komputer się resetuje

**Posty:** 279 · przez **Alban** 30 Mar 2008, 00:15

Witam.. Mam problem. Mianowicie gdy wchodzę do jakiejś gry, po kilkunasty minutach komputer mi sie resetuje. Sprzęt ok, temperatura GÓRA 52st. Napięcie ok...

Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:12:30, on 2008-03-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: IEFW Object - {B5141620-C2B2-4D95-9F0F-134D99C87AB0} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TI WLAN] C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O8 - Extra context menu item: Open With JPEGCompress - res://C:\Program Files\JPEGCompress\owjc.dll/CONTEXT_HANDLE.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Ghost Navigator - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx
O16 - DPF: {987ECFCE-E607-4D52-B2C5-2EA1F6F303C4} (WinlessActiveX Control) - http://www.pangya.com/PangyaLauncher/PangyaLauncher.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS5\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS6\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS7\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS8\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS9\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS10\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS11\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS12\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS13\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS14\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS15\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS16\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS17\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS18\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS19\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS20\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS21\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS22\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS23\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS24\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS25\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS26\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS27\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS28\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS29\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS30\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS31\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS32\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
O22 - SharedTaskScheduler: coronally - {1b17f1db-790e-4d42-8e0c-d4d19123ee5b} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TI Wlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe

--
End of file - 10319 bytes

**Posty:** 3854 · przez **Dzi@dek** 30 Mar 2008, 00:23

O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - (no file)
O2 - BHO: IEFW Object - {B5141620-C2B2-4D95-9F0F-134D99C87AB0} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
O22 - SharedTaskScheduler: coronally - {1b17f1db-790e-4d42-8e0c-d4d19123ee5b} - (no file)

Usuń te wpisy w HijackThis i powinieneś mieć już OK.

**Posty:** 279 · przez **Alban** 30 Mar 2008, 15:40

Nie pomogło... :roll:

Może wina sterowników?

**Posty:** 8001 · przez **Okocza** 30 Mar 2008, 16:00

zastosuj sdfixa i wrzuć raport, zastosuj też combofixa

**Posty:** 279 · przez **Alban** 30 Mar 2008, 17:56

a-squared Command Line Scanner - Version 3.0
Last update: N/A

Scan settings:

Objects: Memory, Traces, Cookies, C:
Scan archives: On
Heuristics: Off
ADS Scan: On

Scan start: 2008-03-30 16:52:55

Key: HKEY_CURRENT_USER\software\kazaa detected: Trace.Registry.KaZaA
Key: HKEY_LOCAL_MACHINE\software\myglobalsearch detected: Trace.Registry.MyGlobalSearchToolbar
Value: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> DisplayName detected: Trace.Registry.MyWebSearch Toolbar
Value: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> URL detected: Trace.Registry.MyWebSearch Toolbar
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> DisplayName detected: Trace.Registry.MyWebSearch Toolbar
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> URL detected: Trace.Registry.MyWebSearch Toolbar
Key: HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin detected: Trace.Registry.MyWebSearchToobar
Key: HKEY_CURRENT_USER\software\mywebsearch detected: Trace.Registry.MyWebSearchToobar
Key: HKEY_LOCAL_MACHINE\software\classes\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07} detected: Trace.Registry.WhenU.SaveNow
Key: HKEY_LOCAL_MACHINE\software\classes\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97} detected: Trace.Registry.WhenU.SaveNow
Key: HKEY_LOCAL_MACHINE\software\classes\runmsc.loader.1\clsid detected: Trace.Registry.WhenU.SaveNow
Key: HKEY_LOCAL_MACHINE\software\classes\runmsc.loader\clsid detected: Trace.Registry.WhenU.SaveNow
Key: HKEY_LOCAL_MACHINE\software\classes\runmsc.loader\curver detected: Trace.Registry.WhenU.SaveNow
Value: HKEY_CLASSES_ROOT\CLSID\{1339B54C-3453-11D2-93B9-000000000000}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Internet Cleanup 5.0
C:\Documents and Settings\Dobre\Cookies\dobre@2o7[2].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@adserver.o2[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@adtech[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@com[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@doubleclick[2].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@edge.ru4[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@fastclick[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@mediaplex[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@please[2].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@please[3].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@showit[2].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@spylog[2].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@statcounter[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@statse.webtrendslive[1].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Cookies\dobre@tradedoubler[2].txt detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:12 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:70 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:79 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:80 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:81 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:96 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:202 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:240 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:247 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\cookies.txt:277 detected: Trace.TrackingCookie
C:\Documents and Settings\Dobre\Dane aplikacji\Sun\Java\Deployment\cache\6.0\62\70a93cfe-2a0cae5c detected: Exploit.Java.Gimsh.a
C:\WINDOWS\system32\AlxRes.dll.bak detected: Adware.Win32.AlexaBar.j

Scanned

Files: 169921
Traces: 173522
Cookies: 412
Processes: 30

Found

Files: 2
Traces: 14
Cookies: 25
Processes: 0

Quarantined

Files: 2
Traces: 14
Cookies: 25
Processes: 0

Scan end: 2008-03-30 17:52:33
Scan time: 0:59:38

ComboFix 08-03-29.1 - Dobre 2008-03-29 23:22:25.1 - NTFSx86
Running from: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\.protected
C:\Documents and Settings\domowy\Dane aplikacji\install.dat
C:\Documents and Settings\domowy\Menu Start\Programy\Autostart\.protected
C:\Program Files\Common Files\companion wizard
C:\WINDOWS\dialerexe.ini
C:\WINDOWS\system32\av.cpl
C:\WINDOWS\system32\drivers\etc\.protected
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\drivers\vspf_hk5.sys
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\nsn3C.tmp
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\yxvjvap.dat
C:\WINDOWS\system32\yxvjvap.exe
C:\WINDOWS\system32\yxvjvap_nav.dat
c:\WINDOWS\system32\yxvjvap_navps.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FOPN
-------\Legacy_FWSVC
-------\Legacy_VSPF
-------\Legacy_VSPF_HK

((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-29 )))))))))))))))))))))))))))))))
.

2008-03-29 23:09 . 2008-03-29 23:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-21 12:54 . 2008-03-28 22:13 <DIR> d-------- C:\Program Files\Guitar Pro 5
2008-03-01 22:57 . 2008-03-01 22:57 <DIR> d-------- C:\Documents and Settings\domowy\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-03-01 15:01 . 2008-03-01 15:01 <DIR> d-------- C:\Program Files\Zylom Games
2008-03-01 15:01 . 2008-03-01 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2008-02-29 17:37 . 2008-02-29 17:37 <DIR> d-------- C:\Rozliczenie Roczne 2007

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-29 20:43 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-03-29 10:18 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-03-28 21:15 --------- d-----w C:\Program Files\CDFashion
2008-03-28 21:14 --------- d-----w C:\Program Files\Java
2008-03-28 21:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-28 21:12 --------- d-----w C:\Program Files\Google
2008-03-23 19:10 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-03-08 13:32 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Ahead
2008-03-08 13:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-03-05 14:59 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-03-01 13:04 --------- d-----w C:\Program Files\DivX
2008-02-28 21:56 --------- d-----w C:\Program Files\Common Files\Stardock
2008-02-14 14:09 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-12 23:04 --------- d-----w C:\Program Files\Gadu-Gadu
2008-02-12 15:40 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-02-12 15:33 --------- d-----w C:\Program Files\Mozilla ActiveX Control v1.7.1
2008-02-12 15:32 --------- d-----w C:\Program Files\Realtek AC97
2008-02-12 15:32 --------- d-----w C:\Program Files\Real Alternative
2008-02-12 15:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2008-02-12 15:32 --------- d-----w C:\Program Files\Media Player Classic
2008-02-12 15:32 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2008-02-12 15:32 --------- d-----w C:\Program Files\jv16 PowerTools 2006
2008-02-12 15:32 --------- d-----w C:\Program Files\foobar2000
2008-02-12 15:32 --------- d-----w C:\Program Files\Advanced JPEG Compressor
2008-02-08 22:47 --------- d-s---w C:\Program Files\Xfire
2008-02-08 16:38 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Xfire
2008-02-06 16:33 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2006-08-03 15:28 0 ----a-w C:\Documents and Settings\Dobre\loaded.exe
2006-07-28 02:14 0 ----a-w C:\Documents and Settings\domowy\loaded.exe
2006-07-05 15:07 81,920 ----a-w C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
Kod: Zaznacz wszystko
<pre> ----a-w 190,976 2005-04-26 11:08:40 C:\Documents and Settings\Dobre\Pulpit\Dawid\WSZYSTKO\KeyGen Adobe Photoshop CS2 9.0.1 .exe </pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{140BD8E3-C167-11D4-B4A3-080000180323}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:23 221568]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 14:12 90112 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 21:05 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 16:49 1150976]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 14:57 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll 2001-12-20 23:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-09-06 11:06 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 18:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed]
--a------ 2007-11-22 13:44 2016256 C:\Program Files\AusLogics BoostSpeed\boostspeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 11:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2007-02-12 11:01 1149440 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 20:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 14:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM]
--a------ 2005-09-26 15:19 524288 C:\Program Files\Philips\Philips Device Manager\Bin\DeviceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 14:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 17:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 14:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2006-11-24 01:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"CPUCooLServer"=2 (0x2)
"cFosSpeedS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 11:57]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 18:35]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 20:34]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys []
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys []
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 15:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 15:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 15:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 15:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 15:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86251670-f036-11dc-8b94-001109c995bc}]
\Shell\Auto\command - H:\fun.xls.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 23:30:58
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2008-03-29 23:34:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 22:34:12
Pre-Run: 2,276,720,640 bajtów wolnych
Post-Run: 2,192,470,016 bajt˘w wolnych
.
2008-03-16 08:14:04 --- E O F ---

**Posty:** 8001 · przez **Okocza** 30 Mar 2008, 18:00

jest już ok :?:

czy dalej to samo :?:

Autor postu otrzymał pochwałę

**Posty:** 279 · przez **Alban** 30 Mar 2008, 18:05

Nie, wiem, dopiero mi FDfix skończył skanowanie. ^^ Jak jakieś zmiany będą, to dam znać. ^^

**Posty:** 8001 · przez **Okocza** 30 Mar 2008, 18:06

Czekamy.

**Posty:** 18165 · przez **wojtas** 30 Mar 2008, 18:09

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\AlxRes.dll.bak

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86251670-f036-11dc-8b94-001109c995bc}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

znasz to:

C:\Documents and Settings\Dobre\loaded.exe
C:\Documents and Settings\domowy\loaded.exe

**Posty:** 279 · przez **Alban** 31 Mar 2008, 21:47

Nie, nie znam tych plików. Właściwie nigdy ich nawet nie widziałem.
Nowy log:

ComboFix 08-03-29.1 - Dobre 2008-03-31 21:38:48.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.23 [GMT 2:00]
Running from: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dobre\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\AlxRes.dll.bak
.

((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 )))))))))))))))))))))))))))))))
.

2008-03-30 16:46 . 2008-03-30 17:52 <DIR> d-------- C:\SDFix
2008-03-30 00:09 . 2008-03-30 00:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-21 13:54 . 2008-03-28 23:13 <DIR> d-------- C:\Program Files\Guitar Pro 5
2008-03-01 16:01 . 2008-03-01 16:01 <DIR> d-------- C:\Program Files\Zylom Games
2008-03-01 16:01 . 2008-03-01 16:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2008-02-29 18:37 . 2008-02-29 18:37 <DIR> d-------- C:\Rozliczenie Roczne 2007
2008-02-28 23:58 . 2008-02-28 23:58 2,359,350 --a------ C:\WINDOWS\darkportal-1024x.bmp
2008-02-27 17:50 . 2008-03-13 15:35 <DIR> d-------- C:\Documents and Settings\Dobre\dwhelper
2008-02-21 04:05 . 2008-02-21 04:05 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-02-21 04:05 . 2008-02-21 04:05 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-02-06 16:13 . 2008-02-06 16:13 173,533 --a------ C:\WINDOWS\system32\elynch.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-29 20:43 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-03-29 10:18 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-03-28 21:15 --------- d-----w C:\Program Files\CDFashion
2008-03-28 21:14 --------- d-----w C:\Program Files\Java
2008-03-28 21:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-28 21:12 --------- d-----w C:\Program Files\Google
2008-03-23 19:10 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-03-08 13:32 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Ahead
2008-03-08 13:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-03-05 14:59 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-03-01 13:04 --------- d-----w C:\Program Files\DivX
2008-02-28 21:56 --------- d-----w C:\Program Files\Common Files\Stardock
2008-02-14 14:09 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-12 23:04 --------- d-----w C:\Program Files\Gadu-Gadu
2008-02-12 15:40 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-02-12 15:33 --------- d-----w C:\Program Files\Mozilla ActiveX Control v1.7.1
2008-02-12 15:32 --------- d-----w C:\Program Files\Realtek AC97
2008-02-12 15:32 --------- d-----w C:\Program Files\Real Alternative
2008-02-12 15:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2008-02-12 15:32 --------- d-----w C:\Program Files\Media Player Classic
2008-02-12 15:32 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2008-02-12 15:32 --------- d-----w C:\Program Files\jv16 PowerTools 2006
2008-02-12 15:32 --------- d-----w C:\Program Files\foobar2000
2008-02-12 15:32 --------- d-----w C:\Program Files\Advanced JPEG Compressor
2008-02-08 22:47 --------- d-s---w C:\Program Files\Xfire
2008-02-08 16:38 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Xfire
2008-02-06 16:33 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-01-31 02:02 54,608 ----a-w C:\WINDOWS\system32\xfcodec.dll
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:42 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2006-08-03 15:28 0 ----a-w C:\Documents and Settings\Dobre\loaded.exe
2006-07-28 02:14 0 ----a-w C:\Documents and Settings\domowy\loaded.exe
2006-07-05 15:07 81,920 ----a-w C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
Kod: Zaznacz wszystko
<pre> ----a-w 190,976 2005-04-26 11:08:40 C:\Documents and Settings\Dobre\Pulpit\Dawid\WSZYSTKO\KeyGen Adobe Photoshop CS2 9.0.1 .exe </pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 15:12 90112 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 22:05 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 17:49 1150976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll 2001-12-21 00:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed]
--a------ 2007-11-22 14:44 2016256 C:\Program Files\AusLogics BoostSpeed\boostspeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2007-02-12 12:01 1149440 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM]
--a------ 2005-09-26 16:19 524288 C:\Program Files\Philips\Philips Device Manager\Bin\DeviceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2006-11-24 02:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"CPUCooLServer"=2 (0x2)
"cFosSpeedS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12:57]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 19:35]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys []
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys []
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 16:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 16:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 16:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 16:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 16:50]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 21:43:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-31 21:45:42
ComboFix-quarantined-files.txt 2008-03-31 19:45:38
ComboFix2.txt 2008-03-29 22:34:17
Pre-Run: 2,888,052,736 bajtów wolnych
Post-Run: 2,866,454,528 bajtów wolnych
.
2008-03-16 08:14:04 --- E O F ---

**Posty:** 18165 · przez **wojtas** 31 Mar 2008, 21:56

wklej do notatnika:

File::
C:\Documents and Settings\Dobre\loaded.exe
C:\Documents and Settings\domowy\loaded.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 279 · przez **Alban** 01 Kwi 2008, 11:33

ComboFix 08-03-29.1 - Dobre 2008-04-01 11:24:56.3 - NTFSx86
Running from: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dobre\Pulpit\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Dobre\loaded.exe
C:\Documents and Settings\domowy\loaded.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Dobre\loaded.exe
C:\Documents and Settings\domowy\loaded.exe

.
((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-03-30 16:46 . 2008-03-30 17:52 <DIR> d-------- C:\SDFix
2008-03-30 00:09 . 2008-03-30 00:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-21 13:54 . 2008-03-28 23:13 <DIR> d-------- C:\Program Files\Guitar Pro 5
2008-03-01 23:57 . 2008-03-01 23:57 <DIR> d-------- C:\Documents and Settings\domowy\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-03-01 16:01 . 2008-03-01 16:01 <DIR> d-------- C:\Program Files\Zylom Games
2008-03-01 16:01 . 2008-03-01 16:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Zylom

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-29 20:43 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-03-29 10:18 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-03-28 21:15 --------- d-----w C:\Program Files\CDFashion
2008-03-28 21:14 --------- d-----w C:\Program Files\Java
2008-03-28 21:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-28 21:12 --------- d-----w C:\Program Files\Google
2008-03-23 19:10 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-03-08 13:32 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Ahead
2008-03-08 13:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead
2008-03-05 14:59 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-03-01 13:04 --------- d-----w C:\Program Files\DivX
2008-02-28 21:56 --------- d-----w C:\Program Files\Common Files\Stardock
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-14 14:09 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-12 23:04 --------- d-----w C:\Program Files\Gadu-Gadu
2008-02-12 15:40 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-02-12 15:33 --------- d-----w C:\Program Files\Mozilla ActiveX Control v1.7.1
2008-02-12 15:32 --------- d-----w C:\Program Files\Realtek AC97
2008-02-12 15:32 --------- d-----w C:\Program Files\Real Alternative
2008-02-12 15:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2
2008-02-12 15:32 --------- d-----w C:\Program Files\Media Player Classic
2008-02-12 15:32 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2008-02-12 15:32 --------- d-----w C:\Program Files\jv16 PowerTools 2006
2008-02-12 15:32 --------- d-----w C:\Program Files\foobar2000
2008-02-12 15:32 --------- d-----w C:\Program Files\Advanced JPEG Compressor
2008-02-08 22:47 --------- d-s---w C:\Program Files\Xfire
2008-02-08 16:38 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Xfire
2008-02-06 16:33 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-06 14:13 173,533 ----a-w C:\WINDOWS\system32\elynch.exe
2008-01-31 02:02 54,608 ----a-w C:\WINDOWS\system32\xfcodec.dll
2006-07-05 15:07 81,920 ----a-w C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
Kod: Zaznacz wszystko
<pre> ----a-w 190,976 2005-04-26 11:08:40 C:\Documents and Settings\Dobre\Pulpit\Dawid\WSZYSTKO\KeyGen Adobe Photoshop CS2 9.0.1 .exe </pre>

((((((((((((((((((((((((((((( snapshot@2008-03-31_21.45.24,98 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-31 18:58:16 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-01 09:23:56 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-31 18:58:16 68,450 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-04-01 09:23:56 68,450 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-03-31 18:58:16 383,562 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-01 09:23:56 383,562 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-03-31 18:58:16 439,528 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-04-01 09:23:56 439,528 ----a-w C:\WINDOWS\system32\perfh015.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 15:12 90112 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 22:05 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 17:49 1150976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll 2001-12-21 00:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed]
--a------ 2007-11-22 14:44 2016256 C:\Program Files\AusLogics BoostSpeed\boostspeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2007-02-12 12:01 1149440 C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM]
--a------ 2005-09-26 16:19 524288 C:\Program Files\Philips\Philips Device Manager\Bin\DeviceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2006-11-24 02:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12:57]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 19:35]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys []
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys []
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 16:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 16:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 16:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 16:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 16:50]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 11:28:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-01 11:31:03
ComboFix-quarantined-files.txt 2008-04-01 09:30:54
ComboFix2.txt 2008-03-31 19:45:43
ComboFix3.txt 2008-03-29 22:34:17
Pre-Run: 2,847,338,496 bajtów wolnych
Post-Run: 2,826,706,944 bajtów wolnych
.
2008-03-16 08:14:04 --- E O F ---

**Posty:** 18165 · przez **wojtas** 01 Kwi 2008, 18:51

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\elynch.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

Autor postu otrzymał pochwałę

**Posty:** 279 · przez **Alban** 03 Kwi 2008, 12:27

Wszystko już działa.

Dziękuję bardzo. ^^

[ Dodano: Dzisiaj o 13:10 ]
No i problem powrócił.. :roll:

W logu z HJ nie ma NIC podejrzanego... Więc zamieszczam z ComboFix. SDFix nie zdaży zrobić nawet scana...

Kod: Zaznacz wszystko: ComboFix 08-04-10.7 - Dobre 2008-04-11 13:28:08.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.33 [GMT 2:00] Running from: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 ))))))))))))))))))))))))))))))) . 2008-04-03 14:18 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-04-03 14:18 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-04-03 14:18 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-04-03 14:18 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-04-03 14:18 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-04-03 14:18 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys 2008-04-03 14:18 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-04-03 14:18 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-04-03 14:18 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-04-03 14:18 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys 2008-03-30 16:46 . 2008-04-11 12:52 <DIR> d-------- C:\SDFix 2008-03-30 00:09 . 2008-03-30 00:09 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-21 13:54 . 2008-03-28 23:13 <DIR> d-------- C:\Program Files\Guitar Pro 5 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-10 20:42 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Skype 2008-04-10 13:28 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl 2008-04-10 10:49 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-09 14:24 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000 2008-04-07 18:04 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2 2008-04-04 12:34 --------- d-----w C:\Program Files\Sony Ericsson 2008-03-28 21:15 --------- d-----w C:\Program Files\CDFashion 2008-03-28 21:14 --------- d-----w C:\Program Files\Java 2008-03-28 21:12 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-28 21:12 --------- d-----w C:\Program Files\Google 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-08 13:32 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Ahead 2008-03-08 13:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-03-01 14:01 --------- d-----w C:\Program Files\Zylom Games 2008-03-01 14:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Zylom 2008-03-01 13:04 --------- d-----w C:\Program Files\DivX 2008-02-28 21:56 --------- d-----w C:\Program Files\Common Files\Stardock 2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-14 14:09 --------- d-----w C:\Program Files\Common Files\LightScribe 2008-02-12 15:40 --------- d-----w C:\Program Files\Common Files\AVSMedia 2008-02-12 15:33 --------- d-----w C:\Program Files\Mozilla ActiveX Control v1.7.1 2008-02-12 15:32 --------- d-----w C:\Program Files\Realtek AC97 2008-02-12 15:32 --------- d-----w C:\Program Files\Real Alternative 2008-02-12 15:32 --------- d-----w C:\Program Files\OpenOffice.org 2.2 2008-02-12 15:32 --------- d-----w C:\Program Files\Media Player Classic 2008-02-12 15:32 --------- d-----w C:\Program Files\LightScribeTemplateLabeler 2008-02-12 15:32 --------- d-----w C:\Program Files\jv16 PowerTools 2006 2008-02-12 15:32 --------- d-----w C:\Program Files\foobar2000 2008-02-12 15:32 --------- d-----w C:\Program Files\Advanced JPEG Compressor 2008-02-06 14:13 173,533 ----a-w C:\WINDOWS\system32\elynch.exe 2008-01-31 02:02 54,608 ----a-w C:\WINDOWS\system32\xfcodec.dll 2006-07-05 15:07 81,920 ----a-w C:\Documents and Settings\Dobre\index.dat 2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . [code]<pre> ----a-w 190,976 2005-04-26 11:08:40 C:\Documents and Settings\Dobre\Pulpit\Dawid\WSZYSTKO\KeyGen Adobe Photoshop CS2 9.0.1 .exe </pre>[/code] ((((((((((((((((((((((((((((( snapshot@2008-03-31_21.45.24,98 ))))))))))))))))))))))))))))))))))))))))) . + 2008-03-20 08:01:00 1,846,144 ----a-w C:\WINDOWS\$hf_mig$\KB941693\SP2QFE\win32k.sys + 2007-03-06 03:28:35 16,096 ----a-w C:\WINDOWS\$hf_mig$\KB941693\spmsg.dll + 2007-03-06 03:28:40 216,288 ----a-w C:\WINDOWS\$hf_mig$\KB941693\spuninst.exe + 2007-03-06 03:28:33 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB941693\update\spcustom.dll + 2007-03-06 03:28:58 723,680 ----a-w C:\WINDOWS\$hf_mig$\KB941693\update\update.exe + 2007-03-06 03:29:50 386,784 ----a-w C:\WINDOWS\$hf_mig$\KB941693\update\updspapi.dll + 2008-02-16 09:32:31 1,024,000 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\browseui.dll + 2008-02-16 09:32:31 151,552 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\cdfview.dll + 2008-02-16 09:32:31 1,055,744 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\danim.dll + 2008-02-16 09:32:31 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\dxtmsft.dll + 2008-02-16 09:32:31 205,312 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\dxtrans.dll + 2008-02-16 09:32:31 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\extmgr.dll + 2008-02-15 09:07:53 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\iedw.exe + 2008-02-16 09:32:31 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\iepeers.dll + 2008-02-16 09:32:32 96,768 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\inseng.dll + 2008-02-16 09:32:32 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\jsproxy.dll + 2008-02-16 09:32:33 3,087,872 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\mshtml.dll + 2008-02-16 09:32:33 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\mshtmled.dll + 2008-02-16 09:32:33 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\msrating.dll + 2008-02-16 09:32:34 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\mstime.dll + 2008-02-16 09:32:34 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\pngfilt.dll + 2008-02-16 09:32:34 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\shdocvw.dll + 2008-02-16 09:32:35 474,112 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\shlwapi.dll + 2008-02-15 23:03:24 369,152 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\spru0415.dll + 2008-02-16 09:32:35 619,520 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\urlmon.dll + 2008-02-16 09:32:35 668,672 ----a-w C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\wininet.dll + 2007-03-06 03:28:35 16,096 ----a-w C:\WINDOWS\$hf_mig$\KB947864\spmsg.dll + 2007-03-06 03:28:40 216,288 ----a-w C:\WINDOWS\$hf_mig$\KB947864\spuninst.exe + 2007-03-06 03:28:33 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB947864\update\spcustom.dll + 2007-03-06 03:28:58 723,680 ----a-w C:\WINDOWS\$hf_mig$\KB947864\update\update.exe + 2007-03-06 03:29:50 386,784 ----a-w C:\WINDOWS\$hf_mig$\KB947864\update\updspapi.dll + 2008-02-20 06:53:12 282,624 ----a-w C:\WINDOWS\$hf_mig$\KB948590\SP2QFE\gdi32.dll + 2007-03-06 03:28:35 16,096 ----a-w C:\WINDOWS\$hf_mig$\KB948590\spmsg.dll + 2007-03-06 03:28:40 216,288 ----a-w C:\WINDOWS\$hf_mig$\KB948590\spuninst.exe + 2007-03-06 03:28:33 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB948590\update\spcustom.dll + 2007-03-06 03:28:58 723,680 ----a-w C:\WINDOWS\$hf_mig$\KB948590\update\update.exe + 2007-03-06 03:29:50 386,784 ----a-w C:\WINDOWS\$hf_mig$\KB948590\update\updspapi.dll - 2000-08-31 06:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2000-08-31 06:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe + 2000-08-31 06:00:00 80,412 ----a-w C:\WINDOWS\grep.exe + 2000-08-31 06:00:00 98,816 ----a-w C:\WINDOWS\sed.exe + 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe + 2000-08-31 06:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe + 2000-08-31 06:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe - 2007-12-07 01:08:12 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll + 2008-02-16 09:05:10 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll - 2007-12-07 01:08:12 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll + 2008-02-16 09:05:10 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll - 2007-12-07 01:08:12 1,055,744 ----a-w C:\WINDOWS\system32\danim.dll + 2008-02-16 09:05:11 1,055,744 ----a-w C:\WINDOWS\system32\danim.dll - 2007-12-07 01:08:12 1,023,488 -c----w C:\WINDOWS\system32\dllcache\browseui.dll + 2008-02-16 09:05:10 1,023,488 -c----w C:\WINDOWS\system32\dllcache\browseui.dll - 2007-12-07 01:08:12 151,552 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll + 2008-02-16 09:05:10 151,552 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll - 2007-12-07 01:08:12 1,055,744 -c----w C:\WINDOWS\system32\dllcache\danim.dll + 2008-02-16 09:05:11 1,055,744 -c----w C:\WINDOWS\system32\dllcache\danim.dll + 2008-02-20 05:38:07 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll + 2008-02-20 05:38:07 45,568 -c----w C:\WINDOWS\system32\dllcache\dnsrslvr.dll - 2007-12-07 01:08:12 357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-02-16 09:05:11 357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2007-12-07 01:08:12 205,312 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-02-16 09:05:11 205,312 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-12-07 01:08:12 55,808 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-02-16 09:05:11 55,808 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll - 2007-06-19 13:32:56 282,112 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll + 2008-02-20 06:51:41 282,624 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll - 2007-12-06 13:07:07 18,432 -c----w C:\WINDOWS\system32\dllcache\iedw.exe + 2008-02-15 09:23:37 18,432 -c----w C:\WINDOWS\system32\dllcache\iedw.exe - 2007-12-07 01:08:12 251,392 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll + 2008-02-16 09:05:11 251,392 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll - 2007-12-07 01:08:12 96,768 -c----w C:\WINDOWS\system32\dllcache\inseng.dll + 2008-02-16 09:05:11 96,768 -c----w C:\WINDOWS\system32\dllcache\inseng.dll - 2007-11-14 07:28:56 450,560 -c----w C:\WINDOWS\system32\dllcache\jscript.dll + 2007-12-18 14:42:55 450,560 -c----w C:\WINDOWS\system32\dllcache\jscript.dll - 2007-12-07 01:08:12 16,384 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-02-16 09:05:11 16,384 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2007-12-07 14:38:14 3,080,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-02-16 22:35:14 3,080,704 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll - 2007-12-07 01:08:13 449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-02-16 09:05:13 449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2007-12-07 01:08:13 146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-02-16 09:05:13 146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll - 2007-12-07 01:08:13 532,480 -c----w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-02-16 09:05:13 532,480 -c----w C:\WINDOWS\system32\dllcache\mstime.dll - 2007-12-07 01:08:13 39,424 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-02-16 09:05:14 39,424 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-12-07 01:08:13 1,494,528 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll + 2008-02-16 09:05:15 1,494,528 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll - 2007-12-07 01:08:13 474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll + 2008-02-16 09:05:15 474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll - 2007-12-07 01:08:13 616,448 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-02-16 09:05:15 616,960 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll + 2007-12-18 14:42:55 417,792 -c----w C:\WINDOWS\system32\dllcache\vbscript.dll - 2007-03-08 15:37:33 1,843,840 -c----w C:\WINDOWS\system32\dllcache\win32k.sys + 2008-03-20 08:09:45 1,845,504 -c----w C:\WINDOWS\system32\dllcache\win32k.sys - 2007-12-07 01:08:13 662,016 -c----w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-02-16 09:05:15 662,016 -c----w C:\WINDOWS\system32\dllcache\wininet.dll - 2006-06-26 17:45:40 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll + 2008-02-20 05:38:07 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll - 2007-12-07 01:08:12 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-02-16 09:05:11 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2007-12-07 01:08:12 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-02-16 09:05:11 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2007-12-07 01:08:12 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-02-16 09:05:11 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll - 2008-03-22 10:38:41 1,730,056 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-04-10 11:45:44 1,730,056 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2007-12-07 01:08:12 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll + 2008-02-16 09:05:11 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll - 2007-12-07 01:08:12 96,768 ----a-w C:\WINDOWS\system32\inseng.dll + 2008-02-16 09:05:11 96,768 ----a-w C:\WINDOWS\system32\inseng.dll - 2007-11-14 07:28:56 450,560 ----a-w C:\WINDOWS\system32\jscript.dll + 2007-12-18 14:42:55 450,560 ----a-w C:\WINDOWS\system32\jscript.dll - 2007-12-07 01:08:12 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-02-16 09:05:11 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll - 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe - 2007-12-07 14:38:14 3,080,192 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-02-16 22:35:14 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-12-07 01:08:13 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-02-16 09:05:13 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2007-12-07 01:08:13 146,432 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-02-16 09:05:13 146,432 ----a-w C:\WINDOWS\system32\msrating.dll - 2007-12-07 01:08:13 532,480 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-02-16 09:05:13 532,480 ----a-w C:\WINDOWS\system32\mstime.dll - 2008-03-31 18:58:16 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-04-11 11:29:43 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-03-31 18:58:16 68,450 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-04-11 11:29:43 68,450 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-03-31 18:58:16 383,562 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-04-11 11:29:43 383,562 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-03-31 18:58:16 439,528 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-04-11 11:29:43 439,528 ----a-w C:\WINDOWS\system32\perfh015.dat - 2007-12-07 01:08:13 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-02-16 09:05:14 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-12-07 01:08:13 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll + 2008-02-16 09:05:15 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll - 2007-12-07 01:08:13 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll + 2008-02-16 09:05:15 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll - 2007-12-07 01:08:13 616,448 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-02-16 09:05:15 616,960 ----a-w C:\WINDOWS\system32\urlmon.dll - 2004-08-03 22:44:14 417,792 ----a-w C:\WINDOWS\system32\vbscript.dll + 2007-12-18 14:42:55 417,792 ----a-w C:\WINDOWS\system32\vbscript.dll - 2007-12-06 23:40:40 368,640 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2008-02-15 23:03:24 369,152 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2008-04-07 16:59:52 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_d0.dat + 2000-08-31 06:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe + 2000-08-31 06:00:00 68,096 ----a-w C:\WINDOWS\zip.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-10-04 15:12 90112 C:\WINDOWS\soundman.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 22:05 344064] "TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 17:49 1150976] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll 2001-12-21 00:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk] backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk] backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk] backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk] backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk] backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] --a------ 2008-03-29 19:37 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed] --a------ 2007-11-22 14:44 2016256 C:\Program Files\AusLogics BoostSpeed\boostspeed.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] --a------ 2007-02-12 12:01 1149440 C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] --a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM] --a------ 2005-09-26 16:19 524288 C:\Program Files\Philips\Philips Device Manager\Bin\DeviceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3] --a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2006-11-24 02:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "D:\\Program Files\\Id\\Quake3\\quake3.exe"= "D:\\Program Files\\Id\\Quake3\\quake3e.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Program Files\\Media Player Classic\\mplayerc.exe"= "D:\\Program Files\\Quake3\\quake3.exe"= "D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "D:\\Program Files\\Icewind Dale II\\IWD2.exe"= "D:\\Program Files\\OGPlanet\\Albatross18\\update.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12:57] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 19:35] S3 dump_wmimmc;dump_wmimmc;D:\Program Files\OGPlanet\Albatross18\GameGuard\dump_wmimmc.sys [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 21:34] S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [] S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [] S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 16:49] S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 16:50] S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 16:50] S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 16:50] S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 16:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe3fb1c8-0234-11dd-8be2-001109c995bc}] \Shell\AutoRun\command - oufddh.exe \Shell\explore\Command - oufddh.exe \Shell\open\Command - oufddh.exe *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-11 13:31:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-11 13:33:35 ComboFix-quarantined-files.txt 2008-04-11 11:33:29 ComboFix2.txt 2008-04-01 09:31:04 ComboFix3.txt 2008-03-31 19:45:43 ComboFix4.txt 2008-03-29 22:34:17 Pre-Run: 2,419,544,064 bajtów wolnych Post-Run: 2,401,132,544 bajtów wolnych . 2008-04-10 10:54:14 --- E O F ---

komputer się resetuje

Komputer się resetuje

Kto jest na forum