh.ini c:\windows\system32\jauuoduv.ini c:\windows\system32\jhqnrraf.dll c:\windows\system32\jowtnujx.ini c:\windows\system32\jrdxfywo.dll c:\windows\system32\jsjspi.dll c:\windows\system32\jsuwpstb.ini c:\windows\system32\kgratx.dll c:\windows\system32\lkfqwshi.ini c:\windows\system32\lkvgwppo.ini c:\windows\system32\llwonw.dll c:\windows\system32\lqtzxe.dll c:\windows\system32\luqghjbv.ini c:\windows\system32\mijxooml.ini c:\windows\system32\mitlpopt.ini c:\windows\system32\mlulnhhb.ini c:\windows\system32\mmljtswd.ini c:\windows\system32\mrkxkmnj.dll c:\windows\system32\mwjsjlho.ini c:\windows\system32\mxborvtv.ini c:\windows\system32\nmknbt.dll c:\windows\system32\nnimgwqd.ini c:\windows\system32\nqujdcay.ini c:\windows\system32\nxxbvl.dll c:\windows\system32\ocafhnhp.dll c:\windows\system32\oijrymbr.ini c:\windows\system32\ojckxifk.ini c:\windows\system32\oklqsius.ini c:\windows\system32\oobkuapd.ini c:\windows\system32\oqojylqo.ini c:\windows\system32\owegclgr.ini c:\windows\system32\oxeckkke.ini c:\windows\system32\pofvsnbt.ini c:\windows\system32\PWEhknpo.ini c:\windows\system32\PWEhknpo.ini2 c:\windows\system32\qbitdpkw.dll c:\windows\system32\qdalrgev.dll c:\windows\system32\qkycbapi.ini c:\windows\system32\qsgdmyjw.ini c:\windows\system32\rcdxyltt.dll c:\windows\system32\rgrfvllq.ini c:\windows\system32\rrctbr.dll c:\windows\system32\sfhzwo.dll c:\windows\system32\stwvDfhk.ini c:\windows\system32\stwvDfhk.ini2 c:\windows\system32\suisqlko.dll c:\windows\system32\swwxlsli.ini c:\windows\system32\tktfjaaj.ini c:\windows\system32\trsxdjrt.ini c:\windows\system32\ttiymkgv.ini c:\windows\system32\ufoweyky.ini c:\windows\system32\utlgkocr.dll c:\windows\system32\vifkxlhy.ini c:\windows\system32\vodicyxm.ini c:\windows\system32\vshvtqcw.ini c:\windows\system32\vybIRtwa.ini c:\windows\system32\vybIRtwa.ini2 c:\windows\system32\wbubhlub.ini c:\windows\system32\winiuejn.ini c:\windows\system32\wnnssbpx.ini c:\windows\system32\wtwpeavv.dll c:\windows\system32\wyrclven.ini c:\windows\system32\xcrsmdsu.dll c:\windows\system32\xemwatll.ini c:\windows\system32\xfhhupuc.ini c:\windows\system32\xIPWDfhk.ini c:\windows\system32\xIPWDfhk.ini2 c:\windows\system32\xiqyxjas.dll c:\windows\system32\xjparrva.dll c:\windows\system32\xkpexspq.ini c:\windows\system32\xmlqxikx.ini c:\windows\system32\yacdjuqn.dll c:\windows\system32\yohcocdo.ini c:\windows\system32\yqlloosr.dll c:\windows\system32\yvprbx.dll . ---- Previous Run ------- . c:\documents and settings\Luque\Dane aplikacji\Adobe\Player.exe.bak c:\documents and settings\Piter\Menu Start\Programy\Autostart\userinit.exe c:\documents and settings\Piter\svchost.exe C:\u.exe c:\windows\system32\~.exe c:\windows\system32\drivers\services.exe c:\windows\system32\kr_done1 c:\windows\system32\mcrh.tmp ----- BITS: Możliwe zainfekowane strony ----- hxxp://78.157.143.198 . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_VFILT ((((((((((((((((((((((((( Pliki utworzone od 2008-11-04 do 2008-12-04 ))))))))))))))))))))))))))))))) . 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\program files\Avira 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Avira 2008-12-02 12:10 . 2008-12-02 12:10 <DIR> d-------- c:\documents and settings\Ewelina\Dane aplikacji\BearShare 2008-12-01 09:20 . 2008-12-01 09:20 106,496 --a------ c:\windows\system32\ppmdvkmn.dll 2008-11-30 11:02 . 2008-11-30 11:02 <DIR> d--hs---- c:\windows\ftpcache 2008-11-29 20:04 . 2008-11-29 20:04 70,656 --a------ c:\windows\system32\qpsxepkx.dll 2008-11-29 08:19 . 2008-11-20 16:35 579,072 --a------ c:\windows\system32\okxnhtaq 2008-11-26 14:17 . 2008-11-26 14:17 <DIR> d-------- c:\program files\Common Files\Futuremark Shared 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\documents and settings\Luque\SystemRequirementsLab 2008-11-24 06:39 . 2008-11-24 06:39 <DIR> d-------- c:\windows\system32\Futuremark 2008-11-24 06:39 . 2008-05-29 12:33 27,672 -ra------ c:\windows\system32\drivers\Entech.sys 2008-11-24 06:39 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys 2008-11-24 06:38 . 2008-11-24 06:38 <DIR> d-------- c:\program files\Futuremark 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\program files\Auslogics 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\Auslogics 2008-11-22 10:34 . 2008-11-22 10:34 104,448 --a------ c:\windows\system32\pyfdax.dll 2008-11-21 08:17 . 2008-11-21 08:17 103,936 --a------ c:\windows\system32\sfjhxf.dll 2008-11-20 18:55 . 2008-11-20 18:55 104,448 --a------ c:\windows\system32\soitxl.dll 2008-11-20 18:55 . 2008-11-20 18:55 104,448 --a------ c:\windows\system32\qakihuha.dll 2008-11-20 16:35 . 2008-11-20 16:35 180,224 --a------ c:\windows\system32\nvaux32.VIR 2008-11-20 16:35 . 2008-11-29 08:18 137,728 --a------ c:\windows\system32\aston.mt 2008-11-20 16:35 . 2008-11-29 10:10 63,488 --a------ c:\windows\system32\rigv.xl 2008-11-20 16:35 . 2008-11-29 10:10 32,768 --a------ c:\windows\system32\fxe.sp 2008-11-20 16:35 . 2008-11-29 10:10 32,768 --a------ c:\windows\system32\fjes.ra 2008-11-18 11:07 . 2008-11-18 11:07 104,448 --a------ c:\windows\system32\qrtdqs.dll 2008-11-16 11:31 . 2008-11-16 11:31 <DIR> d-------- c:\program files\Apple Software Update 2008-11-16 09:11 . 2008-12-04 08:50 86,354 --a------ c:\windows\system32\drivers\6ce7d2e2.sys 2008-11-15 12:49 . 2008-11-15 12:49 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\TigerPlayer 2008-11-10 16:28 . 2008-11-10 16:28 104,448 --a------ c:\windows\system32\umrrboyi.dll 2008-11-09 17:32 . 2008-11-09 17:32 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\ipla 2008-11-09 11:46 . 2008-11-29 17:50 4,876 --a------ c:\windows\system32\d3d9caps.dat 2008-11-08 12:45 . 2008-11-10 16:01 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\BearShare 2008-11-05 20:48 . 2008-11-05 20:48 102,912 --a------ c:\windows\system32\zppegk.dll 2008-11-04 16:59 . 2008-11-04 16:59 68,096 --a------ c:\windows\system32\qgjteagi.dll 2008-11-04 08:48 . 2008-12-04 08:50 100,702 --a------ c:\windows\system32\drivers\f9f2f2b1.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-04 09:32 --------- d-----w c:\program files\DNA 2008-12-04 09:32 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DNA 2008-12-04 09:24 --------- d-----w c:\program files\BitComet 2008-12-04 07:19 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\uTorrent 2008-12-03 16:26 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Hamachi 2008-12-03 16:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Hamachi 2008-12-02 06:55 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\ipla 2008-11-30 15:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Skype 2008-11-30 15:07 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\skypePM 2008-11-28 21:43 --------- d-----w c:\program files\Common Files\Adobe 2008-11-26 13:17 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-25 19:22 --------- d-----w c:\program files\NAPI-PROJEKT 2008-11-24 18:40 --------- d-----w c:\program files\Gadu-Gadu 2008-11-20 15:35 579,072 ----a-w c:\windows\system32\user32.DLL 2008-11-17 15:45 --------- d-----w c:\program files\Nowe Gadu-Gadu 2008-11-11 14:53 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Sports Interactive 2008-11-10 15:52 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Sports Interactive 2008-11-10 13:47 --------- d-----w c:\program files\Winamp 2008-11-08 14:13 --------- d-----w c:\program files\Google 2008-11-03 15:10 --------- d-----w c:\program files\Prawo Jazdy 2006 2008-11-02 19:12 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Sports Interactive 2008-11-02 19:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-11-02 19:03 --------- d-----w c:\program files\Sports Interactive 2008-11-02 11:21 --------- d-----w c:\program files\Opera 2008-11-02 10:18 --------- d-----w c:\program files\Live_TV 2008-11-01 07:25 244,224 ----a-w c:\windows\system32\opnkhEWP.VIR 2008-10-31 17:35 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\BearShare 2008-10-29 21:13 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Skype 2008-10-29 20:05 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\skypePM 2008-10-28 21:44 1,982 ----a-w c:\windows\system32\ealregsnapshot1.reg 2008-10-28 21:44 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Leadertech 2008-10-27 18:59 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Canon 2008-10-27 05:20 101,888 ----a-w c:\windows\system32\qltvijod.dll 2008-10-23 16:49 69,632 ----a-w c:\windows\system32\wjymdgsq.dll 2008-10-23 16:46 101,376 ----a-w c:\windows\system32\zlhfnw.dll 2008-10-22 17:07 --------- d-----w c:\program files\AbiSuite2 2008-10-22 08:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-10-21 10:36 --------- d-----w c:\program files\F-Secure Internet Security 2008-10-21 10:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\f-secure 2008-10-21 10:21 101,888 ----a-w c:\windows\system32\pdvnqlky.dll 2008-10-21 09:35 101,888 ----a-w c:\windows\system32\yqauffme.dll 2008-10-21 09:35 101,888 ----a-w c:\windows\system32\vwbtxu.dll 2008-10-20 17:42 --------- d-----w c:\program files\Hamachi 2008-10-20 17:41 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys 2008-10-19 18:32 --------- d-----w c:\program files\Conduit 2008-10-16 17:53 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Nowe Gadu-Gadu 2008-10-16 09:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Skype 2008-10-16 08:27 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\skypePM 2008-10-16 08:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Nowe Gadu-Gadu 2008-10-15 15:13 68,096 ----a-w c:\windows\system32\qllvfrgr.dll 2008-10-15 12:09 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Leadertech 2008-10-15 11:22 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DAEMON Tools 2008-10-15 07:31 --------- d-----w c:\program files\Chemix 2008-10-15 06:26 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\DAEMON Tools 2008-10-14 20:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\F-Secure 2008-10-14 19:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Ahead 2008-10-14 19:34 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-14 19:33 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Leadertech 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-14 19:10 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\DAEMON Tools 2008-10-14 19:05 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-14 19:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\DAEMON Tools 2008-10-12 11:42 --------- d-----w c:\program files\Common Files\NSV 2008-10-11 17:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Trymedia 2008-10-09 15:47 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\F-Secure 2008-10-09 12:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\F-Secure 2008-10-09 12:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\fssg 2008-10-09 12:06 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\TigerPlayer 2008-10-06 16:23 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ipla 2008-10-05 16:47 --------- d-----w c:\program files\ipla 2008-10-05 15:09 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-10-05 15:09 --------- d-----w c:\program files\GameTop.com 2008-10-05 15:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\PC Tools 2008-10-05 13:59 --------- d-----w c:\program files\Common Files\PC Tools 2008-10-04 16:03 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Canon 2008-09-30 13:20 4,608 ----a-w c:\windows\system32\w95inf32.dll 2008-09-30 13:20 2,272 ----a-w c:\windows\system32\w95inf16.dll . [color=red] c:\windows\system32\user32.dll ... jest zarażony !! [/color] 578,560 2005-03-02 18:21:08 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll 579,584 2007-03-08 15:51:57 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll 578,560 2004-08-03 22:44:14 c:\windows\$NtUninstallKB890859$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll.000 579,072 2008-11-20 15:35:35 c:\windows\system32\user32.DLL 579,072 2008-11-20 15:35:35 c:\windows\system32\dllcache\user32.dll ------- Sigcheck ------- 2005-03-02 19:21 578560 6a93565be9b8422eb7538c66ac732d76 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll 2007-03-08 16:51 579584 11abdecc02efc1d2b6a6a0fa46c26594 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll 2004-08-03 23:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 c:\windows\$NtUninstallKB890859$\user32.dll 2005-03-02 19:18 578560 b7eeb1a1af740306049241ddf61f21ff c:\windows\$NtUninstallKB925902$\user32.dll 2008-11-20 16:35 579072 9e53caa5a0a90105ed98e3d476273505 c:\windows\system32\user32.DLL 2008-11-20 16:35 579072 9e53caa5a0a90105ed98e3d476273505 c:\windows\system32\dllcache\user32.dll 2004-08-03 23:44 82944 ab82237486b727dd7dab36a76f38a3a2 c:\windows\system32\ws2_32.dll 2004-08-03 23:44 82944 ab82237486b727dd7dab36a76f38a3a2 c:\windows\system32\dllcache\ws2_32.dll 2008-06-23 17:16 669696 bc26f2968396842367b02730435dd588 c:\windows\$hf_mig$\KB953838\SP2QFE\wininet.dll 2008-06-23 16:13 668672 28fa0fd33916ebebc3e0dc1410f48651 c:\windows\$hf_mig$\KB953838\SP3GDR\wininet.dll 2008-06-23 15:57 669184 9ea369835e233f077c0d832676a29d40 c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll 2004-08-03 23:44 658944 d37dafb534ac8343d59a1b501abe852c c:\windows\$NtUninstallKB953838$\wininet.dll 2008-06-23 16:41 662016 32dc67b19496a88850c892cadf8366e3 c:\windows\ie8\wininet.dll 2008-03-03 19:01 830464 102afb4826c69fe386955e2e77f28040 c:\windows\system32\wininet.dll 2008-03-03 19:01 830464 102afb4826c69fe386955e2e77f28040 c:\windows\system32\dllcache\wininet.dll 2008-06-20 11:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys 2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys 2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB951748$\tcpip.sys 2008-06-20 11:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\system32\dllcache\tcpip.sys 2008-06-20 11:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\system32\drivers\tcpip.sys 2004-08-03 23:44 505856 25da11068eb165da00d3ed7eb3c1512e c:\windows\system32\winlogon.exe 2004-08-03 22:14 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys 2004-08-03 22:14 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys 2004-08-03 22:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\dllcache\ip6fw.sys 2004-08-03 22:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys 2005-03-02 19:14 2058240 35d11fdc381536ab95e3005489131f44 c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe 2007-02-28 17:09 2060672 2f4a36b1b03d64fb176cb0f3eb597118 c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe 2004-08-03 23:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe 2005-03-02 19:08 2058112 0f6990820c6ce0a7a911fae5937ef1f6 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe 2007-02-28 17:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d c:\windows\Driver Cache\i386\ntkrnlpa.exe 2008-08-14 14:46 2059008 740d5209ce5ec76bb99923a710cd0a53 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2GDR\ntkrnlpa.exe 2008-08-14 14:40 2064256 bd1c2093733023e5afc1520c095c2195 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2QFE\ntkrnlpa.exe 2008-08-14 14:26 2067328 5ab2f07ad3fd76790294ddccc6e06d46 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3GDR\ntkrnlpa.exe 2008-08-14 18:27 2067328 638346856e53887b0c3da62a9ab2c203 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3QFE\ntkrnlpa.exe 2007-02-28 17:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d c:\windows\system32\ntkrnlpa.exe 2007-02-28 17:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d c:\windows\system32\dllcache\ntkrnlpa.exe 2005-03-02 19:14 2180864 dba3e4215279c8012b37d2135b531258 c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe 2007-02-28 17:09 2183424 c450518ef9acc02a2d799698021e31a8 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe 2004-08-03 23:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f c:\windows\$NtUninstallKB890859$\ntoskrnl.exe 2005-03-02 19:09 2180608 3f3612846d67352468d2286fc23fb0c2 c:\windows\$NtUninstallKB931784$\ntoskrnl.exe 2007-02-28 17:04 2181632 c378be3a1edc5e4421d428655ac4a48c c:\windows\Driver Cache\i386\ntoskrnl.exe 2008-08-14 14:46 2181632 1e808411607a060ad7c582b7556c9afa c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2GDR\ntoskrnl.exe 2008-08-14 14:40 2187264 8eac2f887f5e093186a6b2e548f719ba c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2QFE\ntoskrnl.exe 2008-08-14 14:26 2190464 9ce159c91e076ff6c25d055310ebb259 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3GDR\ntoskrnl.exe 2008-08-14 18:27 2190464 dcdd970025463dfc9676ebe18abd6a86 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3QFE\ntoskrnl.exe 2007-02-28 17:04 2181632 c378be3a1edc5e4421d428655ac4a48c c:\windows\system32\ntoskrnl.exe 2007-02-28 17:04 2181632 c378be3a1edc5e4421d428655ac4a48c c:\windows\system32\dllcache\ntoskrnl.exe 2007-06-13 14:23 1036800 421f5b217986acdd7016b6deb039a7b8 c:\windows\explorer.exe 2007-06-13 14:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-03 23:44 1033728 379098a96e6c165b659de7e4328010ea c:\windows\$NtUninstallKB938828$\explorer.exe 2004-08-03 23:44 110080 ba79ea13e862177aa55843006e7f39cb c:\windows\system32\services.exe 2004-08-03 23:44 14336 786c044e17041dbc105656202708c14d c:\windows\system32\lsass.exe 2004-08-03 23:44 15360 cbfa30492d70ce3938d8a7783d0c0436 c:\windows\system32\ctfmon.exe 2004-08-03 23:44 15360 cbfa30492d70ce3938d8a7783d0c0436 c:\windows\system32\dllcache\ctfmon.exe 2005-06-11 01:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2004-08-03 23:44 57856 bebe8a85954ff460374fd5a0cd21e19b c:\windows\$NtUninstallKB896423$\spoolsv.exe 2005-06-11 00:53 58368 3513a57ec257df60f641d20031acb383 c:\windows\system32\spoolsv.exe 2004-08-03 23:44 25088 bd768099b4c44aa631728cb74eb54396 c:\windows\system32\userinit.exe 2004-08-03 23:44 25088 bd768099b4c44aa631728cb74eb54396 c:\windows\system32\dllcache\userinit.exe 2004-08-03 23:44 296448 2c28157229925280916b3041ccc5fe4b c:\windows\system32\termsrv.dll 2004-08-03 23:44 296448 2c28157229925280916b3041ccc5fe4b c:\windows\system32\dllcache\termsrv.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-12-03 2514744] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336] "ares"="c:\program files\Ares\Ares.exe" [2008-11-23 880640] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304] "QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-01 185896] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "EditLevel"= 0 (0x0) "NoCommonGroups"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=bylmnk.dll joqjpf.dll fbygow.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll "vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll "wave2"= alcxnt.dll "aux1"= alcxnt.dll "mixer1"= alcxnt.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproRemote.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproRemote.lnk backup=c:\windows\pss\ComproRemote.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproScheduler.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproScheduler.lnk backup=c:\windows\pss\ComproScheduler.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproSchedulerDTV.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproSchedulerDTV.lnk backup=c:\windows\pss\ComproSchedulerDTV.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TweakYC.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TweakYC.lnk backup=c:\windows\pss\TweakYC.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] -ra------ 2005-11-28 06:52 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] -ra------ 2005-11-28 06:55 118784 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] -ra------ 2005-11-28 06:55 98304 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2007-01-08 21:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 13:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu] --a------ 2008-10-10 10:50 6500960 c:\program files\Nowe Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2007-03-14 20:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-09-29 16:57 21755688 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-09-01 16:42 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 17:43 69632 c:\windows\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2008-05-07 14:39 16862208 c:\windows\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\EA Sports\\FIFA 08\\FIFA08.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\Program Files\\FIFA09.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2009 Demo\\fm.exe"= "c:\\Documents and Settings\\Piter\\Pulpit\\Skype.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Ares Destiny\\AresDestiny.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12475:TCP"= 12475:TCP:BitComet 12475 TCP "12475:UDP"= 12475:UDP:BitComet 12475 UDP "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "20950:TCP"= 20950:TCP:TORRENT "49438:TCP"= 49438:TCP:torrent "9433:TCP"= 9433:TCP:BitComet 9433 TCP "9433:UDP"= 9433:UDP:BitComet 9433 UDP . Zawartość folderu 'Zaplanowane zadania' 2008-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{00000000-0000-0000-0281-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-0542-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-09f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-10ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-13f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-1581-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-26f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-2a42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-2b81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-4cf0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0000-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0001-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0002-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0002-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0002-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0004-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0009-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0009-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0013-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0013-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0026-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0027-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-004d-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-004f-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-009a-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-009d-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-0134-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-013a-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-026b-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-04d2-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-04d7-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-09a5-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-09d5-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-134a-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-13ab-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-2694-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-27d7-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0000-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0001-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0002-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0003-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0004-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0006-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0009-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0010-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0012-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0021-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0024-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0033-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0048-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0075-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0091-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-00ce-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000000-00eb-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0123-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0211-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-03ae-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0422-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000000-048f-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-075c-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-091f-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000000-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000000-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000001-1089-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000002-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000002-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000005-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000009-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{0000000a-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{0000000b-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{00000013-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000014-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{00000026-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{00000045-1089-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{0000004c-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{0000005e-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll BHO-{0000008b-1089-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll BHO-{00000099-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll BHO-{000000a1-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll BHO-{000000BC-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{00000132-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00000178-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{00000264-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00000285-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll BHO-{000004C8-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{000008B2-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\yhjfuown.dll BHO-{00000990-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00000BC6-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{00001320-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{0000178C-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{00002641-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00002F18-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{00004591-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\yhjfuown.dll BHO-{00004C82-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00005E30-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{00009905-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{0000A168-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll BHO-{0001320A-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00022C89-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\yhjfuown.dll BHO-{00026415-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{0002F187-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{0004C82A-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00050B47-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll BHO-{0005E30E-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll BHO-{000A168F-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll BHO-{001320A8-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll BHO-{00142D1E-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll BHO-{0022C894-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\gfeeuvsm.dll BHO-{00264151-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll BHO-{002F1877-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\gfeeuvsm.dll BHO-{004C82A3-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll BHO-{008B2251-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\gfeeuvsm.dll BHO-{00990546-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll BHO-{011644A3-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\gfeeuvsm.dll BHO-{01320A8D-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll BHO-{0178C3B8-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\gfeeuvsm.dll BHO-{0700EB00-F49C-47DA-8777-A6D37FD101A7} - c:\windows\system32\khfDvwts.dll BHO-{20B96CEC-E9C7-4D32-8F03-39C59581AA17} - c:\windows\system32\yayvWoMf.dll BHO-{3FA7DE87-271F-4E53-A27D-334D58D61000} - c:\windows\system32\tuvVmnLf.dll BHO-{4B3408FA-9FD6-4EE4-93A9-29E0F771EF54} - c:\windows\system32\qoMdETKc.dll BHO-{54975995-6e64-4fce-b072-7841982308de} - c:\windows\system32\opnkhEWP.dll BHO-{8FCFAE2D-18BF-4AE9-8C1A-835CA4EC858A} - c:\windows\system32\khfDWPIx.dll BHO-{ae534fc2-54b2-4f1a-969a-9aed32ecc7e3} - c:\windows\system32\fbygow.dll BHO-{EEBDAC78-6721-4347-95AE-100C0756C4F3} - c:\windows\system32\awtRIbyv.dll BHO-{FDED8846-95B0-4005-9E39-9F1720B6815E} - c:\windows\system32\rqRKCttu.dll ShellExecuteHooks-{FDED8846-95B0-4005-9E39-9F1720B6815E} - c:\windows\system32\rqRKCttu.dll SSODL-sCzDrx-{9420C3A1-3E8A-690B-4DBD-BC1293A664A2} - c:\windows\system32\ap.dll Notify-rqRKCttu - rqRKCttu.dll MSConfigStartUp-QuickTime Task - c:\windows\system32\qttask.exe MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Ewelina\Dane aplikacji\Mozilla\Firefox\Profiles\icsp1s7t.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin2.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin3.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin4.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin5.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin6.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin7.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-04 10:31:46 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2] "ImagePath"="\SystemRoot\System32\drivers\6ce7d2e2.sys" -- [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1] "ImagePath"="\SystemRoot\System32\drivers\f9f2f2b1.sys" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe . ************************************************************************** . Czas ukończenia: 2008-12-04 10:34:14 - komputer został uruchomiony ponownie [Ewelina] ComboFix-quarantined-files.txt 2008-12-04 09:34:11 Przed: 4,211,531,776 bajtów wolnych Po: 8,368,304,128 bajtów wolnych 621 --- E O F --- 2008-10-08 09:38:45

Sorry nie wiedzialam jak wkleić :roll:

proszę o pomoc

**Posty:** 18165 · przez **wojtas** 04 Gru 2008, 17:08

c:\windows\system32\user32.dll ... jest zarażony !!

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 13 · przez **NIKI4355** 04 Gru 2008, 17:35

SDFix: Version 1.240
Run by Ewelina on 08-12-04 at 16:23

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
f9f2f2b1

Path :

f9f2f2b1 - Deleted

Infected user32.dll Found!

user32.dll File Locations:

"C:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll" 578560 05-03-02 19:21
"C:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll" 579584 07-03-08 16:51
"C:\windows\$NtUninstallKB890859$\user32.dll" 578560 04-08-03 23:44
"C:\windows\$NtUninstallKB925902$\user32.dll" 578560 05-03-02 19:18
"C:\windows\system32\user32.DLL" 579072 08-11-20 16:35
"C:\windows\system32\dllcache\user32.dll" 579072 08-11-20 16:35

[C:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll] 6A93565BE9B8422EB7538C66AC732D76
[C:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll] 11ABDECC02EFC1D2B6A6A0FA46C26594
[C:\windows\$NtUninstallKB890859$\user32.dll] 0C81764F50F32D376E6E4B9E9F4B01A0
[C:\windows\$NtUninstallKB925902$\user32.dll] B7EEB1A1AF740306049241DDF61F21FF
[C:\windows\system32\user32.DLL] 9E53CAA5A0A90105ED98E3D476273505
[C:\windows\system32\dllcache\user32.dll] 9E53CAA5A0A90105ED98E3D476273505

[C:\windows\System32\ibqcs] A37A4637F84F8DD771274EAF8D17FA65
[C:\windows\System32\okxnhtaq] 9E53CAA5A0A90105ED98E3D476273505

Note: SDFix does not repair this file!

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Dodano Dzisiaj, 16:37:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:37:09, on 08-12-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\windows\Explorer.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\BitComet\BitComet.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Opera\opera.exe
C:\windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file)
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\MpcStar\Codecs\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: pobierz wszystkie video za pomocą bitcomet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: pobierz wszystko za pomocą bitcomet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: pobierz za pomocą bitcomet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet - {d18a0b52-d63c-4ed0-afc6-c1e3dc1af43a} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{516B060E-FEC8-4FC3-91CF-D8F34D0B0B03}: NameServer = 80.85.224.2,80.85.224.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Zarządzanie aplikacjami (AppMgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Przeglądarka komputera (Browser) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Usługi kryptograficzne (CryptSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Program uruchamiający proces serwera DCOM (DcomLaunch) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Klient DHCP (Dhcp) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Menedżer dysków logicznych (dmserver) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Klient DNS (Dnscache) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Automatyczna konfiguracja sieci przewodowej (Dot3svc) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Usługa protokołu uwierzytelniania rozszerzonego (EAP) (EapHost) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: System zdarzeń COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)
O23 - Service: Zgodność szybkiego przełączania użytkowników (FastUserSwitchingCompatibility) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pomoc i obsługa techniczna (helpsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Usługa zarządzania kluczami i certyfikatami kondycji (hkmsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Serwer (LanmanServer) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Stacja robocza (lanmanworkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Pomoc TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Agent ochrony dostępu do sieci (napagent) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Połączenia sieciowe (Netman) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Rozpoznawanie lokalizacji w sieci (NLA) (Nla) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Magazyn wymienny (NtmsSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Usługa klienta dla systemu NetWare (NWCWorkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Menedżer autopołączenia dostępu zdalnego (RasAuto) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Menedżer połączeń usługi Dostęp zdalny (RasMan) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Rejestr zdalny (RemoteRegistry) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Zdalne wywoływanie procedur (RPC) (RpcSs) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Logowanie pomocnicze (seclogon) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Zawiadomienie o zdarzeniu systemowym (SENS) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Zapora systemu Windows/Udostępnianie połączenia internetowego (SharedAccess) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Wykrywanie sprzętu powłoki (ShellHWDetection) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Usługa przywracania systemu (srservice) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Usługa odnajdywania SSDP (SSDPSRV) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Telefonia (TapiSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Usługi terminalowe (TermService) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Kompozycje (Themes) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Klient śledzenia łączy rozproszonych (TrkWks) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Host uniwersalnego urządzenia Plug and Play (upnphost) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Usługa Czas systemu Windows (W32Time) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: WebClient - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Instrumentacja zarządzania Windows (winmgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Usługa numeru seryjnego multimediów przenośnych (WmdmPmSN) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Rozszerzenia sterownika Instrumentacji zarządzania Windows (Wmi) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Centrum zabezpieczeń (wscsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing)
O23 - Service: Konfiguracja zerowej sieci bezprzewodowej (WZCSVC) - Unknown owner - C:\windows\System32\svchost.exe (file missing)
O23 - Service: Usługa dostarczania sieci (xmlprov) - Unknown owner - C:\windows\System32\svchost.exe (file missing)

--
End of file - 13829 bytes

Dodano Dzisiaj, 16:38:

ComboFix 08-12-02.02 - Ewelina 2008-12-04 10:20:20.3 - NTFSx86
Uruchomiony z: c:\documents and settings\Ewelina\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\bdxttj.dll
c:\windows\system32\bexxajwk.ini
c:\windows\system32\cKTEdMoq.ini
c:\windows\system32\cKTEdMoq.ini2
c:\windows\system32\cnhxsk.dll
c:\windows\system32\cybtslsv.ini
c:\windows\system32\dkirmevd.ini
c:\windows\system32\dpaukboo.dll
c:\windows\system32\dzimui.dll
c:\windows\system32\egneonnl.ini
c:\windows\system32\eisljhra.ini
c:\windows\system32\eivirugk.ini
c:\windows\system32\fbygow.dll
c:\windows\system32\fgankwdv.ini
c:\windows\system32\fLnmVvut.ini
c:\windows\system32\fLnmVvut.ini2
c:\windows\system32\fMoWvyay.ini
c:\windows\system32\fMoWvyay.ini2
c:\windows\system32\fqytaikq.ini
c:\windows\system32\frqyukmf.ini
c:\windows\system32\gclwvykx.ini
c:\windows\system32\gjmuoegn.ini
c:\windows\system32\gyjtflmw.ini
c:\windows\system32\hharmopj.ini
c:\windows\system32\hikqdtxb.ini
c:\windows\system32\hsmmfewy.ini
c:\windows\system32\icpabbby.ini
c:\windows\system32\igaetjgq.ini
c:\windows\system32\iigdtyjy.ini
c:\windows\system32\iiswiu.dll
c:\windows\system32\ilslxwws.dll
c:\windows\system32\imundstn.dll
c:\windows\system32\ipumfyaf.ini
c:\windows\system32\itxtxhfh.ini
c:\windows\system32\jauuoduv.ini
c:\windows\system32\jhqnrraf.dll
c:\windows\system32\jowtnujx.ini
c:\windows\system32\jrdxfywo.dll
c:\windows\system32\jsjspi.dll
c:\windows\system32\jsuwpstb.ini
c:\windows\system32\kgratx.dll
c:\windows\system32\lkfqwshi.ini
c:\windows\system32\lkvgwppo.ini
c:\windows\system32\llwonw.dll
c:\windows\system32\lqtzxe.dll
c:\windows\system32\luqghjbv.ini
c:\windows\system32\mijxooml.ini
c:\windows\system32\mitlpopt.ini
c:\windows\system32\mlulnhhb.ini
c:\windows\system32\mmljtswd.ini
c:\windows\system32\mrkxkmnj.dll
c:\windows\system32\mwjsjlho.ini
c:\windows\system32\mxborvtv.ini
c:\windows\system32\nmknbt.dll
c:\windows\system32\nnimgwqd.ini
c:\windows\system32\nqujdcay.ini
c:\windows\system32\nxxbvl.dll
c:\windows\system32\ocafhnhp.dll
c:\windows\system32\oijrymbr.ini
c:\windows\system32\ojckxifk.ini
c:\windows\system32\oklqsius.ini
c:\windows\system32\oobkuapd.ini
c:\windows\system32\oqojylqo.ini
c:\windows\system32\owegclgr.ini
c:\windows\system32\oxeckkke.ini
c:\windows\system32\pofvsnbt.ini
c:\windows\system32\PWEhknpo.ini
c:\windows\system32\PWEhknpo.ini2
c:\windows\system32\qbitdpkw.dll
c:\windows\system32\qdalrgev.dll
c:\windows\system32\qkycbapi.ini
c:\windows\system32\qsgdmyjw.ini
c:\windows\system32\rcdxyltt.dll
c:\windows\system32\rgrfvllq.ini
c:\windows\system32\rrctbr.dll
c:\windows\system32\sfhzwo.dll
c:\windows\system32\stwvDfhk.ini
c:\windows\system32\stwvDfhk.ini2
c:\windows\system32\suisqlko.dll
c:\windows\system32\swwxlsli.ini
c:\windows\system32\tktfjaaj.ini
c:\windows\system32\trsxdjrt.ini
c:\windows\system32\ttiymkgv.ini
c:\windows\system32\ufoweyky.ini
c:\windows\system32\utlgkocr.dll
c:\windows\system32\vifkxlhy.ini
c:\windows\system32\vodicyxm.ini
c:\windows\system32\vshvtqcw.ini
c:\windows\system32\vybIRtwa.ini
c:\windows\system32\vybIRtwa.ini2
c:\windows\system32\wbubhlub.ini
c:\windows\system32\winiuejn.ini
c:\windows\system32\wnnssbpx.ini
c:\windows\system32\wtwpeavv.dll
c:\windows\system32\wyrclven.ini
c:\windows\system32\xcrsmdsu.dll
c:\windows\system32\xemwatll.ini
c:\windows\system32\xfhhupuc.ini
c:\windows\system32\xIPWDfhk.ini
c:\windows\system32\xIPWDfhk.ini2
c:\windows\system32\xiqyxjas.dll
c:\windows\system32\xjparrva.dll
c:\windows\system32\xkpexspq.ini
c:\windows\system32\xmlqxikx.ini
c:\windows\system32\yacdjuqn.dll
c:\windows\system32\yohcocdo.ini
c:\windows\system32\yqlloosr.dll
c:\windows\system32\yvprbx.dll
.
---- Previous Run -------
.
c:\documents and settings\Luque\Dane aplikacji\Adobe\Player.exe.bak
c:\documents and settings\Piter\Menu Start\Programy\Autostart\userinit.exe
c:\documents and settings\Piter\svchost.exe
C:\u.exe
c:\windows\system32\~.exe
c:\windows\system32\drivers\services.exe
c:\windows\system32\kr_done1
c:\windows\system32\mcrh.tmp

----- BITS: Możliwe zainfekowane strony -----

hxxp://78.157.143.198
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VFILT

((((((((((((((((((((((((( Pliki utworzone od 2008-11-04 do 2008-12-04 )))))))))))))))))))))))))))))))
.

2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\program files\Avira
2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Avira
2008-12-02 12:10 . 2008-12-02 12:10 <DIR> d-------- c:\documents and settings\Ewelina\Dane aplikacji\BearShare
2008-12-01 09:20 . 2008-12-01 09:20 106,496 --a------ c:\windows\system32\ppmdvkmn.dll
2008-11-30 11:02 . 2008-11-30 11:02 <DIR> d--hs---- c:\windows\ftpcache
2008-11-29 20:04 . 2008-11-29 20:04 70,656 --a------ c:\windows\system32\qpsxepkx.dll
2008-11-29 08:19 . 2008-11-20 16:35 579,072 --a------ c:\windows\system32\okxnhtaq
2008-11-26 14:17 . 2008-11-26 14:17 <DIR> d-------- c:\program files\Common Files\Futuremark Shared
2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\documents and settings\Luque\SystemRequirementsLab
2008-11-24 06:39 . 2008-11-24 06:39 <DIR> d-------- c:\windows\system32\Futuremark
2008-11-24 06:39 . 2008-05-29 12:33 27,672 -ra------ c:\windows\system32\drivers\Entech.sys
2008-11-24 06:39 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys
2008-11-24 06:38 . 2008-11-24 06:38 <DIR> d-------- c:\program files\Futuremark
2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\program files\Auslogics
2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\Auslogics
2008-11-22 10:34 . 2008-11-22 10:34 104,448 --a------ c:\windows\system32\pyfdax.dll
2008-11-21 08:17 . 2008-11-21 08:17 103,936 --a------ c:\windows\system32\sfjhxf.dll
2008-11-20 18:55 . 2008-11-20 18:55 104,448 --a------ c:\windows\system32\soitxl.dll
2008-11-20 18:55 . 2008-11-20 18:55 104,448 --a------ c:\windows\system32\qakihuha.dll
2008-11-20 16:35 . 2008-11-20 16:35 180,224 --a------ c:\windows\system32\nvaux32.VIR
2008-11-20 16:35 . 2008-11-29 08:18 137,728 --a------ c:\windows\system32\aston.mt
2008-11-20 16:35 . 2008-11-29 10:10 63,488 --a------ c:\windows\system32\rigv.xl
2008-11-20 16:35 . 2008-11-29 10:10 32,768 --a------ c:\windows\system32\fxe.sp
2008-11-20 16:35 . 2008-11-29 10:10 32,768 --a------ c:\windows\system32\fjes.ra
2008-11-18 11:07 . 2008-11-18 11:07 104,448 --a------ c:\windows\system32\qrtdqs.dll
2008-11-16 11:31 . 2008-11-16 11:31 <DIR> d-------- c:\program files\Apple Software Update
2008-11-16 09:11 . 2008-12-04 08:50 86,354 --a------ c:\windows\system32\drivers\6ce7d2e2.sys
2008-11-15 12:49 . 2008-11-15 12:49 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\TigerPlayer
2008-11-10 16:28 . 2008-11-10 16:28 104,448 --a------ c:\windows\system32\umrrboyi.dll
2008-11-09 17:32 . 2008-11-09 17:32 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\ipla
2008-11-09 11:46 . 2008-11-29 17:50 4,876 --a------ c:\windows\system32\d3d9caps.dat
2008-11-08 12:45 . 2008-11-10 16:01 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\BearShare
2008-11-05 20:48 . 2008-11-05 20:48 102,912 --a------ c:\windows\system32\zppegk.dll
2008-11-04 16:59 . 2008-11-04 16:59 68,096 --a------ c:\windows\system32\qgjteagi.dll
2008-11-04 08:48 . 2008-12-04 08:50 100,702 --a------ c:\windows\system32\drivers\f9f2f2b1.sys

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 09:32 --------- d-----w c:\program files\DNA
2008-12-04 09:32 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DNA
2008-12-04 09:24 --------- d-----w c:\program files\BitComet
2008-12-04 07:19 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\uTorrent
2008-12-03 16:26 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Hamachi
2008-12-03 16:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Hamachi
2008-12-02 06:55 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\ipla
2008-11-30 15:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Skype
2008-11-30 15:07 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\skypePM
2008-11-28 21:43 --------- d-----w c:\program files\Common Files\Adobe
2008-11-26 13:17 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-25 19:22 --------- d-----w c:\program files\NAPI-PROJEKT
2008-11-24 18:40 --------- d-----w c:\program files\Gadu-Gadu
2008-11-20 15:35 579,072 ----a-w c:\windows\system32\user32.DLL
2008-11-17 15:45 --------- d-----w c:\program files\Nowe Gadu-Gadu
2008-11-11 14:53 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Sports Interactive
2008-11-10 15:52 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Sports Interactive
2008-11-10 13:47 --------- d-----w c:\program files\Winamp
2008-11-08 14:13 --------- d-----w c:\program files\Google
2008-11-03 15:10 --------- d-----w c:\program files\Prawo Jazdy 2006
2008-11-02 19:12 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Sports Interactive
2008-11-02 19:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive
2008-11-02 19:03 --------- d-----w c:\program files\Sports Interactive
2008-11-02 11:21 --------- d-----w c:\program files\Opera
2008-11-02 10:18 --------- d-----w c:\program files\Live_TV
2008-11-01 07:25 244,224 ----a-w c:\windows\system32\opnkhEWP.VIR
2008-10-31 17:35 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\BearShare
2008-10-29 21:13 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Skype
2008-10-29 20:05 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\skypePM
2008-10-28 21:44 1,982 ----a-w c:\windows\system32\ealregsnapshot1.reg
2008-10-28 21:44 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Leadertech
2008-10-27 18:59 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Canon
2008-10-27 05:20 101,888 ----a-w c:\windows\system32\qltvijod.dll
2008-10-23 16:49 69,632 ----a-w c:\windows\system32\wjymdgsq.dll
2008-10-23 16:46 101,376 ----a-w c:\windows\system32\zlhfnw.dll
2008-10-22 17:07 --------- d-----w c:\program files\AbiSuite2
2008-10-22 08:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-10-21 10:36 --------- d-----w c:\program files\F-Secure Internet Security
2008-10-21 10:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\f-secure
2008-10-21 10:21 101,888 ----a-w c:\windows\system32\pdvnqlky.dll
2008-10-21 09:35 101,888 ----a-w c:\windows\system32\yqauffme.dll
2008-10-21 09:35 101,888 ----a-w c:\windows\system32\vwbtxu.dll
2008-10-20 17:42 --------- d-----w c:\program files\Hamachi
2008-10-20 17:41 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2008-10-19 18:32 --------- d-----w c:\program files\Conduit
2008-10-16 17:53 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Nowe Gadu-Gadu
2008-10-16 09:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Skype
2008-10-16 08:27 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\skypePM
2008-10-16 08:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Nowe Gadu-Gadu
2008-10-15 15:13 68,096 ----a-w c:\windows\system32\qllvfrgr.dll
2008-10-15 12:09 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Leadertech
2008-10-15 11:22 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DAEMON Tools
2008-10-15 07:31 --------- d-----w c:\program files\Chemix
2008-10-15 06:26 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\DAEMON Tools
2008-10-14 20:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\F-Secure
2008-10-14 19:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Ahead
2008-10-14 19:34 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2008-10-14 19:33 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Leadertech
2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Toolbar
2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-14 19:10 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\DAEMON Tools
2008-10-14 19:05 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-14 19:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\DAEMON Tools
2008-10-12 11:42 --------- d-----w c:\program files\Common Files\NSV
2008-10-11 17:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Trymedia
2008-10-09 15:47 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\F-Secure
2008-10-09 12:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\F-Secure
2008-10-09 12:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\fssg
2008-10-09 12:06 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\TigerPlayer
2008-10-06 16:23 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ipla
2008-10-05 16:47 --------- d-----w c:\program files\ipla
2008-10-05 15:09 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-10-05 15:09 --------- d-----w c:\program files\GameTop.com
2008-10-05 15:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\PC Tools
2008-10-05 13:59 --------- d-----w c:\program files\Common Files\PC Tools
2008-10-04 16:03 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Canon
2008-09-30 13:20 4,608 ----a-w c:\windows\system32\w95inf32.dll
2008-09-30 13:20 2,272 ----a-w c:\windows\system32\w95inf16.dll
.
c:\windows\system32\user32.dll ... jest zarażony !!
578,560 2005-03-02 18:21:08 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
579,584 2007-03-08 15:51:57 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
578,560 2004-08-03 22:44:14 c:\windows\$NtUninstallKB890859$\user32.dll
578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll
578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll.000
579,072 2008-11-20 15:35:35 c:\windows\system32\user32.DLL
579,072 2008-11-20 15:35:35 c:\windows\system32\dllcache\user32.dll

------- Sigcheck -------

2005-03-02 19:21 578560 6a93565be9b8422eb7538c66ac732d76 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 16:51 579584 11abdecc02efc1d2b6a6a0fa46c26594 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
2004-08-03 23:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 c:\windows\$NtUninstallKB890859$\user32.dll
2005-03-02 19:18 578560 b7eeb1a1af740306049241ddf61f21ff c:\windows\$NtUninstallKB925902$\user32.dll
2008-11-20 16:35 579072 9e53caa5a0a90105ed98e3d476273505 c:\windows\system32\user32.DLL
2008-11-20 16:35 579072 9e53caa5a0a90105ed98e3d476273505 c:\windows\system32\dllcache\user32.dll

2004-08-03 23:44 82944 ab82237486b727dd7dab36a76f38a3a2 c:\windows\system32\ws2_32.dll
2004-08-03 23:44 82944 ab82237486b727dd7dab36a76f38a3a2 c:\windows\system32\dllcache\ws2_32.dll

2008-06-23 17:16 669696 bc26f2968396842367b02730435dd588 c:\windows\$hf_mig$\KB953838\SP2QFE\wininet.dll
2008-06-23 16:13 668672 28fa0fd33916ebebc3e0dc1410f48651 c:\windows\$hf_mig$\KB953838\SP3GDR\wininet.dll
2008-06-23 15:57 669184 9ea369835e233f077c0d832676a29d40 c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll
2004-08-03 23:44 658944 d37dafb534ac8343d59a1b501abe852c c:\windows\$NtUninstallKB953838$\wininet.dll
2008-06-23 16:41 662016 32dc67b19496a88850c892cadf8366e3 c:\windows\ie8\wininet.dll
2008-03-03 19:01 830464 102afb4826c69fe386955e2e77f28040 c:\windows\system32\wininet.dll
2008-03-03 19:01 830464 102afb4826c69fe386955e2e77f28040 c:\windows\system32\dllcache\wininet.dll

2008-06-20 11:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-06-20 11:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\system32\dllcache\tcpip.sys
2008-06-20 11:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\system32\drivers\tcpip.sys

2004-08-03 23:44 505856 25da11068eb165da00d3ed7eb3c1512e c:\windows\system32\winlogon.exe

2004-08-03 22:14 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys
2004-08-03 22:14 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys

2004-08-03 22:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\dllcache\ip6fw.sys
2004-08-03 22:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys

2005-03-02 19:14 2058240 35d11fdc381536ab95e3005489131f44 c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 17:09 2060672 2f4a36b1b03d64fb176cb0f3eb597118 c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2004-08-03 23:54 2058112 44d1bc1b05e0c7c82e81687b79c653c7 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-02 19:08 2058112 0f6990820c6ce0a7a911fae5937ef1f6 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
2007-02-28 17:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d c:\windows\Driver Cache\i386\ntkrnlpa.exe
2008-08-14 14:46 2059008 740d5209ce5ec76bb99923a710cd0a53 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2GDR\ntkrnlpa.exe
2008-08-14 14:40 2064256 bd1c2093733023e5afc1520c095c2195 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2QFE\ntkrnlpa.exe
2008-08-14 14:26 2067328 5ab2f07ad3fd76790294ddccc6e06d46 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3GDR\ntkrnlpa.exe
2008-08-14 18:27 2067328 638346856e53887b0c3da62a9ab2c203 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3QFE\ntkrnlpa.exe
2007-02-28 17:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d c:\windows\system32\ntkrnlpa.exe
2007-02-28 17:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d c:\windows\system32\dllcache\ntkrnlpa.exe

2005-03-02 19:14 2180864 dba3e4215279c8012b37d2135b531258 c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 17:09 2183424 c450518ef9acc02a2d799698021e31a8 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2004-08-03 23:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-02 19:09 2180608 3f3612846d67352468d2286fc23fb0c2 c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
2007-02-28 17:04 2181632 c378be3a1edc5e4421d428655ac4a48c c:\windows\Driver Cache\i386\ntoskrnl.exe
2008-08-14 14:46 2181632 1e808411607a060ad7c582b7556c9afa c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2GDR\ntoskrnl.exe
2008-08-14 14:40 2187264 8eac2f887f5e093186a6b2e548f719ba c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2QFE\ntoskrnl.exe
2008-08-14 14:26 2190464 9ce159c91e076ff6c25d055310ebb259 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3GDR\ntoskrnl.exe
2008-08-14 18:27 2190464 dcdd970025463dfc9676ebe18abd6a86 c:\windows\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3QFE\ntoskrnl.exe
2007-02-28 17:04 2181632 c378be3a1edc5e4421d428655ac4a48c c:\windows\system32\ntoskrnl.exe
2007-02-28 17:04 2181632 c378be3a1edc5e4421d428655ac4a48c c:\windows\system32\dllcache\ntoskrnl.exe

2007-06-13 14:23 1036800 421f5b217986acdd7016b6deb039a7b8 c:\windows\explorer.exe
2007-06-13 14:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-03 23:44 1033728 379098a96e6c165b659de7e4328010ea c:\windows\$NtUninstallKB938828$\explorer.exe

2004-08-03 23:44 110080 ba79ea13e862177aa55843006e7f39cb c:\windows\system32\services.exe

2004-08-03 23:44 14336 786c044e17041dbc105656202708c14d c:\windows\system32\lsass.exe

2004-08-03 23:44 15360 cbfa30492d70ce3938d8a7783d0c0436 c:\windows\system32\ctfmon.exe
2004-08-03 23:44 15360 cbfa30492d70ce3938d8a7783d0c0436 c:\windows\system32\dllcache\ctfmon.exe

2005-06-11 01:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-03 23:44 57856 bebe8a85954ff460374fd5a0cd21e19b c:\windows\$NtUninstallKB896423$\spoolsv.exe
2005-06-11 00:53 58368 3513a57ec257df60f641d20031acb383 c:\windows\system32\spoolsv.exe

2004-08-03 23:44 25088 bd768099b4c44aa631728cb74eb54396 c:\windows\system32\userinit.exe
2004-08-03 23:44 25088 bd768099b4c44aa631728cb74eb54396 c:\windows\system32\dllcache\userinit.exe

2004-08-03 23:44 296448 2c28157229925280916b3041ccc5fe4b c:\windows\system32\termsrv.dll
2004-08-03 23:44 296448 2c28157229925280916b3041ccc5fe4b c:\windows\system32\dllcache\termsrv.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"="c:\program files\BitComet\BitComet.exe" [2008-12-03 2514744]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336]
"ares"="c:\program files\Ares\Ares.exe" [2008-11-23 880640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-01 185896]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=bylmnk.dll joqjpf.dll fbygow.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll
"vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"wave2"= alcxnt.dll
"aux1"= alcxnt.dll
"mixer1"= alcxnt.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproRemote.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproRemote.lnk
backup=c:\windows\pss\ComproRemote.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproScheduler.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproScheduler.lnk
backup=c:\windows\pss\ComproScheduler.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproSchedulerDTV.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproSchedulerDTV.lnk
backup=c:\windows\pss\ComproSchedulerDTV.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TweakYC.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TweakYC.lnk
backup=c:\windows\pss\TweakYC.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
-ra------ 2005-11-28 06:52 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
-ra------ 2005-11-28 06:55 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
-ra------ 2005-11-28 06:55 98304 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2007-01-08 21:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 13:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu]
--a------ 2008-10-10 10:50 6500960 c:\program files\Nowe Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2007-03-14 20:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-09-29 16:57 21755688 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-09-01 16:42 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 17:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2008-05-07 14:39 16862208 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\EA Sports\\FIFA 08\\FIFA08.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\FIFA09.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2009 Demo\\fm.exe"=
"c:\\Documents and Settings\\Piter\\Pulpit\\Skype.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Ares Destiny\\AresDestiny.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12475:TCP"= 12475:TCP:BitComet 12475 TCP
"12475:UDP"= 12475:UDP:BitComet 12475 UDP
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"20950:TCP"= 20950:TCP:TORRENT
"49438:TCP"= 49438:TCP:torrent
"9433:TCP"= 9433:TCP:BitComet 9433 TCP
"9433:UDP"= 9433:UDP:BitComet 9433 UDP
.
Zawartość folderu 'Zaplanowane zadania'

2008-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

BHO-{00000000-0000-0000-0281-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-0542-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-09f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-10ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-13f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-1581-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-26f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-2a42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-2b81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-4cf0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0000-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0001-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0002-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0002-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0002-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0004-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0009-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0009-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0013-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0013-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0026-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0027-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-004d-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-004f-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-009a-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-009d-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-0134-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-013a-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-026b-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-04d2-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-04d7-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-09a5-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-09d5-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-134a-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-13ab-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-2694-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-27d7-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0000-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0001-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0002-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0003-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0004-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0006-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0009-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0010-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0012-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0021-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0024-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0033-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0048-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0075-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0091-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-00ce-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-00eb-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0123-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0211-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-03ae-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0422-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-048f-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-075c-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-091f-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000000-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000001-1089-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000002-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000002-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000005-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000009-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{0000000a-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{0000000b-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000013-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000014-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{00000026-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000045-1089-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{0000004c-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{0000005e-33b2-4ead-98f0-b762347e6457} - c:\windows\system32\yhjfuown.dll
BHO-{0000008b-1089-4fae-82ab-0531323e7f06} - c:\windows\system32\yhjfuown.dll
BHO-{00000099-48f8-4d29-ac81-0cb39c4bca6e} - c:\windows\system32\yhjfuown.dll
BHO-{000000a1-0eb9-4d72-aa42-567e79f147ef} - c:\windows\system32\yhjfuown.dll
BHO-{000000BC-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000132-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000178-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{00000264-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000285-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll
BHO-{000004C8-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{000008B2-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\yhjfuown.dll
BHO-{00000990-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00000BC6-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{00001320-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{0000178C-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{00002641-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00002F18-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{00004591-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\yhjfuown.dll
BHO-{00004C82-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00005E30-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{00009905-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{0000A168-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll
BHO-{0001320A-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00022C89-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\yhjfuown.dll
BHO-{00026415-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{0002F187-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{0004C82A-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00050B47-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll
BHO-{0005E30E-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\yhjfuown.dll
BHO-{000A168F-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll
BHO-{001320A8-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\yhjfuown.dll
BHO-{00142D1E-0EB9-4D72-AA42-567E79F147Ef} - c:\windows\system32\yhjfuown.dll
BHO-{0022C894-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\gfeeuvsm.dll
BHO-{00264151-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll
BHO-{002F1877-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\gfeeuvsm.dll
BHO-{004C82A3-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll
BHO-{008B2251-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\gfeeuvsm.dll
BHO-{00990546-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll
BHO-{011644A3-1089-4FAE-82AB-0531323E7F06} - c:\windows\system32\gfeeuvsm.dll
BHO-{01320A8D-48F8-4D29-AC81-0CB39C4BCA6e} - c:\windows\system32\gfeeuvsm.dll
BHO-{0178C3B8-33B2-4EAD-98F0-B762347E6457} - c:\windows\system32\gfeeuvsm.dll
BHO-{0700EB00-F49C-47DA-8777-A6D37FD101A7} - c:\windows\system32\khfDvwts.dll
BHO-{20B96CEC-E9C7-4D32-8F03-39C59581AA17} - c:\windows\system32\yayvWoMf.dll
BHO-{3FA7DE87-271F-4E53-A27D-334D58D61000} - c:\windows\system32\tuvVmnLf.dll
BHO-{4B3408FA-9FD6-4EE4-93A9-29E0F771EF54} - c:\windows\system32\qoMdETKc.dll
BHO-{54975995-6e64-4fce-b072-7841982308de} - c:\windows\system32\opnkhEWP.dll
BHO-{8FCFAE2D-18BF-4AE9-8C1A-835CA4EC858A} - c:\windows\system32\khfDWPIx.dll
BHO-{ae534fc2-54b2-4f1a-969a-9aed32ecc7e3} - c:\windows\system32\fbygow.dll
BHO-{EEBDAC78-6721-4347-95AE-100C0756C4F3} - c:\windows\system32\awtRIbyv.dll
BHO-{FDED8846-95B0-4005-9E39-9F1720B6815E} - c:\windows\system32\rqRKCttu.dll
ShellExecuteHooks-{FDED8846-95B0-4005-9E39-9F1720B6815E} - c:\windows\system32\rqRKCttu.dll
SSODL-sCzDrx-{9420C3A1-3E8A-690B-4DBD-BC1293A664A2} - c:\windows\system32\ap.dll
Notify-rqRKCttu - rqRKCttu.dll
MSConfigStartUp-QuickTime Task - c:\windows\system32\qttask.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Ewelina\Dane aplikacji\Mozilla\Firefox\Profiles\icsp1s7t.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin2.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin3.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin4.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin5.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin6.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin7.dll
FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin8.dll
FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll
FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 10:31:46
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2]
"ImagePath"="\SystemRoot\System32\drivers\6ce7d2e2.sys"
--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1]
"ImagePath"="\SystemRoot\System32\drivers\f9f2f2b1.sys"
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
.
**************************************************************************
.
Czas ukończenia: 2008-12-04 10:34:14 - komputer został uruchomiony ponownie [Ewelina]
ComboFix-quarantined-files.txt 2008-12-04 09:34:11

Przed: 4,211,531,776 bajtów wolnych
Po: 8,368,304,128 bajtów wolnych

621 --- E O F --- 2008-10-08 09:38:45
Kod: Zaznacz wszystko
[code][quote][/quote][/code]

Dodano Dzisiaj, 16:39:
Nie wiem czy o to chodziło, jestem zielona jesli chodzi o te sprawy

**Posty:** 18165 · przez **wojtas** 04 Gru 2008, 17:49

tak tylko daj wszystkie logi w tagi code i nowy log z combofixa...

**Posty:** 13 · przez **NIKI4355** 04 Gru 2008, 17:59

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Ewelina on 08-12-04 at 16:23 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: f9f2f2b1 [b]Path [/b]: f9f2f2b1 - Deleted [b]Infected user32.dll Found![/b] user32.dll File Locations: "C:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll" 578560 05-03-02 19:21 "C:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll" 579584 07-03-08 16:51 "C:\windows\$NtUninstallKB890859$\user32.dll" 578560 04-08-03 23:44 "C:\windows\$NtUninstallKB925902$\user32.dll" 578560 05-03-02 19:18 "C:\windows\system32\user32.DLL" 579072 08-11-20 16:35 "C:\windows\system32\dllcache\user32.dll" 579072 08-11-20 16:35 [C:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll] 6A93565BE9B8422EB7538C66AC732D76 [C:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll] 11ABDECC02EFC1D2B6A6A0FA46C26594 [C:\windows\$NtUninstallKB890859$\user32.dll] 0C81764F50F32D376E6E4B9E9F4B01A0 [C:\windows\$NtUninstallKB925902$\user32.dll] B7EEB1A1AF740306049241DDF61F21FF [C:\windows\system32\user32.DLL] 9E53CAA5A0A90105ED98E3D476273505 [C:\windows\system32\dllcache\user32.dll] 9E53CAA5A0A90105ED98E3D476273505 [C:\windows\System32\ibqcs] A37A4637F84F8DD771274EAF8D17FA65 [C:\windows\System32\okxnhtaq] 9E53CAA5A0A90105ED98E3D476273505 Note: SDFix does not repair this file! Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [code][*][/code]

Dodano Dzisiaj, 17:01:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:00:41, on 08-12-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\windows\Explorer.EXE C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\BitComet\BitComet.exe C:\windows\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Opera\opera.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\windows\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file) O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file) O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\MpcStar\Codecs\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O8 - Extra context menu item: pobierz wszystkie video za pomocą bitcomet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: pobierz wszystko za pomocą bitcomet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: pobierz za pomocą bitcomet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: BitComet - {d18a0b52-d63c-4ed0-afc6-c1e3dc1af43a} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{516B060E-FEC8-4FC3-91CF-D8F34D0B0B03}: NameServer = 80.85.224.2,80.85.224.50 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Zarządzanie aplikacjami (AppMgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Przeglądarka komputera (Browser) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługi kryptograficzne (CryptSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Program uruchamiający proces serwera DCOM (DcomLaunch) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Klient DHCP (Dhcp) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer dysków logicznych (dmserver) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Klient DNS (Dnscache) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Automatyczna konfiguracja sieci przewodowej (Dot3svc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa protokołu uwierzytelniania rozszerzonego (EAP) (EapHost) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: System zdarzeń COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing) O23 - Service: Zgodność szybkiego przełączania użytkowników (FastUserSwitchingCompatibility) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Pomoc i obsługa techniczna (helpsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa zarządzania kluczami i certyfikatami kondycji (hkmsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Serwer (LanmanServer) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Stacja robocza (lanmanworkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Pomoc TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Agent ochrony dostępu do sieci (napagent) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Połączenia sieciowe (Netman) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Rozpoznawanie lokalizacji w sieci (NLA) (Nla) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Magazyn wymienny (NtmsSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa klienta dla systemu NetWare (NWCWorkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer autopołączenia dostępu zdalnego (RasAuto) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer połączeń usługi Dostęp zdalny (RasMan) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Rejestr zdalny (RemoteRegistry) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Zdalne wywoływanie procedur (RPC) (RpcSs) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Logowanie pomocnicze (seclogon) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Zawiadomienie o zdarzeniu systemowym (SENS) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Zapora systemu Windows/Udostępnianie połączenia internetowego (SharedAccess) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Wykrywanie sprzętu powłoki (ShellHWDetection) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa przywracania systemu (srservice) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa odnajdywania SSDP (SSDPSRV) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Telefonia (TapiSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługi terminalowe (TermService) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Kompozycje (Themes) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Klient śledzenia łączy rozproszonych (TrkWks) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Host uniwersalnego urządzenia Plug and Play (upnphost) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa Czas systemu Windows (W32Time) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: WebClient - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Instrumentacja zarządzania Windows (winmgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa numeru seryjnego multimediów przenośnych (WmdmPmSN) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Rozszerzenia sterownika Instrumentacji zarządzania Windows (Wmi) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Centrum zabezpieczeń (wscsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Konfiguracja zerowej sieci bezprzewodowej (WZCSVC) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa dostarczania sieci (xmlprov) - Unknown owner - C:\windows\System32\svchost.exe (file missing) -- End of file - 13869 bytes [code][*][/code]

Dodano Dzisiaj, 17:16:

Kod: Zaznacz wszystko: ComboFix 08-12-03.04 - Ewelina 2008-12-04 17:02:36.4 - NTFSx86 Uruchomiony z: c:\documents and settings\Ewelina\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-04 do 2008-12-04 ))))))))))))))))))))))))))))))) . 2008-12-04 16:36 . 2008-12-04 16:36 <DIR> d-------- c:\program files\Trend Micro 2008-12-04 11:40 . 2008-12-04 11:40 76,560 --a------ c:\documents and settings\Wojciech Potcatchme.zip 2008-12-04 11:37 . 2008-12-04 11:37 <DIR> d-------- c:\windows\ERUNT 2008-12-04 11:29 . 2008-12-04 16:30 <DIR> d-------- C:\SDFix 2008-12-04 10:49 . 2008-12-04 10:49 0 --a------ c:\windows\system32\oobkua 2008-12-04 10:49 . 2008-12-04 10:49 0 --a------ c:\windows\system32\oklqsi 2008-12-04 10:49 . 2008-12-04 10:49 0 --a------ c:\windows\system32\ojckxi 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\program files\Avira 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Avira 2008-12-02 12:10 . 2008-12-02 12:10 <DIR> d-------- c:\documents and settings\Ewelina\Dane aplikacji\BearShare 2008-12-01 09:20 . 2008-12-01 09:20 106,496 --a------ c:\windows\system32\ppmdvkmn.dll 2008-11-30 11:02 . 2008-11-30 11:02 <DIR> d--hs---- c:\windows\ftpcache 2008-11-29 20:04 . 2008-11-29 20:04 70,656 --a------ c:\windows\system32\qpsxepkx.dll 2008-11-29 08:19 . 2008-11-20 16:35 579,072 --a------ c:\windows\system32\okxnhtaq 2008-11-26 14:17 . 2008-11-26 14:17 <DIR> d-------- c:\program files\Common Files\Futuremark Shared 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\documents and settings\Luque\SystemRequirementsLab 2008-11-24 06:39 . 2008-11-24 06:39 <DIR> d-------- c:\windows\system32\Futuremark 2008-11-24 06:39 . 2008-05-29 12:33 27,672 -ra------ c:\windows\system32\drivers\Entech.sys 2008-11-24 06:39 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys 2008-11-24 06:38 . 2008-11-24 06:38 <DIR> d-------- c:\program files\Futuremark 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\program files\Auslogics 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\Auslogics 2008-11-22 10:34 . 2008-11-22 10:34 104,448 --a------ c:\windows\system32\pyfdax.dll 2008-11-21 08:17 . 2008-11-21 08:17 103,936 --a------ c:\windows\system32\sfjhxf.dll 2008-11-20 18:55 . 2008-11-20 18:55 104,448 --a------ c:\windows\system32\soitxl.dll 2008-11-20 18:55 . 2008-11-20 18:55 104,448 --a------ c:\windows\system32\qakihuha.dll 2008-11-20 16:35 . 2008-11-20 16:35 180,224 --a------ c:\windows\system32\nvaux32.VIR 2008-11-20 16:35 . 2008-11-29 08:18 137,728 --a------ c:\windows\system32\aston.mt 2008-11-20 16:35 . 2008-11-29 10:10 63,488 --a------ c:\windows\system32\rigv.xl 2008-11-20 16:35 . 2008-11-29 10:10 32,768 --a------ c:\windows\system32\fxe.sp 2008-11-20 16:35 . 2008-11-29 10:10 32,768 --a------ c:\windows\system32\fjes.ra 2008-11-18 11:07 . 2008-11-18 11:07 104,448 --a------ c:\windows\system32\qrtdqs.dll 2008-11-16 11:31 . 2008-11-16 11:31 <DIR> d-------- c:\program files\Apple Software Update 2008-11-16 09:11 . 2008-12-04 08:50 86,354 --a------ c:\windows\system32\drivers\6ce7d2e2.sys 2008-11-15 12:49 . 2008-11-15 12:49 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\TigerPlayer 2008-11-10 16:28 . 2008-11-10 16:28 104,448 --a------ c:\windows\system32\umrrboyi.dll 2008-11-09 17:32 . 2008-11-09 17:32 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\ipla 2008-11-09 11:46 . 2008-11-29 17:50 4,876 --a------ c:\windows\system32\d3d9caps.dat 2008-11-08 12:45 . 2008-11-10 16:01 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\BearShare 2008-11-05 20:48 . 2008-11-05 20:48 102,912 --a------ c:\windows\system32\zppegk.dll 2008-11-04 16:59 . 2008-11-04 16:59 68,096 --a------ c:\windows\system32\qgjteagi.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-04 16:11 --------- d-----w c:\program files\DNA 2008-12-04 16:11 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DNA 2008-12-04 16:03 --------- d-----w c:\program files\BitComet 2008-12-04 07:19 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\uTorrent 2008-12-03 16:26 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Hamachi 2008-12-03 16:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Hamachi 2008-12-02 06:55 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\ipla 2008-11-30 15:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Skype 2008-11-30 15:07 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\skypePM 2008-11-28 21:43 --------- d-----w c:\program files\Common Files\Adobe 2008-11-26 13:17 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-25 19:22 --------- d-----w c:\program files\NAPI-PROJEKT 2008-11-24 18:40 --------- d-----w c:\program files\Gadu-Gadu 2008-11-20 15:35 579,072 ----a-w c:\windows\system32\user32.DLL 2008-11-17 15:45 --------- d-----w c:\program files\Nowe Gadu-Gadu 2008-11-11 14:53 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Sports Interactive 2008-11-10 15:52 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Sports Interactive 2008-11-10 13:47 --------- d-----w c:\program files\Winamp 2008-11-08 14:13 --------- d-----w c:\program files\Google 2008-11-03 15:10 --------- d-----w c:\program files\Prawo Jazdy 2006 2008-11-02 19:12 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Sports Interactive 2008-11-02 19:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-11-02 19:03 --------- d-----w c:\program files\Sports Interactive 2008-11-02 11:21 --------- d-----w c:\program files\Opera 2008-11-02 10:18 --------- d-----w c:\program files\Live_TV 2008-11-01 07:25 244,224 ----a-w c:\windows\system32\opnkhEWP.VIR 2008-10-31 17:35 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\BearShare 2008-10-29 21:13 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Skype 2008-10-29 20:05 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\skypePM 2008-10-28 21:44 1,982 ----a-w c:\windows\system32\ealregsnapshot1.reg 2008-10-28 21:44 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Leadertech 2008-10-27 18:59 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Canon 2008-10-27 05:20 101,888 ----a-w c:\windows\system32\qltvijod.dll 2008-10-23 16:49 69,632 ----a-w c:\windows\system32\wjymdgsq.dll 2008-10-23 16:46 101,376 ----a-w c:\windows\system32\zlhfnw.dll 2008-10-22 17:07 --------- d-----w c:\program files\AbiSuite2 2008-10-22 08:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-10-21 10:36 --------- d-----w c:\program files\F-Secure Internet Security 2008-10-21 10:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\f-secure 2008-10-21 10:21 101,888 ----a-w c:\windows\system32\pdvnqlky.dll 2008-10-21 09:35 101,888 ----a-w c:\windows\system32\yqauffme.dll 2008-10-21 09:35 101,888 ----a-w c:\windows\system32\vwbtxu.dll 2008-10-20 17:42 --------- d-----w c:\program files\Hamachi 2008-10-20 17:41 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys 2008-10-19 18:32 --------- d-----w c:\program files\Conduit 2008-10-16 17:53 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Nowe Gadu-Gadu 2008-10-16 09:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Skype 2008-10-16 08:27 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\skypePM 2008-10-16 08:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Nowe Gadu-Gadu 2008-10-15 15:13 68,096 ----a-w c:\windows\system32\qllvfrgr.dll 2008-10-15 12:09 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Leadertech 2008-10-15 11:22 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DAEMON Tools 2008-10-15 07:31 --------- d-----w c:\program files\Chemix 2008-10-15 06:26 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\DAEMON Tools 2008-10-14 20:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\F-Secure 2008-10-14 19:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Ahead 2008-10-14 19:34 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-14 19:33 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Leadertech 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-14 19:10 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\DAEMON Tools 2008-10-14 19:05 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-14 19:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\DAEMON Tools 2008-10-12 11:42 --------- d-----w c:\program files\Common Files\NSV 2008-10-11 17:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Trymedia 2008-10-09 15:47 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\F-Secure 2008-10-09 12:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\F-Secure 2008-10-09 12:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\fssg 2008-10-09 12:06 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\TigerPlayer 2008-10-06 16:23 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ipla 2008-10-05 16:47 --------- d-----w c:\program files\ipla 2008-10-05 15:09 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-10-05 15:09 --------- d-----w c:\program files\GameTop.com 2008-10-05 15:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\PC Tools 2008-10-05 13:59 --------- d-----w c:\program files\Common Files\PC Tools 2008-10-04 16:03 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Canon 2008-09-30 13:20 4,608 ----a-w c:\windows\system32\w95inf32.dll 2008-09-30 13:20 2,272 ----a-w c:\windows\system32\w95inf16.dll . [color=red] c:\windows\system32\user32.dll ... jest zarażony !! [/color] 578,560 2005-03-02 18:21:08 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll 579,584 2007-03-08 15:51:57 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll 578,560 2004-08-03 22:44:14 c:\windows\$NtUninstallKB890859$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll.000 579,072 2008-11-20 15:35:35 c:\windows\system32\user32.DLL 579,072 2008-11-20 15:35:35 c:\windows\system32\dllcache\user32.dll ((((((((((((((((((((((((((((( snapshot@2008-12-04_10.33.33.31 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-12-04 15:21:40 4,841,472 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-04 15:21:40 176,128 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-12-04 10:37:36 4,255,744 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-04 10:37:36 245,760 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-03-03 17:51:50 69,120 ----a-w c:\windows\system32\admparse.dll + 2004-08-03 22:43:52 61,440 ----a-w c:\windows\system32\admparse.dll - 2008-03-03 17:51:42 126,464 ----a-w c:\windows\system32\advpack.dll + 2004-08-03 22:43:52 100,864 ----a-w c:\windows\system32\advpack.dll - 2008-03-03 17:52:20 17,920 ----a-w c:\windows\system32\corpol.dll + 2004-08-03 22:43:56 35,328 ----a-w c:\windows\system32\corpol.dll - 2008-03-03 17:51:50 69,120 -c--a-w c:\windows\system32\dllcache\admparse.dll + 2004-08-03 22:43:52 61,440 -c--a-w c:\windows\system32\dllcache\admparse.dll - 2008-03-03 17:51:42 126,464 -c--a-w c:\windows\system32\dllcache\advpack.dll + 2004-08-03 22:43:52 100,864 -c--a-w c:\windows\system32\dllcache\advpack.dll - 2008-03-03 17:52:20 17,920 -c--a-w c:\windows\system32\dllcache\corpol.dll + 2004-08-03 22:43:56 35,328 -c--a-w c:\windows\system32\dllcache\corpol.dll - 2008-03-03 17:50:34 345,600 -c--a-w c:\windows\system32\dllcache\dxtmsft.dll + 2008-06-23 15:41:36 357,888 -c--a-w c:\windows\system32\dllcache\dxtmsft.dll - 2008-03-03 17:50:30 212,992 -c--a-w c:\windows\system32\dllcache\dxtrans.dll + 2008-06-23 15:41:36 205,312 -c--a-w c:\windows\system32\dllcache\dxtrans.dll - 2008-03-03 17:46:02 68,096 -c--a-w c:\windows\system32\dllcache\hmmapi.dll + 2004-08-03 22:44:00 38,912 -c--a-w c:\windows\system32\dllcache\hmmapi.dll - 2008-03-03 17:51:52 70,656 -c--a-w c:\windows\system32\dllcache\ie4uinit.exe + 2004-08-03 22:44:22 34,304 -c--a-w c:\windows\system32\dllcache\ie4uinit.exe - 2008-03-03 17:51:56 119,808 -c--a-w c:\windows\system32\dllcache\ieakeng.dll + 2004-08-03 22:44:00 139,264 -c--a-w c:\windows\system32\dllcache\ieakeng.dll - 2008-03-03 17:52:04 224,768 -c--a-w c:\windows\system32\dllcache\ieaksie.dll + 2004-08-03 22:44:00 219,648 -c--a-w c:\windows\system32\dllcache\ieaksie.dll - 2008-03-03 17:51:50 149,504 -c--a-w c:\windows\system32\dllcache\ieakui.dll + 2001-10-26 19:28:02 237,568 -c--a-w c:\windows\system32\dllcache\ieakui.dll - 2008-03-03 17:52:02 349,184 -c--a-w c:\windows\system32\dllcache\iedkcs32.dll + 2004-08-03 22:44:00 323,584 -c--a-w c:\windows\system32\dllcache\iedkcs32.dll - 2008-03-03 17:52:46 70,656 -c--a-w c:\windows\system32\dllcache\iedw.exe + 2008-06-23 09:49:29 18,432 -c--a-w c:\windows\system32\dllcache\iedw.exe - 2008-03-03 17:53:14 78,336 -c--a-w c:\windows\system32\dllcache\ieencode.dll + 2004-08-03 22:44:00 81,920 -c--a-w c:\windows\system32\dllcache\ieencode.dll - 2008-03-03 18:01:22 184,320 -c--a-w c:\windows\system32\dllcache\iepeers.dll + 2008-06-23 15:41:36 251,392 -c--a-w c:\windows\system32\dllcache\iepeers.dll - 2008-03-03 17:51:46 44,032 -c--a-w c:\windows\system32\dllcache\iernonce.dll + 2004-08-03 22:44:00 48,640 -c--a-w c:\windows\system32\dllcache\iernonce.dll - 2008-03-03 17:51:48 69,120 -c--a-w c:\windows\system32\dllcache\iesetup.dll + 2004-08-03 22:44:00 63,488 -c--a-w c:\windows\system32\dllcache\iesetup.dll - 2008-03-03 17:52:48 599,552 -c--a-w c:\windows\system32\dllcache\iexplore.exe + 2004-08-03 22:44:22 93,184 -c--a-w c:\windows\system32\dllcache\iexplore.exe - 2008-03-03 17:50:30 36,352 -c--a-w c:\windows\system32\dllcache\imgutil.dll + 2004-08-03 22:44:00 35,840 -c--a-w c:\windows\system32\dllcache\imgutil.dll - 2008-03-03 17:51:46 94,208 -c--a-w c:\windows\system32\dllcache\inseng.dll + 2008-06-23 15:41:36 96,768 -c--a-w c:\windows\system32\dllcache\inseng.dll - 2008-03-03 17:51:38 557,056 -c--a-w c:\windows\system32\dllcache\jscript.dll + 2007-12-18 14:42:55 450,560 -c--a-w c:\windows\system32\dllcache\jscript.dll - 2008-03-03 18:01:22 28,672 -c--a-w c:\windows\system32\dllcache\jsproxy.dll + 2008-06-23 15:41:36 16,384 -c--a-w c:\windows\system32\dllcache\jsproxy.dll - 2008-03-03 17:52:54 41,984 -c--a-w c:\windows\system32\dllcache\licmgr10.dll + 2004-08-03 22:44:02 22,016 -c--a-w c:\windows\system32\dllcache\licmgr10.dll - 2008-03-03 17:50:10 45,568 -c--a-w c:\windows\system32\dllcache\mshta.exe + 2004-08-03 22:44:24 29,184 -c--a-w c:\windows\system32\dllcache\mshta.exe - 2008-03-03 18:01:22 5,120,000 -c--a-w c:\windows\system32\dllcache\mshtml.dll + 2008-06-23 15:41:37 3,080,704 -c--a-w c:\windows\system32\dllcache\mshtml.dll - 2008-03-03 18:01:22 68,608 -c--a-w c:\windows\system32\dllcache\mshtmled.dll + 2008-06-23 15:41:37 449,024 -c--a-w c:\windows\system32\dllcache\mshtmled.dll - 2008-03-03 17:50:16 48,128 -c--a-w c:\windows\system32\dllcache\mshtmler.dll + 2004-08-03 22:42:58 57,344 -c--a-w c:\windows\system32\dllcache\mshtmler.dll - 2008-03-03 18:01:22 156,160 -c--a-w c:\windows\system32\dllcache\msls31.dll + 2001-10-26 19:26:58 146,432 -c--a-w c:\windows\system32\dllcache\msls31.dll - 2008-03-03 17:52:58 193,024 -c--a-w c:\windows\system32\dllcache\msrating.dll + 2008-06-23 15:41:37 146,432 -c--a-w c:\windows\system32\dllcache\msrating.dll - 2008-03-03 18:01:22 629,248 -c--a-w c:\windows\system32\dllcache\mstime.dll + 2008-06-23 15:41:37 532,480 -c--a-w c:\windows\system32\dllcache\mstime.dll - 2008-03-03 17:52:52 116,224 -c--a-w c:\windows\system32\dllcache\occache.dll + 2004-08-03 22:44:08 97,280 -c--a-w c:\windows\system32\dllcache\occache.dll - 2008-03-03 17:50:32 44,544 -c--a-w c:\windows\system32\dllcache\pngfilt.dll + 2008-06-23 15:41:37 39,424 -c--a-w c:\windows\system32\dllcache\pngfilt.dll - 2008-03-03 17:52:54 105,984 -c--a-w c:\windows\system32\dllcache\url.dll + 2004-08-03 22:44:14 37,888 -c--a-w c:\windows\system32\dllcache\url.dll - 2008-03-03 18:01:22 1,188,352 -c--a-w c:\windows\system32\dllcache\urlmon.dll + 2008-06-23 15:41:37 616,960 -c--a-w c:\windows\system32\dllcache\urlmon.dll - 2008-03-03 18:01:22 434,176 -c--a-w c:\windows\system32\dllcache\vbscript.dll + 2007-12-18 14:42:55 417,792 -c--a-w c:\windows\system32\dllcache\vbscript.dll - 2008-03-03 18:01:22 755,200 -c--a-w c:\windows\system32\dllcache\VGX.dll + 2004-08-03 22:44:14 848,384 -c--a-w c:\windows\system32\dllcache\vgx.dll - 2008-03-03 18:01:22 233,984 -c--a-w c:\windows\system32\dllcache\webcheck.dll + 2004-08-03 22:44:14 279,552 -c--a-w c:\windows\system32\dllcache\webcheck.dll - 2008-03-03 18:01:22 830,464 -c--a-w c:\windows\system32\dllcache\wininet.dll + 2008-06-23 15:41:38 662,016 -c--a-w c:\windows\system32\dllcache\wininet.dll - 2008-03-03 17:50:34 345,600 ----a-w c:\windows\system32\dxtmsft.dll + 2008-06-23 15:41:36 357,888 ----a-w c:\windows\system32\dxtmsft.dll - 2008-03-03 17:50:30 212,992 ----a-w c:\windows\system32\dxtrans.dll + 2008-06-23 15:41:36 205,312 ----a-w c:\windows\system32\dxtrans.dll - 2008-03-03 17:51:52 70,656 ----a-w c:\windows\system32\ie4uinit.exe + 2004-08-03 22:44:22 34,304 ----a-w c:\windows\system32\ie4uinit.exe - 2008-03-03 17:51:56 119,808 ----a-w c:\windows\system32\ieakeng.dll + 2004-08-03 22:44:00 139,264 ----a-w c:\windows\system32\ieakeng.dll - 2008-03-03 17:52:04 224,768 ----a-w c:\windows\system32\ieaksie.dll + 2004-08-03 22:44:00 219,648 ----a-w c:\windows\system32\ieaksie.dll - 2008-03-03 17:51:50 149,504 ----a-w c:\windows\system32\ieakui.dll + 2001-10-26 19:28:02 237,568 ----a-w c:\windows\system32\ieakui.dll - 2008-03-03 17:52:02 349,184 ----a-w c:\windows\system32\iedkcs32.dll + 2004-08-03 22:44:00 323,584 ----a-w c:\windows\system32\iedkcs32.dll - 2008-03-03 17:53:14 78,336 ----a-w c:\windows\system32\ieencode.dll + 2004-08-03 22:44:00 81,920 ----a-w c:\windows\system32\ieencode.dll - 2008-03-03 18:01:22 184,320 ----a-w c:\windows\system32\iepeers.dll + 2008-06-23 15:41:36 251,392 ----a-w c:\windows\system32\iepeers.dll - 2008-03-03 17:51:46 44,032 ----a-w c:\windows\system32\iernonce.dll + 2004-08-03 22:44:00 48,640 ----a-w c:\windows\system32\iernonce.dll - 2008-03-03 17:51:48 69,120 ----a-w c:\windows\system32\iesetup.dll + 2004-08-03 22:44:00 63,488 ----a-w c:\windows\system32\iesetup.dll - 2008-03-03 17:50:30 36,352 ----a-w c:\windows\system32\imgutil.dll + 2004-08-03 22:44:00 35,840 ----a-w c:\windows\system32\imgutil.dll - 2008-03-03 17:51:46 94,208 ----a-w c:\windows\system32\inseng.dll + 2008-06-23 15:41:36 96,768 ----a-w c:\windows\system32\inseng.dll - 2008-03-03 17:51:38 557,056 ----a-w c:\windows\system32\jscript.dll + 2007-12-18 14:42:55 450,560 ----a-w c:\windows\system32\jscript.dll - 2008-03-03 18:01:22 28,672 ----a-w c:\windows\system32\jsproxy.dll + 2008-06-23 15:41:36 16,384 ----a-w c:\windows\system32\jsproxy.dll - 2008-03-03 17:52:54 41,984 ----a-w c:\windows\system32\licmgr10.dll + 2004-08-03 22:44:02 22,016 ----a-w c:\windows\system32\licmgr10.dll - 2008-03-03 17:50:10 45,568 ----a-w c:\windows\system32\mshta.exe + 2004-08-03 22:44:24 29,184 ----a-w c:\windows\system32\mshta.exe - 2008-03-03 18:01:22 5,120,000 ----a-w c:\windows\system32\mshtml.dll + 2008-06-23 15:41:37 3,080,704 ----a-w c:\windows\system32\mshtml.dll - 2008-03-03 18:01:22 68,608 ----a-w c:\windows\system32\mshtmled.dll + 2008-06-23 15:41:37 449,024 ----a-w c:\windows\system32\mshtmled.dll - 2008-03-03 17:50:16 48,128 ----a-w c:\windows\system32\mshtmler.dll + 2004-08-03 22:42:58 57,344 ----a-w c:\windows\system32\mshtmler.dll - 2008-03-03 18:01:22 156,160 ----a-w c:\windows\system32\msls31.dll + 2001-10-26 19:26:58 146,432 ----a-w c:\windows\system32\msls31.dll - 2008-03-03 17:52:58 193,024 ----a-w c:\windows\system32\msrating.dll + 2008-06-23 15:41:37 146,432 ----a-w c:\windows\system32\msrating.dll - 2008-03-03 18:01:22 629,248 ----a-w c:\windows\system32\mstime.dll + 2008-06-23 15:41:37 532,480 ----a-w c:\windows\system32\mstime.dll - 2008-03-03 17:52:52 116,224 ----a-w c:\windows\system32\occache.dll + 2004-08-03 22:44:08 97,280 ----a-w c:\windows\system32\occache.dll - 2008-03-03 17:50:32 44,544 ----a-w c:\windows\system32\pngfilt.dll + 2008-06-23 15:41:37 39,424 ----a-w c:\windows\system32\pngfilt.dll - 2008-03-03 17:52:54 105,984 ----a-w c:\windows\system32\url.dll + 2004-08-03 22:44:14 37,888 ----a-w c:\windows\system32\url.dll - 2008-03-03 18:01:22 1,188,352 ----a-w c:\windows\system32\urlmon.dll + 2008-06-23 15:41:37 616,960 ----a-w c:\windows\system32\urlmon.dll - 2008-03-03 18:01:22 434,176 ----a-w c:\windows\system32\vbscript.dll + 2007-12-18 14:42:55 417,792 ----a-w c:\windows\system32\vbscript.dll - 2008-03-03 18:01:22 233,984 ----a-w c:\windows\system32\webcheck.dll + 2004-08-03 22:44:14 279,552 ----a-w c:\windows\system32\webcheck.dll - 2008-03-03 18:01:22 830,464 ----a-w c:\windows\system32\wininet.dll + 2008-06-23 15:41:38 662,016 ----a-w c:\windows\system32\wininet.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-12-03 2514744] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336] "ares"="c:\program files\Ares\Ares.exe" [2008-11-23 880640] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304] "QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-01 185896] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "EditLevel"= 0 (0x0) "NoCommonGroups"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=bylmnk.dll joqjpf.dll fbygow.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll "vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll "wave2"= alcxnt.dll "aux1"= alcxnt.dll "mixer1"= alcxnt.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproRemote.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproRemote.lnk backup=c:\windows\pss\ComproRemote.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproScheduler.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproScheduler.lnk backup=c:\windows\pss\ComproScheduler.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproSchedulerDTV.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproSchedulerDTV.lnk backup=c:\windows\pss\ComproSchedulerDTV.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TweakYC.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TweakYC.lnk backup=c:\windows\pss\TweakYC.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] -ra------ 2005-11-28 06:52 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] -ra------ 2005-11-28 06:55 118784 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] -ra------ 2005-11-28 06:55 98304 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2007-01-08 21:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 13:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu] --a------ 2008-10-10 10:50 6500960 c:\program files\Nowe Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2007-03-14 20:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-09-29 16:57 21755688 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-09-01 16:42 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 17:43 69632 c:\windows\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2008-05-07 14:39 16862208 c:\windows\RTHDCPL.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\EA Sports\\FIFA 08\\FIFA08.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\Program Files\\FIFA09.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2009 Demo\\fm.exe"= "c:\\Documents and Settings\\Piter\\Pulpit\\Skype.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Ares Destiny\\AresDestiny.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12475:TCP"= 12475:TCP:BitComet 12475 TCP "12475:UDP"= 12475:UDP:BitComet 12475 UDP "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "20950:TCP"= 20950:TCP:TORRENT "49438:TCP"= 49438:TCP:torrent "9433:TCP"= 9433:TCP:BitComet 9433 TCP "9433:UDP"= 9433:UDP:BitComet 9433 UDP [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \shell\autorun\command - I:\Run.exe . Zawartość folderu 'Zaplanowane zadania' 2008-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.atcomet.com/b/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: pobierz wszystkie video za pomocą bitcomet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: pobierz wszystko za pomocą bitcomet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: pobierz za pomocą bitcomet - c:\program files\BitComet\BitComet.exe/AddLink.htm TCP: {516B060E-FEC8-4FC3-91CF-D8F34D0B0B03} = 80.85.224.2,80.85.224.50 O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd FireFox -: Profile - c:\documents and settings\Ewelina\Dane aplikacji\Mozilla\Firefox\Profiles\icsp1s7t.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin2.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin3.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin4.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin5.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin6.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin7.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-04 17:11:19 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2] "ImagePath"="\SystemRoot\System32\drivers\6ce7d2e2.sys" . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe . ************************************************************************** . Czas ukończenia: 2008-12-04 17:13:11 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-04 16:13:09 ComboFix2.txt 2008-12-04 09:34:16 Przed: 10 698 244 096 bajtów wolnych Po: 10,742,829,056 bajtów wolnych 460 --- E O F --- 2008-10-08 09:38:45 [code][*][/code]

**Posty:** 18165 · przez **wojtas** 04 Gru 2008, 18:23

Ściągnij program Fixwareout i zastosuj go

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
"appinit_dlls"=""

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\ppmdvkmn.dll
c:\windows\system32\qpsxepkx.dll
c:\windows\system32\okxnhtaq
c:\windows\system32\pyfdax.dll
c:\windows\system32\sfjhxf.dll
c:\windows\system32\soitxl.dll
c:\windows\system32\qakihuha.dll
c:\windows\system32\oobkua
c:\windows\system32\oklqsi
c:\windows\system32\ojckxi
c:\windows\system32\nvaux32.VIR
c:\windows\system32\aston.mt
c:\windows\system32\rigv.xl
c:\windows\system32\fxe.sp
c:\windows\system32\fjes.ra
c:\windows\system32\qrtdqs.dll
c:\windows\system32\zppegk.dll
c:\windows\system32\qgjteagi.dll
c:\windows\system32\umrrboyi.dll
c:\windows\system32\drivers\f9f2f2b1.sys
c:\windows\system32\drivers\6ce7d2e2.sys
c:\windows\system32\opnkhEWP.VIR
c:\windows\system32\qltvijod.dll
c:\windows\system32\wjymdgsq.dll
c:\windows\system32\zlhfnw.dll
c:\windows\system32\pdvnqlky.dll
c:\windows\system32\yqauffme.dll
c:\windows\system32\vwbtxu.dl
c:\windows\system32\qllvfrgr.dll

Folder::
c:\program files\Conduit

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

do tego

włóż płytkę windowsa - zbootuj ją. wejdź do konsoli odzyskiwania i w niej wpisz

i wpisz:

expand X:\i386\user32.dl_ C:\Windows\sytem32\user32.dll

X- literka Twojego cd romu

potem reset kompa i nowy log z hijacka i combofixa !

**Posty:** 13 · przez **NIKI4355** 04 Gru 2008, 19:30

Nie mogę przeciągac plików na pulpicie !!!!!!

**Posty:** 18165 · przez **wojtas** 04 Gru 2008, 22:08

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

c:\windows\system32\ppmdvkmn.dll
c:\windows\system32\qpsxepkx.dll
c:\windows\system32\okxnhtaq
c:\windows\system32\pyfdax.dll
c:\windows\system32\sfjhxf.dll
c:\windows\system32\soitxl.dll
c:\windows\system32\qakihuha.dll
c:\windows\system32\oobkua
c:\windows\system32\oklqsi
c:\windows\system32\ojckxi
c:\windows\system32\nvaux32.VIR
c:\windows\system32\aston.mt
c:\windows\system32\rigv.xl
c:\windows\system32\fxe.sp
c:\windows\system32\fjes.ra
c:\windows\system32\qrtdqs.dll
c:\windows\system32\zppegk.dll
c:\windows\system32\qgjteagi.dll
c:\windows\system32\umrrboyi.dll
c:\windows\system32\drivers\f9f2f2b1.sys
c:\windows\system32\drivers\6ce7d2e2.sys
c:\windows\system32\opnkhEWP.VIR
c:\windows\system32\qltvijod.dll
c:\windows\system32\wjymdgsq.dll
c:\windows\system32\zlhfnw.dll
c:\windows\system32\pdvnqlky.dll
c:\windows\system32\yqauffme.dll
c:\windows\system32\vwbtxu.dl
c:\windows\system32\qllvfrgr.dll

Folders to delete:

c:\program files\Conduit

Registry keys to delete:

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt oraz nowy log z hijacka i combofixa

**Posty:** 13 · przez **NIKI4355** 05 Gru 2008, 09:37

Wszysko fajnie pięknie, ale zatrzymalam sie na operacji przenoszenia notatnika na ikonke combofixa......

Nie mogę poprostu właczyc combo bez przenoszenia bo nie da sie ruszyc ani jednej ikonki :evil:

**Posty:** 18165 · przez **wojtas** 05 Gru 2008, 10:02

to nie rob z combofixem tylko z avengerem... i daj raport z avengera, log z hijacka i jak nie mozesz z combofixa to daj z rsita.. (temat z combofixem)

**Posty:** 13 · przez **NIKI4355** 05 Gru 2008, 11:50

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "c:\windows\system32\ppmdvkmn.dll" deleted successfully. File "c:\windows\system32\qpsxepkx.dll" deleted successfully. File "c:\windows\system32\okxnhtaq" deleted successfully. File "c:\windows\system32\pyfdax.dll" deleted successfully. File "c:\windows\system32\sfjhxf.dll" deleted successfully. File "c:\windows\system32\soitxl.dll" deleted successfully. File "c:\windows\system32\qakihuha.dll" deleted successfully. File "c:\windows\system32\oobkua" deleted successfully. File "c:\windows\system32\oklqsi" deleted successfully. File "c:\windows\system32\ojckxi" deleted successfully. File "c:\windows\system32\nvaux32.VIR" deleted successfully. File "c:\windows\system32\aston.mt" deleted successfully. File "c:\windows\system32\rigv.xl" deleted successfully. File "c:\windows\system32\fxe.sp" deleted successfully. File "c:\windows\system32\fjes.ra" deleted successfully. File "c:\windows\system32\qrtdqs.dll" deleted successfully. File "c:\windows\system32\zppegk.dll" deleted successfully. File "c:\windows\system32\qgjteagi.dll" deleted successfully. File "c:\windows\system32\umrrboyi.dll" deleted successfully. Error: file "c:\windows\system32\drivers\f9f2f2b1.sys" not found! Deletion of file "c:\windows\system32\drivers\f9f2f2b1.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "c:\windows\system32\drivers\6ce7d2e2.sys" deleted successfully. File "c:\windows\system32\opnkhEWP.VIR" deleted successfully. File "c:\windows\system32\qltvijod.dll" deleted successfully. File "c:\windows\system32\wjymdgsq.dll" deleted successfully. File "c:\windows\system32\zlhfnw.dll" deleted successfully. File "c:\windows\system32\pdvnqlky.dll" deleted successfully. File "c:\windows\system32\yqauffme.dll" deleted successfully. Error: file "c:\windows\system32\vwbtxu.dl" not found! Deletion of file "c:\windows\system32\vwbtxu.dl" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "c:\windows\system32\qllvfrgr.dll" deleted successfully. Folder "c:\program files\Conduit" deleted successfully. Registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2" deleted successfully. Error: registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1" not found! Deletion of registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate. [code][*][/code]

Dodano Dzisiaj, 10:51:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:51:04, on 08-12-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\windows\Explorer.EXE C:\windows\system32\NOTEPAD.EXE C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\windows\RTHDCPL.EXE C:\Program Files\BitComet\BitComet.exe C:\windows\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file) O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file) O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\MpcStar\Codecs\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" (User '?') O4 - HKUS\S-1-5-21-796845957-838170752-1177238915-1004\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User '?') O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: BitComet - {d18a0b52-d63c-4ed0-afc6-c1e3dc1af43a} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{516B060E-FEC8-4FC3-91CF-D8F34D0B0B03}: NameServer = 80.85.224.2,80.85.224.50 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Zarządzanie aplikacjami (AppMgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Przeglądarka komputera (Browser) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługi kryptograficzne (CryptSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Program uruchamiający proces serwera DCOM (DcomLaunch) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Klient DHCP (Dhcp) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer dysków logicznych (dmserver) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Klient DNS (Dnscache) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Automatyczna konfiguracja sieci przewodowej (Dot3svc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa protokołu uwierzytelniania rozszerzonego (EAP) (EapHost) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: System zdarzeń COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing) O23 - Service: Zgodność szybkiego przełączania użytkowników (FastUserSwitchingCompatibility) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Pomoc i obsługa techniczna (helpsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa zarządzania kluczami i certyfikatami kondycji (hkmsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Serwer (LanmanServer) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Stacja robocza (lanmanworkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Pomoc TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Agent ochrony dostępu do sieci (napagent) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Połączenia sieciowe (Netman) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Rozpoznawanie lokalizacji w sieci (NLA) (Nla) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Magazyn wymienny (NtmsSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa klienta dla systemu NetWare (NWCWorkstation) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer autopołączenia dostępu zdalnego (RasAuto) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Menedżer połączeń usługi Dostęp zdalny (RasMan) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Rejestr zdalny (RemoteRegistry) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Zdalne wywoływanie procedur (RPC) (RpcSs) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Logowanie pomocnicze (seclogon) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Zawiadomienie o zdarzeniu systemowym (SENS) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Zapora systemu Windows/Udostępnianie połączenia internetowego (SharedAccess) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Wykrywanie sprzętu powłoki (ShellHWDetection) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa przywracania systemu (srservice) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa odnajdywania SSDP (SSDPSRV) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Telefonia (TapiSrv) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługi terminalowe (TermService) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Kompozycje (Themes) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Klient śledzenia łączy rozproszonych (TrkWks) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Host uniwersalnego urządzenia Plug and Play (upnphost) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa Czas systemu Windows (W32Time) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: WebClient - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Instrumentacja zarządzania Windows (winmgmt) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Usługa numeru seryjnego multimediów przenośnych (WmdmPmSN) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Rozszerzenia sterownika Instrumentacji zarządzania Windows (Wmi) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Centrum zabezpieczeń (wscsvc) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\windows\system32\svchost.exe (file missing) O23 - Service: Konfiguracja zerowej sieci bezprzewodowej (WZCSVC) - Unknown owner - C:\windows\System32\svchost.exe (file missing) O23 - Service: Usługa dostarczania sieci (xmlprov) - Unknown owner - C:\windows\System32\svchost.exe (file missing) -- End of file - 14778 bytes [code][*][/code]

Dodano Dzisiaj, 11:08:
I znowu mam problem tym razem z tym Ristem jak naciskam continue pojawia sie taki komunikat:

Line - 1 :
Error: Incorrent number of parameters in function call. :?:

Dodano Dzisiaj, 11:12:
Wydaje mi się że Rist nie moze znaleśc Hijacka, niby go instaluje a w folderze jest tylko ikonka Hijack Install

Dodano Dzisiaj, 11:28:
A jeszcze jedno

jak chodzi z ta kontrola odzyskiwania to nie zrobila tego jeszcze. a gdzie jest ta opcja bo nie moge jej znalesc

**Posty:** 18165 · przez **wojtas** 05 Gru 2008, 17:12

skasuj:

O3 - Toolbar: (no name) - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - (no file)

bez combofixa lub rsita nic nie zrobimy raczej... sprobuj w awaryjnym go odpalić

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

c:\windows\system32\vwbtxu.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

i postaraj dac loga .. moze nowa instalke sciagnij lub cos

**Posty:** 13 · przez **NIKI4355** 05 Gru 2008, 17:41

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "c:\windows\system32\ppmdvkmn.dll" deleted successfully. File "c:\windows\system32\qpsxepkx.dll" deleted successfully. File "c:\windows\system32\okxnhtaq" deleted successfully. File "c:\windows\system32\pyfdax.dll" deleted successfully. File "c:\windows\system32\sfjhxf.dll" deleted successfully. File "c:\windows\system32\soitxl.dll" deleted successfully. File "c:\windows\system32\qakihuha.dll" deleted successfully. File "c:\windows\system32\oobkua" deleted successfully. File "c:\windows\system32\oklqsi" deleted successfully. File "c:\windows\system32\ojckxi" deleted successfully. File "c:\windows\system32\nvaux32.VIR" deleted successfully. File "c:\windows\system32\aston.mt" deleted successfully. File "c:\windows\system32\rigv.xl" deleted successfully. File "c:\windows\system32\fxe.sp" deleted successfully. File "c:\windows\system32\fjes.ra" deleted successfully. File "c:\windows\system32\qrtdqs.dll" deleted successfully. File "c:\windows\system32\zppegk.dll" deleted successfully. File "c:\windows\system32\qgjteagi.dll" deleted successfully. File "c:\windows\system32\umrrboyi.dll" deleted successfully. Error: file "c:\windows\system32\drivers\f9f2f2b1.sys" not found! Deletion of file "c:\windows\system32\drivers\f9f2f2b1.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "c:\windows\system32\drivers\6ce7d2e2.sys" deleted successfully. File "c:\windows\system32\opnkhEWP.VIR" deleted successfully. File "c:\windows\system32\qltvijod.dll" deleted successfully. File "c:\windows\system32\wjymdgsq.dll" deleted successfully. File "c:\windows\system32\zlhfnw.dll" deleted successfully. File "c:\windows\system32\pdvnqlky.dll" deleted successfully. File "c:\windows\system32\yqauffme.dll" deleted successfully. Error: file "c:\windows\system32\vwbtxu.dl" not found! Deletion of file "c:\windows\system32\vwbtxu.dl" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "c:\windows\system32\qllvfrgr.dll" deleted successfully. Folder "c:\program files\Conduit" deleted successfully. Registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6ce7d2e2" deleted successfully. Error: registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1" not found! Deletion of registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f9f2f2b1" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate. ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Dodatek Service Pack 2) Fri Dec 05 16:27:31 2008 16:27:31: Error: Invalid script. A valid script must begin with a command directive. Aborting execution! ////////////////////////////////////////// ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Dodatek Service Pack 2) Fri Dec 05 16:27:34 2008 16:27:34: Error: Invalid script. A valid script must begin with a command directive. Aborting execution! ////////////////////////////////////////// ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Dodatek Service Pack 2) Fri Dec 05 16:27:40 2008 16:27:40: Error: Invalid script. A valid script must begin with a command directive. Aborting execution! ////////////////////////////////////////// ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Dodatek Service Pack 2) Fri Dec 05 16:27:47 2008 16:27:47: Error: Invalid script. A valid script must begin with a command directive. Aborting execution! ////////////////////////////////////////// Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Completed script processing. ******************* Finished! Terminate. [code][*][/code]

**Posty:** 18165 · przez **wojtas** 05 Gru 2008, 20:39

to nie ten raport..a co z logiem z combofixa ?

**Posty:** 13 · przez **NIKI4355** 07 Gru 2008, 10:45

Jakbyś mógł napisz mi jeszcze raz co mam zrobić pokolei :lol:

codzi co comboefixa - jeszcze raz zainstalować? tylko ze ja wogóle zadnych ikonek ani na pilpicie ani w folderach nie mogę przesuwać :oops:

**Posty:** 18165 · przez **wojtas** 07 Gru 2008, 12:58

to sciagnij jeszcze raz combofixa ale najpierw tego wywal..

**Posty:** 13 · przez **NIKI4355** 08 Gru 2008, 10:43

Wytłumacz mi tak na clopski rozum bo ja nic z tych operacji nie wiem co to wszysko da??? Wyinstalowałam tak jak pisales wszystkie sterowniki dzwięku i zainstalowałam ponownie, niestety kontroler multimediów nie chce się zainstalowac i pojawia sie cos takiego: Potrzebny jest plik 'VMXYid sys' z ComproVideo Matex series Drivers installation disk. Oczywiście mam płytkę do tego ale z powodu tych wirusów nic nie mogę instalowac pisze mi ze nie moze odnalesc jakiegos Serwera RPC no i koło sie zamyka

myślisz ze jakbym poszla z nim do serwisu potrzebny by był format???

**Posty:** 18165 · przez **wojtas** 08 Gru 2008, 19:23

staramy pomoc.. ale bez loga z combofixa lub rsita nic nie zrobimy raczej.. a w serwisie walna formata... na poczatku dałas loga z combofixa teraz prosimy o nowego loga..

**Posty:** 13 · przez **NIKI4355** 09 Gru 2008, 12:24

Rozumiem i naprawdę jestem wdzieczna - nie wiem czy to to al zrobilam loga z combofixa

Kod: Zaznacz wszystko: ComboFix 08-12-07.04 - Ewelina 2008-12-09 11:09:04.5 - NTFSx86 Uruchomiony z: c:\documents and settings\Ewelina\Ustawienia lokalne\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-09 do 2008-12-09 ))))))))))))))))))))))))))))))) . 2008-12-06 14:15 . 2008-12-06 14:15 <DIR> d-------- c:\program files\Bus Driver 2008-12-05 20:27 . 2008-12-05 20:27 <DIR> d-------- c:\program files\Sierra On-Line 2008-12-05 20:27 . 2008-12-05 20:27 173 --a------ c:\windows\SIERRA.INI 2008-12-05 20:26 . 2008-12-05 20:26 <DIR> d-------- c:\documents and settings\Luque\WINDOWS 2008-12-05 17:01 . 2008-12-05 17:01 <DIR> d-------- c:\windows\compro 2008-12-05 10:56 . 2008-12-05 10:56 <DIR> d-------- C:\rsit 2008-12-04 18:02 . 2008-12-05 10:36 <DIR> d-------- C:\fixwareout 2008-12-04 16:36 . 2008-12-04 16:36 <DIR> d-------- c:\program files\Trend Micro 2008-12-04 11:40 . 2008-12-04 11:40 76,560 --a------ c:\documents and settings\Wojciech Potcatchme.zip 2008-12-04 11:37 . 2008-12-04 11:37 <DIR> d-------- c:\windows\ERUNT 2008-12-04 11:29 . 2008-12-04 16:30 <DIR> d-------- C:\SDFix 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\program files\Avira 2008-12-04 08:47 . 2008-12-04 08:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Avira 2008-12-02 12:10 . 2008-12-02 12:10 <DIR> d-------- c:\documents and settings\Ewelina\Dane aplikacji\BearShare 2008-11-30 11:02 . 2008-11-30 11:02 <DIR> d--hs---- c:\windows\ftpcache 2008-11-26 14:17 . 2008-11-26 14:17 <DIR> d-------- c:\program files\Common Files\Futuremark Shared 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-11-26 14:11 . 2008-11-26 14:11 <DIR> d-------- c:\documents and settings\Luque\SystemRequirementsLab 2008-11-24 06:39 . 2008-11-24 06:39 <DIR> d-------- c:\windows\system32\Futuremark 2008-11-24 06:39 . 2008-05-29 12:33 27,672 -ra------ c:\windows\system32\drivers\Entech.sys 2008-11-24 06:39 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys 2008-11-24 06:38 . 2008-11-24 06:38 <DIR> d-------- c:\program files\Futuremark 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\program files\Auslogics 2008-11-22 11:58 . 2008-11-22 11:58 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\Auslogics 2008-11-16 11:31 . 2008-11-16 11:31 <DIR> d-------- c:\program files\Apple Software Update 2008-11-15 12:49 . 2008-11-15 12:49 <DIR> d-------- c:\documents and settings\Luque\Dane aplikacji\TigerPlayer 2008-11-09 17:32 . 2008-11-09 17:32 <DIR> d-------- c:\documents and settings\Wojciech Potępa\Dane aplikacji\ipla 2008-11-09 11:46 . 2008-11-29 17:50 4,876 --a------ c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-09 10:16 --------- d-----w c:\program files\DNA 2008-12-09 10:16 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DNA 2008-12-09 10:10 --------- d-----w c:\program files\BitComet 2008-12-08 19:34 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Nowe Gadu-Gadu 2008-12-05 14:56 --------- d-----w c:\program files\Opera 2008-12-04 19:47 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Hamachi 2008-12-04 07:19 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\uTorrent 2008-12-03 16:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Hamachi 2008-12-02 06:55 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\ipla 2008-11-30 15:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Skype 2008-11-30 15:07 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\skypePM 2008-11-28 21:43 --------- d-----w c:\program files\Common Files\Adobe 2008-11-26 13:17 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-25 19:22 --------- d-----w c:\program files\NAPI-PROJEKT 2008-11-24 18:40 --------- d-----w c:\program files\Gadu-Gadu 2008-11-20 15:35 579,072 ----a-w c:\windows\system32\user32.DLL 2008-11-17 15:45 --------- d-----w c:\program files\Nowe Gadu-Gadu 2008-11-11 14:53 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Sports Interactive 2008-11-10 15:52 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Sports Interactive 2008-11-10 15:01 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\BearShare 2008-11-10 13:47 --------- d-----w c:\program files\Winamp 2008-11-08 14:13 --------- d-----w c:\program files\Google 2008-11-03 15:10 --------- d-----w c:\program files\Prawo Jazdy 2006 2008-11-02 19:12 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Sports Interactive 2008-11-02 19:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-11-02 19:03 --------- d-----w c:\program files\Sports Interactive 2008-11-02 10:18 --------- d-----w c:\program files\Live_TV 2008-10-31 17:35 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\BearShare 2008-10-29 21:13 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Skype 2008-10-29 20:05 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\skypePM 2008-10-28 21:44 1,982 ----a-w c:\windows\system32\ealregsnapshot1.reg 2008-10-28 21:44 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Leadertech 2008-10-27 18:59 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\Canon 2008-10-22 17:07 --------- d-----w c:\program files\AbiSuite2 2008-10-22 08:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-10-21 10:36 --------- d-----w c:\program files\F-Secure Internet Security 2008-10-21 10:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\f-secure 2008-10-21 09:35 101,888 ----a-w c:\windows\system32\vwbtxu.dll 2008-10-20 17:42 --------- d-----w c:\program files\Hamachi 2008-10-20 17:41 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys 2008-10-16 17:53 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\Nowe Gadu-Gadu 2008-10-16 09:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Skype 2008-10-16 08:27 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\skypePM 2008-10-15 12:09 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\Leadertech 2008-10-15 11:22 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\DAEMON Tools 2008-10-15 07:31 --------- d-----w c:\program files\Chemix 2008-10-15 06:26 --------- d-----w c:\documents and settings\Wojciech Potępa\Dane aplikacji\DAEMON Tools 2008-10-14 20:13 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\F-Secure 2008-10-14 19:36 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Ahead 2008-10-14 19:34 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-14 19:33 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\Leadertech 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-10-14 19:11 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-14 19:10 --------- d-----w c:\documents and settings\Luque\Dane aplikacji\DAEMON Tools 2008-10-14 19:05 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-14 19:05 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\DAEMON Tools 2008-10-12 11:42 --------- d-----w c:\program files\Common Files\NSV 2008-10-11 17:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Trymedia 2008-10-09 15:47 --------- d-----w c:\documents and settings\Ewelina\Dane aplikacji\F-Secure 2008-10-09 12:24 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\F-Secure 2008-10-09 12:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\fssg 2008-10-09 12:06 --------- d-----w c:\documents and settings\Piter\Dane aplikacji\TigerPlayer 2008-09-30 13:20 4,608 ----a-w c:\windows\system32\w95inf32.dll 2008-09-30 13:20 2,272 ----a-w c:\windows\system32\w95inf16.dll . [color=red] c:\windows\system32\user32.dll ... jest zarażony !! [/color] 578,560 2005-03-02 18:21:08 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll 579,584 2007-03-08 15:51:57 c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll 578,560 2004-08-03 22:44:14 c:\windows\$NtUninstallKB890859$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll 578,560 2005-03-02 18:18:38 c:\windows\$NtUninstallKB925902$\user32.dll.000 579,072 2008-11-20 15:35:35 c:\windows\system32\user32.DLL 579,072 2008-11-20 15:35:35 c:\windows\system32\dllcache\user32.dll ((((((((((((((((((((((((((((( snapshot_2008-12-04_17.12.44.00 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-03 21:08:00 60,288 ----a-w c:\windows\system32\drivers\drmk.sys + 2004-08-03 22:08:00 60,288 ----a-w c:\windows\system32\drivers\drmk.sys - 2004-08-03 21:15:22 140,928 ----a-w c:\windows\system32\drivers\ks.sys + 2004-08-03 22:15:22 140,928 ----a-w c:\windows\system32\drivers\ks.sys - 2004-08-03 21:08:04 48,640 ----a-w c:\windows\system32\drivers\stream.sys + 2004-08-03 22:08:04 48,640 ----a-w c:\windows\system32\drivers\stream.sys - 2004-08-03 22:44:02 4,096 ------w c:\windows\system32\ksuser.dll + 2004-08-03 23:44:02 4,096 ----a-w c:\windows\system32\ksuser.dll + 2004-08-30 05:50:00 43,128 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]015\DriverFiles\alcxnt.dll + 2004-08-30 05:50:00 209,656 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]015\DriverFiles\alcxnt.sys + 2004-08-30 05:50:00 43,128 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]016\DriverFiles\alcxnt.dll + 2004-08-30 05:50:00 209,656 ----a-r c:\windows\system32\ReinstallBackups\[u]0[/u]016\DriverFiles\alcxnt.sys - 2004-08-03 22:54:52 23,552 ----a-w c:\windows\system32\wdmaud.drv + 2004-08-03 23:44:32 23,552 ----a-w c:\windows\system32\wdmaud.drv . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitComet"="c:\program files\BitComet\BitComet.exe" [2008-12-03 2514744] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-12 342336] "ares"="c:\program files\Ares\Ares.exe" [2008-11-23 880640] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304] "QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-01 185896] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "RTHDCPL"="RTHDCPL.EXE" [2008-05-07 c:\windows\RTHDCPL.EXE] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "EditLevel"= 0 (0x0) "NoCommonGroups"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll "vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproRemote.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproRemote.lnk backup=c:\windows\pss\ComproRemote.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproScheduler.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproScheduler.lnk backup=c:\windows\pss\ComproScheduler.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ComproSchedulerDTV.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\ComproSchedulerDTV.lnk backup=c:\windows\pss\ComproSchedulerDTV.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^TweakYC.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\TweakYC.lnk backup=c:\windows\pss\TweakYC.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] -ra------ 2005-11-28 06:52 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] -ra------ 2005-11-28 06:55 118784 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] -ra------ 2005-11-28 06:55 98304 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2007-01-08 21:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 13:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu] --a------ 2008-10-10 10:50 6500960 c:\program files\Nowe Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2007-03-14 20:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-09-29 16:57 21755688 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-09-01 16:42 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 17:43 69632 c:\windows\ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2008-05-07 14:39 16862208 c:\windows\RTHDCPL.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\EA Sports\\FIFA 08\\FIFA08.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\Program Files\\FIFA09.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Sports Interactive\\Football Manager 2009 Demo\\fm.exe"= "c:\\Documents and Settings\\Piter\\Pulpit\\Skype.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Ares Destiny\\AresDestiny.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12475:TCP"= 12475:TCP:BitComet 12475 TCP "12475:UDP"= 12475:UDP:BitComet 12475 UDP "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "20950:TCP"= 20950:TCP:TORRENT "49438:TCP"= 49438:TCP:torrent "9433:TCP"= 9433:TCP:BitComet 9433 TCP "9433:UDP"= 9433:UDP:BitComet 9433 UDP . Zawartość folderu 'Zaplanowane zadania' 2008-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.atcomet.com/b/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm TCP: {516B060E-FEC8-4FC3-91CF-D8F34D0B0B03} = 80.85.224.2,80.85.224.50 O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd FireFox -: Profile - c:\documents and settings\Ewelina\Dane aplikacji\Mozilla\Firefox\Profiles\icsp1s7t.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin2.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin3.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin4.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin5.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin6.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin7.dll FF -: plugin - c:\program files\MpcStar\Codecs\QuickTime\Plugins\npqtplugin8.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-09 11:15:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe . ************************************************************************** . Czas ukończenia: 2008-12-09 11:17:25 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-09 10:17:23 ComboFix2.txt 2008-12-04 16:13:13 ComboFix3.txt 2008-12-04 09:34:16 Przed: 5 838 000 128 bajtów wolnych Po: 5,864,275,968 bajtów wolnych 291 --- E O F --- 2008-10-08 09:38:45 [code][*][/code]

**Posty:** 18165 · przez **wojtas** 09 Gru 2008, 18:36

i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Files to delete:

c:\windows\system32\vwbtxu.dll

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

potem podmien plik user32.dll zgodnie z instrukcja wyżej ^^ i wroc z logami