Wyrzuca mnie z internet explorera i pokazuje błąd

**Posty:** 9 · przez **IWCIU** 04 Sty 2009, 14:20

Witam serdecznie kolegów,
od jakiegoś czasu w trakcie surfowania po internecie nagle wyskakuje mi komunikat z microsoftu o błędzie i po naciśnięciu "wyślij błąd" lub "nie wysyłaj" nagle mnie wyrzuca z explorera. Bardzo mi to utrudnia pracę i denerwuje. proszę o POMOC kolegów.
następny problem to nieprzechodzenie w stan czuwania po zamknięciu klapy laptopa- windows zawisa i nic się nie dzieje:( nie wiem co robić.
poniżej załączam logi combofix oraz hijackthis. dzięki z góry za wszelką pomoc!

Kod: Zaznacz wszystko: ComboFix 09-01-01.02 - mit 2009-01-02 21:13:01.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.1023.557 [GMT 1:00] Uruchomiony z: c:\documents and settings\mit\Desktop\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\INSTALL.LOG . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-02 do 2009-01-02 ))))))))))))))))))))))))))))))) . 2009-01-02 10:34 . 2007-10-21 11:54 289,060 --a------ c:\windows\hplj1010.hi1 2009-01-02 10:34 . 2007-10-21 11:54 19,016 --a------ c:\windows\hplj1010.bu1 2008-12-27 14:44 . 2004-08-04 00:56 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-12-27 14:44 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-12-27 14:44 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-12-27 14:44 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-12-27 14:12 . 2008-12-27 14:12 <DIR> d-------- c:\documents and settings\mit\Application Data\ConvertTemp 2008-12-27 14:11 . 2008-12-27 20:25 <DIR> d-------- c:\documents and settings\mit\Application Data\Samsung 2008-12-27 13:50 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-12-27 13:49 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-12-27 13:41 . 2008-12-27 13:50 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers 2008-12-27 13:41 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-12-04 20:19 . 2008-12-04 20:19 <DIR> d-------- c:\program files\ANSYS_DesignSpace100PL 2008-12-04 20:19 . 2000-10-19 20:14 121,856 --a------ c:\windows\UnGins.exe 2008-12-04 20:15 . 2008-12-04 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Macrovision 2008-12-04 20:08 . 2008-12-04 20:08 <DIR> d-------- c:\documents and settings\mit\Application Data\Ansys 2008-12-04 20:03 . 2005-03-03 22:09 389,120 --------- c:\windows\system32\Codejock.DockingPane.Unicode.9601.ocx 2008-12-04 19:52 . 2008-12-04 20:10 <DIR> d-------- c:\program files\ANSYS Inc . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-02 18:40 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-01-02 18:26 --------- d-----w c:\program files\Spyware Doctor 2009-01-02 09:42 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-02 09:42 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-01-02 09:39 --------- d-----w c:\program files\Java 2009-01-02 09:35 --------- d-----w c:\program files\Hewlett-Packard 2009-01-02 09:32 --------- d-----w c:\program files\Common Files\eDrawings2007 2008-12-31 08:01 --------- d-----w c:\program files\eMule 2008-12-27 12:49 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-10 20:53 --------- d-----w c:\documents and settings\mit\Application Data\SolidWorks 2008-11-02 15:35 --------- d-----w c:\program files\SolidWorks 2008-10-25 11:55 19,067 ----a-w C:\[u]0[/u]xf9.exe 2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:07 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll 2007-03-19 18:13 6,422,611 -c--a-w c:\program files\frostwire-4.13.1.6.windows.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 13:54 1555480 --a------ c:\program files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856] "Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2007-04-16 2115728] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-02-22 216520] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7585792] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 53248] "fscp"="c:\program files\AVC Finger-sensing Pad Driver\fscp.exe" [2006-09-18 995328] "PowerManager"="c:\program files\Power Manager\PM.exe" [2006-09-06 151552] "FuncKey"="c:\program files\Hotkey Management\FuncKey.exe" [2006-09-05 139264] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-04-15 45056] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-01-10 949376] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360] "Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2007-04-16 2115728] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-01-10 15424] R2 ANSYS FLEXlm license manager;ANSYS FLEXlm license manager;c:\progra~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe [2008-12-04 909312] R2 FspadSvc;FspadSvc;c:\program files\AVC Finger-sensing Pad Driver\fspadsvr.exe [2007-01-26 520704] R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;c:\windows\system32\DRIVERS\fspad.sys [2007-01-26 22912] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a15c7952-a68e-11dc-a7fc-00140b05b4f4}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1f5f372-c233-11dd-a9c6-00c0a8ccabbe}] \Shell\AutoRun\command - G:\WDSetup.exe *Newly Created Service* - PROCEXP90 . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.wp.pl/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = <local> uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\imon.dll c:\windows\Downloaded Program Files\SignActivX.ocx - O16 -: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} hxxps://www.bph.pl/pi/components/SignActivX.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-02 21:16:50 Windows 5.1.2600 Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv] "ImagePath"="\??\c:\windows\TEMP\mc21.tmp" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(784) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Czas ukończenia: 2009-01-02 21:18:31 ComboFix-quarantined-files.txt 2009-01-02 20:18:28 Przed: 87 318 159 360 bytes free Po: 88,957,972,480 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 175 --- E O F --- 2008-12-19 16:08:02

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:47:54, on 2009-01-04 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe C:\Program Files\Power Manager\PM.exe C:\Program Files\Hotkey Management\FuncKey.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Program Files\Ansys Inc\Shared Files\Licensing\intel\ansyslmd.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [fscp] C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe O4 - HKLM\..\Run: [FuncKey] "C:\Program Files\Hotkey Management\FuncKey.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230921395578 O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O23 - Service: ANSYS FLEXlm license manager - Macrovision Corporation - C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 9369 bytes

**Posty:** 18165 · przez **wojtas** 04 Sty 2009, 16:18

prosze objąć log w tagi

**Posty:** 9 · przez **IWCIU** 04 Sty 2009, 20:08

witaj,
zrobiłem wszystko wg sugestii, są wklejone dwa odrębne tagi i inaczej nie potrafię.

**Posty:** 8001 · przez **Okocza** 04 Sty 2009, 20:10

IWCIU napisał(a):zrobiłem wszystko wg sugestii, są wklejone dwa odrębne tagi i inaczej nie potrafię.

miały być w tagach 'code' a nie 'quote' - popraw.

**Posty:** 9 · przez **IWCIU** 04 Sty 2009, 20:16

przepraszam i dziękuje, teraz faktycznie lepiej to wygląda,:)
pozdrawiam i proszę o pomoc

**Posty:** 18165 · przez **wojtas** 04 Sty 2009, 20:38

Otworz notatnik i wklej w nim to:

File::
C:\0xf9.exe

Folder::
c:\program files\free-downloads.net
c:\windows\TEMP

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a15c7952-a68e-11dc-a7fc-00140b05b4f4}]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 9 · przez **IWCIU** 04 Sty 2009, 21:12

sznowny kolego poniżej log po czynności wykonanej wg Twojej sugestii. czekam cierpliwie na dalsze instrukcje, dzięki!!!

Kod: Zaznacz wszystko: ComboFix 09-01-01.02 - mit 2009-01-04 19:54:12.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.1023.561 [GMT 1:00] Uruchomiony z: c:\documents and settings\mit\Desktop\ComboFix.exe Użyto następujących komend :: c:\documents and settings\mit\Desktop\CFScript.txt * Utworzono nowy punkt przywracania * Resident AV is active FILE :: C:\[u]0[/u]xf9.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\[u]0[/u]xf9.exe c:\program files\free-downloads.net c:\program files\free-downloads.net\INSTALL.LOG c:\program files\free-downloads.net\tbfree.dll c:\program files\free-downloads.net\toolbar.cfg c:\program files\free-downloads.net\UNWISE.EXE c:\windows\TEMP\exp13.tmp c:\windows\TEMP\T30DebugLogFile.txt c:\windows\TEMP\WGAErrLog.txt c:\windows\TEMP\WGANotify.settings c:\windows\TEMP\xsw2 c:\windows\TEMP . . . . nie udało się usunąć c:\windows\TEMP\rg4sfay . . . . nie udało się usunąć c:\windows\TEMP\ydf8dk . . . . nie udało się usunąć . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-04 do 2009-01-04 ))))))))))))))))))))))))))))))) . 2009-01-04 12:47 . 2009-01-04 12:47 <DIR> d-------- c:\program files\Trend Micro 2009-01-03 11:57 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll 2009-01-03 11:57 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui 2009-01-02 10:34 . 2007-10-21 11:54 289,060 --a------ c:\windows\hplj1010.hi1 2009-01-02 10:34 . 2007-10-21 11:54 19,016 --a------ c:\windows\hplj1010.bu1 2008-12-27 14:44 . 2004-08-04 00:56 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-12-27 14:44 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-12-27 14:44 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-12-27 14:44 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-12-27 14:12 . 2008-12-27 14:12 <DIR> d-------- c:\documents and settings\mit\Application Data\ConvertTemp 2008-12-27 14:11 . 2008-12-27 20:25 <DIR> d-------- c:\documents and settings\mit\Application Data\Samsung 2008-12-27 13:50 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-12-27 13:49 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-12-27 13:41 . 2008-12-27 13:50 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers 2008-12-27 13:41 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-12-04 20:19 . 2008-12-04 20:19 <DIR> d-------- c:\program files\ANSYS_DesignSpace100PL 2008-12-04 20:19 . 2000-10-19 20:14 121,856 --a------ c:\windows\UnGins.exe 2008-12-04 20:15 . 2008-12-04 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Macrovision 2008-12-04 20:08 . 2008-12-04 20:08 <DIR> d-------- c:\documents and settings\mit\Application Data\Ansys 2008-12-04 20:03 . 2005-03-03 22:09 389,120 --------- c:\windows\system32\Codejock.DockingPane.Unicode.9601.ocx 2008-12-04 19:52 . 2008-12-04 20:10 <DIR> d-------- c:\program files\ANSYS Inc . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-04 19:01 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-01-02 18:26 --------- d-----w c:\program files\Spyware Doctor 2009-01-02 09:42 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-02 09:42 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-01-02 09:39 --------- d-----w c:\program files\Java 2009-01-02 09:35 --------- d-----w c:\program files\Hewlett-Packard 2009-01-02 09:32 --------- d-----w c:\program files\Common Files\eDrawings2007 2008-12-31 08:01 --------- d-----w c:\program files\eMule 2008-12-27 12:49 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-10 20:53 --------- d-----w c:\documents and settings\mit\Application Data\SolidWorks 2007-03-19 18:13 6,422,611 -c--a-w c:\program files\frostwire-4.13.1.6.windows.exe . ((((((((((((((((((((((((((((( snapshot@2009-01-02_21.17.40,87 ))))))))))))))))))))))))))))))))))))))))) . + 2009-01-04 09:51:35 91,488 ----a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath.Xml\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.Xml.dll + 2009-01-04 09:51:34 103,776 ----a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.dll - 2007-03-01 06:36:07 64,088 -c--a-w c:\windows\assembly\GAC\Microsoft.Vbe.Interop\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll + 2009-01-04 09:48:57 66,936 ----a-w c:\windows\assembly\GAC\Microsoft.Vbe.Interop\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll - 2007-03-01 06:36:07 223,800 -c--a-w c:\windows\assembly\GAC\office\11.0.0.0__71e9bce111e9429c\OFFICE.DLL + 2009-01-04 09:48:28 226,656 ----a-w c:\windows\assembly\GAC\office\11.0.0.0__71e9bce111e9429c\OFFICE.DLL + 2003-07-15 10:13:58 166,456 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\ACCWIZ.DLL + 2003-07-15 05:43:20 87,616 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\ADDRPARS.DLL + 2003-07-15 05:57:34 38,968 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\AUTHZAX.DLL + 2003-07-15 05:53:06 94,768 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\AW.DLL + 2003-07-15 02:14:28 350,264 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\CDLMSO.DLL + 2003-07-15 10:18:12 47,160 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\DFUICOM.EXE + 2003-07-26 01:57:20 75,832 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\DLGSETP.DLL + 2003-07-15 05:56:54 14,904 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\DSITF.DLL + 2003-07-15 05:57:14 98,360 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\DSSM.EXE + 2003-07-31 22:19:52 131,648 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\ENVELOPE.DLL + 2003-08-13 09:34:38 10,073,144 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\EXCEL.EXE + 2003-07-15 05:41:44 13,368 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FINDER.EXE + 2003-08-03 17:56:16 1,146,184 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FM20.DLL + 2003-07-24 06:01:40 1,949,240 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FPCUTL.DLL + 2003-07-15 06:36:14 186,424 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FPDTC.DLL + 2003-07-15 05:40:12 179,768 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FPERSON.DLL + 2003-07-26 02:00:16 1,157,696 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FPSRVUTL.DLL + 2003-07-26 02:14:50 799,288 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\FPWEC.DLL + 2003-07-15 06:11:42 2,139,192 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\GRAPH.EXE + 2003-07-14 21:57:44 87,096 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\IEAWSDC.DLL + 2003-07-15 05:53:50 161,336 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\IETAG.DLL + 2003-07-24 05:32:32 121,400 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\IMPMAIL.DLL + 2003-08-01 22:07:36 4,815,424 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\INFOPATH.EXE + 2003-07-15 05:45:14 58,944 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\INLAUNCH.DLL + 2003-05-28 22:42:48 514,680 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\INTLNAME.DLL + 2003-06-19 00:31:44 758,784 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MDIGRAPH.DLL + 2003-06-18 16:31:10 252,928 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MDIINK.DLL + 2003-06-19 00:31:48 17,920 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MDIMON.DLL + 2003-06-19 00:31:48 18,944 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MDIPPR.DLL + 2003-06-19 00:31:46 35,328 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MDIUI.DLL + 2003-06-18 16:31:34 443,904 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MDIVWCTL.DLL + 2003-05-28 22:42:50 342,616 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\METCONV.DLL + 2003-07-15 05:46:08 176,696 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MIMEDIR.DLL + 2003-08-15 07:54:08 6,627,392 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSACCESS.EXE + 2003-07-15 10:13:58 130,112 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSAEXP30.DLL + 2003-07-14 21:58:04 230,968 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSCDM.DLL + 2003-07-15 05:51:50 116,288 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSCONV97.DLL + 2002-12-17 18:08:50 359,600 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSDMENG.DLL + 2002-12-17 18:08:54 1,383,592 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSDMINE.DLL + 2003-07-15 05:51:44 87,104 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSENCODE.DLL + 2003-07-15 10:14:00 139,328 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSJSPP40.DLL + 2002-04-09 19:14:36 187,560 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSMDUN80.DLL + 2003-07-15 05:52:52 17,464 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSMH.DLL + 2003-08-08 07:23:16 12,172,336 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSO.DLL + 2003-07-14 21:57:16 120,888 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOAUTH.DLL + 2003-07-15 02:14:18 106,552 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOCF.DLL + 2003-07-23 21:35:26 127,032 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOCFU.DLL + 2003-07-15 05:52:52 27,704 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSODCW.DLL + 2003-07-15 05:44:06 25,144 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOEURO.DLL + 2003-07-15 05:52:56 55,360 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOHTMED.EXE + 2002-12-17 18:09:24 2,071,752 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOLAP80.DLL + 2003-07-15 10:18:52 376,888 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSORUN.DLL + 2003-07-14 21:52:54 28,224 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOSTYLE.DLL + 2003-07-15 05:52:52 35,896 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOSV.DLL + 2003-07-15 05:53:20 39,488 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOSVFBR.DLL + 2003-07-15 05:46:16 42,040 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOXEV.DLL + 2003-07-15 05:45:12 55,360 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOXMLED.EXE + 2003-07-15 05:45:12 39,488 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSOXMLMF.DLL + 2003-06-18 16:31:24 1,033,216 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSPCORE.DLL + 2003-06-18 16:31:50 16,384 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSPGIMME.DLL + 2003-07-28 19:24:40 5,677,112 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSPUB.EXE + 2003-06-19 15:05:50 364,648 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSPVIEW.EXE + 2003-07-15 05:52:58 41,528 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSSH.DLL + 2003-07-15 06:02:14 627,256 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSTORDB.EXE + 2003-07-15 05:56:24 124,984 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSTORE.EXE + 2003-07-24 05:40:00 482,872 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSTORES.DLL + 2003-07-15 06:00:54 145,984 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\MSWEBCAP.DLL + 2003-07-15 05:57:10 56,888 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\NAME.DLL + 2003-07-15 05:56:52 13,888 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\NPOFFICE.DLL + 2007-03-01 06:36:07 223,800 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OFFICE.DLL + 2003-07-15 10:14:26 283,696 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OIS.EXE + 2003-07-15 10:14:26 828,472 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OISAPP.DLL + 2003-07-15 10:14:26 27,192 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OISCTRL.DLL + 2003-07-15 10:14:26 242,240 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OISGRAPH.DLL + 2003-07-15 06:05:24 1,054,264 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OMFC.DLL + 2003-07-15 05:41:56 24,640 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLACCT.DLL + 2003-07-15 05:44:34 102,968 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLCTL.DLL + 2003-07-07 20:36:00 2,058,343 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DAT + 2003-07-08 18:48:00 115,288 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DLL + 2003-08-10 06:06:42 7,522,360 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLLIB.DLL + 2003-07-15 05:44:32 88,128 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLMIME.DLL + 2003-07-15 05:45:18 196,152 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLOOK.EXE + 2003-07-15 05:43:48 139,320 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLPH.DLL + 2003-07-15 05:43:18 64,056 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLRPC.DLL + 2003-07-15 05:43:16 49,208 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OUTLWAB.DLL + 2003-08-04 20:19:34 7,330,360 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OWC10.DLL + 2003-08-01 22:09:04 8,086,072 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\OWC11.DLL + 2003-07-30 19:40:40 6,133,312 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\POWERPNT.EXE + 2003-07-15 10:18:54 430,136 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PP4X322.DLL + 2003-07-15 10:18:44 93,752 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PP7X32.DLL + 2003-07-31 22:21:08 1,782,840 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PPTVIEW.EXE + 2003-07-15 05:40:26 130,104 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PRTF9.DLL + 2003-07-15 05:51:12 604,728 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PTXT9.DLL + 2003-07-15 05:50:26 551,480 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PUBCONV.DLL + 2003-07-15 05:40:16 51,256 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\PUBTRAP.DLL + 2003-07-15 05:42:26 37,432 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\RECALL.DLL + 2003-05-09 04:54:00 77,824 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\REFEDIT.DLL + 2003-07-15 05:57:08 40,512 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\REFIEBAR.DLL + 2003-07-15 05:43:30 74,288 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\RM.DLL + 2003-07-21 18:46:38 390,712 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\RTFHTML.DLL + 2003-07-15 05:44:16 66,616 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\SENDTO.DLL + 2003-07-14 21:57:08 58,944 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\SEQCHK10.DLL + 2003-07-15 05:53:14 11,848 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\SMARTTAGINSTALL.EXE + 2003-08-06 20:26:18 445,488 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\SOA.DLL + 2003-08-03 17:52:32 2,808,376 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\STSLIST.DLL + 2003-07-15 06:00:22 99,904 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\TRANSMGR.DLL + 2003-07-03 14:19:36 2,502,656 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\VBE6.DLL + 2007-03-01 06:36:07 64,088 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\VBIDEPIA.DLL + 2003-08-06 20:24:20 12,037,688 ----a-r c:\windows\Installer\$PatchCache$\Managed\5140110900063D11C8EF10054038389C\11.0.5614\WINWORD.EXE - 2007-03-01 06:36:57 593,920 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2009-01-04 09:54:08 593,920 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2007-03-01 06:36:57 12,288 -c--a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2009-01-04 09:54:08 12,288 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2007-03-01 06:36:57 86,016 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2009-01-04 09:54:09 86,016 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2007-03-01 06:36:57 135,168 -c--a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\misc.exe + 2009-01-04 09:54:07 135,168 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\misc.exe - 2007-03-01 06:36:57 11,264 -c--a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2009-01-04 09:54:09 11,264 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2007-03-01 06:36:57 27,136 -c--a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2009-01-04 09:54:09 27,136 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2007-03-01 06:36:57 4,096 -c--a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2009-01-04 09:54:09 4,096 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2007-03-01 06:36:57 794,624 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2009-01-04 09:54:09 794,624 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2007-03-01 06:36:57 249,856 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2009-01-04 09:54:08 249,856 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2007-03-01 06:36:57 61,440 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2009-01-04 09:54:07 61,440 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2007-03-01 06:36:57 23,040 -c--a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2009-01-04 09:54:10 23,040 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2007-03-01 06:36:57 286,720 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2009-01-04 09:54:07 286,720 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2007-03-01 06:36:57 409,600 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2009-01-04 09:54:06 409,600 ----a-r c:\windows\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2001-07-14 16:32:24 69,632 ----a-w c:\windows\setup.pss\setupupd\temp\wsdueng.dll - 2003-08-03 17:56:16 1,146,184 ----a-w c:\windows\system32\FM20.DLL + 2007-06-06 09:53:34 1,195,888 ----a-w c:\windows\system32\FM20.DLL - 2003-07-15 05:57:04 32,584 ----a-w c:\windows\system32\FM20ENU.DLL + 2007-03-22 18:17:04 35,440 ----a-w c:\windows\system32\FM20ENU.DLL - 2008-10-22 13:38:16 399,144 ----a-w c:\windows\system32\FNTCACHE.DAT + 2009-01-04 10:00:43 399,144 ----a-w c:\windows\system32\FNTCACHE.DAT - 2007-03-15 16:19:28 1,476,992 ------w c:\windows\system32\LegitCheckControl.dll + 2008-03-20 17:06:36 1,480,232 ------w c:\windows\system32\LegitCheckControl.dll - 2003-06-19 00:31:48 17,920 ----a-w c:\windows\system32\mdimon.dll + 2007-04-09 12:23:54 28,040 ----a-w c:\windows\system32\mdimon.dll - 2003-06-19 00:31:44 758,784 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mdigraph.dll + 2007-04-09 12:24:04 758,664 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mdigraph.dll - 2003-06-19 00:31:46 35,328 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mdiui.dll + 2007-04-09 12:23:58 46,472 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mdiui.dll - 2003-06-19 00:31:44 758,784 -c--a-w c:\windows\system32\spool\drivers\w32x86\mdigraph.dll + 2007-04-09 12:24:04 758,664 ----a-w c:\windows\system32\spool\drivers\w32x86\mdigraph.dll - 2003-06-19 00:31:46 35,328 -c--a-w c:\windows\system32\spool\drivers\w32x86\mdiui.dll + 2007-04-09 12:23:58 46,472 ----a-w c:\windows\system32\spool\drivers\w32x86\mdiui.dll - 2003-06-19 00:31:48 18,944 ----a-w c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll + 2007-04-09 12:23:54 28,552 ----a-w c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856] "Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2007-04-16 2115728] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-02-22 216520] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7585792] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 53248] "fscp"="c:\program files\AVC Finger-sensing Pad Driver\fscp.exe" [2006-09-18 995328] "PowerManager"="c:\program files\Power Manager\PM.exe" [2006-09-06 151552] "FuncKey"="c:\program files\Hotkey Management\FuncKey.exe" [2006-09-05 139264] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-04-15 45056] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-01-10 949376] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360] "Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2007-04-16 2115728] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"= "c:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-01-10 15424] R2 ANSYS FLEXlm license manager;ANSYS FLEXlm license manager;c:\progra~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe [2008-12-04 909312] R2 FspadSvc;FspadSvc;c:\program files\AVC Finger-sensing Pad Driver\fspadsvr.exe [2007-01-26 520704] R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;c:\windows\system32\DRIVERS\fspad.sys [2007-01-26 22912] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1f5f372-c233-11dd-a9c6-00c0a8ccabbe}] \Shell\AutoRun\command - G:\WDSetup.exe . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.wp.pl/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = <local> uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\imon.dll c:\windows\Downloaded Program Files\SignActivX.ocx - O16 -: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} hxxps://www.bph.pl/pi/components/SignActivX.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-04 20:02:35 Windows 5.1.2600 Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1577463664-3418726585-640939880-1005\Software\Microsoft\SystemCertificates\AddressBook*NULL*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_USERS\S-1-5-21-1577463664-3418726585-640939880-1005\Software\Policies\Microsoft\SystemCertificates\AddressBook*NULL*] @Allowed: (Read) (S-1-5-21-1577463664-3418726585-640939880-1005) @Allowed: (Read) (S-1-5-21-1577463664-3418726585-640939880-1005) @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(788) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\rundll32.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\windows\ehome\ehrecvr.exe c:\program files\ANSYS Inc\Shared Files\Licensing\intel\ansyslmd.exe c:\windows\ehome\ehSched.exe c:\program files\Eset\nod32krn.exe c:\windows\system32\nvsvc32.exe c:\program files\Spyware Doctor\sdhelp.exe c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\windows\ehome\mcrdsvc.exe c:\windows\ehome\ehmsas.exe c:\windows\system32\dllhost.exe . ************************************************************************** . Czas ukończenia: 2009-01-04 20:08:47 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-04 19:08:43 ComboFix2.txt 2009-01-02 20:18:33 Przed: 87 771 275 264 bytes free Po: 87,889,981,440 bajtów wolnych 352 --- E O F --- 2009-01-04 09:54:12

**Posty:** 18165 · przez **wojtas** 04 Sty 2009, 21:44

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 9 · przez **IWCIU** 04 Sty 2009, 22:33

OK, zrobilem wszystko ale teraz nie wiem jak mam zrobić skan tym kasperskim - czy opcją on-line czy opcją file scan, co dokładnie mam przeskanować w mój komputer?

**Posty:** 18165 · przez **wojtas** 04 Sty 2009, 23:19

online

**Posty:** 9 · przez **IWCIU** 05 Sty 2009, 00:08

szanowny kolego Wojtas,
Przepraszam ale za szybko podałem informacje o tym, że Kasperski nic nie znalazł, właśnie widzę 3 infekcje i jest 79% więc jutro zamieszcze raport po zakończeniu, myślałem że jeśli jest ponad 70% i nic nie ma, to już nie znajdze i nagle wywaliło 3 infekcje, sorki
poniżej log z fixIEDef, a potem załącze raport z kasperskiego

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.7238 * * * ******************************************************************************** Created at 21:36:27 on Sunday, January 04, 2009 Time Zone : (GMT+01:00) Sarajevo, Skopje, Warsaw, Zagreb Logged On User : mit Operating System : Microsoft Windows XP Professional Service Pack 2 OS Version : 5.1.2600 System Langauge : English (United States) Keyboard Layout : English (United States) Processor : X86 AMD Turion(tm) 64 X2 Mobile Technology TL-52 System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : 472657 System Drive Size : 152.63 GB System Drive Free : 83.79 GB Total Physical Memory: 1023 MB Free Physical Memory : 574 MB Total Page File : 1023 MB Free Page File : 1989 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1967 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\ikhcore.log C:\WINDOWS\system32\Uninstall.ico -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Dodano Dzisiaj, 06:33:
Kolego Wojtas załączam ponownie log z fixiedoraz raport txt po skanowaniu kasperskim,
czekam na wskazówki i pozdrawiam

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.7238 * * * ******************************************************************************** Created at 21:36:27 on Sunday, January 04, 2009 Time Zone : (GMT+01:00) Sarajevo, Skopje, Warsaw, Zagreb Logged On User : mit Operating System : Microsoft Windows XP Professional Service Pack 2 OS Version : 5.1.2600 System Langauge : English (United States) Keyboard Layout : English (United States) Processor : X86 AMD Turion(tm) 64 X2 Mobile Technology TL-52 System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : 472657 System Drive Size : 152.63 GB System Drive Free : 83.79 GB Total Physical Memory: 1023 MB Free Physical Memory : 574 MB Total Page File : 1023 MB Free Page File : 1989 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1967 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\ikhcore.log C:\WINDOWS\system32\Uninstall.ico -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 poniedziałek, 5 styczeń 2009 System operacyjny: Microsoft Windows XP Professional Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Sunday, January 04, 2009 20:14:08 Liczba wpisów: 1559758 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: C:\ D:\ E:\ F:\ Statystyki skanowania: Przeskanowanych plików: 127844 Nazwa zagrożenia: 4 Zainfekowanych obiektów: 4 Podejrzanych obiektów: 0 Czas skanowania: 04:01:06 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\Program Files\Eset\infected\1B5ECUAA.NQF Zainfekowany: P2P-Worm.Win32.Kapucen.ac 1 C:\Program Files\Eset\infected\JDG04MDA.NQF Zainfekowany: Backdoor.Win32.Agent.aou 1 C:\Program Files\Eset\infected\T34Z4QBA.NQF Zainfekowany: Trojan-Downloader.Win32.VB.hww 1 C:\sdstart.exe Zainfekowany: not-a-virus:Monitor.Win32.KeyLogger.dq 1 Wybrany obszar został przeskanowany.

Dodano Dzisiaj, 19:46:
kolego Wojtas, sorki że naciskam ale prosze o pomoc
wczoraj zamieściłem to co mi kazałeś i czekam, czekam...

Dodano Dzisiaj, 20:26:
help

**Posty:** 18165 · przez **wojtas** 05 Sty 2009, 21:30

te plik/i :

C:\sdstart.exe

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow oraz oproznij folder: C:\Program Files\Eset\infected

**Posty:** 9 · przez **IWCIU** 05 Sty 2009, 21:54

witaj, podaje raporty ze skanów

Kod: Zaznacz wszystko: Scan taken on 05 Jan 2009 19:38:03 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found not-a-virus:Monitor.Win32.KeyLogger.dq (6, 2, 604) G DATA Found nothing Ikarus Found not-a-virus:Monitor.Win32.Keylogger.dq Kaspersky Anti-Virus Found not-a-virus:Monitor.Win32.KeyLogger.dq NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.0.0.73 2009.01.05 Riskware.Monitor.Win32.Keylogger.dq!IK AhnLab-V3 2009.1.5.3 2009.01.05 - AntiVir 7.9.0.45 2009.01.05 - Authentium 5.1.0.4 2009.01.05 - Avast 4.8.1281.0 2009.01.05 - AVG 8.0.0.199 2009.01.05 - BitDefender 7.2 2009.01.05 - CAT-QuickHeal 10.00 2009.01.05 - ClamAV 0.94.1 2009.01.05 - Comodo 878 2009.01.05 - DrWeb 4.44.0.09170 2009.01.05 - eTrust-Vet 31.6.6289 2009.01.02 - Ewido 4.0 2008.12.31 - F-Prot 4.4.4.56 2009.01.05 - F-Secure 8.0.14470.0 2009.01.05 Monitor.Win32.KeyLogger.dq Fortinet 3.117.0.0 2009.01.05 Keylog/KeyLogger GData 19 2009.01.05 - Ikarus T3.1.1.45.0 2009.01.05 not-a-virus:Monitor.Win32.Keylogger.dq K7AntiVirus 7.10.576 2009.01.05 - Kaspersky 7.0.0.125 2009.01.05 not-a-virus:Monitor.Win32.KeyLogger.dq McAfee 5485 2009.01.05 - McAfee+Artemis 5485 2009.01.05 - Microsoft 1.4205 2009.01.05 - NOD32 3739 2009.01.05 - Norman 5.80.02 2009.01.02 - Panda 9.0.0.4 2009.01.05 - PCTools 4.4.2.0 2009.01.05 - Prevx1 V2 2009.01.05 - Rising 21.11.02.00 2009.01.05 - SecureWeb-Gateway 6.7.6 2009.01.05 - Sophos 4.37.0 2009.01.05 - Sunbelt 3.2.1809.2 2008.12.22 - Symantec 10 2009.01.05 - TheHacker 6.3.1.4.205 2009.01.05 - TrendMicro 8.700.0.1004 2009.01.05 - VBA32 3.12.8.10 2009.01.05 - ViRobot 2009.1.5.1544 2009.01.05 - VirusBuster 4.5.11.0 2009.01.05 -

Dodano Dzisiaj, 19:32:
witam kolego Wojtas,
jestem gotowy do następnych kroków, czekam niecierpliwie,
pozdawiam

Dodano Dzisiaj, 21:05:
Hello Wojtas,

SOrki, że przeszkadzam ale poszę o informację czy coś jeszcze możemy zrobić czy to już wsystko
póki co zapuściłem ponownie scanowanie kasperskim.

pozdro