Zawirusowany komputer (mks znalazł 400 wirusów)

**Posty:** 6 · przez **k0r3k505** 24 Sie 2009, 14:33

Witam!

Wróciłem z wakacji nad morzem, i zostawiłem mój komputer pod opieką tacie...
Po powrocie strasznie wariował... Mks mi znalazł i usunął ponad 400 wirów... Ale to nic nie pomogło:((

Proszę o pomoc... Napiszcie mi co mam zrobić abyście poznali w ogóle mój problem... Jestem totalnie zielony w grzebaniu w systemie

**Posty:** 8001 · przez **Okocza** 24 Sie 2009, 17:06

k0r3k505, daj log z RSIT

**Posty:** 6 · przez **k0r3k505** 24 Sie 2009, 17:10

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Admin at 2009-08-24 17:10:11 Microsoft Windows XP Home Edition Dodatek Service Pack 2 System drive C: has 35 GB (70%) free of 50 GB Total RAM: 3070 MB (76% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:10:17, on 2009-08-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\svchost.exe C:\games\icytower1.3\icytower13.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Admin\Pulpit\Muza\RSIT.exe C:\Program Files\trend micro\Admin.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mks.com.pl/skaner/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll R3 - URLSearchHook: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll O3 - Toolbar: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll O3 - Toolbar: ToggleEN Toolbar - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files\ToggleEN\tbTog1.dll O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [GEST] m‘|\ü O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Admin] C:\Documents and Settings\Admin\Admin.exe /i O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\Admin\USTAWI~1\Temp\herss.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: rncsys32.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe -- End of file - 4526 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] ToggleEN Toolbar - C:\Program Files\ToggleEN\tbTog1.dll [2009-08-24 2215960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] Free Lunch Design Toolbar - C:\Program Files\Free_Lunch_Design\tbFre1.dll [2009-08-24 2215960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}] IEPluginBHO Class - C:\Documents and Settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-05-28 42088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - Free Lunch Design Toolbar - C:\Program Files\Free_Lunch_Design\tbFre1.dll [2009-08-24 2215960] {038cb5c7-48ea-4af9-94e0-a1646542e62b} - ToggleEN Toolbar - C:\Program Files\ToggleEN\tbTog1.dll [2009-08-24 2215960] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-14 16862720] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-04 69632] "GEST"=m‘|\ü [] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-04-10 37888] "Regedit32"=C:\WINDOWS\system32\regedit.exe [] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2008-03-20 2127296] "ALLUpdate"=C:\Program Files\ALLPlayer\ALLUpdate.exe [2008-11-24 869888] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-04 1667584] "Admin"=C:\Documents and Settings\Admin\Admin.exe [2009-07-01 21593] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-02 393216] "wsctf.exe"=wsctf.exe [] "EXPLORER.EXE"=C:\WINDOWS\EXPLORER.EXE [2004-08-04 1033728] "cdoosoft"=C:\DOCUME~1\Admin\USTAWI~1\Temp\herss.exe [2009-08-24 111687] C:\Documents and Settings\Admin\Menu Start\Programy\Autostart rncsys32.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2008-03-19 126976] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "E:\Nowe Gadu-Gadu\gg.exe"="E:\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu" "D:\World of Warcraft\Launcher.exe"="D:\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher" "D:\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"="D:\World of Warcraft\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe:*:Enabled:Blizzard Downloader" "D:\Program Files\UrbanTerror\ioUrbanTerror.exe"="D:\Program Files\UrbanTerror\ioUrbanTerror.exe:*:Enabled:ioUrbanTerror" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f8e1c2f-651b-11de-9e94-806d6172696f}] shell\AutoRun\command - D:\g8k.exe shell\open\command - D:\g8k.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f8e1c30-651b-11de-9e94-806d6172696f}] shell\AutoRun\command - E:\g8k.exe shell\open\command - E:\g8k.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f8e1c32-651b-11de-9e94-806d6172696f}] shell\AutoRun\command - C:\g8k.exe shell\open\command - C:\g8k.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13b058f2-7ca3-11de-8563-001fd099b7dd}] shell\AutoRun\command - G:\rx.exe shell\open\command - G:\rx.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d8d6816-6554-11de-853c-001fd099b7dd}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ab2542c-7c4a-11de-8562-001fd099b7dd}] shell\AutoRun\command - G:\EXPLORER.EXE shell\explore\command - G:\EXPLORER.EXE shell\open\command - G:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec4df165-9096-11de-856a-001fd099b7dd}] shell\AutoRun\command - G:\g8k.exe shell\open\command - G:\g8k.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0c5dd44-7a81-11de-855d-001fd099b7dd}] shell\AutoRun\command - G:\p.exe shell\open\command - G:\p.exe ======List of files/folders created in the last 1 months====== 2009-08-24 17:10:12 ----D---- C:\Program Files\trend micro 2009-08-24 17:10:11 ----D---- C:\rsit 2009-08-24 13:39:10 ----D---- C:\Program Files\SkanerOnline 2009-08-24 10:43:22 ----RSH---- C:\g8k.exe 2009-08-17 22:29:23 ----RSH---- C:\lcw.exe 2009-08-11 00:15:32 ----RSH---- C:\wbj.exe 2009-08-09 12:00:58 ----RSH---- C:\ktly.exe 2009-07-30 02:52:24 ----RSH---- C:\rx.exe 2009-07-29 01:35:00 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Blizzard 2009-07-28 19:24:39 ----D---- C:\Program Files\Common Files\Blizzard Entertainment 2009-07-28 02:06:26 ----D---- C:\Documents and Settings\Admin\Dane aplikacji\WinRAR 2009-07-28 00:26:48 ----RSH---- C:\mb9x.exe 2009-07-27 09:50:26 ----RSH---- C:\u0riu2.exe 2009-07-27 09:49:41 ----RSH---- C:\p.exe 2009-07-25 22:52:28 ----D---- C:\Program Files\GWP 2009-07-25 22:49:17 ----N---- C:\WINDOWS\system32\spmsg.dll 2009-07-25 22:49:09 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ ======List of files/folders modified in the last 1 months====== 2009-08-24 17:10:12 ----RD---- C:\Program Files 2009-08-24 16:50:27 ----D---- C:\Program Files\Mozilla Firefox 2009-08-24 16:43:24 ----D---- C:\Documents and Settings\Admin\Dane aplikacji\Winamp 2009-08-24 15:00:44 ----D---- C:\WINDOWS\system32 2009-08-24 15:00:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-08-24 14:56:52 ----D---- C:\WINDOWS\Temp 2009-08-24 14:03:57 ----RASH---- C:\WINDOWS\MS32DLL.dll.vbs 2009-08-24 14:03:57 ----RASH---- C:\MS32DLL.dll.vbs 2009-08-24 13:54:26 ----D---- C:\WINDOWS 2009-08-24 13:39:10 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-08-24 13:37:43 ----D---- C:\Program Files\ToggleEN 2009-08-24 13:37:43 ----D---- C:\Program Files\Free_Lunch_Design 2009-08-24 12:23:59 ----D---- C:\Program Files\Gadu-Gadu 2009-08-24 10:42:24 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-08-24 10:42:19 ----D---- C:\WINDOWS\system32\drivers 2009-08-24 10:42:14 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-20 11:09:43 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-08-20 08:28:39 ----D---- C:\Program Files\NAPI-PROJEKT 2009-08-20 08:20:39 ----D---- C:\WINDOWS\Prefetch 2009-07-28 19:24:39 ----D---- C:\Program Files\Common Files 2009-07-28 02:06:14 ----D---- C:\Program Files\WinRAR 2009-07-25 22:52:30 ----SHD---- C:\WINDOWS\Installer 2009-07-25 22:52:30 ----SD---- C:\Documents and Settings\Admin\Dane aplikacji\Microsoft 2009-07-25 22:49:19 ----HD---- C:\WINDOWS\inf ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;Sterownik procesora AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43520] R1 WmiAcpi;Interfejs zarządzania Microsoft Windows dla ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-04 8832] R2 ksi32sk;ksi32sk; \??\C:\WINDOWS\system32\drivers\ksi32sk.sys [] R2 netsik;netsik; \??\C:\WINDOWS\system32\drivers\netsik.sys [] R2 nicsk32;nicsk32; \??\C:\WINDOWS\system32\drivers\nicsk32.sys [] R2 securentm;securentm; \??\C:\WINDOWS\system32\drivers\securentm.sys [] R2 systemntmi;systemntmi; \??\C:\WINDOWS\system32\drivers\systemntmi.sys [] R2 ws2_32sik;ws2_32sik; \??\C:\WINDOWS\system32\drivers\ws2_32sik.sys [] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-03-19 2871296] R3 BridgeMP;Miniport mostka MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2004-08-04 71552] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-15 4742144] R3 netrcacm;RCA USB Digital Cable Modem Driver; C:\WINDOWS\system32\DRIVERS\netrcacm.sys [2003-04-02 20648] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtHDMI.sys [2008-04-29 3688960] R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-04 105856] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S2 acpi32;acpi32; \??\C:\WINDOWS\system32\drivers\acpi32.sys [] S2 amd64si;amd64si; \??\C:\WINDOWS\system32\drivers\amd64si.sys [] S2 ati64si;ati64si; \??\C:\WINDOWS\system32\drivers\ati64si.sys [] S2 fips32cup;fips32cup; \??\C:\WINDOWS\system32\drivers\fips32cup.sys [] S2 i386si;i386si; \??\C:\WINDOWS\system32\drivers\i386si.sys [] S2 port135sik;port135sik; \??\C:\WINDOWS\system32\drivers\port135sik.sys [] S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys [] S3 Bridge;Mostek MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2004-08-04 71552] S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys [] S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 83336] S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s116mdfl.sys [2007-04-03 15112] S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s116mdm.sys [2007-04-03 108680] S3 s116mgmt;Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s116mgmt.sys [2007-04-03 100488] S3 s116nd5;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS); C:\WINDOWS\system32\DRIVERS\s116nd5.sys [2007-04-03 23176] S3 s116obex;Sony Ericsson Device 116 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s116obex.sys [2007-04-03 98696] S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM); C:\WINDOWS\system32\DRIVERS\s116unic.sys [2007-04-03 99080] S3 s217bus;Sony Ericsson Device 217 driver (WDM); C:\WINDOWS\system32\DRIVERS\s217bus.sys [2007-11-02 83496] S3 s217mdfl;Sony Ericsson Device 217 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s217mdfl.sys [2007-11-02 15016] S3 s217mdm;Sony Ericsson Device 217 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s217mdm.sys [2007-11-02 109992] S3 s217mgmt;Sony Ericsson Device 217 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s217mgmt.sys [2007-11-02 103976] S3 s217nd5;Sony Ericsson Device 217 USB Ethernet Emulation SEMC217 (NDIS); C:\WINDOWS\system32\DRIVERS\s217nd5.sys [2007-11-02 24872] S3 s217obex;Sony Ericsson Device 217 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s217obex.sys [2007-11-02 100008] S3 s217unic;Sony Ericsson Device 217 USB Ethernet Emulation SEMC217 (WDM); C:\WINDOWS\system32\DRIVERS\s217unic.sys [2007-11-02 105896] S3 s816bus;Sony Ericsson Device 816 driver (WDM); C:\WINDOWS\system32\DRIVERS\s816bus.sys [2007-06-19 81832] S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-03-19 536576] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 24 Sie 2009, 17:17

k0r3k505, specjalne-narzedzia-czyszczace-vt96631.html zastosuj sobie SDFix a później combofixa - daj z nich logi.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **k0r3k505** 24 Sie 2009, 18:01

SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2009-08-24 at 18:08 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-24 18:11:51 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "E:\\Nowe Gadu-Gadu\\gg.exe"="E:\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu" "D:\\World of Warcraft\\Launcher.exe"="D:\\World of Warcraft\\Launcher.exe:*:Enabled:Blizzard Launcher" "D:\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"="D:\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe:*:Enabled:Blizzard Downloader" "D:\\Program Files\\UrbanTerror\\ioUrbanTerror.exe"="D:\\Program Files\\UrbanTerror\\ioUrbanTerror.exe:*:Enabled:ioUrbanTerror" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 24 Aug 2009 111,687 ..SHR --- "C:\g8k.exe" Tue 28 Jul 2009 108,530 ..SHR --- "C:\mb9x.exe" Thu 2 Jul 2009 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" [b]Finished![/b]

ComboFix:

Kod: Zaznacz wszystko: ComboFix 09-08-23.01 - Admin 2009-08-24 17:53.1.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1045.18.3070.2419 [GMT 2:00] Uruchomiony z: c:\documents and settings\Admin\Pulpit\Muza\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\docume~1\Admin\USTAWI~1\Temp\cvasds0.dll c:\docume~1\Admin\USTAWI~1\Temp\cvasds1.dll c:\documents and settings\Admin\Admin.exe c:\documents and settings\Admin\Dane aplikacji\wiaserva.log c:\documents and settings\Admin\Menu Start\Programy\Autostart\rncsys32.exe c:\documents and settings\Admin\oashdihasidhasuidhiasdhiashdiuasdhasd c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd C:\ktly.exe C:\lcw.exe C:\MS32DLL.dll.vbs C:\p.exe C:\rx.exe C:\u0riu2.exe C:\wbj.exe c:\windows\autorun.inf c:\windows\MS32DLL.dll.vbs c:\windows\system32\drivers\acpi32.sys c:\windows\system32\drivers\amd64si.sys c:\windows\system32\drivers\ati64si.sys c:\windows\system32\drivers\fips32cup.sys c:\windows\system32\drivers\i386si.sys c:\windows\system32\drivers\ksi32sk.sys c:\windows\system32\drivers\netsik.sys c:\windows\system32\drivers\nicsk32.sys c:\windows\system32\drivers\port135sik.sys c:\windows\system32\drivers\securentm.sys c:\windows\system32\drivers\systemntmi.sys c:\windows\system32\drivers\ws2_32sik.sys c:\windows\system32\tmp.reg D:\Autorun.inf D:\install.exe D:\ktly.exe D:\lcw.exe D:\MS32DLL.dll.vbs D:\p.exe D:\rx.exe D:\u0riu2.exe D:\wbj.exe E:\autorun.inf E:\ktly.exe E:\lcw.exe E:\MS32DLL.dll.vbs E:\p.exe E:\rx.exe E:\u0riu2.exe E:\wbj.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ACPI32 -------\Legacy_ATI64SI -------\Legacy_FIPS32CUP -------\Legacy_I386SI -------\Legacy_KSI32SK -------\Legacy_NETSIK -------\Legacy_NICSK32 -------\Legacy_PORT135SIK -------\Legacy_SECURENTM -------\Legacy_SYSTEMNTMI -------\Legacy_WS2_32SIK -------\Service_acpi32 -------\Service_ati64si -------\Service_AVPsys -------\Service_fips32cup -------\Service_i386si -------\Service_ksi32sk -------\Service_netsik -------\Service_nicsk32 -------\Service_port135sik -------\Service_securentm -------\Service_systemntmi -------\Service_ws2_32sik -------\Legacy_amd64si -------\Service_amd64si ((((((((((((((((((((((((( Pliki utworzone od 2009-07-24 do 2009-08-24 ))))))))))))))))))))))))))))))) . 2009-08-24 15:10 . 2009-08-24 15:10 -------- d-----w- c:\program files\trend micro 2009-08-24 15:10 . 2009-08-24 15:10 -------- d-----w- C:\rsit 2009-08-24 11:39 . 2009-08-24 11:50 -------- d-----w- c:\program files\SkanerOnline 2009-08-24 08:43 . 2009-08-24 08:42 111687 --sh--r- C:\g8k.exe 2009-07-28 23:35 . 2009-07-28 23:35 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Blizzard 2009-07-28 17:24 . 2009-07-28 17:24 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment 2009-07-27 22:26 . 2009-07-28 21:44 108530 --sh--r- C:\mb9x.exe 2009-07-25 20:52 . 2009-07-25 20:52 894 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_31FFBB7F2B96F08A3B3C68.exe 2009-07-25 20:52 . 2009-07-25 20:52 6946 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_7AB75738770C49804D1EEB.exe 2009-07-25 20:52 . 2009-07-25 20:52 6946 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_58E8AD03A9288502DAB89F.exe 2009-07-25 20:52 . 2009-07-25 20:52 1150 ----a-r- c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_6FEFF9B68218417F98F549.exe 2009-07-25 20:52 . 2009-07-25 20:52 -------- d-----w- c:\program files\GWP . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-24 14:43 . 2009-06-30 01:47 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Winamp 2009-08-24 13:00 . 2004-08-04 12:00 74450 ----a-w- c:\windows\system32\perfc015.dat 2009-08-24 13:00 . 2004-08-04 12:00 448348 ----a-w- c:\windows\system32\perfh015.dat 2009-08-24 11:37 . 2009-07-07 18:36 -------- d-----w- c:\program files\ToggleEN 2009-08-24 11:37 . 2009-07-07 18:35 -------- d-----w- c:\program files\Free_Lunch_Design 2009-08-24 10:23 . 2009-06-30 01:37 -------- d-----w- c:\program files\Gadu-Gadu 2009-08-24 08:42 . 2004-08-04 12:00 625952 ----a-w- c:\windows\system32\drivers\ntfs.sys 2009-08-20 06:28 . 2009-06-30 01:40 -------- d-----w- c:\program files\NAPI-PROJEKT 2009-07-18 16:46 . 2009-07-18 16:46 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM 2009-07-18 16:46 . 2009-07-18 16:46 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\OpenFM 2009-07-11 21:45 . 2009-07-07 18:37 14 ----a-w- c:\windows\popcinfot.dat 2009-07-10 23:25 . 2009-07-10 22:17 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu 2009-07-07 18:36 . 2009-07-07 18:36 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\PopCap Games 2009-07-07 18:36 . 2009-07-07 18:36 -------- d-----w- c:\program files\PopCap Games 2009-07-07 18:35 . 2009-07-07 18:35 -------- d-----w- c:\program files\Conduit 2009-07-07 13:56 . 2009-07-07 13:50 -------- d-----w- c:\documents and settings\Kasia\Dane aplikacji\Winamp 2009-07-05 20:19 . 2009-06-30 01:46 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\WinZip 2009-07-03 06:27 . 2009-06-30 00:37 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-02 17:39 . 2009-07-02 13:27 -------- d-----w- c:\program files\Avanquest update 2009-07-02 13:27 . 2009-07-02 13:27 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2009-07-02 13:27 . 2009-06-30 01:13 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-02 13:26 . 2009-07-02 13:26 -------- d-----w- c:\program files\Sony Ericsson 2009-07-02 13:26 . 2009-07-02 13:26 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson 2009-07-02 07:49 . 2009-07-02 07:48 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Tibia 2009-07-01 00:20 . 2009-07-01 00:19 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Ventrilo 2009-07-01 00:15 . 2009-07-01 00:15 -------- d-----w- c:\program files\Ventrilo 2009-07-01 00:14 . 2009-07-01 00:14 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-06-30 12:41 . 2009-06-30 12:41 12328 ----a-w- c:\documents and settings\Kasia\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-06-30 12:41 . 2009-06-30 12:41 -------- d-----w- c:\documents and settings\Kasia\Dane aplikacji\ATI 2009-06-30 09:00 . 2009-06-30 09:00 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Media Player Classic 2009-06-30 09:00 . 2009-06-30 09:00 -------- d-----w- c:\program files\Real Alternative 2009-06-30 08:41 . 2009-06-30 08:41 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Gadu-Gadu 2009-06-30 01:48 . 2009-06-30 01:47 -------- d-----w- c:\program files\Winamp 2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\program files\ALLPlayer 2009-06-30 01:39 . 2009-06-30 01:39 -------- d-----w- c:\program files\Xvid 2009-06-30 01:38 . 2009-06-30 01:38 0 ----a-w- c:\windows\nsreg.dat 2009-06-30 01:37 . 2009-06-30 01:37 -------- d-----w- c:\program files\Audacity 2009-06-30 01:22 . 2009-06-30 01:20 -------- d-----w- c:\program files\Realtek 2009-06-30 01:22 . 2009-06-30 01:12 16608 ----a-w- c:\windows\gdrv.sys 2009-06-30 01:20 . 2009-06-30 01:20 315392 ----a-w- c:\windows\HideWin.exe 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\program files\AMD 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\InstallShield 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ATI 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\ATI 2009-06-30 01:18 . 2009-06-30 01:18 0 ----a-w- c:\windows\ativpsrm.bin 2009-06-30 01:17 . 2009-06-30 01:13 -------- d-----w- c:\program files\ATI Technologies 2009-06-30 01:16 . 2009-06-30 01:13 -------- d-----w- c:\program files\Common Files\InstallShield 2009-06-30 00:52 . 2009-06-30 00:52 12328 ----a-w- c:\documents and settings\Admin\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-06-30 00:47 . 2009-06-30 00:46 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-30 00:37 . 2009-06-30 00:37 -------- d-----w- c:\program files\microsoft frontpage 2009-06-30 00:36 . 2009-06-30 00:36 -------- d-----w- c:\program files\Usługi online 2009-06-30 00:35 . 2009-06-30 00:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-05-28 09:23 . 2009-05-28 09:23 42088 ----a-w- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll 2009-05-28 08:34 . 2009-05-28 08:34 11264 ----a-w- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll . ------- Sigcheck ------- [-] 2009-08-24 08:42 625952 F5E8BFD2CA7E4FBE742CB2313D528BF2 c:\windows\system32\drivers\ntfs.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2009-08-24 2215960] "{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-08-24 2215960] [HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] 2009-08-24 11:38 2215960 ----a-w- c:\program files\ToggleEN\tbTog1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] 2009-08-24 11:38 2215960 ----a-w- c:\program files\Free_Lunch_Design\tbFre1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2009-08-24 2215960] "{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-08-24 2215960] [HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-08-24 2215960] "{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2009-08-24 2215960] [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] [HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="m‘|\ü" [X] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-14 16862720] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "e:\\Nowe Gadu-Gadu\\gg.exe"= "d:\\World of Warcraft\\Launcher.exe"= "d:\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"= "d:\\Program Files\\UrbanTerror\\ioUrbanTerror.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [2009-07-02 81832] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-wsctf.exe - wsctf.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.mks.com.pl/skaner/ FF - ProfilePath - c:\documents and settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\l9guk0ax.default\ FF - prefs.js: browser.startup.homepage - Google.pl FF - plugin: c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-24 17:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1072) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(4372) c:\windows\system32\msi.dll c:\windows\system32\browselc.dll c:\program files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll c:\program files\WinZip\wzshlstb.dll c:\program files\WinZip\wzshlex1.dll c:\program files\WinZip\WZCAB3.DLL c:\program files\WinRAR\rarext.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\wscntfy.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\windows\system32\imapi.exe . ************************************************************************** . Czas ukończenia: 2009-08-24 17:58 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-08-24 15:58 Przed: 36 562 944 000 bajtów wolnych Po: 36 666 310 656 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer 259

**Posty:** 18165 · przez **wojtas** 25 Sie 2009, 09:33

Otworz notatnik i wklej w nim to:

File::
C:\g8k.exe
C:\mb9x.exe
e:\g8k.exe
e:\mb9x.exe
d:\g8k.exe
d:\mb9x.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_31FFBB7F2B96F08A3B3C68.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_7AB75738770C49804D1EEB.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_58E8AD03A9288502DAB89F.exe
c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_6FEFF9B68218417F98F549.exe

Folder::
c:\program files\Conduit

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Rozpocznie się usuwanie i powstanie log daj go.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **k0r3k505** 25 Sie 2009, 13:11

Kod: Zaznacz wszystko: ComboFix 09-08-24.06 - Admin 2009-08-25 13:01.2.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1045.18.3070.2533 [GMT 2:00] Uruchomiony z: c:\documents and settings\Admin\Pulpit\Muza\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Admin\Pulpit\CFScript.txt FILE :: "c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_31FFBB7F2B96F08A3B3C68.exe" "c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_58E8AD03A9288502DAB89F.exe" "c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_6FEFF9B68218417F98F549.exe" "c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_7AB75738770C49804D1EEB.exe" "C:\g8k.exe" "C:\mb9x.exe" "d:\g8k.exe" "d:\mb9x.exe" "e:\g8k.exe" "e:\mb9x.exe" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\docume~1\Admin\USTAWI~1\Temp\cvasds0.dll c:\docume~1\Admin\USTAWI~1\Temp\cvasds1.dll c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_31FFBB7F2B96F08A3B3C68.exe c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_58E8AD03A9288502DAB89F.exe c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_6FEFF9B68218417F98F549.exe c:\documents and settings\Admin\Dane aplikacji\Microsoft\Installer\{71DCFCD5-C976-4C9E-B7D5-B47D3529E32A}\_7AB75738770C49804D1EEB.exe c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd C:\g8k.exe C:\mb9x.exe c:\program files\Conduit c:\program files\Conduit\Community Alerts\Alert.dll C:\rx.exe c:\windows\system32\EXPLORER.EXE c:\windows\system32\ieuinit.inf D:\autorun.inf d:\g8k.exe d:\mb9x.exe D:\rx.exe E:\Autorun.inf e:\g8k.exe e:\mb9x.exe E:\rx.exe Zainfekowana kopia c:\windows\system32\drivers\ntfs.sys została znaleziona. Problem naprawiono Plik odzyskano z - c:\system volume information\_restore{1A59AFF1-3A9E-41DB-BBD0-5D37F1AD1B5B}\RP34\A0005447.sys . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_AVPsys ((((((((((((((((((((((((( Pliki utworzone od 2009-07-25 do 2009-08-25 ))))))))))))))))))))))))))))))) . 2009-08-24 16:03 . 2009-08-24 16:12 -------- d-----w- C:\SDFix 2009-08-24 15:10 . 2009-08-24 15:10 -------- d-----w- c:\program files\trend micro 2009-08-24 15:10 . 2009-08-24 15:10 -------- d-----w- C:\rsit 2009-08-24 11:39 . 2009-08-24 11:50 -------- d-----w- c:\program files\SkanerOnline 2009-07-28 23:35 . 2009-07-28 23:35 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Blizzard 2009-07-28 17:24 . 2009-07-28 17:24 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-25 09:18 . 2004-08-04 12:00 74450 ----a-w- c:\windows\system32\perfc015.dat 2009-08-25 09:18 . 2004-08-04 12:00 448348 ----a-w- c:\windows\system32\perfh015.dat 2009-08-24 19:27 . 2009-06-30 01:47 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Winamp 2009-08-24 11:37 . 2009-07-07 18:36 -------- d-----w- c:\program files\ToggleEN 2009-08-24 11:37 . 2009-07-07 18:35 -------- d-----w- c:\program files\Free_Lunch_Design 2009-08-24 10:23 . 2009-06-30 01:37 -------- d-----w- c:\program files\Gadu-Gadu 2009-08-20 06:28 . 2009-06-30 01:40 -------- d-----w- c:\program files\NAPI-PROJEKT 2009-07-25 20:52 . 2009-07-25 20:52 -------- d-----w- c:\program files\GWP 2009-07-18 16:46 . 2009-07-18 16:46 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM 2009-07-18 16:46 . 2009-07-18 16:46 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\OpenFM 2009-07-11 21:45 . 2009-07-07 18:37 14 ----a-w- c:\windows\popcinfot.dat 2009-07-10 23:25 . 2009-07-10 22:17 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu 2009-07-07 18:36 . 2009-07-07 18:36 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\PopCap Games 2009-07-07 18:36 . 2009-07-07 18:36 -------- d-----w- c:\program files\PopCap Games 2009-07-07 13:56 . 2009-07-07 13:50 -------- d-----w- c:\documents and settings\Kasia\Dane aplikacji\Winamp 2009-07-05 20:19 . 2009-06-30 01:46 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\WinZip 2009-07-03 06:27 . 2009-06-30 00:37 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-02 17:39 . 2009-07-02 13:27 -------- d-----w- c:\program files\Avanquest update 2009-07-02 13:27 . 2009-07-02 13:27 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2009-07-02 13:27 . 2009-06-30 01:13 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-02 13:26 . 2009-07-02 13:26 -------- d-----w- c:\program files\Sony Ericsson 2009-07-02 13:26 . 2009-07-02 13:26 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson 2009-07-02 07:49 . 2009-07-02 07:48 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Tibia 2009-07-01 00:20 . 2009-07-01 00:19 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Ventrilo 2009-07-01 00:15 . 2009-07-01 00:15 -------- d-----w- c:\program files\Ventrilo 2009-07-01 00:14 . 2009-07-01 00:14 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-06-30 12:41 . 2009-06-30 12:41 12328 ----a-w- c:\documents and settings\Kasia\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-06-30 12:41 . 2009-06-30 12:41 -------- d-----w- c:\documents and settings\Kasia\Dane aplikacji\ATI 2009-06-30 09:00 . 2009-06-30 09:00 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Media Player Classic 2009-06-30 09:00 . 2009-06-30 09:00 -------- d-----w- c:\program files\Real Alternative 2009-06-30 08:41 . 2009-06-30 08:41 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\Gadu-Gadu 2009-06-30 01:48 . 2009-06-30 01:47 -------- d-----w- c:\program files\Winamp 2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\program files\ALLPlayer 2009-06-30 01:39 . 2009-06-30 01:39 -------- d-----w- c:\program files\Xvid 2009-06-30 01:38 . 2009-06-30 01:38 0 ----a-w- c:\windows\nsreg.dat 2009-06-30 01:37 . 2009-06-30 01:37 -------- d-----w- c:\program files\Audacity 2009-06-30 01:22 . 2009-06-30 01:20 -------- d-----w- c:\program files\Realtek 2009-06-30 01:22 . 2009-06-30 01:12 16608 ----a-w- c:\windows\gdrv.sys 2009-06-30 01:20 . 2009-06-30 01:20 315392 ----a-w- c:\windows\HideWin.exe 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\program files\AMD 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\InstallShield 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ATI 2009-06-30 01:19 . 2009-06-30 01:19 -------- d-----w- c:\documents and settings\Admin\Dane aplikacji\ATI 2009-06-30 01:18 . 2009-06-30 01:18 0 ----a-w- c:\windows\ativpsrm.bin 2009-06-30 01:17 . 2009-06-30 01:13 -------- d-----w- c:\program files\ATI Technologies 2009-06-30 01:16 . 2009-06-30 01:13 -------- d-----w- c:\program files\Common Files\InstallShield 2009-06-30 00:52 . 2009-06-30 00:52 12328 ----a-w- c:\documents and settings\Admin\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-06-30 00:47 . 2009-06-30 00:46 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-30 00:37 . 2009-06-30 00:37 -------- d-----w- c:\program files\microsoft frontpage 2009-06-30 00:36 . 2009-06-30 00:36 -------- d-----w- c:\program files\Usługi online 2009-06-30 00:35 . 2009-06-30 00:35 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-05-28 09:23 . 2009-05-28 09:23 42088 ----a-w- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll 2009-05-28 08:34 . 2009-05-28 08:34 11264 ----a-w- c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll . ((((((((((((((((((((((((((((( SnapShot@2009-08-24_15.57.24 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-04 12:00 . 2009-08-24 13:00 58732 c:\windows\system32\perfc009.dat + 2004-08-04 12:00 . 2009-08-25 09:18 58732 c:\windows\system32\perfc009.dat + 2009-07-02 13:27 . 2007-06-19 07:51 97320 c:\windows\system32\drivers\s816obex.sys + 2009-07-02 13:27 . 2007-06-19 07:51 13864 c:\windows\system32\drivers\s816mdfl.sys + 2009-07-02 13:27 . 2007-06-19 07:51 11176 c:\windows\system32\drivers\s816cmnt.sys + 2009-07-02 13:27 . 2007-06-19 07:51 11176 c:\windows\system32\drivers\s816cm.sys + 2009-08-24 16:07 . 2009-08-24 16:07 8192 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat + 2009-08-24 16:07 . 2009-08-24 16:07 8192 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat - 2004-08-04 12:00 . 2009-08-24 13:00 392432 c:\windows\system32\perfh009.dat + 2004-08-04 12:00 . 2009-08-25 09:18 392432 c:\windows\system32\perfh009.dat + 2009-07-02 13:27 . 2007-06-19 07:51 107304 c:\windows\system32\drivers\s816mdm.sys + 2004-08-04 12:00 . 2004-08-04 12:00 574592 c:\windows\system32\drivers\ntfs.sys + 2009-08-24 16:07 . 2009-08-24 16:07 372736 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT + 2009-08-24 16:07 . 2008-08-07 13:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2009-08-24 16:07 . 2009-08-24 16:07 372736 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT + 2009-08-24 16:07 . 2008-08-07 13:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2009-08-24 2215960] "{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-08-24 2215960] [HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] 2009-08-24 11:38 2215960 ----a-w- c:\program files\ToggleEN\tbTog1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] 2009-08-24 11:38 2215960 ----a-w- c:\program files\Free_Lunch_Design\tbFre1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2009-08-24 2215960] "{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-08-24 2215960] [HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "c:\program files\ToggleEN\tbTog1.dll" [2009-08-24 2215960] "{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2009-08-24 2215960] [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}] [HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216] "wsctf.exe"="wsctf.exe" [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="m‘|\ü" [X] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-14 16862720] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "e:\\Nowe Gadu-Gadu\\gg.exe"= "d:\\World of Warcraft\\Launcher.exe"= "d:\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enGB-downloader.exe"= "d:\\Program Files\\UrbanTerror\\ioUrbanTerror.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [2009-07-02 81832] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [2009-07-02 13864] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [2009-07-02 107304] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [2009-07-02 97320] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.mks.com.pl/skaner/ FF - ProfilePath - c:\documents and settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\l9guk0ax.default\ FF - prefs.js: browser.startup.homepage - Google.pl FF - plugin: c:\documents and settings\Admin\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-25 13:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1056) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(4204) c:\windows\system32\msi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\wscntfy.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\windows\system32\imapi.exe . ************************************************************************** . Czas ukończenia: 2009-08-25 13:07 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-08-25 11:07 ComboFix2.txt 2009-08-24 15:58 Przed: 36 607 479 808 bajtów wolnych Po: 36 561 670 144 bajtów wolnych 224

Teraz doszło, że nie mogę dwukrotnym kliknięciem otworzyć dysków.. Musze PPM i Eksploruj
_______________________________________________________________________________
Jednak to błąd sprzętowy =] - problem opanowany

**Posty:** 18165 · przez **wojtas** 25 Sie 2009, 13:40

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 6 · przez **k0r3k505** 25 Sie 2009, 16:27

KASPERSKY ONLINE SCANNER 7.0: raport skanowania
wtorek, 25 sierpień 2009
System operacyjny: Microsoft Windows XP Home Edition Dodatek Service Pack 2 (build 2600)
Wersja Kaspersky Online Scanner: 7.0.26.13
Data ostatniej aktualizacji baz danych: Tuesday, August 25, 2009 15:12:12
Liczba wpisów: 2686887
Ustawienia skanowania
typ baz danych użytych do skanowania rozszerzone
Skanuj archiwa tak
Skanuj pocztowe bazy danych tak
Obszar skanowania Mój komputer
A:\
C:\
D:\
E:\
F:\
Statystyki skanowania
Przeskanowanych obiektów 107490
Wykrytych zagrożeń 1
Wyykrytych zainfekowanych obiektów 2
Wykrytych podejrzanych obiektów 0
Czas skanowania 00:51:56

Nazwa pliku Zagrożenie Liczba zagrożeń
D:\Pulpit Kuba\Nowy folder\mIRC\mirc.exe Zainfekowanych: not-a-virus:Client-IRC.Win32.mIRC.621 1
D:\Pulpit Kuba\Nowy folder\mIRC.rar Zainfekowanych: not-a-virus:Client-IRC.Win32.mIRC.621 1
Wybrany obszar został przeskanowany.

**Posty:** 8001 · przez **Okocza** 25 Sie 2009, 16:41

k0r3k505, czysto

**Posty:** 6 · przez **k0r3k505** 25 Sie 2009, 16:43

Bardzo wam dziękuję=] chodzi jak złoto=]

Kto jest na forum