Zamulanie kompa, problemy z uruchamianiem

**Posty:** 9 · przez **kasiulks** 31 Lip 2008, 20:48

tak więc mam problemy z uruchamianiem kompa, trochę czasu potrwa, zanim normalnie dostane się do swojego konta. Plus ogólnie zamula mi komp, zoptymalizowałam już, pousuwałam co zbędne. a oto logi:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:30:40, on 2008-07-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Creative\Shared Files\CTDevSrv.exe c:\usr\MYSQL\bin\mysqld.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\PC Check-up\PCCheckUp.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.imesh.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQToolbar\toolbaru.dll O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQToolbar\toolbaru.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQToolbar\toolbaru.dll O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PC Check-up\PCCheckUp.exe" -mini O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kas\Menu Start\Programy\IMVU\Run IMVU.lnk O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206133173281 O16 - DPF: {A6916797-7ABD-4F07-93AE-098B6F543129} (CO2Player Class) - http://www.lemontv.pl/lmctrlp.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InterBase 2007 Guardian gds_db (IBG_gds_db) - Borland Software Corporation - C:\Borland\InterBase\bin\ibguard.exe O23 - Service: InterBase 2007 Server gds_db (IBS_gds_db) - Borland Software Corporation - C:\Borland\InterBase\bin\ibserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 8174 bytes

Kod: Zaznacz wszystko: ComboFix 08-07-19.1 - Kas 2008-07-31 20:32:49.10 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.567 [GMT 2:00] Running from: C:\Documents and Settings\Kas\Pulpit\sciagane\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 ))))))))))))))))))))))))))))))) . 2008-07-28 15:13 . 2008-07-28 15:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-28 15:13 . 2008-07-28 15:13 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-22 23:48 . 2008-07-22 23:49 <DIR> d-------- C:\Program Files\iMesh Applications 2008-07-22 23:48 . 2008-07-26 11:14 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\iMesh 2008-07-22 23:48 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-07-22 23:44 . 2008-07-28 11:59 <DIR> d-------- C:\Program Files\eMule 2008-07-20 11:05 . 2008-07-20 11:05 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-20 10:30 . 2008-07-20 11:35 <DIR> d----c--- C:\SDFix 2008-07-19 19:50 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-19 19:49 . 2008-07-19 19:49 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-18 19:44 . 2008-07-20 00:17 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\FileZilla 2008-07-18 19:43 . 2008-07-18 19:43 <DIR> d-------- C:\Program Files\FileZilla FTP Client 2008-07-18 13:07 . 2008-07-18 13:26 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\HateML 2008-07-18 13:06 . 2008-07-18 13:06 <DIR> d-------- C:\Program Files\Migajek Software 2008-07-17 23:50 . 2008-07-17 23:51 <DIR> d-------- C:\Program Files\foobar2000 2008-07-16 13:22 . 2008-07-16 13:22 <DIR> d----c--- C:\BlueJ 2008-07-15 09:33 . 2008-07-15 10:29 <DIR> d-------- C:\Program Files\3D Driving-School Demo 2008-07-15 08:17 . 2008-07-15 08:17 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\CodeGear 2008-07-15 08:17 . 2008-07-19 23:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CodeGear 2008-07-15 08:12 . 2008-07-15 08:12 <DIR> d-------- C:\Program Files\CodeGear 2008-07-14 23:09 . 2007-08-01 13:11 36,864 --a------ C:\WINDOWS\system32\ibxml.dll 2008-07-14 23:08 . 2008-07-14 23:08 <DIR> d----c--- C:\Borland 2008-07-14 23:08 . 2007-08-01 13:11 425,984 --a------ C:\WINDOWS\system32\gds32.dll 2008-07-09 14:28 . 2008-07-09 14:28 <DIR> d-------- C:\WINDOWS\SQLTools9_KB948109_ENU 2008-07-09 14:25 . 2008-07-09 14:25 <DIR> d-------- C:\WINDOWS\SQL9_KB948109_ENU 2008-07-03 21:18 . 2008-07-03 21:18 <DIR> d-------- C:\Documents and Settings\Kasiuś\Dane aplikacji\ICQ Toolbar 2008-07-03 13:19 . 2008-07-03 13:19 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\ICQ Toolbar 2008-07-03 13:12 . 2008-07-28 23:19 <DIR> d-------- C:\Program Files\ICQToolbar 2008-07-03 13:10 . 2008-07-03 13:16 <DIR> d-------- C:\Program Files\ICQ6 2008-06-25 22:03 . 2008-06-25 22:03 <DIR> d----c--- C:\Deckard 2008-06-23 11:25 . 2008-06-23 11:25 <DIR> d-------- C:\Documents and Settings\Kasiuś\Dane aplikacji\Gadu-Gadu 2008-06-22 20:48 . 2008-07-05 23:50 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\Dev-Cpp 2008-06-22 20:47 . 2008-06-22 20:48 <DIR> d----c--- C:\Dev-Cpp 2008-06-18 20:26 . 2008-06-18 20:26 <DIR> d-------- C:\Documents and Settings\Kasiuś\Dane aplikacji\DivX 2008-06-18 16:12 . 2008-06-18 16:12 38 --a------ C:\WINDOWS\avisplitter.INI 2008-06-18 14:43 . 2008-06-18 14:43 <DIR> d-------- C:\Program Files\IObit 2008-06-18 14:24 . 2008-07-28 21:30 <DIR> d----c--- C:\fixwareout 2008-06-18 12:48 . 2008-06-18 12:49 <DIR> d-------- C:\Program Files\Picasa2 2008-06-18 11:52 . 2008-06-18 11:54 <DIR> d----c--- C:\Dev-C++ 2008-06-18 11:52 . 1996-07-18 13:06 297,472 --a------ C:\WINDOWS\uninst.exe 2008-06-18 11:48 . 2008-06-18 11:48 <DIR> d----c--- C:\Downloads 2008-06-18 11:48 . 2008-06-18 11:49 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\GetRightToGo 2008-06-15 18:15 . 2008-06-15 18:15 55,564 --a------ C:\WINDOWS\FontData.fdb 2008-06-14 19:08 . 2008-03-21 22:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-06-14 19:08 . 2008-01-10 14:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-06-14 19:08 . 2008-03-31 23:25 682,496 --a------ C:\WINDOWS\system32\divx.dll 2008-06-14 19:08 . 2004-01-25 18:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-06-14 19:08 . 2007-09-04 18:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll 2008-06-14 19:08 . 2008-01-10 14:16 159,839 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-06-14 19:08 . 2008-03-21 22:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-06-14 19:08 . 2007-10-03 17:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-06-14 19:05 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-06-14 19:05 . 2008-03-28 19:41 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-06-14 19:05 . 2008-03-28 19:40 6,144 --a------ C:\WINDOWS\system32\ff_acm.acm 2008-06-14 19:05 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-06-14 18:58 . 2008-06-14 19:03 <DIR> d-------- C:\Program Files\XP Codec Pack 2008-06-11 07:37 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 07:37 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-09 18:01 . 2008-06-10 07:01 <DIR> d-------- C:\Documents and Settings\Kasiuť\Ustawienia lokalne 2008-06-09 18:01 . 2008-06-09 18:01 <DIR> d-------- C:\Documents and Settings\Kasiuť 2008-06-09 17:14 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-09 17:14 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-06-09 15:55 . 2008-06-09 15:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-09 13:50 . 2008-06-09 13:50 <DIR> d-------- C:\Documents and Settings\Kasik\Dane aplikacji\Teleca 2008-06-09 13:49 . 2008-06-09 13:49 <DIR> d-------- C:\Documents and Settings\Kasik\Dane aplikacji\Sony Ericsson 2008-06-08 21:41 . 2008-06-08 21:41 <DIR> dr------- C:\Documents and Settings\LocalService\Ulubione 2008-06-08 21:23 . 2008-06-15 18:11 2,516 --ahs---- C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys 2008-06-08 21:23 . 2008-06-15 18:11 88 -r-hs---- C:\Documents and Settings\All Users\Dane aplikacji\[u]0[/u]35A723127.sys 2008-06-08 21:16 . 2008-06-08 21:16 <DIR> d-------- C:\Program Files\Common Files\Protexis 2008-06-08 21:10 . 2008-06-08 21:10 <DIR> d-------- C:\Program Files\Common Files\Corel 2008-06-08 21:07 . 2008-06-08 21:07 <DIR> d-------- C:\Program Files\Corel 2008-06-08 18:14 . 2008-06-08 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-06-08 18:02 . 2008-06-08 18:02 <DIR> d-------- C:\Program Files\Bonjour 2008-06-08 17:49 . 2008-06-08 17:49 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-06-08 08:48 . 2008-06-08 08:48 <DIR> d-------- C:\WINDOWS\Adobe Illustrator CS 2008-06-06 13:53 . 2008-06-06 13:53 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\Media Player Classic 2008-06-06 13:53 . 2006-09-24 17:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-06-06 13:52 . 2008-06-14 19:12 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-06-04 20:06 . 2008-06-04 20:06 <DIR> d----c--- C:\totalcmdd 2008-06-04 18:10 . 2008-06-04 18:10 <DIR> d-------- C:\Program Files\FreshWebmaster 2008-06-04 18:07 . 2008-07-16 13:29 <DIR> d-------- C:\Program Files\ESTsoft 2008-06-04 18:07 . 2008-06-04 18:07 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\ESTsoft 2008-06-04 18:07 . 2008-07-16 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft 2008-06-02 23:42 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-06-02 23:42 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-06-02 23:42 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-06-02 23:42 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-06-02 21:20 . 2008-06-02 21:20 30 --a------ C:\WINDOWS\iedit.INI . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-29 05:50 --------- d-----w C:\Documents and Settings\Kasiuś\Dane aplikacji\OpenOffice.org2 2008-07-26 20:50 --------- d-----w C:\Program Files\uTorrent 2008-07-26 20:50 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\uTorrent 2008-07-22 21:42 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\LimeWire 2008-07-20 10:03 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Kingston 2008-07-19 22:11 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-07-19 21:48 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\OpenOffice.org2 2008-07-19 17:50 --------- d-----w C:\Program Files\Java 2008-07-16 11:36 --------- d-----w C:\Program Files\Maxis 2008-07-16 11:32 --------- d-----w C:\Program Files\Google 2008-07-16 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-16 11:29 --------- d-----w C:\Program Files\Reallusion 2008-07-16 11:28 --------- d-----w C:\Program Files\Alcohol Soft 2008-07-16 11:27 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-09 12:28 --------- d-----w C:\Program Files\Microsoft SQL Server 2008-07-03 11:14 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\ICQ 2008-06-26 10:57 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\GanymedeNet 2008-06-26 10:56 --------- d-----w C:\Program Files\Ganymede 2008-06-22 13:01 --------- d-----w C:\Documents and Settings\Kasik\Dane aplikacji\OpenOffice.org2 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-18 12:55 --------- d-----w C:\Program Files\Speeditup Free 2008-06-18 12:39 --------- d-----w C:\Program Files\PC Check-up 2008-06-18 10:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-06-15 13:02 --------- d-----w C:\Program Files\Odkurzacz 2008-06-14 17:48 --------- d-----w C:\Program Files\QuickTime 2008-06-14 17:48 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-06-14 17:48 --------- d-----w C:\Program Files\IrfanView 2008-06-14 17:05 --------- d-----w C:\Program Files\ffdshow 2008-06-09 13:43 --------- d-----w C:\Program Files\Adware Away 2008-06-09 11:25 --------- d-----w C:\Program Files\SkanerOnline 2008-06-08 19:23 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Corel 2008-06-08 19:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2008-05-30 21:17 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Ulead Systems 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-23 00:00 1,470,464 ----a-w C:\WINDOWS\system32\libmySQL.dll 2007-12-02 18:10 150 -c--a-w C:\Documents and Settings\Kas\Dane aplikacji\wklnhst.dat 2006-06-20 06:07 14 -c--a-w C:\Documents and Settings\Kas\getfile.dat 2006-05-31 08:56 14 -c--a-w C:\Documents and Settings\Kasik\getfile.dat 2005-08-17 15:10 457 -c--a-w C:\Program Files\INSTALL.LOG 2005-08-08 19:25 36 -c--a-w C:\Documents and Settings\Kas\klextlock.dat 2005-05-31 12:50 36 -c--a-w C:\Documents and Settings\Kasik\klextlock.dat 2004-10-01 13:00 40,960 -c--a-w C:\Program Files\Uninstall_CDS.exe 2006-05-24 15:38 233,472 -c--a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll 2006-05-18 16:00 204,895 -c--a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll 2005-09-29 13:41 77,824 -c--a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll 2006-05-18 15:59 426,081 -c--a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll 2005-02-02 11:19 458,752 -c--a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll 2006-04-10 17:35 139,264 -c--a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll 2005-11-09 10:10 204,800 -c--a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll 2005-11-09 10:42 106,496 -c--a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll 2006-01-04 10:22 212,992 -c--a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll 2006-01-04 10:21 167,936 -c--a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll 2008-03-22 07:38 88 --sh--r C:\WINDOWS\system32\[u]0[/u]35A723127.sys 2007-09-21 14:55 88 --sha-r C:\WINDOWS\system32\3821D0B0CB.sys 2006-02-24 22:46 56 -csha-r C:\WINDOWS\system32\CBB0D02138.sys 2008-03-22 07:38 5,642 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot_2008-07-20_10.26.58.29 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-20 09:05:42 12,988,416 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-20 09:05:42 208,896 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-07-20 09:05:25 12,988,416 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-20 09:05:25 208,896 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2007-11-21 00:52:38 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll + 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll - 2007-11-21 00:52:40 218,496 -c--a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe + 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe - 2008-01-12 15:39:02 70,264 -c--a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe + 2008-07-28 13:35:39 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe + 2008-07-31 18:23:56 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_530.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}] 2008-07-07 11:21 398768 --a------ C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC-Checkup"="C:\Program Files\PC Check-up\PCCheckUp.exe" [2008-03-17 23:49 4047360] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904] C:\Documents and Settings\Kasiu\Menu Start\Programy\Autostart\ OpenOffice.org 2.0.2.lnk - C:\Program Files\OpenOffice.org 2.0.2\program\quickstart.exe [2006-03-12 01:12:44 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 23:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.avis"= ff_acm.acm "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e-Kiosk] --a------ 2007-11-15 20:30 552448 C:\Program Files\e-Kiosk Reader\eGazetaST.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] --a------ 2003-03-24 17:38 1443328 C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a--c--- 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] --a------ 2008-02-01 22:32 8699904 C:\Program Files\MySpace\IM\MySpaceIM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a--c--- 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\system32\\ccapp.exe"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Gadulec\\gg.exe"= "C:\\totalcmd\\WINCMD32.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Soldat\\Soldat.exe"= "C:\\usr\\SMTP Server\\localsrv.exe"= "C:\\usr\\apache\\Apache.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\totalcmdd\\TOTALCMD.EXE"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\Migajek Software\\HateML\\DbgListener\\DbgListener.exe"= "C:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-03-03 04:17] R0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdsk.sys [2004-09-28 04:00] R1 aiptektp;Pen Pad;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2006-06-06 09:51] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R2 PSI_SVC_2;Protexis Licensing V2;c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 11:15] S2 IBG_gds_db;InterBase 2007 Guardian gds_db;C:\Borland\InterBase\bin\ibguard.exe [2007-08-01 13:11] S3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [] S3 IBS_gds_db;InterBase 2007 Server gds_db;C:\Borland\InterBase\bin\ibserver.exe [2007-08-01 13:11] S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 10:51] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 10:51] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 10:51] S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 10:51] S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 10:51] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 10:51] S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 10:51] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-31 20:35:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" . Completion time: 2008-07-31 20:40:23 ComboFix-quarantined-files.txt 2008-07-31 18:39:56 ComboFix2.txt 2008-07-28 10:14:03 ComboFix3.txt 2008-07-20 08:27:19 ComboFix4.txt 2008-06-18 12:19:34 Pre-Run: 28,840,497,152 bajtów wolnych Post-Run: 28,985,528,320 bajtów wolnych 271 --- E O F --- 2008-07-16 08:39:09

eh... zawsze jakimś trafem dziwnie komputer mój chodzi, gdy siostra się dobierze:/

**Posty:** 8001 · przez **Okocza** 31 Lip 2008, 20:52

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 684 · przez **djarta** 31 Lip 2008, 20:59

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.imesh.com/pl/
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PC Check-up\PCCheckUp.exe" -mini
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab
O16 - DPF: {A6916797-7ABD-4F07-93AE-098B6F543129} (CO2Player Class) - http://www.lemontv.pl/lmctrlp.cab

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\Process.exe Folder:: C:\Deckard C:\fixwareout C:\Program Files\PC Check-up Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC-Checkup"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log). Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

C:\WINDOWS\system32\035A723127.sys
C:\WINDOWS\system32\3821D0B0CB.sys
C:\WINDOWS\system32\CBB0D02138.sys

Sprawdź je na --> http://virusscan.jotti.org/
albo na http://www.virustotal.com/en/indexf.html.

**Posty:** 9 · przez **kasiulks** 05 Sie 2008, 23:20

Kod: Zaznacz wszystko: [b]SDFix: Version 1.213 [/b] Run by Kas on 2008-08-05 at 22:59 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-05 23:11:54 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:6a,21,e5,78,46,b3,f1,7b,93,84,55,7f,f1,1f,f4,ed,79,53,c2,b8,81,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:72,8f,2a,ed,40,1a,94,0d,41,9c,3f,db,1b,ea,bd,cc,a2,c8,7e,ff,f0,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,ec,2c,99,4e,1c,32,46,3d,84,77,b3,f8,b0,fa,8a,59,22,.. "khjeh"=hex:cd,c0,f2,73,05,d8,73,a1,b8,88,20,67,6e,78,86,f7,6d,79,a7,10,a8,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f1,e7,09,99,62,7f,9d,4b,b3,07,7c,bf,b8,38,08,ca,0f,dd,ab,c7,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:8e,00,da,bc,6f,b8,11,92,d8,29,c5,9e,77,b2,52,4b,a6,46,4a,f6,59,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:30,c1,63,92,6e,d7,da,04,cb,d4,f9,d0,62,bc,ea,97,ef,66,0f,dc,6f,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:84,6a,c1,4b,62,d7,b3,34,63,97,dd,7a,0c,da,43,51,d1,61,8c,74,7b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:6a,21,e5,78,46,b3,f1,7b,93,84,55,7f,f1,1f,f4,ed,79,53,c2,b8,81,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:72,8f,2a,ed,40,1a,94,0d,41,9c,3f,db,1b,ea,bd,cc,a2,c8,7e,ff,f0,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,ec,2c,99,4e,1c,32,46,3d,84,77,b3,f8,b0,fa,8a,59,22,.. "khjeh"=hex:cd,c0,f2,73,05,d8,73,a1,b8,88,20,67,6e,78,86,f7,6d,79,a7,10,a8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f1,e7,09,99,62,7f,9d,4b,b3,07,7c,bf,b8,38,08,ca,0f,dd,ab,c7,ed,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:8e,00,da,bc,6f,b8,11,92,d8,29,c5,9e,77,b2,52,4b,a6,46,4a,f6,59,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:30,c1,63,92,6e,d7,da,04,cb,d4,f9,d0,62,bc,ea,97,ef,66,0f,dc,6f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:84,6a,c1,4b,62,d7,b3,34,63,97,dd,7a,0c,da,43,51,d1,61,8c,74,7b,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\system32\\ccapp.exe"="%windir%\\system32\\ccapp.exe:*:Enabled:System Process" "C:\\Program Files\\Tlen.pl\\tlen.exe"="C:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:tlen" "C:\\Gadulec\\gg.exe"="C:\\Gadulec\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\totalcmd\\WINCMD32.EXE"="C:\\totalcmd\\WINCMD32.EXE:*:Enabled:Windows Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC" "C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat" "C:\\usr\\SMTP Server\\localsrv.exe"="C:\\usr\\SMTP Server\\localsrv.exe:*:Enabled:localsrv" "C:\\usr\\apache\\Apache.exe"="C:\\usr\\apache\\Apache.exe:*:Enabled:Apache" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger" "C:\\totalcmdd\\TOTALCMD.EXE"="C:\\totalcmdd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\ICQ6\\ICQ.exe"="C:\\Program Files\\ICQ6\\ICQ.exe:*:Enabled:ICQ6" "C:\\Program Files\\Migajek Software\\HateML\\DbgListener\\DbgListener.exe"="C:\\Program Files\\Migajek Software\\HateML\\DbgListener\\DbgListener.exe:*:Enabled:Listener for php debugger DBG" "C:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"="C:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe:*:Enabled:iMesh" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 16 Sep 1996 202,240 A..H. --- "C:\setup95.exe" Wed 18 Jun 2008 6,104,632 A..H. --- "C:\Program Files\Picasa2\setup.exe" Sat 22 Mar 2008 88 ..SHR --- "C:\WINDOWS\system32\035A723127.sys" Fri 21 Sep 2007 88 A.SHR --- "C:\WINDOWS\system32\3821D0B0CB.sys" Sat 25 Feb 2006 56 A.SHR --- "C:\WINDOWS\system32\CBB0D02138.sys" Sat 22 Mar 2008 5,642 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Sun 15 Jun 2008 88 ..SHR --- "C:\Documents and Settings\All Users\Dane aplikacji\035A723127.sys" Sun 15 Jun 2008 2,516 A.SH. --- "C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys" Sat 13 Nov 2004 37,376 A..H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:18:18, on 2008-08-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Creative\Shared Files\CTDevSrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE c:\usr\MYSQL\bin\mysqld.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CafeNews\CN.exe C:\Program Files\PC Check-up\PCCheckUp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.imesh.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQToolbar\toolbaru.dll O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQToolbar\toolbaru.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQToolbar\toolbaru.dll O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CafeNews] C:\Program Files\CafeNews\CN.exe /autostart O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PC Check-up\PCCheckUp.exe" -mini O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kas\Menu Start\Programy\IMVU\Run IMVU.lnk O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206133173281 O16 - DPF: {A6916797-7ABD-4F07-93AE-098B6F543129} (CO2Player Class) - http://www.lemontv.pl/lmctrlp.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InterBase 2007 Guardian gds_db (IBG_gds_db) - Borland Software Corporation - C:\Borland\InterBase\bin\ibguard.exe O23 - Service: InterBase 2007 Server gds_db (IBS_gds_db) - Borland Software Corporation - C:\Borland\InterBase\bin\ibserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 8376 bytes

Kod: Zaznacz wszystko: ComboFix 08-07-19.1 - Kas 2008-08-05 22:40:25.11 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.494 [GMT 2:00] Running from: C:\Documents and Settings\Kas\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Kas\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . - REDUCED FUNCTIONALITY MODE - FILE :: C:\WINDOWS\system32\Process.exe C:\WINDOWS\system32\SrchSTS.exe . ((((((((((((((((((((((((( Files Created from 2008-07-05 to 2008-08-05 ))))))))))))))))))))))))))))))) . 2008-08-05 20:22 . 2008-08-05 20:22 <DIR> d-------- C:\Documents and Settings\Wujek\PressService 2008-08-05 20:22 . 2008-08-05 20:22 <DIR> d-------- C:\Documents and Settings\Wujek\Dane aplikacji\MySpace 2008-08-05 10:34 . 2008-08-05 10:34 <DIR> d-------- C:\Documents and Settings\Kas\PressService 2008-08-05 10:33 . 2008-08-05 20:22 <DIR> d-------- C:\Program Files\CafeNews 2008-07-22 23:48 . 2008-07-22 23:49 <DIR> d-------- C:\Program Files\iMesh Applications 2008-07-22 23:48 . 2008-08-05 17:54 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\iMesh 2008-07-22 23:48 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-07-22 23:44 . 2008-07-28 11:59 <DIR> d-------- C:\Program Files\eMule 2008-07-20 11:05 . 2008-07-20 11:05 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-20 10:30 . 2008-07-20 11:35 <DIR> d----c--- C:\SDFix 2008-07-19 19:50 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-19 19:49 . 2008-07-19 19:49 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-18 19:44 . 2008-07-20 00:17 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\FileZilla 2008-07-18 19:43 . 2008-07-18 19:43 <DIR> d-------- C:\Program Files\FileZilla FTP Client 2008-07-18 13:07 . 2008-07-18 13:26 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\HateML 2008-07-18 13:06 . 2008-07-18 13:06 <DIR> d-------- C:\Program Files\Migajek Software 2008-07-17 23:50 . 2008-07-17 23:51 <DIR> d-------- C:\Program Files\foobar2000 2008-07-16 13:22 . 2008-07-16 13:22 <DIR> d----c--- C:\BlueJ 2008-07-15 09:33 . 2008-07-15 10:29 <DIR> d-------- C:\Program Files\3D Driving-School Demo 2008-07-15 08:17 . 2008-07-15 08:17 <DIR> d-------- C:\Documents and Settings\Kas\Dane aplikacji\CodeGear 2008-07-15 08:17 . 2008-07-19 23:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CodeGear 2008-07-15 08:12 . 2008-07-15 08:12 <DIR> d-------- C:\Program Files\CodeGear 2008-07-14 23:09 . 2007-08-01 13:11 36,864 --a------ C:\WINDOWS\system32\ibxml.dll 2008-07-14 23:08 . 2008-07-14 23:08 <DIR> d----c--- C:\Borland 2008-07-14 23:08 . 2007-08-01 13:11 425,984 --a------ C:\WINDOWS\system32\gds32.dll 2008-07-09 14:28 . 2008-07-09 14:28 <DIR> d-------- C:\WINDOWS\SQLTools9_KB948109_ENU 2008-07-09 14:25 . 2008-07-09 14:25 <DIR> d-------- C:\WINDOWS\SQL9_KB948109_ENU . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-05 20:10 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\OpenOffice.org2 2008-08-05 16:14 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\uTorrent 2008-08-05 12:16 --------- d-----w C:\Program Files\ICQToolbar 2008-08-05 11:21 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Kingston 2008-08-05 07:13 --------- d-----w C:\Documents and Settings\Kasiuś\Dane aplikacji\OpenOffice.org2 2008-08-05 00:17 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\LimeWire 2008-07-26 20:50 --------- d-----w C:\Program Files\uTorrent 2008-07-19 22:11 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-07-19 17:50 --------- d-----w C:\Program Files\Java 2008-07-16 11:36 --------- d-----w C:\Program Files\Maxis 2008-07-16 11:32 --------- d-----w C:\Program Files\Google 2008-07-16 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-16 11:29 --------- d-----w C:\Program Files\Reallusion 2008-07-16 11:29 --------- d-----w C:\Program Files\ESTsoft 2008-07-16 11:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft 2008-07-16 11:28 --------- d-----w C:\Program Files\Alcohol Soft 2008-07-16 11:27 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-09 12:28 --------- d-----w C:\Program Files\Microsoft SQL Server 2008-07-05 21:50 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Dev-Cpp 2008-07-03 19:18 --------- d-----w C:\Documents and Settings\Kasiuś\Dane aplikacji\ICQ Toolbar 2008-07-03 11:19 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\ICQ Toolbar 2008-07-03 11:16 --------- d-----w C:\Program Files\ICQ6 2008-07-03 11:14 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\ICQ 2008-06-26 10:57 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\GanymedeNet 2008-06-26 10:56 --------- d-----w C:\Program Files\Ganymede 2008-06-23 09:25 --------- d-----w C:\Documents and Settings\Kasiuś\Dane aplikacji\Gadu-Gadu 2008-06-22 13:01 --------- d-----w C:\Documents and Settings\Kasik\Dane aplikacji\OpenOffice.org2 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-18 18:26 --------- d-----w C:\Documents and Settings\Kasiuś\Dane aplikacji\DivX 2008-06-18 12:55 --------- d-----w C:\Program Files\Speeditup Free 2008-06-18 12:43 --------- d-----w C:\Program Files\IObit 2008-06-18 12:39 --------- d-----w C:\Program Files\PC Check-up 2008-06-18 10:49 --------- d-----w C:\Program Files\Picasa2 2008-06-18 10:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-06-18 09:49 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\GetRightToGo 2008-06-15 16:11 88 --sh--r C:\Documents and Settings\All Users\Dane aplikacji\[u]0[/u]35A723127.sys 2008-06-15 16:11 2,516 --sha-w C:\Documents and Settings\All Users\Dane aplikacji\KGyGaAvL.sys 2008-06-15 13:02 --------- d-----w C:\Program Files\Odkurzacz 2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 17:48 --------- d-----w C:\Program Files\QuickTime 2008-06-14 17:48 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-06-14 17:48 --------- d-----w C:\Program Files\IrfanView 2008-06-14 17:12 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-06-14 17:05 --------- d-----w C:\Program Files\ffdshow 2008-06-14 17:03 --------- d-----w C:\Program Files\XP Codec Pack 2008-06-09 13:55 --------- d-----w C:\Program Files\Trend Micro 2008-06-09 13:43 --------- d-----w C:\Program Files\Adware Away 2008-06-09 11:50 --------- d-----w C:\Documents and Settings\Kasik\Dane aplikacji\Teleca 2008-06-09 11:49 --------- d-----w C:\Documents and Settings\Kasik\Dane aplikacji\Sony Ericsson 2008-06-09 11:25 --------- d-----w C:\Program Files\SkanerOnline 2008-06-08 21:58 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-06-08 19:23 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Corel 2008-06-08 19:16 --------- d-----w C:\Program Files\Common Files\Protexis 2008-06-08 19:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2008-06-08 19:10 --------- d-----w C:\Program Files\Common Files\Corel 2008-06-08 19:07 --------- d-----w C:\Program Files\Corel 2008-06-08 16:14 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-06-08 16:02 --------- d-----w C:\Program Files\Bonjour 2008-06-08 15:49 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-06-06 11:53 --------- d-----w C:\Documents and Settings\Kas\Dane aplikacji\Media Player Classic 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2007-12-02 18:10 150 -c--a-w C:\Documents and Settings\Kas\Dane aplikacji\wklnhst.dat 2006-06-20 06:07 14 -c--a-w C:\Documents and Settings\Kas\getfile.dat 2006-05-31 08:56 14 -c--a-w C:\Documents and Settings\Kasik\getfile.dat 2005-08-17 15:10 457 -c--a-w C:\Program Files\INSTALL.LOG 2005-08-08 19:25 36 -c--a-w C:\Documents and Settings\Kas\klextlock.dat 2005-05-31 12:50 36 -c--a-w C:\Documents and Settings\Kasik\klextlock.dat 2004-10-01 13:00 40,960 -c--a-w C:\Program Files\Uninstall_CDS.exe 2006-05-24 15:38 233,472 -c--a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll 2006-05-18 16:00 204,895 -c--a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll 2005-09-29 13:41 77,824 -c--a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll 2006-05-18 15:59 426,081 -c--a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll 2005-02-02 11:19 458,752 -c--a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll 2006-04-10 17:35 139,264 -c--a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll 2005-11-09 10:10 204,800 -c--a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll 2005-11-09 10:42 106,496 -c--a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll 2006-01-04 10:22 212,992 -c--a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll 2006-01-04 10:21 167,936 -c--a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll 2008-03-22 07:38 88 --sh--r C:\WINDOWS\system32\[u]0[/u]35A723127.sys 2007-09-21 14:55 88 --sha-r C:\WINDOWS\system32\3821D0B0CB.sys 2006-02-24 22:46 56 -csha-r C:\WINDOWS\system32\CBB0D02138.sys 2008-03-22 07:38 5,642 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot_2008-07-20_10.26.58.29 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-07-20 09:05:42 12,988,416 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-20 09:05:42 208,896 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-07-17 10:57:07 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-07-20 09:05:25 12,988,416 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-07-20 09:05:25 208,896 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2007-11-21 00:52:38 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll + 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll - 2007-11-21 00:52:40 218,496 -c--a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe + 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe - 2008-01-12 15:39:02 70,264 -c--a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe + 2008-07-28 13:35:39 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe + 2008-08-05 20:32:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_500.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}] 2008-07-07 11:21 398768 --a------ C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-24 14:23 282624] "CafeNews"="C:\Program Files\CafeNews\CN.exe" [2008-07-01 13:47 1228800] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904] C:\Documents and Settings\Kasiu\Menu Start\Programy\Autostart\ OpenOffice.org 2.0.2.lnk - C:\Program Files\OpenOffice.org 2.0.2\program\quickstart.exe [2006-03-12 01:12:44 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 23:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.avis"= ff_acm.acm "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e-Kiosk] --a------ 2007-11-15 20:30 552448 C:\Program Files\e-Kiosk Reader\eGazetaST.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] --a------ 2003-03-24 17:38 1443328 C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a--c--- 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] --a------ 2008-02-01 22:32 8699904 C:\Program Files\MySpace\IM\MySpaceIM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a--c--- 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\system32\\ccapp.exe"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Gadulec\\gg.exe"= "C:\\totalcmd\\WINCMD32.EXE"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Soldat\\Soldat.exe"= "C:\\usr\\SMTP Server\\localsrv.exe"= "C:\\usr\\apache\\Apache.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\totalcmdd\\TOTALCMD.EXE"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\Migajek Software\\HateML\\DbgListener\\DbgListener.exe"= "C:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2008-03-03 04:17] R0 Ramdisk;Ramdisk Driver;C:\WINDOWS\system32\DRIVERS\ramdsk.sys [2004-09-28 04:00] R1 aiptektp;Pen Pad;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2006-06-06 09:51] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R2 PSI_SVC_2;Protexis Licensing V2;c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 11:15] S2 IBG_gds_db;InterBase 2007 Guardian gds_db;C:\Borland\InterBase\bin\ibguard.exe [2007-08-01 13:11] S3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [] S3 IBS_gds_db;InterBase 2007 Server gds_db;C:\Borland\InterBase\bin\ibserver.exe [2007-08-01 13:11] S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 10:51] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s816mdfl.sys [2007-06-19 10:51] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s816mdm.sys [2007-06-19 10:51] S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s816mgmt.sys [2007-06-19 10:51] S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\WINDOWS\system32\DRIVERS\s816nd5.sys [2007-06-19 10:51] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s816obex.sys [2007-06-19 10:51] S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\WINDOWS\system32\DRIVERS\s816unic.sys [2007-06-19 10:51] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-05 22:44:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" . Completion time: 2008-08-05 22:48:25 ComboFix-quarantined-files.txt 2008-08-05 20:48:10 ComboFix2.txt 2008-07-31 18:40:24 ComboFix3.txt 2008-07-28 10:14:03 ComboFix4.txt 2008-07-20 08:27:19 ComboFix5.txt 2008-08-05 20:39:12 Pre-Run: 29,315,317,760 bajtów wolnych Post-Run: 29,658,476,544 bajtów wolnych 243 --- E O F --- 2008-07-16 08:39:09

prooszee

**Posty:** 8001 · przez **Okocza** 05 Sie 2008, 23:23

Kasiu moja droga:

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

i będze ok

Autor postu otrzymał pochwałę