Wyskakujące pop-up'y i niedziałający ie

**Posty:** 216 · przez **dArtal** 09 Wrz 2008, 14:13

Witam!

Proszę o sprawdzenie log'a. Przy każdym uruchomieniu komputera na ekranie pojawiają mi się jakieś durne reklamy. A ponadto od wczoraj nie działa IE. Wiem, że generalnie powinienem sie z tego cieszyć bo teraz mogę używać Mozilli :wink:

ale innym domownikom troszkę to przeszkadza. A konkretnie jak go otwieram to strasznie długo wczytuje stronę startową (bez różnicy jak zmieniłem stronę startową na inną), lecz potem działa normalnie.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:08:22, on 2007-09-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\BearShare\BearShare.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Vista Drive Icon\DrvIcon.exe C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wp.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Rmn plugin - {2FDA60DF-6D94-4f16-A48C-3C4EC57FEF58} - symdb32.dll (file missing) O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - Startup: Thoosje Vista Sidebar.lnk = C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

**Posty:** 684 · przez **djarta** 09 Wrz 2008, 15:05

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Rmn plugin - {2FDA60DF-6D94-4f16-A48C-3C4EC57FEF58} - symdb32.dll (file missing)
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

Pobierz ComboFix ,ale nie uruchamiaj

Wklej do Notatnika:

Kod: Zaznacz wszystko: Folder:: C:\Program Files\MyGlobalSearch

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

========================
K.

**Posty:** 216 · przez **dArtal** 09 Wrz 2008, 18:31

Usunąłem wskazane log, utworzyłem CFScprit i jak go przeciągam na ikonę CF'a to pojawia mi się błąd:

Jednak po usunięciu wskazanych logów problem przestał występować.

**Posty:** 684 · przez **djarta** 09 Wrz 2008, 18:47

1) Usuń tego ComboFixa i pobierz ponownie.
2) Po pobraniu zapisz go tak: Combo-Fix.exe, z kreseczką pomiędzy.
3) Wyłącz wszystkie programy.
4) Zmień wstecz datę o parę miesięcy/lat.
5) Rób wszystko w trybie awaryjnym.

================================
K.

**Posty:** 216 · przez **dArtal** 12 Wrz 2008, 22:32

No! Udało się. CF przeskanował i pousuwał brzydkie pliki. Oto log z CF'a po czyszczeniu:

Kod: Zaznacz wszystko: ComboFix 08-09-11.02 - Piotru 2008-09-12 22:23:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1522 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Piotru.PIOTR-101C5F109\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Piotru.PIOTR-101C5F109\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\administrator@t.ifilm[1].txt C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\administrator@www.gomusic[2].txt C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\piotruś@clicktorrent[2].txt C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\piotruś@tradedoubler[1].txt C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\WINDOWS\system32\ps1.dat C:\WINDOWS\system32\rc.dat . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-12 do 2008-09-12 ))))))))))))))))))))))))))))))) . 2008-08-28 20:08 . <DIR> C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\SecuROM 2008-08-28 20:08 . 2008-08-28 20:08 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-08-26 17:07 . 2008-08-26 17:07 36,864 --a------ C:\WINDOWS\system32\symdb32.dll 2008-08-26 17:01 . 2008-08-26 17:01 <DIR> d-------- C:\Program Files\Yahoo! 2008-08-26 17:01 . <DIR> C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Yahoo! 2008-08-26 17:01 . 2008-08-26 17:01 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Yahoo! Companion 2008-08-26 09:43 . 2008-08-26 09:43 1 --a------ C:\WINDOWS\system32\bb1.dat 2008-08-26 00:49 . 2008-08-26 00:49 36,864 --a------ C:\WINDOWS\system32\nokia32.dll 2008-08-26 00:49 . 2008-08-26 17:07 4,544 --a------ C:\WINDOWS\system32\gh.dat 2008-08-23 22:11 . 2005-07-07 16:25 81,728 -ra------ C:\WINDOWS\system32\drivers\k750mgmt.sys 2008-08-23 22:10 . 2005-07-07 16:25 89,872 -ra------ C:\WINDOWS\system32\drivers\k750mdm.sys 2008-08-23 22:10 . 2005-07-07 16:25 79,488 -ra------ C:\WINDOWS\system32\drivers\k750obex.sys 2008-08-23 22:10 . 2005-07-07 16:26 6,576 -ra------ C:\WINDOWS\system32\drivers\k750mdfl.sys 2008-08-23 22:10 . 2005-07-07 16:26 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cmnt.sys 2008-08-23 22:10 . 2005-07-07 16:26 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cm.sys 2008-08-23 22:09 . 2005-07-07 16:26 55,216 -ra------ C:\WINDOWS\system32\drivers\k750bus.sys 2008-08-23 22:09 . 2005-07-07 16:25 5,744 -ra------ C:\WINDOWS\system32\drivers\k750whnt.sys 2008-08-23 22:09 . 2005-07-07 16:25 5,744 -ra------ C:\WINDOWS\system32\drivers\k750wh.sys 2008-08-13 16:25 . 2008-08-13 16:25 <DIR> d-------- C:\Program Files\Common Files\DirectX 2008-08-13 16:24 . 2008-08-13 16:24 <DIR> d-------- C:\WINDOWS\USB Vibration 2008-08-13 16:24 . 2008-08-13 16:24 <DIR> d-------- C:\Program Files\USB Vibration 2008-08-13 16:24 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-08-13 16:24 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-12 19:54 233,472 ----a-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT 2008-09-12 19:54 233,472 ----a-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT 2008-08-26 15:01 --------- d-----w C:\Program Files\DivX 2008-08-13 14:24 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-11 18:59 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-08-11 18:30 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Sun 2008-08-11 18:21 --------- d-----w C:\Program Files\Java 2008-08-10 12:16 --------- d-----w C:\Program Files\PhotoScape 2008-08-10 12:08 --------- d-----w C:\Program Files\SubEdit-Player 2008-08-08 17:53 --------- d-s---w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Microsoft 2008-08-08 17:51 286,720 ----a-w C:\WINDOWS\iun505.exe 2008-08-08 17:51 --------- d-----w C:\Program Files\InterCover 2008-08-08 17:35 --------- d-----w C:\Program Files\Ahead 2008-08-08 16:03 --------- d-----w C:\Program Files\Apple Software Update 2008-08-08 12:56 --------- d-----w C:\Program Files\Vista Drive Icon 2008-08-07 11:25 --------- d-----w C:\Program Files\Thoosje Sidebar V2.3 2008-08-06 21:41 --------- d-----w C:\Program Files\Safari 2008-08-06 21:41 --------- d-----w C:\Program Files\Bonjour 2008-08-06 20:00 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\ViStart 2008-08-06 13:29 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Ahead 2008-08-04 11:52 --------- d-----w C:\Program Files\iTunes 2008-08-04 11:51 --------- d-----w C:\Program Files\iPod 2008-08-01 08:55 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-07-31 13:35 --------- d-----w C:\Program Files\BitComet 2008-07-31 13:31 --------- d-----w C:\Program Files\BearShare 2008-07-31 13:24 271,360 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2008-07-31 13:24 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys 2008-07-31 13:18 --------- d-----w C:\Program Files\DAEMON Tools Toolbar 2008-07-31 13:15 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-07-31 13:15 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\DAEMON Tools 2008-07-30 21:31 --------- d-----w C:\Program Files\Google 2008-07-30 19:36 --------- d-----w C:\Program Files\Skype 2008-07-30 19:36 --------- d-----w C:\Program Files\Common Files\Skype 2008-07-30 19:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype 2008-07-30 19:14 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Google 2008-07-29 19:42 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Adobe 2008-07-28 22:00 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\ATI 2008-07-28 22:00 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ATI 2008-07-28 21:42 --------- d-----w C:\Program Files\Realtek 2008-07-28 21:41 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-28 21:30 --------- d-----w C:\Program Files\ATI 2008-07-28 21:28 --------- d-----w C:\Program Files\ATI Technologies 2008-07-28 21:13 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Apple Computer 2008-07-28 21:13 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2008-07-28 21:11 --------- d-----w C:\Program Files\QuickTime 2008-07-28 21:10 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple 2008-07-28 20:46 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Talkback 2008-07-28 20:46 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Mozilla 2008-07-28 20:43 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Macromedia 2008-07-28 20:31 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Identities 2008-07-28 20:22 --------- d-----w C:\Program Files\Usługi online 2008-07-28 19:40 --------- d-----w C:\Program Files\BrowsingAdvisor 2008-07-28 19:10 --------- d-----w C:\Program Files\PeerGuardian2 2008-07-28 13:58 --------- d-----w C:\Program Files\Spyware Doctor 2008-07-28 11:35 --------- d-----w C:\Program Files\Search Spider 2008-07-28 11:31 --------- d-----w C:\Program Files\Zone Labs 2008-07-28 11:13 --------- d-----w C:\Program Files\Alwil Software 2008-07-28 10:44 --------- d-----w C:\Program Files\uTorrent 2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-16 17:14 16,806,400 ----a-w C:\WINDOWS\RTHDCPL.exe 2008-07-16 16:52 4,747,776 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys 2008-07-15 11:47 1,196,032 ----a-w C:\WINDOWS\RtlUpd.exe 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-04 03:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-07-04 03:25 421,888 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-07-04 03:23 309,248 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-07-04 03:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-07-04 03:14 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-07-04 03:14 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-07-04 03:13 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-07-04 03:13 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-07-04 03:12 561,152 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-07-04 03:10 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-07-04 03:06 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-07-04 03:00 3,786,144 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-07-04 02:55 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-07-04 02:49 2,140,672 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-07-04 02:34 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-07-04 02:30 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-07-04 02:29 32,768 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-07-04 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-07-04 02:25 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-07-04 02:22 565,248 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-07-03 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-19 14:42 2,808,832 ----a-w C:\WINDOWS\alcwzrd.exe 2008-06-19 14:27 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2008-06-19 14:20 57,344 ----a-w C:\WINDOWS\Alcmtr.exe 2008-06-18 16:01 77,824 ----a-w C:\WINDOWS\SoundMan.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-07-30 171448] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 790528] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-06-03 21718312] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-03-14 192512] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 3313664] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2004-07-08 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe" [2007-10-05 75256] "RTHDCPL"="RTHDCPL.EXE" [2008-07-16 C:\WINDOWS\RTHDCPL.exe] "SoundMan"="SOUNDMAN.EXE" [2008-06-18 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2008-06-19 C:\WINDOWS\alcwzrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360] C:\Documents and Settings\Piotru.PIOTR-101C5F109\Menu Start\Programy\Autostart\ Thoosje Vista Sidebar.lnk - C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe [2007-10-22 524288] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Program Files\\SEGA\\Beijing 2008\\Beijing.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-01-11 13824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15f7af7a-6192-11dd-a6fe-0050ba5b6ba0}] \Shell\AutoRun\command - wscript.exe .\.vbs \Shell\open\command - wscript.exe .\.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46b6365b-7122-11dd-a71e-0050ba5b6ba0}] \Shell\AutoRun\command - wscript.exe .\.vbs \Shell\open\command - wscript.exe .\.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a51f912c-6532-11dd-a708-0050ba5b6ba0}] \Shell\AutoRun\command - H:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7d7ea5e-714f-11dd-a71f-0050ba5b6ba0}] \Shell\AutoRun\command - wscript.exe .\.vbs \Shell\open\command - wscript.exe .\.vbs *Newly Created Service* - PROCEXP90 . Zawartość folderu 'Zaplanowane zadania' . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-12 22:25:20 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-12 22:25:54 ComboFix-quarantined-files.txt 2008-09-12 20:25:52 Przed: 1,953,591,296 bajt˘w wolnych Po: 2,410,024,960 bajt˘w wolnych 228 --- E O F --- 2008-09-12 17:46:11

**Posty:** 684 · przez **djarta** 13 Wrz 2008, 09:36

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\bb1.dat C:\WINDOWS\system32\nokia32.dll C:\WINDOWS\system32\gh.dat C:\WINDOWS\system32\symdb32.dll Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

===========================
K.

**Posty:** 216 · przez **dArtal** 13 Wrz 2008, 23:00

Kod: Zaznacz wszystko: ComboFix 08-09-11.02 - Piotru 2008-09-13 22:57:01.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1447 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Piotru.PIOTR-101C5F109\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Piotru.PIOTR-101C5F109\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\administrator@t.ifilm[1].txt C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\administrator@www.gomusic[2].txt C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\piotruś@clicktorrent[2].txt C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Cookies\piotruś@tradedoubler[1].txt . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-13 do 2008-09-13 ))))))))))))))))))))))))))))))) . 2008-08-28 20:08 . <DIR> C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\SecuROM 2008-08-28 20:08 . 2008-08-28 20:08 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-08-26 17:07 . 2008-08-26 17:07 36,864 --a------ C:\WINDOWS\system32\symdb32.dll 2008-08-26 17:01 . 2008-08-26 17:01 <DIR> d-------- C:\Program Files\Yahoo! 2008-08-26 17:01 . <DIR> C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Yahoo! 2008-08-26 17:01 . 2008-08-26 17:01 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Yahoo! Companion 2008-08-26 09:43 . 2008-08-26 09:43 1 --a------ C:\WINDOWS\system32\bb1.dat 2008-08-26 00:49 . 2008-08-26 00:49 36,864 --a------ C:\WINDOWS\system32\nokia32.dll 2008-08-26 00:49 . 2008-08-26 17:07 4,544 --a------ C:\WINDOWS\system32\gh.dat 2008-08-23 22:11 . 2005-07-07 16:25 81,728 -ra------ C:\WINDOWS\system32\drivers\k750mgmt.sys 2008-08-23 22:10 . 2005-07-07 16:25 89,872 -ra------ C:\WINDOWS\system32\drivers\k750mdm.sys 2008-08-23 22:10 . 2005-07-07 16:25 79,488 -ra------ C:\WINDOWS\system32\drivers\k750obex.sys 2008-08-23 22:10 . 2005-07-07 16:26 6,576 -ra------ C:\WINDOWS\system32\drivers\k750mdfl.sys 2008-08-23 22:10 . 2005-07-07 16:26 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cmnt.sys 2008-08-23 22:10 . 2005-07-07 16:26 6,144 -ra------ C:\WINDOWS\system32\drivers\k750cm.sys 2008-08-23 22:09 . 2005-07-07 16:26 55,216 -ra------ C:\WINDOWS\system32\drivers\k750bus.sys 2008-08-23 22:09 . 2005-07-07 16:25 5,744 -ra------ C:\WINDOWS\system32\drivers\k750whnt.sys 2008-08-23 22:09 . 2005-07-07 16:25 5,744 -ra------ C:\WINDOWS\system32\drivers\k750wh.sys 2008-08-13 16:25 . 2008-08-13 16:25 <DIR> d-------- C:\Program Files\Common Files\DirectX 2008-08-13 16:24 . 2008-08-13 16:24 <DIR> d-------- C:\WINDOWS\USB Vibration 2008-08-13 16:24 . 2008-08-13 16:24 <DIR> d-------- C:\Program Files\USB Vibration 2008-08-13 16:24 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-08-13 16:24 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-26 15:01 --------- d-----w C:\Program Files\DivX 2008-08-13 14:24 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-11 18:59 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-08-11 18:30 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Sun 2008-08-11 18:21 --------- d-----w C:\Program Files\Java 2008-08-10 12:16 --------- d-----w C:\Program Files\PhotoScape 2008-08-10 12:08 --------- d-----w C:\Program Files\SubEdit-Player 2008-08-08 17:53 --------- d-s---w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Microsoft 2008-08-08 17:51 286,720 ----a-w C:\WINDOWS\iun505.exe 2008-08-08 17:51 --------- d-----w C:\Program Files\InterCover 2008-08-08 17:35 --------- d-----w C:\Program Files\Ahead 2008-08-08 16:03 --------- d-----w C:\Program Files\Apple Software Update 2008-08-08 12:56 --------- d-----w C:\Program Files\Vista Drive Icon 2008-08-07 11:25 --------- d-----w C:\Program Files\Thoosje Sidebar V2.3 2008-08-06 21:41 --------- d-----w C:\Program Files\Safari 2008-08-06 21:41 --------- d-----w C:\Program Files\Bonjour 2008-08-06 20:00 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\ViStart 2008-08-06 13:29 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Ahead 2008-08-04 11:52 --------- d-----w C:\Program Files\iTunes 2008-08-04 11:51 --------- d-----w C:\Program Files\iPod 2008-08-01 08:55 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-07-31 13:35 --------- d-----w C:\Program Files\BitComet 2008-07-31 13:31 --------- d-----w C:\Program Files\BearShare 2008-07-31 13:24 271,360 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2008-07-31 13:24 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys 2008-07-31 13:18 --------- d-----w C:\Program Files\DAEMON Tools Toolbar 2008-07-31 13:15 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-07-31 13:15 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\DAEMON Tools 2008-07-30 21:31 --------- d-----w C:\Program Files\Google 2008-07-30 19:36 --------- d-----w C:\Program Files\Skype 2008-07-30 19:36 --------- d-----w C:\Program Files\Common Files\Skype 2008-07-30 19:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype 2008-07-30 19:14 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Google 2008-07-29 19:42 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Adobe 2008-07-28 22:00 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\ATI 2008-07-28 22:00 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ATI 2008-07-28 21:42 --------- d-----w C:\Program Files\Realtek 2008-07-28 21:41 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-28 21:30 --------- d-----w C:\Program Files\ATI 2008-07-28 21:28 --------- d-----w C:\Program Files\ATI Technologies 2008-07-28 21:13 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Apple Computer 2008-07-28 21:13 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple Computer 2008-07-28 21:11 --------- d-----w C:\Program Files\QuickTime 2008-07-28 21:10 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Apple 2008-07-28 20:46 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Talkback 2008-07-28 20:43 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Macromedia 2008-07-28 20:31 --------- d-----w C:\Documents and Settings\Piotruś.PIOTR-101C5F109\Dane aplikacji\Identities 2008-07-28 20:22 --------- d-----w C:\Program Files\Usługi online 2008-07-28 19:40 --------- d-----w C:\Program Files\BrowsingAdvisor 2008-07-28 19:10 --------- d-----w C:\Program Files\PeerGuardian2 2008-07-28 13:58 --------- d-----w C:\Program Files\Spyware Doctor 2008-07-28 11:35 --------- d-----w C:\Program Files\Search Spider 2008-07-28 11:31 --------- d-----w C:\Program Files\Zone Labs 2008-07-28 11:13 --------- d-----w C:\Program Files\Alwil Software 2008-07-28 10:44 --------- d-----w C:\Program Files\uTorrent 2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-16 17:14 16,806,400 ----a-w C:\WINDOWS\RTHDCPL.exe 2008-07-16 16:52 4,747,776 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys 2008-07-15 11:47 1,196,032 ----a-w C:\WINDOWS\RtlUpd.exe 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-04 03:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-07-04 03:25 421,888 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-07-04 03:23 309,248 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-07-04 03:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-07-04 03:14 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-07-04 03:14 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-07-04 03:13 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-07-04 03:13 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-07-04 03:12 561,152 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-07-04 03:10 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-07-04 03:06 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-07-04 03:00 3,786,144 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-07-04 02:55 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-07-04 02:49 2,140,672 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-07-04 02:34 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-07-04 02:30 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-07-04 02:29 32,768 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-07-04 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-07-04 02:25 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-07-04 02:22 565,248 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-07-03 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-19 14:42 2,808,832 ----a-w C:\WINDOWS\alcwzrd.exe 2008-06-19 14:27 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2008-06-19 14:20 57,344 ----a-w C:\WINDOWS\Alcmtr.exe 2008-06-18 16:01 77,824 ----a-w C:\WINDOWS\SoundMan.exe 2008-05-05 13:20 233,472 ----a-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT 2008-05-05 13:20 233,472 ----a-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT 2007-06-11 18:44 54,752 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-07-30 171448] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 790528] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-06-03 21718312] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-03-14 192512] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 3313664] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2004-07-08 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe" [2007-10-05 75256] "RTHDCPL"="RTHDCPL.EXE" [2008-07-16 C:\WINDOWS\RTHDCPL.exe] "SoundMan"="SOUNDMAN.EXE" [2008-06-18 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2008-06-19 C:\WINDOWS\alcwzrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15360] C:\Documents and Settings\Piotru.PIOTR-101C5F109\Menu Start\Programy\Autostart\ Thoosje Vista Sidebar.lnk - C:\Program Files\Thoosje Sidebar V2.3\Thoosje Vista Sidebar.exe [2007-10-22 524288] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Program Files\\SEGA\\Beijing 2008\\Beijing.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-01-11 13824] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15f7af7a-6192-11dd-a6fe-0050ba5b6ba0}] \Shell\AutoRun\command - wscript.exe .\.vbs \Shell\open\command - wscript.exe .\.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46b6365b-7122-11dd-a71e-0050ba5b6ba0}] \Shell\AutoRun\command - wscript.exe .\.vbs \Shell\open\command - wscript.exe .\.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a51f912c-6532-11dd-a708-0050ba5b6ba0}] \Shell\AutoRun\command - H:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7d7ea5e-714f-11dd-a71f-0050ba5b6ba0}] \Shell\AutoRun\command - wscript.exe .\.vbs \Shell\open\command - wscript.exe .\.vbs . Zawartość folderu 'Zaplanowane zadania' . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-13 22:58:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-13 22:58:58 ComboFix-quarantined-files.txt 2008-09-13 20:58:55 ComboFix2.txt 2008-09-12 20:25:55 Przed: 2,508,140,544 bajt˘w wolnych Po: 2,584,420,352 bajt˘w wolnych 218 --- E O F --- 2008-09-12 17:46:11

I jeszcze jedna sprawa. Przy włączaniu komputera (i gadu chyba też?) pojawia mi się takie coś:

Dotyczy to różnych URL'i. Czasami thoosje jak tu, czy bearshare czy innych.

**Posty:** 684 · przez **djarta** 14 Wrz 2008, 10:07

Nic się nie usunęło - powtórka!

=========================
K.