wolny komp

**Posty:** 27 · przez **burgund** 19 Lip 2008, 13:20

Jak w temacie komp bardzo zwolnił, dobrze chodzi w trybie awaryjnym.
Wklejam logi:

Kod: Zaznacz wszystko: ComboFix 08-07-17.4 - admin 2008-07-19 13:07:06.5 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.819 [GMT 2:00] Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 ))))))))))))))))))))))))))))))) . 2008-07-05 10:22 . 2008-07-18 22:08 5,304 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-07-04 23:44 . 2008-07-05 08:12 <DIR> d-------- C:\Downloads 2008-06-19 22:47 . 2008-04-23 09:20 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-06-19 22:47 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-06-19 22:47 . 2007-03-08 07:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-06-19 22:47 . 2008-04-23 09:20 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-06-19 22:47 . 2008-04-23 09:20 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-06-19 22:47 . 2008-04-23 09:20 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-06-19 22:47 . 2008-04-23 09:20 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-06-19 22:47 . 2008-04-23 09:20 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-06-19 22:47 . 2008-04-22 09:39 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-19 22:24 . 2008-06-19 22:24 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-19 22:17 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-19 22:17 . 2008-06-15 15:28 81,920 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-06-19 22:17 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-19 11:02 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype 2008-07-19 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-07-18 20:39 4,436 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-07-18 20:39 368,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-18 20:39 27,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-18 20:39 2,981,920 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-18 18:59 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM 2008-07-13 23:21 --------- d-----w C:\Program Files\Winamp 2008-06-18 15:07 --------- d-----w C:\Program Files\Opera 2008-06-17 16:48 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-06-17 16:48 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-06-17 16:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-06-17 16:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-06-17 16:28 --------- d-----w C:\Program Files\3D Fish School 3 2008-06-17 16:09 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\AVG7 2008-06-16 17:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-06-16 17:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-15 18:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-06-15 17:49 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 08:24 --------- d-----w C:\Program Files\Lx_cats 2008-06-05 21:19 --------- d-----w C:\Program Files\MSXML 4.0 2008-05-30 07:10 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-17 07:16 155,995 ----a-w C:\WINDOWS\java\Packages\CBDVZP7D.ZIP 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-05-06 15:56 43,520 ----a-w C:\WINDOWS\system32\bt8x8.dll 2008-05-06 15:56 13,312 ----a-w C:\WINDOWS\buninst.exe 2008-04-25 16:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:43 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-21 07:03 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2008-04-21 07:03 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2008-04-21 07:03 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2008-04-21 07:03 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll 2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-19_23.45.03,20 ))))))))))))))))))))))))))))))))))))))))) . + 2008-02-26 11:49:59 297,984 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\SP2QFE\msctf.dll + 2007-03-06 03:28:35 16,096 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spmsg.dll + 2007-03-06 03:28:40 216,288 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spuninst.exe + 2007-03-06 03:28:33 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\spcustom.dll + 2007-03-06 03:28:58 723,680 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe + 2007-03-06 03:29:50 386,784 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\updspapi.dll + 2007-07-12 23:29:43 765,952 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\SP2QFE\vgx.dll + 2007-03-06 03:28:35 16,096 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\spmsg.dll + 2007-03-06 03:28:40 216,288 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\spuninst.exe + 2007-03-06 03:28:33 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\spcustom.dll + 2007-03-06 03:28:58 723,680 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe + 2007-03-06 03:29:50 386,784 ----a-w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\updspapi.dll - 2008-04-14 15:53:43 273,024 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-06-14 18:01:34 273,024 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2007-03-06 03:28:40 216,288 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe + 2007-03-06 03:29:50 386,784 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll + 2007-08-13 16:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll + 2007-08-13 16:39:00 123,904 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll + 2007-08-13 16:35:46 346,624 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll + 2007-08-13 16:35:38 214,528 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll + 2007-08-13 16:54:10 131,584 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll + 2007-08-13 16:36:26 61,952 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll + 2007-08-13 16:39:06 54,784 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe + 2007-08-13 16:39:26 152,064 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll + 2007-08-13 16:39:54 229,376 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll + 2007-08-13 15:56:54 161,792 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll + 2007-02-12 14:10:12 2,451,312 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dat + 2007-07-11 10:27:48 383,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll + 2007-08-13 16:39:50 382,976 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll + 2007-08-13 16:54:10 6,049,280 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll + 2007-08-13 16:39:10 43,008 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll + 2007-08-13 16:34:04 266,752 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll + 2007-08-13 16:39:10 13,312 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe + 2007-08-13 16:43:56 622,080 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe + 2007-08-13 16:54:10 27,136 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll + 2007-08-13 16:54:10 458,752 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll + 2007-08-13 16:54:10 50,688 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll + 2007-08-13 16:54:12 3,578,368 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll + 2007-08-13 16:54:10 475,648 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll + 2007-08-13 16:44:26 192,000 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll + 2007-08-13 16:54:10 670,720 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll + 2007-08-13 16:44:06 101,376 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll + 2007-08-13 16:36:12 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll + 2007-03-06 03:28:39 216,288 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe + 2007-03-06 03:29:50 386,784 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll + 2007-08-13 16:44:30 105,984 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\url.dll + 2007-08-13 16:54:10 1,162,240 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll + 2007-08-13 16:54:10 231,424 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll + 2007-08-13 16:54:10 818,688 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll + 2008-07-04 22:03:22 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe + 2008-07-04 22:03:22 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2008-07-04 22:03:22 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe - 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe + 2000-08-31 06:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe - 2007-08-13 16:39:00 123,904 ----a-w C:\WINDOWS\system32\advpack.dll + 2008-04-23 07:20:42 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2008-06-18 19:28:44 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-07-19 10:56:09 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-06-18 19:28:44 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-07-19 10:56:09 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2007-08-13 16:39:00 123,904 ------w C:\WINDOWS\system32\dllcache\advpack.dll + 2008-04-23 07:20:42 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll - 2007-08-13 16:35:46 346,624 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-04-23 07:20:42 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2007-08-13 16:35:38 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-04-23 07:20:42 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-08-13 16:54:10 131,584 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-04-23 07:20:42 133,120 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2007-08-13 16:39:26 152,064 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2008-04-23 07:20:42 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2007-08-13 16:39:54 229,376 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2008-04-23 07:20:42 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2007-08-13 16:39:50 382,976 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2008-04-23 07:20:42 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2007-08-13 16:39:10 43,008 ------w C:\WINDOWS\system32\dllcache\iernonce.dll + 2008-04-23 07:20:43 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll - 2007-08-13 16:54:10 27,136 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-04-23 07:20:43 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-02-26 12:01:52 294,912 ------w C:\WINDOWS\system32\dllcache\msctf.dll - 2007-08-13 16:54:10 475,648 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-04-23 07:20:43 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2007-08-13 16:44:26 192,000 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-04-23 07:20:43 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2007-08-13 16:54:10 670,720 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-04-23 07:20:43 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2007-08-13 16:44:06 101,376 ------w C:\WINDOWS\system32\dllcache\occache.dll + 2008-04-23 07:20:43 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll - 2007-08-13 16:36:12 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-04-23 07:20:43 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-08-13 16:44:30 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll + 2008-04-23 07:20:43 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll - 2007-08-13 16:54:10 1,162,240 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-04-23 07:20:43 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2007-08-13 16:54:10 765,952 ----a-w C:\WINDOWS\system32\dllcache\VGX.dll + 2007-07-12 23:32:11 765,952 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll - 2007-08-13 16:54:10 231,424 ------w C:\WINDOWS\system32\dllcache\webcheck.dll + 2008-04-23 07:20:43 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll - 2007-08-13 16:54:10 818,688 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-04-23 07:20:44 826,368 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2007-04-26 08:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-04-26 08:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys - 2007-08-13 16:35:46 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-04-23 07:20:42 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2007-08-13 16:35:38 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-04-23 07:20:42 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2007-08-13 16:54:10 131,584 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-04-23 07:20:42 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll - 2007-08-13 16:36:26 61,952 ------w C:\WINDOWS\system32\icardie.dll + 2008-04-23 07:20:42 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2007-08-13 16:39:06 54,784 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2008-04-22 07:43:26 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2007-08-13 16:39:26 152,064 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2008-04-23 07:20:42 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll - 2007-08-13 16:39:54 229,376 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2008-04-23 07:20:42 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll - 2007-08-13 15:56:54 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll + 2008-04-20 05:07:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll - 2007-02-12 14:10:12 2,451,312 ------w C:\WINDOWS\system32\ieapfltr.dat + 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\system32\ieapfltr.dat - 2007-07-11 10:27:48 383,488 ------w C:\WINDOWS\system32\ieapfltr.dll + 2008-04-23 07:20:42 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2007-08-13 16:39:50 382,976 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2008-04-23 07:20:42 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll - 2007-08-13 16:54:10 6,049,280 ------w C:\WINDOWS\system32\ieframe.dll + 2008-04-23 07:20:42 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll - 2007-08-13 16:39:10 43,008 ----a-w C:\WINDOWS\system32\iernonce.dll + 2008-04-23 07:20:43 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll - 2007-08-13 16:34:04 266,752 ------w C:\WINDOWS\system32\iertutil.dll + 2008-04-23 07:20:43 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2007-08-13 16:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2007-08-13 16:54:10 27,136 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-04-23 07:20:43 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll - 2004-08-03 22:44:04 294,400 ----a-w C:\WINDOWS\system32\msctf.dll + 2008-02-26 12:01:52 294,912 ----a-w C:\WINDOWS\system32\msctf.dll - 2007-08-13 16:54:10 458,752 ------w C:\WINDOWS\system32\msfeeds.dll + 2008-04-23 07:20:43 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2007-08-13 16:54:10 50,688 ------w C:\WINDOWS\system32\msfeedsbs.dll + 2008-04-23 07:20:43 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2007-08-13 16:54:12 3,578,368 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-04-23 23:20:44 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-08-13 16:54:10 475,648 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-04-23 07:20:43 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2007-08-13 16:44:26 192,000 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-04-23 07:20:43 193,024 ----a-w C:\WINDOWS\system32\msrating.dll - 2007-08-13 16:54:10 670,720 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-04-23 07:20:43 671,232 ----a-w C:\WINDOWS\system32\mstime.dll - 2007-08-13 16:44:06 101,376 ----a-w C:\WINDOWS\system32\occache.dll + 2008-04-23 07:20:43 102,912 ----a-w C:\WINDOWS\system32\occache.dll - 2007-08-13 16:36:12 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-04-23 07:20:43 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-08-13 16:44:30 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2008-04-23 07:20:43 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2007-08-13 16:54:10 1,162,240 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-04-23 07:20:43 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2007-08-13 16:54:10 231,424 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-04-23 07:20:43 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll - 2007-08-13 16:54:10 818,688 ----a-w C:\WINDOWS\system32\wininet.dll + 2008-04-23 07:20:44 826,368 ----a-w C:\WINDOWS\system32\wininet.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [BU] "SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-04 17:21 2089808] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-03-26 21:28 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-03-26 21:20 106496] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 14:54 90112] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 10:47 4239360] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768] "LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 22:03 69632] "WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288] "TV Card Remote Control Device Monitor"="C:\WINDOWS\713xRMTMon.exe" [2006-10-11 16:03 352256] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-07 21:03 180269] "KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 15:51 212992] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-22 18:10 155648] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 16:39 196608] "EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 19:24 61440] "PROMon.exe"="PROMon.exe" [2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe] "UC_SMB"="" [BU] "nwiz"="nwiz.exe" [2003-01-10 10:47 315392 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJYSkLd] [BU] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16] R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] S0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] S1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] S2 713xTVCard;SAA7130 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2006-10-11 16:03] S2 bDriver;bDriver;C:\WINDOWS\system32\drivers\bDriver.sys [2008-05-06 17:56] S2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 11:29] S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21] S2 WDMTVTuner;Universal WDM TV Tuner;C:\WINDOWS\system32\drivers\WDMTuner.sys [2006-10-11 16:03] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] *Newly Created Service* - WDMTVTUNER . Contents of the 'Scheduled Tasks' folder "2006-04-18 10:43:15 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 1.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 2.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 3.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe . - - - - ORPHANS REMOVED - - - - BHO-{05D47D24-11BA-41F0-9A9B-782BF7719937} - (no file) BHO-{1542806F-9435-4B72-875D-845A86725465} - (no file) BHO-{21251F50-8877-4B97-937F-C374AE7B20A9} - (no file) BHO-{BA44CBC8-E16A-4F36-B066-4D75699E171D} - (no file) BHO-{F18E2675-283E-444F-868A-FBD15E208968} - (no file) SSODL-xkefqtgs-{3876CBCA-D6C5-4552-8118-F80B70C1DCB0} - (no file) SSODL-rnopbfgt-{AB6B9914-1FC0-4913-AFEF-1E28CEEADD83} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-19 13:09:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run TV Card Remote Control Device Monitor = C:\WINDOWS\713xRMTMon.exe?RtlDllShutdownInProgress???????s??????????8??????????????????????????|???|???????|???|???????????|??6~-?6~????????????P?????????????????????6~??????;~????-?????g?8t??-???,?????;~4?????6~????????????P???????|???E?6~??????????????A???? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-19 13:10:57 ComboFix-quarantined-files.txt 2008-07-19 11:10:39 ComboFix2.txt 2008-07-18 20:16:13 ComboFix3.txt 2008-06-19 22:12:27 Pre-Run: 3,099,295,744 bajtów wolnych Post-Run: 3,094,478,848 bajtów wolnych 326 --- E O F --- 2008-06-19 22:26:13

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:13:10, on 2008-07-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = "xę R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {05D47D24-11BA-41F0-9A9B-782BF7719937} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1542806F-9435-4B72-875D-845A86725465} - (no file) O2 - BHO: (no name) - {21251F50-8877-4B97-937F-C374AE7B20A9} - (no file) O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: (no name) - {BA44CBC8-E16A-4F36-B066-4D75699E171D} - (no file) O2 - BHO: (no name) - {F18E2675-283E-444F-868A-FBD15E208968} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [TV Card Remote Control Device Monitor] C:\WINDOWS\713xRMTMon.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [lxbumon.exe] "C:\Program Files\Lexmark 6200 Series\lxbumon.exe" O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 6200 Series\ezprint.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.mks.com.pl O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: mlJYSkLd - C:\WINDOWS\ O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxbucoms.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe -- End of file - 6466 bytes

Z góry dzięki za pomoc!

**Posty:** 7956 · przez **Magik** 19 Lip 2008, 13:24

wklej do notatnika

Kod: Zaznacz wszystko: C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\Process.exe

zapisz jako CFScript.txt, przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {05D47D24-11BA-41F0-9A9B-782BF7719937} - (no file) O2 - BHO: (no name) - {1542806F-9435-4B72-875D-845A86725465} - (no file) O2 - BHO: (no name) - {21251F50-8877-4B97-937F-C374AE7B20A9} - (no file) O2 - BHO: (no name) - {BA44CBC8-E16A-4F36-B066-4D75699E171D} - (no file) O2 - BHO: (no name) - {F18E2675-283E-444F-868A-FBD15E208968} - (no file)

to na fix w HJT

i odpal Sdfix'a bo trojanki masz

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

**Posty:** 27 · przez **burgund** 19 Lip 2008, 13:44

zanim mi odpisales zrobilem juz skan SDfixem

Kod: Zaznacz wszystko: SmitFraudFix v2.328 Scan done at 13:24:13,39, 2008-07-19 Run from C:\Documents and Settings\admin\Pulpit\Nowy folder\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Motorola SURFboard SB5101 USB Cable Modem - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 193.24.198.1 DNS Server Search Order: 85.128.118.18 HKLM\SYSTEM\CCS\Services\Tcpip\..\{37DC2029-2DEA-453A-8240-1FEC74480E28}: DhcpNameServer=193.24.198.1 85.128.118.18 HKLM\SYSTEM\CS1\Services\Tcpip\..\{37DC2029-2DEA-453A-8240-1FEC74480E28}: DhcpNameServer=193.24.198.1 85.128.118.18 HKLM\SYSTEM\CS3\Services\Tcpip\..\{37DC2029-2DEA-453A-8240-1FEC74480E28}: DhcpNameServer=193.24.198.1 85.128.118.18 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=193.24.198.1 85.128.118.18 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=193.24.198.1 85.128.118.18 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=193.24.198.1 85.128.118.18 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

następnie log z combo

Kod: Zaznacz wszystko: ComboFix 08-07-17.4 - admin 2008-07-19 13:32:06.6 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.764 [GMT 2:00] Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\admin\Pulpit\CFScript.txt [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 ))))))))))))))))))))))))))))))) . 2008-07-19 13:24 . 2008-07-19 13:24 3,844 --a------ C:\WINDOWS\system32\tmp.reg 2008-07-19 13:23 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-07-19 13:23 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-07-19 13:23 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-07-19 13:23 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe 2008-07-19 13:23 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-07-19 13:23 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-07-05 10:22 . 2008-07-18 22:08 5,304 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-07-04 23:44 . 2008-07-05 08:12 <DIR> d-------- C:\Downloads 2008-06-19 22:47 . 2008-04-23 09:20 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-06-19 22:47 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-06-19 22:47 . 2007-03-08 07:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-06-19 22:47 . 2008-04-23 09:20 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-06-19 22:47 . 2008-04-23 09:20 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-06-19 22:47 . 2008-04-23 09:20 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-06-19 22:47 . 2008-04-23 09:20 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-06-19 22:47 . 2008-04-23 09:20 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-06-19 22:47 . 2008-04-22 09:39 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-19 22:24 . 2008-06-19 22:24 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-19 22:17 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-19 22:17 . 2008-06-15 15:28 81,920 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-06-19 22:17 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-19 11:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-19 11:02 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype 2008-07-19 11:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-07-18 20:39 4,436 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-07-18 20:39 368,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-18 20:39 27,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-18 20:39 2,981,920 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-18 18:59 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM 2008-07-13 23:21 --------- d-----w C:\Program Files\Winamp 2008-06-18 15:07 --------- d-----w C:\Program Files\Opera 2008-06-17 16:48 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-06-17 16:48 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-06-17 16:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-06-17 16:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-06-17 16:28 --------- d-----w C:\Program Files\3D Fish School 3 2008-06-17 16:09 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\AVG7 2008-06-16 17:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-06-16 17:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-15 17:49 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 08:24 --------- d-----w C:\Program Files\Lx_cats 2008-06-05 21:19 --------- d-----w C:\Program Files\MSXML 4.0 2008-05-30 07:10 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-17 07:16 155,995 ----a-w C:\WINDOWS\java\Packages\CBDVZP7D.ZIP 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-05-06 15:56 43,520 ----a-w C:\WINDOWS\system32\bt8x8.dll 2008-05-06 15:56 13,312 ----a-w C:\WINDOWS\buninst.exe 2008-04-25 16:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:43 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-21 07:03 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2008-04-21 07:03 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2008-04-21 07:03 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2008-04-21 07:03 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll 2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [BU] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-03-26 21:28 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-03-26 21:20 106496] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 14:54 90112] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 10:47 4239360] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768] "LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 22:03 69632] "WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288] "TV Card Remote Control Device Monitor"="C:\WINDOWS\713xRMTMon.exe" [2006-10-11 16:03 352256] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-07 21:03 180269] "KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 15:51 212992] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-22 18:10 155648] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 16:39 196608] "EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 19:24 61440] "PROMon.exe"="PROMon.exe" [2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe] "UC_SMB"="" [BU] "nwiz"="nwiz.exe" [2003-01-10 10:47 315392 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJYSkLd] [BU] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16] R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] S0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] S1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] S2 713xTVCard;SAA7130 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2006-10-11 16:03] S2 bDriver;bDriver;C:\WINDOWS\system32\drivers\bDriver.sys [2008-05-06 17:56] S2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 11:29] S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21] S2 WDMTVTuner;Universal WDM TV Tuner;C:\WINDOWS\system32\drivers\WDMTuner.sys [2006-10-11 16:03] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] *Newly Created Service* - WDMTVTUNER . Contents of the 'Scheduled Tasks' folder "2006-04-18 10:43:15 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 1.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 2.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 3.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe . - - - - ORPHANS REMOVED - - - - BHO-{05D47D24-11BA-41F0-9A9B-782BF7719937} - (no file) BHO-{21251F50-8877-4B97-937F-C374AE7B20A9} - (no file) BHO-{F18E2675-283E-444F-868A-FBD15E208968} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-19 13:33:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run TV Card Remote Control Device Monitor = C:\WINDOWS\713xRMTMon.exe?RtlDllShutdownInProgress???????s??????????8??????????????????????????|???|???????|???|???????????|??6~-?6~????????????P?????????????????????6~??????;~????-?????g?8t??-???,?????;~4?????6~????????????P???????|???E?6~??????????????A???? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-19 13:34:59 ComboFix-quarantined-files.txt 2008-07-19 11:34:42 ComboFix2.txt 2008-07-19 11:10:58 ComboFix3.txt 2008-07-18 20:16:13 ComboFix4.txt 2008-06-19 22:12:27 Pre-Run: 3,099,947,008 bajtów wolnych Post-Run: 3,089,616,896 bajtów wolnych 166 --- E O F --- 2008-06-19 22:26:13

**Posty:** 8001 · przez **Okocza** 19 Lip 2008, 13:54

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\dumphive.exe Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlJYSkLd]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 7956 · przez **Magik** 19 Lip 2008, 14:02

i zostaje Ci przeskanowac kompa

http://www.programosy.pl/program,avg-anti-spyware.html

i zrobic to by Mariusz

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

btw, screen z msconfig, zakladka autostart, wrzuc screen moze cos da sie wyrzucic :arrow:

**Posty:** 27 · przez **burgund** 19 Lip 2008, 14:40

wstawiam raport z SDFixa bo poprzedbio pomyli lem goz ze SmitfraudFix

zaraz dam loga z Combo tak jak pisze okocza

Kod: Zaznacz wszystko: [b]SDFix: Version 1.206 [/b] Run by admin on 2008-07-19 at 13:59 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-19 14:26:29 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... IPC error: 2 Nie można odnaleźć określonego pliku. scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe:*:Enabled:Sunbelt Firewall GUI" "C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 29 Sep 2004 15,360 A..HR --- "C:\WINDOWS\system32\drivers\NetMotCM.sys" Sat 19 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5e981018652bb577d09bbdd87faec116\BITA.tmp" Fri 18 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8a7603e7cf792509c9ebbd8c74c82553\BIT3.tmp" Wed 4 Oct 2006 3,072,000 A..H. --- "C:\Documents and Settings\admin\Dane aplikacji\U3\temp\Launchpad Removal.exe" [b]Finished![/b]

[ Dodano: Dzisiaj o 14:52 ]
log z combo :

Kod: Zaznacz wszystko: ComboFix 08-07-17.4 - admin 2008-07-19 14:45:53.7 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.824 [GMT 2:00] Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\admin\Pulpit\CFScript.txt [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\dumphive.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\dumphive.exe . ((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 ))))))))))))))))))))))))))))))) . 2008-07-19 13:55 . 2008-07-19 13:55 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-19 13:48 . 2008-07-19 14:31 <DIR> d-------- C:\SDFix 2008-07-19 13:24 . 2008-07-19 13:24 3,844 --a------ C:\WINDOWS\system32\tmp.reg 2008-07-19 13:23 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-07-19 13:23 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-07-19 13:23 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-07-19 13:23 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe 2008-07-19 13:23 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-07-05 10:22 . 2008-07-19 14:31 5,529 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-07-04 23:44 . 2008-07-05 08:12 <DIR> d-------- C:\Downloads 2008-06-19 22:47 . 2008-04-23 09:20 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-06-19 22:47 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-06-19 22:47 . 2007-03-08 07:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-06-19 22:47 . 2008-04-23 09:20 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-06-19 22:47 . 2008-04-23 09:20 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-06-19 22:47 . 2008-04-23 09:20 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-06-19 22:47 . 2008-04-23 09:20 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-06-19 22:47 . 2008-04-23 09:20 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-06-19 22:47 . 2008-04-22 09:39 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-19 22:24 . 2008-06-19 22:24 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-19 22:17 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-19 22:17 . 2008-06-15 15:28 81,920 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-06-19 22:17 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-19 12:41 4,436 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-07-19 12:41 368,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-19 12:41 27,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-19 12:41 2,981,920 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-19 12:40 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype 2008-07-19 12:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-07-19 11:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-18 18:59 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM 2008-07-13 23:21 --------- d-----w C:\Program Files\Winamp 2008-06-18 15:07 --------- d-----w C:\Program Files\Opera 2008-06-17 16:48 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-06-17 16:48 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-06-17 16:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-06-17 16:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-06-17 16:28 --------- d-----w C:\Program Files\3D Fish School 3 2008-06-17 16:09 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\AVG7 2008-06-16 17:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-06-16 17:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-15 17:49 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 08:24 --------- d-----w C:\Program Files\Lx_cats 2008-06-05 21:19 --------- d-----w C:\Program Files\MSXML 4.0 2008-05-30 07:10 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-17 07:16 155,995 ----a-w C:\WINDOWS\java\Packages\CBDVZP7D.ZIP 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-05-06 15:56 43,520 ----a-w C:\WINDOWS\system32\bt8x8.dll 2008-05-06 15:56 13,312 ----a-w C:\WINDOWS\buninst.exe 2008-04-25 16:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:43 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-21 07:03 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2008-04-21 07:03 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2008-04-21 07:03 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2008-04-21 07:03 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll 2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll . ((((((((((((((((((((((((((((( snapshot_2008-07-19_13.10.15.21 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-19 11:55:18 4,030,464 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-19 11:55:18 69,632 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-07-19 11:55:16 4,030,464 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-19 11:55:16 69,632 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-07-19 10:56:09 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-07-19 12:07:29 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-07-19 10:56:09 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-07-19 12:07:29 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [BU] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-03-26 21:28 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-03-26 21:20 106496] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 14:54 90112] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 10:47 4239360] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768] "LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 22:03 69632] "TV Card Remote Control Device Monitor"="C:\WINDOWS\713xRMTMon.exe" [2006-10-11 16:03 352256] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-07 21:03 180269] "KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 15:51 212992] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-22 18:10 155648] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 16:39 196608] "EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 19:24 61440] "PROMon.exe"="PROMon.exe" [2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe] "UC_SMB"="" [BU] "nwiz"="nwiz.exe" [2003-01-10 10:47 315392 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16] R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] S0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] S1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] S2 713xTVCard;SAA7130 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2006-10-11 16:03] S2 bDriver;bDriver;C:\WINDOWS\system32\drivers\bDriver.sys [2008-05-06 17:56] S2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 11:29] S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21] S2 WDMTVTuner;Universal WDM TV Tuner;C:\WINDOWS\system32\drivers\WDMTuner.sys [2006-10-11 16:03] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] *Newly Created Service* - WDMTVTUNER . Contents of the 'Scheduled Tasks' folder "2006-04-18 10:43:15 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 1.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 2.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 3.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-19 14:47:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run TV Card Remote Control Device Monitor = C:\WINDOWS\713xRMTMon.exe?RtlDllShutdownInProgress???????s??????????8??????????????????????????|???|???????|???|???????????|??6~-?6~????????????P?????????????????????6~??????;~????s?????f?8t??s???,?????;~4?????6~????????????P???????|???E?6~??????????????A???? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-19 14:49:32 ComboFix-quarantined-files.txt 2008-07-19 12:49:17 ComboFix2.txt 2008-07-19 11:35:01 ComboFix3.txt 2008-07-19 11:10:58 ComboFix4.txt 2008-07-18 20:16:13 ComboFix5.txt 2008-07-19 12:45:31 Pre-Run: 3,028,127,744 bajtów wolnych Post-Run: 3,017,424,896 bajtów wolnych 180 --- E O F --- 2008-06-19 22:26:13

**Posty:** 7956 · przez **Magik** 19 Lip 2008, 15:04

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\WS2Fix.exe

zapisz jako CFScript.txt, przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

zle wpsialem poprzednia regolke

**Posty:** 27 · przez **burgund** 19 Lip 2008, 15:37

kolejny log z Combo:

Kod: Zaznacz wszystko: ComboFix 08-07-18.5 - admin 2008-07-19 15:24:34.8 - NTFSx86 MINIMAL Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.822 [GMT 2:00] Running from: C:\Documents and Settings\admin\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\admin\Pulpit\CFScript.txt [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\404Fix.exe C:\WINDOWS\system32\IEDFix.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\VACFix.exe C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe . ((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 ))))))))))))))))))))))))))))))) . 2008-07-19 13:55 . 2008-07-19 13:55 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-19 13:48 . 2008-07-19 14:31 <DIR> d-------- C:\SDFix 2008-07-05 10:22 . 2008-07-19 15:16 5,694 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-07-04 23:44 . 2008-07-05 08:12 <DIR> d-------- C:\Downloads 2008-06-19 22:47 . 2008-04-23 09:20 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-06-19 22:47 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-06-19 22:47 . 2007-03-08 07:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-06-19 22:47 . 2008-04-23 09:20 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-06-19 22:47 . 2008-04-23 09:20 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-06-19 22:47 . 2008-04-23 09:20 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-06-19 22:47 . 2008-04-23 09:20 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-06-19 22:47 . 2008-04-23 09:20 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-06-19 22:47 . 2008-04-22 09:39 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-19 22:24 . 2008-06-19 22:24 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-19 22:17 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-19 22:17 . 2008-06-15 15:28 81,920 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-06-19 22:17 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-19 13:16 4,436 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-07-19 13:16 368,672 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-19 13:16 27,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-19 13:16 2,981,920 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-19 13:12 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype 2008-07-19 12:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-07-19 11:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-18 18:59 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM 2008-07-13 23:21 --------- d-----w C:\Program Files\Winamp 2008-06-18 15:07 --------- d-----w C:\Program Files\Opera 2008-06-17 16:48 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-06-17 16:48 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-06-17 16:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-06-17 16:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-06-17 16:28 --------- d-----w C:\Program Files\3D Fish School 3 2008-06-17 16:09 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\AVG7 2008-06-16 17:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-06-16 17:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-15 17:49 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 08:24 --------- d-----w C:\Program Files\Lx_cats 2008-06-05 21:19 --------- d-----w C:\Program Files\MSXML 4.0 2008-05-30 07:10 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-17 07:16 155,995 ----a-w C:\WINDOWS\java\Packages\CBDVZP7D.ZIP 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-05-06 15:56 43,520 ----a-w C:\WINDOWS\system32\bt8x8.dll 2008-05-06 15:56 13,312 ----a-w C:\WINDOWS\buninst.exe 2008-04-25 16:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:43 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-21 07:03 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2008-04-21 07:03 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2008-04-21 07:03 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2008-04-21 07:03 1,055,744 ------w C:\WINDOWS\system32\dllcache\danim.dll 2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll . ((((((((((((((((((((((((((((( snapshot_2008-07-19_13.10.15.21 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-19 11:55:18 4,030,464 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-19 11:55:18 69,632 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-07-19 11:55:16 4,030,464 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-19 11:55:16 69,632 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-07-19 10:56:09 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-07-19 12:07:29 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-07-19 10:56:09 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-07-19 12:07:29 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [BU] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-04-23 17:45 22058792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-03-26 21:28 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-03-26 21:20 106496] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-07 14:54 90112] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-01-10 10:47 4239360] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768] "LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 22:03 69632] "TV Card Remote Control Device Monitor"="C:\WINDOWS\713xRMTMon.exe" [2006-10-11 16:03 352256] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-07 21:03 180269] "KMCONFIG"="C:\Program Files\Keyboard & Mouse Driver\StartAutorun.exe" [2007-03-06 15:51 212992] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-22 18:10 155648] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 16:39 196608] "EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 19:24 61440] "PROMon.exe"="PROMon.exe" [2002-04-18 18:32 73728 C:\WINDOWS\system32\PROMon.exe] "UC_SMB"="" [BU] "nwiz"="nwiz.exe" [2003-01-10 10:47 315392 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16] R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] S0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] S1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] S2 713xTVCard;SAA7130 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys [2006-10-11 16:03] S2 bDriver;bDriver;C:\WINDOWS\system32\drivers\bDriver.sys [2008-05-06 17:56] S2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Keyboard & Mouse Driver\KMWDSrv.exe [2007-04-05 11:29] S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21] S2 WDMTVTuner;Universal WDM TV Tuner;C:\WINDOWS\system32\drivers\WDMTuner.sys [2006-10-11 16:03] S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 10:06] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] *Newly Created Service* - WDMTVTUNER . Contents of the 'Scheduled Tasks' folder "2006-04-18 10:43:15 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 1.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 2.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe "2006-04-18 10:43:16 C:\WINDOWS\Tasks\Przypomnienie o rejestracji 3.job" - C:\WINDOWS\System32\OOBE\oobebaln.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-19 15:27:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run TV Card Remote Control Device Monitor = C:\WINDOWS\713xRMTMon.exe?RtlDllShutdownInProgress???????s??????????8??????????????????????????|???|???????|???|???????????|??6~-?6~????????????P?????????????????????6~??????;~????????8 f?8t??????,?????;~4?????6~????????????P???????|???E?6~??????????????A???? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-19 15:29:33 ComboFix-quarantined-files.txt 2008-07-19 13:29:05 ComboFix2.txt 2008-07-19 12:49:34 ComboFix3.txt 2008-07-19 11:35:01 ComboFix4.txt 2008-07-19 11:10:58 ComboFix5.txt 2008-07-19 13:13:54 Pre-Run: 3,019,804,672 bajtów wolnych Post-Run: 3,008,950,272 bajtów wolnych 184 --- E O F --- 2008-06-19 22:26:13

[/quote]

**Posty:** 7956 · przez **Magik** 19 Lip 2008, 15:46

burgund

jest juz czysto

zrob teraz to co napisalem Ci 3 posty wyzej :arrow:

wolny komp

wolny komp

Kto jest na forum