Zawirusowany komputer

**Posty:** 2691 · przez **Z@K** 26 Sie 2008, 18:32

Witam ponownie.

pomimo zarowno moich jak i waszych działan, moj komputer nadal jest zawirusowany, wiec bede musial zrobic reinstal windowsa:D czyli popularnie zwany format

mam do was pytanie, poniewaz zauwazylem ze wirus przerzucił sie na pendrive, karte compact flash itp, to czy `format` tych nośnikow, wyczyści je z wirusa?

pytanie nr dwa, czy jak w miedzy czasie nagrywałem jakies płyty, wirus i na nich moze sie wrzucic?

pytanie nr trzy, mam na kompie 5 partycji, ale chcial bym zachowac wszystkie poza Windowsowską, czy jest mozliwe ze wir siedzi na innych tez?

pozdrawiam i czekam na odp:)

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 18:52

Z@K napisał(a):czy `format` tych nośnikow, wyczyści je z wirusa?

tak.

Z@K napisał(a):czy jak w miedzy czasie nagrywałem jakies płyty, wirus i na nich moze sie wrzucic?

teoretycznie nie, nie jest to pamięć flash, ale nie wiadomo czy nie wrzucałeś plików zainfekowanych

Z@K napisał(a):czy jest mozliwe ze wir siedzi na innych tez?

oczywiście że tak.

wstaw logi - combofix i hijack this (w tej kolejności)

**Posty:** 2691 · przez **Z@K** 26 Sie 2008, 20:01

eh...robilem to juz kilka razy i syf jest nadal/

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - User 2008-08-26 19:57:49.12 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1544 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Documents and Settings\User\Dane aplikacji\macromedia\Flash Player\#SharedObjects\MXXZ7CND\bin.clearspring.com F:\Documents and Settings\User\Dane aplikacji\macromedia\Flash Player\#SharedObjects\MXXZ7CND\bin.clearspring.com\clearspring.sol F:\Documents and Settings\User\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com F:\Documents and Settings\User\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-26 07:46 . 2008-08-26 18:24 3,899 --a------ F:\Documents and Settings\User\planet.exe 2008-08-16 10:22 . 2008-08-16 10:22 44,032 --a------ F:\Documents and Settings\User\service2.exe 2008-08-15 12:52 . 2008-08-26 20:00 <DIR> d-------- F:\Program Files\PeerGuardian2 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-12 18:13 . 2008-08-12 18:13 <DIR> d-------- F:\WINDOWS\system32\VIRepair 2008-08-12 18:08 . 2008-08-12 18:14 <DIR> d-------- F:\WINDOWS\system32\VITrans 2008-08-12 18:08 . 2008-08-12 18:09 <DIR> d-------- F:\VTPFiles 2008-08-12 18:08 . 2008-08-12 18:08 <DIR> d-------- F:\Documents and Settings\User\Dane aplikacji\Styler 2008-08-12 18:08 . 2006-12-03 17:15 69,632 --a------ F:\WINDOWS\system32\moveex.exe 2008-08-12 18:08 . 2006-12-03 17:14 8,636 --a------ F:\WINDOWS\system32\modifype.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 15:21 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-21 19:46 --------- d-----w F:\Program Files\RocketDock 2008-08-18 17:17 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-08-18 07:35 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-15 17:19 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\uTorrent 2008-08-12 07:34 --------- d-----w F:\Program Files\DkZ Studio 2008-08-11 21:04 --------- d-----w F:\Program Files\MD4DC++ 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PeerGuardian"="F:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Tlen.pl\\tlen.exe"= "G:\\utorrent.exe"= "F:\\Documents and Settings\\User\\service2.exe"= "F:\\Program Files\\BearShare\\BearShare.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] *Newly Created Service* - CATCHME *Newly Created Service* - PGFILTER [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . . ------- Supplementary Scan ------- . FireFox -: Profile - F:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\af7dq1jo.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 20:00:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-26 20:01:12 ComboFix-quarantined-files.txt 2008-08-26 18:00:56 ComboFix2.txt 2008-08-14 10:16:41 Pre-Run: 7,684,308,992 bajtów wolnych Post-Run: 7,677,542,400 bajtów wolnych 144

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:02:13, on 2008-08-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\RTHDCPL.EXE F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe F:\Program Files\Winamp\winampa.exe F:\Documents and Settings\User\service2.exe F:\Program Files\RocketDock\RocketDock.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\PeerGuardian2\pg2.exe F:\Program Files\Bonjour\mDNSResponder.exe F:\Program Files\Common Files\LightScribe\LSSrvc.exe F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE F:\WINDOWS\system32\nvsvc32.exe F:\Program Files\Common Files\Protexis\License Service\PSIService.exe F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wscntfy.exe F:\Program Files\Tlen.pl\tlen.exe F:\WINDOWS\system32\notepad.exe F:\WINDOWS\explorer.exe F:\Program Files\Opera\Opera.exe F:\Documents and Settings\User\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - F:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - F:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM] "F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [RocketDock] "F:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PeerGuardian] F:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: Sidebar.lnk = F:\Documents and Settings\User\Moje dokumenty\Clear Sidebar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: f:\program files\bonjour\mdnsnsp.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38BD57F4-72B6-4D7E-81DF-0C65D342AE5B}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - F:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - F:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 20:02

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 2691 · przez **Z@K** 26 Sie 2008, 21:47

Kod: Zaznacz wszystko: [b]SDFix: Version 1.219 [/b] Run by User on 2008-08-26 at 21:38 Microsoft Windows XP [Wersja 5.1.2600] Running From: F:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Folder F:\Documents and Settings\User\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 21:42:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="F:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:78,69,68,c3,5c,12,19,10,a9,8e,46,d4,9f,fb,be,79,3a,b7,cc,13,52,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:d3,aa,f1,78,2a,ca,61,b6,a5,71,a2,c3,d3,74,03,c4,8c,3e,34,98,a2,.. "p0"="F:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,91,93,4b,27,1e,e4,4f,c5,b1,e3,d3,57,0f,c5,f3,b3,37,.. "khjeh"=hex:09,3a,fa,59,92,f5,5b,a7,73,5d,a9,80,f0,46,3c,53,c1,23,2e,8f,11,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:09,ba,11,21,02,6f,75,9e,3e,75,ad,60,a8,8b,54,a9,25,4e,bd,97,73,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="F:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:f2,70,49,0f,19,92,75,96,40,f3,b1,69,8a,3e,aa,1f,d4,ba,8d,56,2c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:d3,aa,f1,78,2a,ca,61,b6,a5,71,a2,c3,d3,74,03,c4,8c,3e,34,98,a2,.. "p0"="F:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,91,93,4b,27,1e,e4,4f,c5,b1,e3,d3,57,0f,c5,f3,b3,37,.. "khjeh"=hex:09,3a,fa,59,92,f5,5b,a7,73,5d,a9,80,f0,46,3c,53,c1,23,2e,8f,11,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:09,ba,11,21,02,6f,75,9e,3e,75,ad,60,a8,8b,54,a9,25,4e,bd,97,73,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions] "A\1A?J?K?A?"="" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "E:\\gry\\PES 2008\\PES2008.exe"="E:\\gry\\PES 2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008" "F:\\Program Files\\Tlen.pl\\tlen.exe"="F:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:tlen" "G:\\utorrent.exe"="G:\\utorrent.exe:*:Enabled:utorrent" "F:\\Documents and Settings\\User\\service2.exe"="F:\\Documents and Settings\\User\\service2.exe:*:Enabled:service2" "F:\\Program Files\\BearShare\\BearShare.exe"="F:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "F:\\Program Files\\Skype\\Phone\\Skype.exe"="F:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sun 6 Apr 2008 88 ..SHR --- "F:\WINDOWS\system32\1EB16A5616.sys" Sun 6 Apr 2008 2,828 A.SH. --- "F:\WINDOWS\system32\KGyGaAvL.sys" Sat 24 May 2008 444 ...HR --- "F:\Documents and Settings\User\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - User 2008-08-26 21:45:57.13 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1599 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-26 21:38 . 2008-08-26 21:38 578,560 --a--c--- F:\WINDOWS\system32\dllcache\user32.dll 2008-08-26 21:36 . 2008-08-26 21:36 <DIR> d-------- F:\WINDOWS\ERUNT 2008-08-26 21:34 . 2008-08-26 21:44 <DIR> d-------- F:\SDFix 2008-08-26 07:46 . 2008-08-26 18:24 3,899 --a------ F:\Documents and Settings\User\planet.exe 2008-08-16 10:22 . 2008-08-16 10:22 44,032 --a------ F:\Documents and Settings\User\service2.exe 2008-08-15 12:52 . 2008-08-26 21:46 <DIR> d-------- F:\Program Files\PeerGuardian2 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-12 18:13 . 2008-08-12 18:13 <DIR> d-------- F:\WINDOWS\system32\VIRepair 2008-08-12 18:08 . 2008-08-12 18:14 <DIR> d-------- F:\WINDOWS\system32\VITrans 2008-08-12 18:08 . 2008-08-12 18:09 <DIR> d-------- F:\VTPFiles 2008-08-12 18:08 . 2008-08-12 18:08 <DIR> d-------- F:\Documents and Settings\User\Dane aplikacji\Styler 2008-08-12 18:08 . 2006-12-03 17:15 69,632 --a------ F:\WINDOWS\system32\moveex.exe 2008-08-12 18:08 . 2006-12-03 17:14 8,636 --a------ F:\WINDOWS\system32\modifype.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 15:21 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-21 19:46 --------- d-----w F:\Program Files\RocketDock 2008-08-18 17:17 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-08-18 07:35 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-15 17:19 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\uTorrent 2008-08-12 07:34 --------- d-----w F:\Program Files\DkZ Studio 2008-08-11 21:04 --------- d-----w F:\Program Files\MD4DC++ 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2008-08-26_20.00.44.34 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-26 19:36:40 6,062,080 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-26 19:36:40 57,344 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-26 19:36:39 6,062,080 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-26 19:36:39 57,344 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PeerGuardian"="F:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Tlen.pl\\tlen.exe"= "G:\\utorrent.exe"= "F:\\Documents and Settings\\User\\service2.exe"= "F:\\Program Files\\BearShare\\BearShare.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] *Newly Created Service* - PGFILTER [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . . ------- Supplementary Scan ------- . FireFox -: Profile - F:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\af7dq1jo.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 21:46:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-26 21:47:42 ComboFix-quarantined-files.txt 2008-08-26 19:47:31 ComboFix2.txt 2008-08-26 18:01:14 ComboFix3.txt 2008-08-14 10:16:41 Pre-Run: 7,602,835,456 bajtów wolnych Post-Run: 7,592,394,752 bajtów wolnych 146

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:48:32, on 2008-08-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Bonjour\mDNSResponder.exe F:\Program Files\Common Files\LightScribe\LSSrvc.exe F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE F:\WINDOWS\system32\nvsvc32.exe F:\Program Files\Common Files\Protexis\License Service\PSIService.exe F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wscntfy.exe F:\WINDOWS\RTHDCPL.EXE F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe F:\Program Files\Winamp\winampa.exe F:\Program Files\RocketDock\RocketDock.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\PeerGuardian2\pg2.exe F:\Program Files\Opera\Opera.exe F:\WINDOWS\system32\notepad.exe F:\WINDOWS\explorer.exe F:\Documents and Settings\User\Moje dokumenty\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - F:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - F:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM] "F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [RocketDock] "F:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PeerGuardian] F:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: Sidebar.lnk = F:\Documents and Settings\User\Moje dokumenty\Clear Sidebar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: f:\program files\bonjour\mdnsnsp.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38BD57F4-72B6-4D7E-81DF-0C65D342AE5B}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - F:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - F:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

wszystko zrobione

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 22:01

Kod: Zaznacz wszystko: Files:: F:\Documents and Settings\User\planet.exe F:\Documents and Settings\User\service2.exe Folder:: F:\WINDOWS\system32\VIRepair F:\WINDOWS\system32\VITrans F:\Documents and Settings\User\Dane aplikacji\Styler

wklejasz do notatnika zapisujesz jako CFScript.txt i przeciągasz na ikonkę combofixa

**Posty:** 2691 · przez **Z@K** 26 Sie 2008, 22:52

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - User 2008-08-26 22:49:56.14 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1558 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe Command switches used :: F:\Documents and Settings\User\Moje dokumenty\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Documents and Settings\User\Dane aplikacji\Styler F:\Documents and Settings\User\Dane aplikacji\Styler\Styler\Data\Styler.ini F:\WINDOWS\system32\VIRepair F:\WINDOWS\system32\VIRepair\vi.sif F:\WINDOWS\system32\VITrans F:\WINDOWS\system32\VITrans\vi.sif . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-26 21:38 . 2008-08-26 21:38 578,560 --a--c--- F:\WINDOWS\system32\dllcache\user32.dll 2008-08-26 21:36 . 2008-08-26 21:36 <DIR> d-------- F:\WINDOWS\ERUNT 2008-08-26 21:34 . 2008-08-26 21:44 <DIR> d-------- F:\SDFix 2008-08-26 07:46 . 2008-08-26 18:24 3,899 --a------ F:\Documents and Settings\User\planet.exe 2008-08-16 10:22 . 2008-08-16 10:22 44,032 --a------ F:\Documents and Settings\User\service2.exe 2008-08-15 12:52 . 2008-08-26 22:51 <DIR> d-------- F:\Program Files\PeerGuardian2 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-12 18:08 . 2008-08-12 18:09 <DIR> d-------- F:\VTPFiles 2008-08-12 18:08 . 2006-12-03 17:15 69,632 --a------ F:\WINDOWS\system32\moveex.exe 2008-08-12 18:08 . 2006-12-03 17:14 8,636 --a------ F:\WINDOWS\system32\modifype.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 15:21 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-21 19:46 --------- d-----w F:\Program Files\RocketDock 2008-08-18 17:17 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-08-18 07:35 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-15 17:19 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\uTorrent 2008-08-12 07:34 --------- d-----w F:\Program Files\DkZ Studio 2008-08-11 21:04 --------- d-----w F:\Program Files\MD4DC++ 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2008-08-26_20.00.44.34 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-26 19:36:40 6,062,080 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-26 19:36:40 57,344 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-26 19:36:39 6,062,080 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-26 19:36:39 57,344 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PeerGuardian"="F:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Tlen.pl\\tlen.exe"= "G:\\utorrent.exe"= "F:\\Documents and Settings\\User\\service2.exe"= "F:\\Program Files\\BearShare\\BearShare.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 22:52:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-26 22:53:02 ComboFix-quarantined-files.txt 2008-08-26 20:52:44 ComboFix2.txt 2008-08-26 19:47:43 ComboFix3.txt 2008-08-26 18:01:14 ComboFix4.txt 2008-08-14 10:16:41 Pre-Run: 7,577,362,432 bajtów wolnych Post-Run: 7,566,651,392 bajtów wolnych 148

log c CF po wykonaniu.

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 22:54

Kod: Zaznacz wszystko: Files:: F:\Documents and Settings\User\planet.exe F:\Documents and Settings\User\service2.exe

CFScript.txt na combofix.exe ale w awaryjnym to zrób - z wyłączonym przywracaniem systemu na WSZYSTKICH dyskach

**Posty:** 2691 · przez **Z@K** 26 Sie 2008, 23:10

Kod: Zaznacz wszystko: ComboFix 08-08-25.01 - User 2008-08-26 23:01:30.15 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1775 [GMT 2:00] Running from: F:\Documents and Settings\User\Moje dokumenty\ComboFix.exe Command switches used :: F:\Documents and Settings\User\Moje dokumenty\CFScript.txt [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-26 21:38 . 2008-08-26 21:38 578,560 --a--c--- F:\WINDOWS\system32\dllcache\user32.dll 2008-08-26 21:36 . 2008-08-26 21:36 <DIR> d-------- F:\WINDOWS\ERUNT 2008-08-26 21:34 . 2008-08-26 21:44 <DIR> d-------- F:\SDFix 2008-08-26 07:46 . 2008-08-26 18:24 3,899 --a------ F:\Documents and Settings\User\planet.exe 2008-08-16 10:22 . 2008-08-16 10:22 44,032 --a------ F:\Documents and Settings\User\service2.exe 2008-08-15 12:52 . 2008-08-26 22:58 <DIR> d-------- F:\Program Files\PeerGuardian2 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-08-14 12:29 . 2008-08-14 12:29 <DIR> d-------- F:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-12 18:08 . 2008-08-12 18:09 <DIR> d-------- F:\VTPFiles 2008-08-12 18:08 . 2006-12-03 17:15 69,632 --a------ F:\WINDOWS\system32\moveex.exe 2008-08-12 18:08 . 2006-12-03 17:14 8,636 --a------ F:\WINDOWS\system32\modifype.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 15:21 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-21 19:46 --------- d-----w F:\Program Files\RocketDock 2008-08-18 17:17 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-08-18 07:35 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-08-15 17:19 --------- d-----w F:\Documents and Settings\User\Dane aplikacji\uTorrent 2008-08-12 07:34 --------- d-----w F:\Program Files\DkZ Studio 2008-08-11 21:04 --------- d-----w F:\Program Files\MD4DC++ 2008-01-13 19:44 22,328 ----a-w F:\Documents and Settings\User\Dane aplikacji\PnkBstrK.sys 2008-04-06 13:45 88 --sh--r F:\WINDOWS\system32\1EB16A5616.sys 2008-04-06 13:45 2,828 --sha-w F:\WINDOWS\system32\KGyGaAvL.sys . ------- Sigcheck ------- 2006-03-12 18:48 360448 65c34c093e839505636954ead50fa315 F:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2008-08-26_20.00.44.34 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-26 19:36:40 6,062,080 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-26 19:36:40 57,344 ----a-w F:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-26 19:36:39 6,062,080 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-26 19:36:39 57,344 ----a-w F:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="F:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080] "ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "PeerGuardian"="F:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "QuickTime Task"="F:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "ISUSPM Startup"="F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 10:58 213936] "ISUSScheduler"="F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 10:58 86960] "ISUSPM"="F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 10:58 213936] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [2008-03-27 08:35 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 12:08 16342528 F:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 F:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= F:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL "VIDC.VP60"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP61"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP62"= F:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll "VIDC.VP70"= F:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll "VIDC.VP31"= F:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll "VIDC.FFDS"= F:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll "msacm.ac3acm"= F:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm "msacm.l3fhg"= F:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=F:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=F:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^User^Menu Start^Programy^Autostart^Vista-HDMonitor-Windows.lnk] path=F:\Documents and Settings\User\Menu Start\Programy\Autostart\Vista-HDMonitor-Windows.lnk backup=F:\WINDOWS\pss\Vista-HDMonitor-Windows.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 03:06 40048 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 F:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-06-29 00:43 81920 F:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\µTorrent] --a------ 2007-08-09 11:09 109568 G:\utorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 F:\WINDOWS\Alcmtr.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "E:\\gry\\PES 2008\\PES2008.exe"= "F:\\Program Files\\Tlen.pl\\tlen.exe"= "G:\\utorrent.exe"= "F:\\Documents and Settings\\User\\service2.exe"= "F:\\Program Files\\BearShare\\BearShare.exe"= "F:\\Program Files\\Skype\\Phone\\Skype.exe"= S3 SetupNTGLM7X;SetupNTGLM7X;H:\NTGLM7X.sys [] S3 usbscan;Sterownik skanera USB;F:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Sterownik magazynu masowego USB;F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2007-08-28 F:\WINDOWS\Tasks\Norton Security Scan.job - F:\Program Files\Norton Security Scan\Nss.exe [2007-04-19 22:42] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 23:03:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-26 23:04:51 ComboFix-quarantined-files.txt 2008-08-26 21:04:40 ComboFix2.txt 2008-08-26 20:53:03 ComboFix3.txt 2008-08-26 19:47:43 ComboFix4.txt 2008-08-26 18:01:14 ComboFix5.txt 2008-08-26 21:01:19 Pre-Run: 7,578,198,016 bajtów wolnych Post-Run: 7,566,659,584 bajtów wolnych 139

wykonane w awaryjnym

**Posty:** 8001 · przez **Okocza** 26 Sie 2008, 23:18

nie chcą się usunąć...

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

zainstaluj jakieś AV bo nie masz nic..

**Posty:** 684 · przez **djarta** 27 Sie 2008, 07:48

Bo źle dajesz do usuwania.Nie "Files" tylko "File"!!

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: F:\Documents and Settings\User\planet.exe F:\Documents and Settings\User\service2.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

===============================
K.

Kto jest na forum